Asuswrt-Merlin - build (11-Jan

Asuswrt-Merlin - build (11-Jan
Asuswrt-Merlin - build (11-Jan-2014)
----Asuswrt is the firmware developed by Asus for their newer routers. They
are also porting it to some of their older models, like the RT-56U and
RT-N16. While originally based on Tomato-RT, Asus has disabled some of
the original Tomato features, and added others.
Asuswrt-merlin is a customized version, which I am developing.
The goal is to do some bugfixes and minor enhancements to Asus's
firmware, without targeting at full-blown advanced featuresets such as
provided by excellent projects like Tomato or DD-WRT. Some of the
features that had been disabled by Asus have also been re-enabled.
This aims to be a more restrained alternative for those who prefer to
stay closer to the original firmware, with limited risks of seeing new
features bring in new stability issues. I value stability over
performance, and performance over features.
Supported Devices
----------------Supported devices are:
* RT-N16
* RT-N66U
* RT-AC66U
* RT-AC56U
* RT-AC68U
NOTE: all the "R" versions (for example RT-N66R) are the same as their
"U" counterparts, they are just different packages aimed at large
retailers. The firmware is 100% compatible with both U and R versions
of the routers.
-------Here is a list of features that Asuswrt-merlin brings over the original
- Based on RT-N66U sources (unreleased) from Asus
- Various bugfixes and optimizations
- Some components were updated to newerversions, for improved
stability and security
- Persistent JFFS partition
- User scripts that run on specific events
- Cron jobs
- Ability to customize the config files used by the router services
- LED control - put your Dark Knight in Stealth Mode by turning off
all LEDs
- Entware easy setup script (alternative to Optware - the two are
mutually exclusive) (not available on RT-AC56U/RT-AC68U)
Enable/disable the use of shorter share names
Disk spindown after user-configurable inactivity timeout
NFS sharing (through webui)
- Better compatibility with 3TB+ and Advanced Format HDDs
- Force acting as a Master Browser
- Act as a WINS server
- Allows tweaking TCP/UDP connection tracking timeouts
- CIFS client support (for mounting remote SMB share on the router)
- Layer7 iptables matching
- User-defined options for WAN DHCP queries (required by some ISPs)
- Improved NAT loopback (based on code from phuzi0n from the DD-WRT
- Advanced OpenVPN client and server support (all models except
- Netfilter ipset module, for efficient blacklist implemetnation
- Configurable IPv6 firewall
- Configurable min/max UPNP ports
- IPSec kernel support
Web interface:
- Improved client list, with DHCP hostnames
- Optionally save traffic stats to disk (USB or JFFS partition)
- Enhanced traffic monitoring: added monthly, as well as per IP
- Name field on the DHCP reservation list and Wireless ACL list
- System info summary page
- Wireless client IP and hostname on the Wireless Log page
- Wifi icon reports the state of both radios
- Display the Ethernet port states
- The various MAC/IP selection pulldowns will also display hostnames
when possible instead of just NetBIOS names
- Wireless site survey
A few features that first debuted in Asuswrt-Merlin have since been
integrated/enabled in the official firmware:
64K NVRAM for the RT-N66U
Turning WPS button into a radio on/off toggle
Use shorter share names (folder name only)
WakeOnLan web interface (with user-entered preset targets)
clickable MACs on the client list for lookup in the OUI database
Display active/tracked network connections
VPN client connection state report
DualWAN and Repeater mode (while it was still under development
by Asus)
- OpenVPN client and server support
-----------Simply flash it like any regular update. You should not need to
reset to factory defaults (see note below for exceptions).
You can revert back to an original Asus firmware at any time just
by flashing a firmware downloaded from Asus's website.
NOTE: resetting to factory default after flashing is
strongly recommended for the following cases:
- Switching between an SDK5 build and a regular build (RT-N66U)
- Coming from Tomato/DD-WRT/OpenWRT firmwares
If upgrading from anything older and you experience issues, then
consider doing a factory default reset then as well.
In all of these cases, do NOT load a saved copy of your settings!
This would be the same thing as NOT resetting at all, as you will
simply re-enter any invalid setting you wanted to get rid of. Make
sure to create a new backup of your settings after reconfiguring.
----** JFFS **
JFFS is a writable section of the flash memory which will allow you to
store small files (such as scripts) inside the router without needing
to have a USB disk plugged in. This space will survive reboots (but it
*MIGHT NOT survive firmware flashing*, so back it up first before
flashing!). It will also be available fairly early at boot (before
USB disks).
To enable this option, go to the Administration page, under the System
First time you enable JFFS, it must be formatted. This can be done
through the web page, same page where you enable it.
Enabling/Disabling/Formating JFFS requires a reboot to take effect.
I do not recommend doing frequent writes to this area, as it will
prematuraly wear out the flash storage. This is a good place to put
files that are written once like scripts or kernel modules, or that
rarely get written to (like once a day). Storing files that constantly
get written to (like logfiles) is NOT recommended - use a USB disk for
** User scripts **
These are shell scripts that you can create, and which will be run when
certain events occur. Those scripts must be saved in /jffs/scripts/
(so, JFFS must be enabled and formatted). Available scripts:
* dhcpc-event: Called whenever a DHCP event occurs on the WAN
interface. The type of event (bound, release, etc...)
is passed as an argument.
* firewall-start: Firewall is started (filter rules have been applied)
The WAN interface will be passed as argument (for
example. "eth0")
* init-start: Right after jffs is mounted, before any of the services
get started
* nat-start: nat rules (i.e. port forwards and such) have been applied
(nat table)
* post-mount: Just after a partition is mounted
* pre-mount: Just before a partition is mounted. Be careful with
this script. This is run in a blocking call and will
block the mounting of the partition for which it is
invoked till its execution is complete. This is done so
that it can be used for things like running e2fsck on the
partition before mounting. This script is also passed the
device path being mounted as an argument which can be
used in the script using $1.
qos-start: Called after both the iptables rules and tc configuration
are completed for QoS.
openvpn-event: Called whenever an OpenVPN server gets
started/stopped, or an OpenVPN client connects to a
remote server. Uses the same syntax/parameters as
the "up" and "down" scripts in OpenVPN.
services-start: Initial service start at boot
services-stop: Services are stopped at shutdown/reboot
unmount: Just before unmounting a partition. This is a blocking
script, so be careful with it. The mount point is passed
as an argument to the script.
wan-start: WAN interface just came up (includes if it went down and
back up). The WAN unit number will be passed as argument
(0 = primary WAN)
Don't forget to set them as executable:
chmod a+rx /jffs/scripts/*
And like any Linux script, they need to start with a shebang:
** SSHD **
SSH support (through Dropbear) was re-enabled. Password-based login
will use the same username and password as telnet/web access. You can
also optionally insert a RSA or ECDSA public key there for
keypair-based authentication. There is also an option to make ssh
access available over WAN.
** Crond **
Crond will automatically start at boot time. You can put your cron
tasks in /var/spool/cron/crontabs/ . The file must be named "admin" as
this is the name of the system user. Note that this location resides in
RAM, so you would have to put your cron script somewhere such as in the
jffs partition, and at boot time copy it to /var/spool/cron/crontabs/
using an init-start user script.
A simple way to manage your cron jobs is through the included "cru"
command. Just run "cru" to see the usage information. You can then
put your "cru" commands inside a user script to re-generate your cron
jobs at boot time.
** Enhanced Traffic monitoring **
Under Tools -> Other Settings are options that will allow you to save
your traffic history to disk, preserving it between router reboots (by
default it is currently kept in RAM, so it will disappear when you
You can save it to a custom location (for example, "/jffs/" if you have
jffs enabled), or /mnt/sda1/ if you have a USB disk plugged in.
Save frequency is also configurable - it is recommended to keep that
frequency lower (for example, once a day) if you are saving to jffs, to
reduce wearing out your flash memory. Make sure not to forget the
trailing slash ad the end of the path.
Note that the first time you use that option, you must tell the router
to create the data file. Make sure you set "Create or reset data
files" to "Yes".
Also, Asuswrt-Merlin can track the traffic generated by each individual
IP on your network. This option is called IPTraffic. To enable this,
you must first set a custom location to store your traffic database
(see above). Once again, you must also tell it to create the new data
file, by enabling "Create or reset IPTraffic data files". Once done,
enable the IPTraffic Monitoring option. This will add three new
entries to the Traffic Monitor page selector (on the Traffic Monitoring
You can optionally specify which IP to monitor, or exclude some IPs
from monitoring. Each IP must be separated by a comma.
It's strongly recommended that
wish to monitor to ensure they
which would make the collected
monitoring is done per IP, NOT
you assign a static IP to devices you
don't get a different IP over time,
data somewhat unreliable. The
per MAC.
** Adjustable TCP/IP connection tracking settings **
Under Tools -> Other Settings there are various parameters that lets
you tweak the timeout values related to connection tracking for TCP and
UDP connections. You should be careful with those settings. Most
commonly, people will tweak the UDP timeout values to make them more
VoIP-friendly, by using smaller timeouts. Timeout values are in
** Mounting remote CIFS shares on the router **
You can mount remote SMB shares on your router. The syntax will
be something like this:
mount \\\\\\ShareName /cifs1 -t cifs -o "username=User,password=Pas
(backslashes must be doubled.)
** Disk Spindown when idle **
Jeff Gibbons's sd-idle-2.6 has been added to the firmware, allowing you
to configure a timeout value (in seconds) on the Tools -> Other Settings
page. Plugged hard drives will stop spinning after being inactive
for that specified period of time. Note that services like Download
Master might be generating background disk activity, preventing it from
** OpenVPN (client and server) **
OpenVPN is an SSL-based VPN technology that is provided as a secure
alternative to the PPTP VPN. OpenVPN is far more secure and more
flexible, however it is not as easy to configure, and requires the
installation of a client software on your computer client. The client
can be obtained through this download page:
Explaining the details of OpenVPN are beyond the scope of this
documentation, and I am in no way an expert on OpenVPN.
Fortunately, there is a lot of available documentation and Howto guides
out there. I tried to stick to the same option descriptions as used by
Tomato, so about any guide written for Tomato can easily be used to
guide you on Asuswrt-Merlin. For pointers, check the Wiki on the
Asuswrt-Merlin Github repository.
You can provide your own custom client config files for the two server
instances. Store them in the /jffs/configs/openvpn/ccd1/ (and ccd2/)
directory based on which server instance they belong to, with the
filenames matching the client common names. See the OpenVPN
documentation for more details on the ccd directory.
** Customized config files **
The services executed by the router such as minidlna or dnsmasq relies
on dynamically-generated config files. There are various methods
through which you can interact with these config scripts to customize
The first method is through custom configs. You can append content to
various configuration files that are created by the firmware, or even
completely replace them with custom config files you have created.
Those config override files must be stored in /jffs/configs/. To have
a config file appended to the one created by the firmware, simply add
".add" at the end of the file listed below. For example,
/jffs/configs/dnsmasq.conf.add will be added at the end of the dnsmasq
configuration file that is created by the firmware, while
/jffs/configs/dnsmasq.conf would completely replace it.
Note that replacing a config file with your own implies that you
properly fill in all the fields usually dynamically created by the
firmware. Since some of these entries require dynamic parameters, you
might be better using the postconf scripts added in 374.36 (see the
postconf scripts section below).
The list of available config overrides:
exports (only exports.add supported)
fstab (only fstab supported, remember to create mount point
through init-start first if it doesn't exist!)
group, gshadow, passwd, shadow (only .add versions supported)
hosts (for /etc/hosts)
profile (shell profile, only profile.add suypported)
upnp (for miniupnpd)
Also, you can put OpenVPN ccd files in the following directories:
The content of these will be copied to their respective
server instance's ccd directory when the server is started.
** Postconf scripts **
A lot of the configuration scripts used by the router services
(such as dnsmasq) are dynamically generated by the firmware. This
makes it hard for advanced users to apply modifications to these, short
of entirely replacing the config file.
Postconf scripts are the solution to that. Those scripts are
executed after the router has generated a configuration script, but
before the related service gets started. This means you can use those
scripts to manipulate the configuration script, using tools such as
"sed" for example.
Postconf scripts must be stored in /jffs/scripts/ .
The path/filename of the target config file is passed as argument to
the postconf script.
The list of available postconf scripts is:
openvpnclient1.postconf (and openvpnclient2.postconf)
openvpnserver1.postconf (and openvpnserver2.postconf)
Here is a simple dnsmasq.postconf script that demonstrates how to
modify the maximum number of leases set in the dnsmasq configuration:
sed "s/dhcp-lease-max=253/dhcp-lease-max=100/" -i $CONFIG
----Note that these scripts are blocking the firmware while they run, to
ensure the service only gets started once the script is done. Make
sure those scripts do exit properly, or the router will be stuck
during boot, requiring a factory default reset to recover it.
** NFS Exports **
IMPORTANT: NFS sharing is still a bit unstable.
In addition to SMB and FTP, you can now also share any plugged
hard disk through NFS. The NFS Exports interface can be accessed
from the USB Applications section, under Servers Center. Click on the
NFS Exports tab.
Select the folder you wish to export by clicking on the Path field.
Under Access List you can enter IPs/Networks to which you wish to give
access. A few examples: - will give access to the whole local network - will give access to the two IPs (separate with spa
Entering nothing will allow anyone to access the export.
Under options you can enter the export options, separated by a comma.
For example:
For more info, search the web for documentation on the format of the
/etc/exports file. The same syntax for the access list and the options
is used by the webui.
You can also manually generate an exports file by creating a file named
/jffs/configs/exports.add , and entering your standard exports there.
They will be added to any exports configured on the webui.
Note that by default, only NFSv3 is supported. You can also enable
NFSv2 support from that page, but this is not recommended, unless you
are using an old NFS client that doesn't support V3. NFSv2 has various
filesystem-level limitations.
** Easy Entware setup **
Entware is an alternative to Optware. They are both online software
repositories that let you easily install additional software to your
router (such as an Apache web server, or an Asterisk PBX). The main
benefit of Entware over Optware (which is used by Asus for their own
Download Master) is it is very actively maintained, with recent
software versions.
Entware and Optware cannot be used at the same time however, so you
can't use Download Master while using Entware.
There is now a script to make setting up Entware ware easier.
Access your router through SSH/Telnet, and run
Note that Entware requires the JFFS partition to be enabled, and an
ext2/ext3 formatted USB disk (NTFS and FAT32 are not supported).
Also note that Entware is not available for the RT-AC56U or RT-AC68U,
due to the different CPU architecture.
** YandexDNS filtering **
Asus is implementing support for the YandexDNS DNS-based filtering.
This service allows you to filter out dangerous websites at the DNS
level. You can configure which computer will make use of this service
if you want, for example, to only filter your children's computer. The
settings can be found under Parental Control.
For more information visit .
** Layer7-based Netfilter module **
Support for layer7 rules in iptables has been enabled. You will need
to manually configure the iptables rules to make use of it - there is
no web interface exposing this. The defined protocols can be found in
To use it, you must first load the module:
modprobe xt_layer7
Additionally, ARM devices such as the RT-AC56 and RT-AC68 require that
you manually enable traffic accounting, with the following command:
echo 1 > nf_conntrack_acct
An example iptable rules that would mark all SSH-related packets
with the value "22", for processing later on in another chain:
iptables -I FORWARD -m layer7 --l7proto ssh -j MARK --set-mark 22
These could be inserted in a firewall-start script, for example.
For more details on how to use layer7 filters, see the documentation on
the project's website:
Source code
----------The source code with all my modifications can be found on Github, at:
------ (11-Jan-2014):
This version isn't available for the RT-N16 or the SDK5 build
of the RT-N66U as support for the SDK5 platform is currently
broken. Please stick to 374.36 Beta 1 for the time being on
these two platforms.
Note that the RT-N66U did get a newer wifi driver, so give it a
try, as it might have resolved or at least improved on the wifi
range issues.
Remember to do a factory default reset if switching from SDK5 to
SDK6 builds! Keep a backup of your existing settings in case you
decide to revert back to an SDK5 build.
- NEW: Merged with 374_2078 GPL provided by Asus (From RT-N66U).
Notable changes:
* Updated SDK for MIPS devices - (r382208)
* PPPoE HW acceleration should be fixed by the new SDK
* Updated AiCloud closed source components (MIPS)
- CHANGED: Reverted Parental Control code to our fixed code,
as I see Asus is still making fixes to their own
code past version 2078.
- CHANGED: Updated AC56 and AC68U wifi driver and CTF to
January 3rd builds (provided by Asus)
- FIXED: emf/igs userspace tools were missing on ARM devices
- FIXED: USB devices missing on MIPS devices (regression
in 374.37)
- FIXED: Wifi stability on ARM devices (regression in
374.37) (31-Dec-2013):
* This build was pulled due to numerous issues *
- NEW: Merged with Asus 374_501 GPL (from RT-AC68U).
Notable changes in this version:
* New SDK (wireless driver and CTF) for AC56/AC68
* dnsmasq updated to 2.68
* radvd updated to 1.9.5
* Improved IPv6 support
* Fixed Parental Control (A-M's own fix was replaced with
this new one for consistency)
* More details shown on Wireless Log page (their changes
were merged with our own changes)
- CHANGED: Dropbear default path will now include the locations
inside /opt
- CHANGED: Don't include a cert/key section in exported .ovpn if the
router has "User authentication only" enabled
- CHANGED: Display in which chain a given port forward rule is, on the
Port Forwarding page. Allows to distinguish manual forwards
from upnp forwards.
- CHANGED: The state of PPTP/L2TP client connections will be reported
on the VPN Status page.
- CHANGED: Removed the display of global OpenVPN statistics on the
VPN Status page.
- CHANGED: Upgraded AiCloud binary components on MIPS routers to
374_1631 build (N16/N66/AC66)
- FIXED: OpenVPN clients with DNS set to "Strict" weren't properly
setting dnsmasq to use "strict-order"
- FIXED: Garbled resolv.conf generated when adding an OpenVPN client DNS
to it
- FIXED: OpenVPN Client static key was incorrectly processed when shown
on the webui. Beta 1 (23-Dec-2013):
- NEW: Added ECDSA key support for SSH
- NEW: postconf scripts. This allow you to modify a generated
config file (for example, smb.conf) before the service
using it gets started.
- NEW: layer7 Netfilter module on ARM devices (AC56, AC68).
Note: traffic accounting must be manually enabled on
these devices (see the Layer7 section in the FW's README)
- CHANGED: Updated dropbear to 2013.62
- CHANGED: Improved rendering of the VPN Status page
- CHANGED: Extended retry period for WAN DHCP queries to 160 secs
in Normal DHCP mode to give time to Charter to
unblacklist customers being accidentally blocked by them.
- CHANGED: Downgraded rp-pppoe from 3.11 to 3.10 to see if it's
more stable for some PPPoE users
- FIXED: Some VPN client username/passwords were incorrectly handled
- FIXED: When disabling Dual WAN, WAN unit wasn't being reset to
unit 0, preventing users from editing the correct unit
(Asus bug)
- FIXED: If you replaced the Asus generated CA with your own, the
exported ovpn file would contain your CA with the
Asus-signed client cert/key. Now, we only insert the
client cert/key if it was signed by the current CA.
- FIXED: MSS clamping for clients connecting to the PPTPD server
(Asus bug)
- FIXED: networkmap's DLNA detection was broken with some devices,
and could result in very long delays during scan (Asus bug)
- FIXED: Adjusted various timings in networkmap which should help
with device lists being incomplete especially after a
reboot. (30-Nov-2013):
- CHANGED: Added a VPN mode selector on the VPN Server Details page.
- FIXED: JS error on the VPN Server Details page related to PPTP
- FIXED: Clicking on "Apply" on VPN Details page would fail to
apply your new settings to a running OpenVPN server.
- FIXED: Some port forward rules were incorrectly generated when
in load-balancing mode (Asus bug)
- FIXED: After adding/removing a user to OpenVPN Server, the password
file was not immediately updated. Note that this fix will
break backward compatibility with Asus as the nvram value
storing the list of OpenVPN user/pass had to be renamed
(so not to be instanced).
- FIXED: VPN client not working on MIPS devices (N66/AC66).
- FIXED: Various formatting issues with generated client.ovpn file (24-Nov-2013):
- FIXED: script location was changed in
339, causing issues with OpenVPN clients (24-Nov-2013):
- NEW: Merged with Asus 374_339 GPL (from RT-AC68U).
Asus added some new features in this release:
* Support for HFS+ and Time Machine (AC56/AC68U only)
* OpenVPN support. Their implementation uses the backend
code from Asuswrt-Merlin but with a more
simplistic, novice-friendly webui. This required
adapting the current webui to be able to retain some
of their improvements without sacrificing the
flexibility of being able to have two separate server
and client configurations.
NEW: Support for Namecheap DDNS (Patch provided by saintdev)
NEW: Added qos-start user script
FIXED: Incorrect range validation for UPnP ports on WAN page.
FIXED: Accidentaly lock out of webui due to software hammering
the router's webui without valid login credentials
FIXED: NAT Loopback broken with CTF enabled (AC56/AC68) (Asus bug)
FIXED: Backing up your settings would return an empty CFG file.
FIXED: Kernel panic when inserting ebtables rule (AC56/AC68,
fix backported from kernel 2.6.37)
FIXED: If an IP/CIDR on the IPv6 firewall page was long enough
to be shortened with "..." it would be incorrectly saved.
CHANGED: IPTraffic will now account for traffic going through
an OpenVPN tunnel
CHANGED: VPN webui is now an hybrid of our original webui,
along with Asus's own. This allows the addition
of these features developed by Asus:
* Ability to export an ovpn config file to give to
your clients
* Support for username/password authentcation on
the built-in server
* Ability to import a tunnel provider's .ovpn
config file to configure a client connection
on the router (01-Nov-2013):
- FIXED: DNS resolution not working for VPN clients
(bug in Asus 374_979)
- FIXED: USB disk detection on AC56/AC68.
- FIXED: Turbo mode option couldn't be saved (RT-AC68) (30-Oct-2013):
- NEW: Merged with Asus 374_979 (from RT-N66U).
AC56/AC68 AiCloud components taken from 374_217.
- NEW: Added RT-AC68U support.
- NEW: Added IPSec support to the kernel. Userspace tools
such as StrongWAN must be installed from Optware/Entware,
and manually configured. (Patch provided by saintdev)
- NEW: Adjustable MTU for DHCP/static IP WAN users
- NEW: WAN interface name passed as argument to firewall-start
- NEW: Configurable min/max ports allowed to be redirected by UPNP.
This allows WHS users to change the min allowed port from
the default value of 1024 to allow UPNP forwarding of
- NEW: Display CPU temperature on Sysinfo page (AC56 and AC68)
- NEW: Display CPU chart on Performance page (AC56 and AC68)
- CHANGED: UPnP rules will now be processed after manual
forwards and port trigger rules.
- CHANGED: Site Survey now reports supported protocol.
- CHANGED: Updated Dropbear to 2013.60.
- CHANGED: Updated dnsmasq to 2.67 final.
- FIXED: Some Traffic Monitor pages were missing the page tabs.
- FIXED: The webui would allow you to enable SSHD while not
setting an authkey or enabling password-based authentication.
- FIXED: 802.11h options should only be available on the 5 GHz band.
- FIXED: Wifi icon hover would report 5G channel as undefined if
2.4GHz radio was disabled.
- FIXED: IPv6 clients list failed to properly merge IPs from similar
MACs (Asus bug)
- FIXED: Minor layout issues with the Clients list
- FIXED: Samba wasn't started at boot time if browser master or WINS
was enabled and we had no USB disk plugged in.
- FIXED: Router/minidlna crashes when processing very large image
collections - various memory leaks plugged.
(patches provided by Paulo Capani)
- FIXED: Buffer overrun when entering more than 35 MACs on the
filter list. We now support up to 64 MACs. (3-Oct-2013):
* IMPORTANT *: RT-N66U users must revert back to factory defaults and
manually reconfigure their settings if coming from a FW
older than (applies to both Asus or
- NEW: Merged with Asus 374_726 code from RT-AC66U GPL. Notable changes:
* RT-N66U now based on the SDK6 driver. This resolved the
numerous connectivity issues, at the expense of a shorter
range (a separate SDK5 build based on driver 5.100 is
available in the Experimental folder as an alternative).
* AiCloud 2.0
- NEW: Added bonding.ko kernel module.
- NEW: Repeater mode moved into regular builds.
- NEW: Dual WAN moved into regular builds.
Note that there are still a few issues left, such as recovery
from failover mode when the primary WAN comes back up.
- NEW: YandexDNS support moved into regular builds. This is
a DNS-based filter list, which can be configured under
Parental Control.
- NEW: Added support for last seen devices on Ethernet port status
(Tools-> Sysinfo) for RT-AC56U.
- NEW: Option to control 802.11 extensions that deal with
regulations. On the Wireless Professional page
you can now enable 802.11d and 802.11h support.
- CHANGED: robocfg now (almost) completely supports the
Northstar platform (RT-AC56U)
- CHANGED: Enabled Syn Cookies for ARM devices (RT-AC56U)
- CHANGED: Allow selecting the Download2 folder for media server
- CHANGED: MIPS builds optimized for mips32r2 code generation, which
should improve general performance. (N16/N66/AC66)
- CHANGED: More openssl backports from 1.0.2, adding
mips32r2 support, improving performance
especially for sha1 (RT-N16/N66/AC66)
- CHANGED: Increased OpenVPN crt/key fields to allow up to 3499
characters - enough to accomodate even a 4096 bits key.
- CHANGED: Removed the firewall rules for acsd since it no longer
listens on a TCP socket.
- FIXED: Samba binding to WAN interface would cause warnings
about WINS/master browser (regression in 374)
- FIXED: The ARM kernel was missing the Advanced IP Routing option,
preventing some of the "ip" command functions from
working (was breaking Astrill's plugin) (RT-AC56U)
- FIXED: With FW 374 Asus changed the Samba priority from too high to
too low (-19), resulting in poor sharing performance.
I changed it to a priority of 0, providing more balanced
performance. (N16/N66/AC66)
- FIXED: Some fields would allow invalid characters (such as
single quotes) which might break the webui JS. There might
still be a few unprotected fields.
- FIXED: Memory leak in httpd service (Asus bug)
- FIXED: Parental Control not working with certain schedules
(patch provided by Makkie2002)
- FIXED: Potential key truncation in httpd if one was to use very
large OpenVPN keys and certs in all fields of all four
- FIXED: Samba would start sharing local disks even if all you
wanted was its WINS/Browser services.
- FIXED: The JFFS formatting code could encounter a case
where it wouldn't write back its cleared
format flag.
- FIXED: Restarting the wireless service would break
stealth mode.
- FIXED: The new thumbnail cache code Asus added in build 720's
minidlna will prevent scanning from completing on very
large collections. Reverted that code for now.
- FIXED: Wireless key field was automatically activated on
page load, which could lead to accidental changes
(issue introduced in 374_720).
- FIXED: Router believed that NTP wasn't properly working after a
LAN or wireless service restart (issue introduced in
- FIXED: IPv6 client list was incorrectly displayed if a client
didn't have a known hostname (Asus bug) (24-Aug-2013):
- NEW: Merged with Asus 374_168 GPL code.
- NEW: wan-start script will get passed the WAN unit number as
- NEW: Webui option to select the location of the DLNA database
(patch by VinceV)
- NEW: IPv6 firewalling. Originally, Asuswrt would allow any IPv6
traffic to be forwarded to your LAN devices. This new option
(enabled by default) will prevent traffic forwarding to LAN
devices. You can also create firewall rules to allow inbound
traffic to specific hosts. The firewall configuration can be
accessed through the "Firewall -> IPv6 Firewall" page.
- CHANGED: Upgraded OpenVPN to 2.3.2
- CHANGED: Implemented IPTraffic support in DualWAN - Load balanced
mode (Experimental builds)
- CHANGED: Updated miniupnpd to 20130730
- CHANGED: Updated some prebuilt binaries (RT-AC56U)
- CHANGED: Updated 2.6.36 kernel to the latest code used
in 372_184 (RT-AC56U), includes some changes
related to USB3, and PPP/CTF.
- CHANGED: Smarter location selection for the DLNA database
location to reduce the chances of having it in
RAM if left to default location, filling it up
(patch by VinceV)
- CHANGED: Updated e2fsprogs to 1.42.8 to be in sync with Asus
- FIXED: Web server would crash if you entered too much data in
OpenVPN key/cert fields.
- FIXED: The ACSD service could be exploited by a LAN user to
gain shell access to the router. TCP connections to
ACSD are now blocked by the firewall.
- FIXED: You could not define time periods on the Parental
Control calendar under IE.
- FIXED: Wireless client list would sometime return incorrect
hostname or be missing IP.
- FIXED: Security issue with Samba and symlinks (28-July-2013):
- FIXED: Samba wouldn't start due to missing symlink (RT-AC56U) (24-July-2013:
- NEW: Merged with 372_1393 code from Asus. Notes:
* Beamforming support for RT-AC66U/RT-AC56U
* RT-N66U driver still downgraded to build 270 (which
means no HW acceleration for PPP, but more reliable
connectivity on the 5 GHz band)
* Minidlna was updated to 1.1.0
* AiCloud security hole fixed
* Parental Control ui still broken under IE10 (use Fx or Chrome
for now)
- NEW: YandexDNS. Asus is currently implementing support in the
firmware for this DNS-based filter. This can be
found under Parental Control. See
for more info (go go Google translate!).
(Experimental builds only)
- NEW: User-provided client config files (ccd) for OpenVPN server.
See the OpenVPN and Custom Config sections of the firmware's
documentation for more info.
- CHANGED: Connections list under System Log will now progressively
display the result while the router is still
resolving IPs (if that option was enabled).
- CHANGED: OpenVPN client password hidden by default (and added
checkbox to display it similar to what Asus added
to the System page)
- FIXED: Sysinfo page was reporting IPv6 as reason for
CTF to be disabled - since 372 that is only true
for ARM devices.
- FIXED: OpenVPN Server in TAP mode + DHCP wasn't routing
properly (DHCP was overruling the default GW) (11-July-2013):
- NEW: Added support for newest RT-N66U hardware revision.
This router has a new model of flash, you can NOT
use any older FW on these. (RT-N66U) (7-July-2013):
(note: since people always thought adding a "b" meant "beta'
rather than revision "b", I am switching to Asus's new
numbering scheme, hence "30_2" for this revised 372.30.)
- FIXED: NAT loopback (invalid iptable rules was silently accepted
by iptables)
- FIXED: Removed empty Yandex tab
- FIXED: Entware setup script missing from all builds
- FIXED: pptpd failing to start (was missing from build)
- FIXED: OpenVPN server not starting if using a static key
- FIXED: Disks plugged to USB 2.0 port weren't getting mounted
(RT-AC56U) (5-July-2013):
- NEW: Merged with preliminary 372 code provided by Asus
(initialy meant for the ARM environment)
- NEW: RT-AC56U support. Various bugs have been fixed
over the original FW that initially shipped with these routers.
Thanks to Asus for providing a development sample.
- NEW: Added JFFS support to RT-AC56U.
- CHANGED: Downgraded wireless driver + CTF to build 270 version
(RT-N66U, fixes 5 GHz stability issues). Note that this
means that HW acceleration for PPPoE is no longer
available for the RT-N66U, as it was new in the 5.110 SDK.
- CHANGED: Updated iptables-1.4.x to 1.4.14 (RT-AC56U)
- CHANGED: Brought back the Connection page under System Logs
- CHANGED: Updated e2fsprogs to 1.42.7. Amongst other things
this new version is more memory-efficient on large
- CHANGED: Renamed Advanced (Per IP) Traffic monitoring for
IPTraffic (to match the Tomato name for that same
- FIXED: GRO kills upload speed if CTF is disabled (patch provided
by Asus, RT-AC56U)
- FIXED: Buffer overrun in NVRAM handling, leading to random crashes
(Asus bug, RT-AC56U)
- FIXED: NVRAM values getting corrupted or disappearing if using more
than 32 KB (Asus bug, RT-AC56U)
- FIXED: Reapply layout fixes to Guest network and DHCP page (were
lost in a recent webui update)
- FIXED: JFFS2 could get reformated again at each subsequent reboots.
- FIXED: Devices with a NetBIOS name of 15 chars long would have
their name merged with the next device's.
- FIXED: Empty Site Survey list if there was only one AP found
- FIXED: Saved settings might fail to restore if they contained
OpenVPN or SSHD keys with CRLF line endings. You should
access the OpenVPN Keys page, click on Apply to re-save
them, then re-create any backup you had of your router
- FIXED: Numerous bugs in ipt_account for Kernel 2.6.36 (RT-AC56U) Beta 1 (17-May-2013):
- KNOWN ISSUE: 5 GHz 40 MHz is unreliable with some wireless
cards (RT-N66U)
- NEW: RT-N16 is no longer an experimentally supported device.
Thanks to Mike from Sapphyre Software for providing
me with an RT-N16.
- NEW: Report currently used channels when mousing over
the wifi icon at the top of the webui
- NEW: Sysinfo: Ethernet port state will report each port's VLAN ID.
- CHANGED: Merged with webui content from
- CHANGED: Increased list height on Site Survey page
- CHANGED: Warn if trying to do a site survey with either
radios disabled.
- CHANGED: Updated to miniupnpd 1.8.20130426
- CHANGED: Updated to dropbear 2013.58
- FIXED: Syslogd must be restarted if we had to adjust its log
level for DHCP query logging.
- FIXED: br0 would change MAC address when starting an OpenVPN server
with a tap interface.
- FIXED: Sysinfo: Port numbering order (RT-N16)
- FIXED: Sysinfo: 5G radio infos weren't hidden if the
router did not support that band (RT-N16)
- FIXED: Wifi status icon would remain half-lit if 2.4 GHz was
disabled on a router without 5 GHz support (RT-N16)
- FIXED: Various fixes related to site survey display
- FIXED: Improved compatibility with USB disks > 2 TB
(must use ext2 or ext3)
- FIXED: Unable to clear DMZ IP (fixed in 364 webui files)
- FIXED: PPTP/L2TP Internet connection unable to connect at boot
(bug introduced in 358.28)
- FIXED: PPTP/L2TP Internet connection unable to reconnect after
going down (unsure if Asus bug or 358.28 bug)
- FIXED: Numerous bugs in the Per IP traffic monitoring causing
inaccurate traffic accounting if there was too much
traffic, or if update requests occured in a too short
period of time.
- FIXED: Asking for traffic monitoring (regular and Per IP) database
to be re-created would re-create it again on next reboot if
in the mean time you didn't change any other settings,
causing the flag not to be cleared on the mtd partition. Beta 1 (19-Apr-2013):
- KNOWN ISSUE: 5 GHz 40 MHz is unreliable with some wireless
cards (RT-N66U)
- KNOWN ISSUE: Sort order is sometimes wrong on the Site Survey page
- NEW: Wireless site survey (on the Wireless tab)
- NEW: openvpn-event user script that gets run when a tunnel goes
up/down. Read the OpenVPN documentation on the "up" and
"down" events for more on how to use this script, and to use
the passed parameters.
- NEW: Enabled sftp support in Dropbear (the sftp server must be
installed from Entware)
- NEW: Option to prevent SSH port hammering (patch submited by dodava)
- CHANGED: Merged with webui pages extract from the Asus released FW,
as they were more recent than the GPL ones
- CHANGED: Port state on Sysinfo page now uses the new OUI lookup
code from Asus
- CHANGED: Try to report on Sysinfo what is forcing HW acceleration
to be disabled
- FIXED: Build 354 reduced minimum syslog level to WARNING - bumped
back to INFO as in previous versions (resolves DHCP events
not being logged). Also ensured we readjusted it if DHCP
logging is enabled, to handle routers that got upgraded
with the new loglevel already set.
- FIXED: Port numbering on the Sysinfo page for devices that has
them backward (untested) (RT-N16)
- FIXED: Client list wasn't using the new OUI code from Asus (was
missing from the GPL archive)
- FIXED: LAN traffic going through the NAT loopback would be counted
in the Per IP traffic monitoring.
- FIXED: IE rendering of the Other Settings page when toggling Per
IP monitoring
- FIXED: Cannot set webui to HTTPS-only (causes port conflict error)
(Asus bug in 354)
- FIXED: Cannot create/modify folders in AiDisk
- FIXED: Couldn't resolve LAN hostnames if WAN was down (the web
redirection would hijack all DNS queries). Now, we let
dnsmasq handle both LAN and redirected queries.
- FIXED: Fixed support for Broadcom Wimax devices
- FIXED: smbpasswd wasn't properly updated when deleting a user
(Asus bug)
- FIXED: Aicloud: handling of disks with multiple partitions on the
webui (Asus bug) (fix submitted by hshang) Beta 1 (31-Mar-2013):
- NEW: Merged with Notable changes:
* New wireless driver
* New Network Tools
* WOL (Under Network Tools
* HW acceleration support for PPPoE
* DHCP Normal/aggressive behaviour. Similar to the 270.25
implementation, except it can be enabled/disabled
Asus considers build 354 to still be beta, so be advised that
there might still be some issues left (there are known issues
related to 3G/4G dongles for instance).
- CHANGED: Removed WOL webui - Asus added their own WOL support on
the Network Tools page. You will have to re-add your
WOL entries.
- CHANGED: Removed System Log -> Connections page, and integrated it
into the new Network Tools -> Netstat page from Asus (as
NAT Connections)
- CHANGED: Removed wol binary, since Asus's WOL page uses ether-wake.
- CHANGED: Removed option to control SIP helper on Firewall page
(use the new Asus option from WAN - NAT PAssthrough page
- CHANGED: WPS button when set as a radio toggle will now behave the
same way as Asus's firmware: pressing it will fully
enable/disable both radios in the webui, rather than just
toggle the state of the enabled radios. This means the
button will override the webui, and radio states will
survive reboots.
- FIXED: Avoid duplicate shares when using simpler share naming
using Asus's code from 354)
- FIXED: Improved fdisk support for 4KB sector size
- FIXED: openvpn: Client-specific entries weren't properly parsed
- FIXED: dnsmasq warning in syslog if DHCP static leases are disabled (17-Mar-2013):
- FIXED: Volume labels with spaces were rejected (Asus used the same
code to validate hostnames and volume labels) (15-Mar-2013):
- NEW: ipset Netfilter support + userspace tool to create ipset lists.
- CHANGED: Router's hostname is now set all the time, regardless of
telnet/ssh states (and including in AP mode)
- CHANGED: Added device name field on the LAN page, since it's now
relevant to the router's hostname (not just SMB). Left
it on the SMB page as well, for those used to see it there.
- CHANGED: Router will supply its device name when requesting an IP
while in AP mode.
- CHANGED: Various webui lists were increased from 32 to 128 entries
- CHANGED: Improved networkmap:
* Will also use DHCP hostnames and user-defined static
names instead of just NetBIOS names
* Client list will show an animation while networkmap is
still busy scanning and resolving device names
* Dropdown menus that use Networkmap to build a list
of devices will also display names in addition to IP/MAC.
- CHANGED: Don't restart the whole network if you only changed DHCP
reservations (LAN -> DHCP page)
- FIXED: Openvpn: Non-CBC ciphers weren't working (their use is still
not recommended)
- FIXED: Proxy auto-configuration support (Asus bug) (3-Mar-2013):
- FIXED: Disabling DHCP logging would cause a syntax error in
dnsmasq's configuration (regression from dnsmasq update)
- FIXED: Outbound VPN client traffic was dropped (regression from
firewall_2 fix)
- NEW: NFS folder sharing. Webui can be found on the
USB Applications -> Servers Center page (NFS Exports tab)
- NEW: dhcpc-event and zcip-event scripts (called on WAN events)
- NEW: Ccustom configs: group.add, gshadow.add, passwd.add,
shadow.add, exports.add
- NEW: New script that will setup Entware for you (written by
ryzhov_al). Run "" through SSH/Telnet to
launch the install process.
- CHANGED: Added a folder picker to the Tools Other Settings page to
select a location to store your traffic data files.
- CHANGED: Updated dnsmasq to 2.65 (backported from
- CHANGED: Enabled additional optimizations for openssl and openvpn
for a significant performance gain
- CHANGED: Reverted wireless driver to build 220 (RT-AC66U only)
- FIXED: Added missing badblocks program
- FIXED: Timing issues under IE where resolved device names would
not display on certain pages (such as the Sysinfo page)
- FIXED: VPN client "common name" wasn't getting saved
- FIXED: DHCP client will be less aggressive in attempting to obtain
a lease (wait 2 mins instead of 20 secs between attempts),
should help with ISPs like Charter who will blacklist you
if you send too many Discovery packets in a short period of
- FIXED: Made profile.add be run after any Optware profile, so the
user changes will have priority over anything else.
- FIXED: WOL list corruption when removing an entry in some browsers
- FIXED: No longer forward packets with a LAN IP as destination
(Asus bug, fixed CDRouter test firewall_2)
- FIXED: IPv6 WAN would have the wrong prefix length (Asus bug, patch
submitted by PiotrKa) (13-Feb-2013):
- NEW: Rebased on Notable changes:
o New driver builds (these are NOT the new major versions that
Asus are still working on)
o NTP-related changes
- NEW: Report CTF (HW Acceleration) state on Sysinfo page.
- NEW: Display Ethernet port states on the Sysinfo page.
- NEW: Replaced Busybox fsck/mkfs tools with those from e2fsprogs,
should be more reliable.
- CHANGED: Temperatures on Sysinfo page will now auto-update every 3
- CHANGED: Connections page now uses Ajax for slightly better rendering
- CHANGED: Improved name resolution on traffic monitor page, now uses
a device's hostname if it reported one.
- CHANGED: Client List now uses our improved name resolution code,
will overwrite names with those entered on the DHCP static
lease page.
- CHANGED: Updated to OpenVPN 2.3.0 and lzo 2.06.
- CHANGED: Updated Busybox to 1.20.2 (with Oleg/wl500g patches
re-applied). Lots of fixes, including GPT support in
- CHANGED: Updated Miniupnpd to version 1.8. NOTE: previous
versions were NOT affected by the recent UPNP exploit
disclosure. This is just as an added security precaution.
- FIXED: Temperature on Performance Tuning page would fail to update
if a radio was disabled.
- FIXED: Various timing issues causing some TrafficMonitoring and the
Sysinfo pages to often fail loading under IE.
- FIXED: JS error on the Per Device pages if FW failed to load the
traffic history.
- FIXED: ebtables were still broken, fixed by a complete rebuild.
- FIXED: Some OpenVPN fields rejected -1 as being valid.
- FIXED: Hide 5G radio info from Sysinfo page if router is \
single band (RT-N16)
- FIXED: Master Browser/WINS would not work if there was no USB disk
- FIXED: Samba would bind to the WAN interface while in router mode
(Asus bug)
- FIXED: Backported various kernel fixes from Oleg/WL500G, Tomato
and to help improve HDD > 2 TB support (still
not perfect, some USB enclosures are simply not Linux
- FIXED: Display of Connections under IE
- FIXED: Trying to apply settings on the System page with a username
containing a non-alphanum would incorrectly assume you just
tried to change to an account name that already existed
(Asus bug).
- FIXED: Wouldn't enable wins in Samba if you had a WINS IP entered
on the DHCP configuration page. (31-Dec-2012):
- FIXED: The IE fix ended up breaking Firefox (and meanwhile, Chrome
worked fine no matter which method was used to build that
dropdown). (31-Dec-2012):
- NEW: Rebased on (from the RT-AC66U GPL)
- NEW: Tools icon contributed by Maximilian Czarnecki.
- FIXED: Skip bad blocks while erasing MTD partition (fixes RT-AC66U
failing to format JFFS2 partition due to bad blocks)
- FIXED: Router would have no hostname if you enabled ssh but kept
telnet disabled.
- FIXED: Couldn't add new ebtables rules (regression in 264.22)
- FIXED: customized minidlna.conf
- FIXED: Traffic monitoring per IP is unreliable if HW acceleration
is enabled. Do not load CTF if booting with cstats enabled.
- FIXED: Per Device traffic monitor pages missing under IE (15-Dec-2012):
- NEW: Rebased on (from the RT-N53 GPL).
- NEW: Traffic monitoring per IP added to the Traffic Monitor section.
Based on the Tomato IPTraffic implementation by Teaman.
- NEW: Option to disable the Netfilter SIP helper (Firewall page),
allows people to manually forward port 5060 to their own SIP
- NEW: Option to enable/disable logging DHCP client queries
(LAN->DHCP page)
- FIXED: Tabs would disappear while on the Monthly traffic page.
- FIXED: Really fixed Firefox issue (the fix wasn't merged
in release 260.21).
- FIXED: Router crash if the list of MAC filters + their names got
too long.
- FIXED: OpenVPN webui: TLS Reneg and Connection Retry wouldn't let
you enter -1 as value.
- FIXED: Layout issues on the DHCP page (one in Asus code, another
in Merlin code)
- FIXED: Beeline Corbina was unable to connect to PPTP/L2TP server
due to DNS issues.
- CHANGED: System log starts at the bottom (backported from GPL 314)
- CHANGED: Dual WAN is no longer enabled in regular builds - too many
issues with it at this point. Regular USB failover
still works. (5-Dec-2012):
- NEW: Rebased on This version should
resolve issues with some Russian ISPs. Note that
the RT-N66U build still uses the wireless driver
from release 220, as this seems to be the most stable
at this time.
- NEW: Option to force the router into becoming the SMB Master Browser.
- NEW: Option to make the router act as a WINS server.
- NEW: Option to control Spanning-Tree Protocol
- NEW: fstab custom config file
- FIXED: Firefox compatibility issues on the DHCP static and
MAC filter name fields.
- FIXED: Wifi status icon wasn't accurately reporting states if they
were changed by a radio schedule.
- FIXED: QIS would report newer firmwares, potentially overwriting
Asuswrt-Merlin with an original Asus firmware.
- FIXED: Wifi LEDs would turn back on if radios were enabled while
in Stealth Mode (now they turn back off after a few seconds)
- FIXED: Webui would break if a network device had an invalid
NetBIOS name (such as the Sonos Dock). (14-Nov-2012):
- NEW: Wifi status icon will be half colored if only one radio is
- NEW: Wifi status icon popup will report the state of each radios.
- NEW: upnp custom config file for miniupnpd
- NEW: unmount user script
- NEW: led_ctrl and makemime (for use in conjunction with sendmail)
- NEW: Implemented control for network switch LEDs (all four at once)
- NEW: Stealth Mode: option to disable all LEDs
- FIXED: Radio toggle through WPS button would be overriden by a
scheduled radio. Reverted "switch" to "toggle" code to
prevent this.
- FIXED: You couldn't disable DMZ by clearing the IP field.
- FIXED: You couldn't edit entered text in DHCP/MAC/etc name field
- FIXED: clientid passing for some ISPs requiring it (like Sky UK)
was broken with the DHCP client change of build 220.
- FIXED: No longer reboot the router three times during boot time if
one of the radios is disabled by the user. (RT-N66U)
- FIXED: Changing the router login name to anything other than "admin"
would prevent radvd, ecmh and the cru script from working
properly - they all assumed "admin". Made then use
http_username instead (which is tied to the superuser)
- CHANGED: Improved SMB and vsftpd read performance by up to 30% (26-Oct-2012):
- FIXED: Reverted wireless driver to build 220 version as the new
one caused various connection issues for some (RT-N66U). (23-Oct-2012):
- NEW: Rebased on Some notable changes:
o New "Enhanced interference management" option under
Wireless -> Professional.
o Improved AiCloud webui
o dnsmasq updated to 2.64
- NEW: Option to enable simpler share names. When enabled, the folder
Share will be shared as "Share" instead of "Share (on sda1)".
The option can be found on the Misc tab, under USB Application.
- NEW: User customized config files for various services. Those custom
config entries can either be appended, or completely replace the
config file generated by the firmware.
- NEW: Added Name field to the Wireless ACL page.
- NEW: Added service applet to rc. For example, "service restart_samba" will
restart the Samba service. For advanced usage/debugging only.
- NEW: Backported OpenSSL ASM optimization from 1.0.1, for significant perfor
improvements in applications such as OpenVPN or SSH when using AES.
- NEW: Report the current CFE/Bootloader version on the Sysinfo page.
- FIXED: Minor tweaks to the AiCloud pages so they can fit on a 15" laptop sc
(some close buttons at the bottom were unreachable)
- FIXED: Enabling SSH access from WAN didn't work if DualWAN
was set to load-balancing.
- FIXED: Removed MAC Filter page, as it doesn't work (not compatible
with Parental Control).
- FIXED: OpenVPN Client "Username Auth only" option was broken.
- FIXED: Limit valid characters in a DHCP/WOL description to prevent
breaking the webui by using invalid ones such as quotes.
- FIXED: OpenVPN Client wasn't properly applying DNS settings that
the server was pushing to us.
- FIXED: Wireless client list alignment in AP mode.
- CHANGED: Less strict rules when validating user-entered MAC hwaddr. (25-Sept-2012):
- NEW: Report both rx and tx rates on wifi connections
- FIXED: Handle cases where the wireless driver returns a speed of -1
- FIXED: Removed rssi retrieval retries, as it would make the first access to
the wireless page take forever if you had multiple connected clients
You will have to manually refresh the page the first time you access
if the RSSI is reported as "??". (23-Sept-2012):
- NEW: Added OpenVPN logging verbosity setting (vpn_loglevel, must be
manually set to a value between 0 and 15, with 3 being the default).
- FIXED: Buffer overrun in init code that would crash the router when
too many features were enabled at compile time.
- FIXED: Re-enabled DualWAN (RT-N66U, RT-AC66U)
- FIXED: Re-enabled Beceem (Wimax) support in RT-AC66U.
- FIXED: OpenVPN 'Start with WAN' and 'Respond to DNS' settings were
not properly saved.
- FIXED: First time a client's rssi is polled it would return 0.
- FIXED: post-mount user script wasn't executed (regression in 220.17)
- CHANGED: Added some info to the OpenVPN server and client pages.
- CHANGED: Improved load time of the VPN Status page. (18-Sept-2012):
- NEW: Rebased on, which includes:
* Fixes to IPv6 6rd
* Fixes to AC66U Wifi + QoS
* AiCloud
* Interference mode once again enabled
- NEW: Display last received rate and rssi for each clients on Wireless Log pa
- FIXED: dnsmasq not listening to DNS requests from OpenVPN clients
if you had just enabled the option on the webui.
- FIXED: PPTP clients not always showing on VPN Status page.
- CHANGED: Disabled DualWAN as it's currently broken in 220.
- CHANGED: Disabled Beceem Wimax support in RT-AC66U as it bricks
the router.
- CHANGED: Removed firmware update checker to avoid accidental
revert to original FW. Beta:
- NEW: (RT-N66U, RT-AC66U) Implemented OpenVPN, based on code written by
Keith Moyer (from the Tomato project).
- NEW: Added crontab command
- FIXED: (RT-AC66U) Would crash when accessing a LAN device through either
VPN or the NAT Loopback (GRO is now disabled for that device)
- FIXED: dnsmasq was listening to all interfaces by default, allowing
even dhcp requests to be serviced from the wan side if you
had the firewall disabled (Asus bug) (fixed by dev0id)
- FIXED: Default disk idle spindown now set to 0 (disabled).
- FIXED: Corrupted WOL list when using IE.
- CHANGED: Upgraded openssl to 1.0.0j.
- CHANGED: Included fully functional openssl command (will allow you to
create keypairs and certificates from the router).
- CHANGED: Removed power adjustments from the Performance page, as they
are redundant, and not as reliable.
- CHANGED: (RT-N16) Disabled Dual WAN, as it exhibited many issues, and I
am unable to work on them without an actual router. (17-Aug-2012):
- NEW: Rebased on Notable fixes by Asus:
* Radio turns back on based on schedule
* Reorganized QoS pages
* Turning WAN DHCP connection off will first release current DHCP lea
- NEW: RT-AC66U officialy supported, with all the same features as the RT-N66
- NEW: (RT-AC66U) Implemented JFFS support. Limiting partition to 32 MB
max, as using the whole 90+ MB available makes little sense for
JFFS, and was also displaying some issues.
- NEW: Added nat-start user script, as NAT rules get applied separately from
other firewall rules (firewall-start changes to the nat table are
being overwritten when the router starts NAT)
- NEW: Added additional info to Sysinfo page
- NEW: Added chroot applet
- NEW: Option to allow SSH access from WAN
- NEW: Option to exclude specific devices from idle spindown
- FIXED: Performance page now uses the new Sysinfo API, and is now able
to deal with cases where radios are disabled.
- FIXED: Web server would crash for some people when accessing
the Wireless Log page.
- NEW: Spin down disks after (user-configurable) inactivity timeout
(using Jeff Gibbons' sd-idle-2.6)
- NEW: System information page under the Tools menu.
- NEW: Station list on the Wireless Log page will now report associated
IP and hostnames (when possible).
- CHANGED: Upgraded to MiniDLNA 1.0.25 (changelog:
- CHANGED: Better integration of the Run Cmd page.
- FIXED: Incorrect left menu rendering when under the Tools menu.
- NEW: Rebased on
- CHANGED: Switched to WPS radio toggle code Asus added,
now on the Administration -> System tab. Beta:
This is based on unreleased Asus code, which they have
graciously provided me with.
- NEW: Rebased on Notable changes from Asus:
. IPv6 tunnel memory leak fixed
. They fixed many issues, making some of my patches
no longer necessary, such as timezone DST, https auth, etc...
. Upgraded radvd
- NEW: Added link to the command shell page in Tools menu.
- NEW: (RT-N16) Enabled power settings (EXPERIMENTAL)
- NEW: Added "tee" command.
- FIXED: NAT loopback rules would actually NAT every lan to lan
connections instead of only those needing the loopback
(bug in Asus's code). Replaced with new code based on a
suggestion from Phuzi0n on the DD-WRT forums.
- FIXED: Accessing the WOL page would make it resend the last
WOL request.
- FIXED: 'cru' was using 'root' instead of 'admin'
- CHANGED: Made tracked connections load async from rest of the page
- CHANGED: Increased hostname width on Connection status page
- CHANGED: Improved WOL page functionality. Beta (6-July-2012):
- NEW: Name field added to DHCP reservation list
- NEW: Webui option to enable resolving IPs on the Connections tab
- NEW: Store a list of computer MACs to use as WOL targets
- CHANGED: Increased dhcp options from 32 to 128 characters
- FIXED: Brought max PPTPD password lenght back to 32 chars (Asus had reduced
it to 16 in recent versions)
- FIXED: Retrieve dhcpc options for the correct wan interface (30-June-2012):
- NEW: Rebased on
- NEW: Support for 64K NVRAM enabled. ***First flash will
wipe out ALL your settings! And you cannot restore
from saved settings - you must manually reconfigure
everything. Be warned!***
- NEW: Enabled support for Broadcom Wimax devices
- NEW: Added cifs kernel module (for mounting remote SMB shares)
- NEW: Added layer7 iptables matching
- NEW: Added user-options for DHCP on the WAN page
- FIXED: Router crashing when connecting to it over Wifi
and running the newer QoS code (disabled GRO)
- FIXED: Router crashing when connecting to a network
device behind the router from over a VPN
connection (disabled GRO).
- FIXED: Incorrect timezone set unless enabling
manual DST. (10-June-2012):
- NEW: Enabled new Dual WAN support from Asus
- FIXED: no-ip DDNS entry would revert to Asus DDNS on webui (8-June-2012):
*** Reverting to factory defaults BEFORE and AFTER flashing
this version is strongly recommended! The newer Asus code base
seems to have changed quite a few settings, so you'll want to
not only start with the new default values, but also get rid
of obsolete settings. Otherwise you will be wasting a
good amount of the limited available nvram. ***
- KNOWN ISSUE: Memory leak when using IPv6 (bug in Asus's code
and/or kernel code)
- KNOWN ISSUE: PPTP VPN can randomly reboot the router if accessing
a LAN device behind the router. Workaround is to
use an IP range outside of the local LAN
(i.e. instead of, and either
set your VPN to use the VPN tunnel as default
gateway, or manually add a route to your VPN
- NEW: Rebased patches on (RT-N53U sources).
Build 130 brings various code changes to IPv6, not sure
what else (as I have no changelog between 112 and 130).
The QoS code remains from build 108, as build 130 is
- NEW: Added "diff" utility
- NEW: Keyword-based filter (new in 130)
- FIXED: Firmware/settings can now be uploaded over HTTPS
(bug fixed by Asus)
- FIXED: Buffer overflow in networkmap that would cause garbled
device names to appear on the clists list (bug in
Asus's code)
- FIXED: Firewall would break when applying a game preset that
had multiple ports separated by a "," (bug in Asus's
- FIXED: WOL through webui wasn't working when IPv6 is enabled
- FIXED: Memory leak in sit.ko (backported from Linux
- IMPROVED: /jffs/scripts/ will be created automatically if it
doesn't exist (you must still make any new script
executable using "chmod a+rx script_filename") (27-May-2012):
- NEW: Added support to DDNS (patch submitted by Igor Pavlov)
- NEW: Added webui page under System Log to display active/tracked
network connections.
- NEW: Added netstat-nat command.
- NEW: Added pre-mount and post-mount user scripts (patch submitted by
Shantanu Goel)
- NEW: Allows tweaking TCP/UDP connection tracking timeouts
- FIXED: Removed check in Asus's code that would reject txpower > 80
unless you clicked three times on Apply (?!).
NOTE: Still not sure power setting even works, as I get
-80db from the other end of the house no matter if I use
40 or 500 mW. (14-May-2012):
- NEW: HTTP access list (backported from build 112)
- NEW: PPTP VPN encryption options (backported from build 112)
- FIXED: Traffic history location was't properly saved
when changed in webui.
- FIXED: Disabled traffic history saving to nvram for now,
to avoid people accidentally filling their limited nvram space.
- FIXED: Missing bottom pixels from the bottom of General menu
- FIXED: Removed invalid CSS attribute
- FIXED: typo in VPN iptables entries (bug in Asus's code) (5-May-2012):
- NEW: Crond starts at boot time.
- NEW: init-start is a new user script that will be run early on
at boot time (right after jffs is mounted, and before any
service gets started)
- NEW: Can save traffic history to a custom location (USB or
JFFS, for instance) to preserve it between reboots.
- NEW: Added Monthly traffic page (ported from Tomato)
- NEW: Added the Performance Tuning page (with temperature).
- FIXED: Webui authentication was bypassed by the web server (bug in
Asus's code)
- FIXED: Httpd crash when uploading a FW or settings file over
https - should simply fail now. For now you have to
use http for flashing the FW or restoring your settings
from a saved config file. (28-Apr-2012):
- NEW: Clicking on the MAC address of an unidentified client will do a lookup
the OUI database (ported from DD-WRT).
- NEW: Added HTTPS access to web interface (configurable under Administration
- NEW: Option to turn the WPS button into a radio on/off toggle (under Admini
- FIXED: sshd would start even if disabled
- CHANGE: Switched back to wol, as people report better compatibility with it
ether-wake remains available over Telnet. (18-Apr-2012):
- NEW: JFFS support (mounted under /jffs)
- NEW: services-start, services-stop, wan-start and firewall-start user scrip
must be located in /jffs/scripts/ .
- NEW: SSHD support
- IMPROVED: Fleshed out this documentation, updated Contact info with SNB for
um URL
- CHANGE: Removed wol binary, and switched to ether-wake (from busybox) inste
- CHANGE: Added "Merlin build" next to the firmware version on web interface. (14-Apr-2012):
- NEW: Added WakeOnLan web page (5-Apr-2012):
- Initial release.
Contact information
------------------SmallNetBuilder forums (preferred method:
thread.php?t=7047 as RMerlin)
Development news will be posted on Twitter. You can also keep a closer
eye on development as it happens through the Github site.
For support questions, please use the SmallNetBuilder forums whenever
possible. There's a dedicated Asuswrt-Merlin sub-forum there, under
the Asus Wireless section.
Drop me a note if you are using this firmware and are enjoying it. If
you really like it and want to give more than a simple "Thank you",
there is also a Paypal donation button on my website.
I want to give my special thanks to Asus for showing an interest in
this project, and also providing me with support when needed. Also,
thank you everyone who has donated through Paypal. Much appreciated!
--Eric Sauvageau
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF