OpenMPTCProuter

OpenMPTCProuter v0.64.2 is available. This is a maintenance release for v0.64: no kernel update and no new major feature, but a large set of fixes on how interfaces enter and leave MPTCP, on OMR-Tracker, on port forwarding used together with OMR-ByPass, and a real reduction of CPU and log usage.

The server side moves from 0.1069 to 0.1081 and should be updated too: it restores IP forwarding lost during the migration from Shorewall to nftables, repairs the firewall resync and disables a fail2ban jail that could ban a router from its own VPS.

Highlights

• MPTCP interface handling: a WAN could stay stuck in backup, an interface down for OMR-Tracker could be put back into MPTCP, and DHCPv6 companion interfaces were treated as real WANs
• PPPoE WAN could stay down forever in OMR-Tracker (#4371)
• Port forwarding now works when OMR-ByPass is used (#4369)
• Firewall rules, zones and SNAT no longer lose the options left at their default value (#4365)
• Lower CPU usage at rest and limited log file size
• The status page no longer times out (#4360)
• MQVPN updated to 0.16.2, tunnel MTU fixed
• Server updated to 0.1081, with IP forwarding (#4363), firewall resync and fail2ban fixes

MPTCP and interfaces

• Fix a WAN staying permanently in backup: the interface page dropped a multipath value equal to the default, and the value previously saved by OpenMPTCProuter was applied again at every MPTCP start (#4368)
• Multipath information is no longer removed when saving an interface or the wizard
• An interface set down by OMR-Tracker is no longer added back as an MPTCP endpoint
• DHCPv6 companion interfaces (wan1_{6, wan2}6...) are no longer handled as real multipath interfaces, and multipath is disabled on them
• Better MPTCP path manager support on both sides: only the path managers advertised by the running kernel are used, and an old v0.95 name (fullmesh, ndiffports, binder) is mapped to the mainline kernel path manager instead of failing at every boot
• No more VPN or proxy restart when an MPTCP scheduler change is not actually applied
• MPTCP page: path manager list refreshed, subflow information now read through omr-sockdiag

OMR-Tracker

• Fix PPPoE interfaces staying down: the tracker kept the Ethernet device (eth3.835 for example) because pppd had not published the PPP device yet, and never resolved it again (#4371)
• Fix route replacement and the log line printed at every check when an interface is in balancing and another one in backup (#4358)
• New openmptcprouter.omr.server and openmptcprouter.omr.proxy state, and many values cached: trackers use much less CPU
• Fix the tracker init script

VPN and proxy

• Shadowsocks: fix load balancing between several servers
• Fix ss-local processes left running after a proxy change (#4357)
• The 192.168.1.3 placeholder server address is replaced by 127.0.0.1, so a proxy that is not configured yet can no longer send traffic to a LAN host
• MQVPN updated to 0.16.2: use-after-free fix on the server side, statistics and status available in client mode, default log level raised from error to warn
• MQVPN: a static MTU on the tunnel device overrode the MTU negotiated by MQVPN and could break traffic in one direction, it is now removed automatically
• Glorytun TCP: tunnel addresses are configured once the device exists, and the CPU affinity, multiqueue and sysctl tuning that could break the tunnel is removed

OMR-ByPass and firewall

• Port forwarding and bypass now work together: the reply packets of a connection opened from outside keep the path the connection came in on (#4369)
• Reloading the rules no longer keeps deleted entries in the nftables sets (#4353)
• Less warnings in the log
• LuCI firewall: rules, zones and SNAT keep the options set to a value equal to the default (#4365)
• A rule without target is no longer sent to the VPS, and a port opened with ACCEPT is no longer reopened on the server at every pass

Web interface

• Status page: global time budget on the checks and cached values in the API, the page does not time out anymore (#4360)
• Wizard: changing the server API key now forces the settings to be retrieved from the VPS
• Metrics page: new section for the omrvpn tunnel
• SQM page: new congestion synchronization settings

Metrics and SQM

• New optional integration between OMR-Metrics and SQM autorate: the congestion score of a WAN (queuing delay, loss, jitter, queue backlog, signal quality) tightens the bufferbloat threshold of cake-autorate for that WAN only.
• Metrics are now also collected for the omrvpn tunnel and displayed in the metrics page
• No VPS API call anymore when the server credentials are incomplete: a new router could otherwise fill the fail2ban jail of its own VPS and get banned from it

OMR-Quota

• A quota with a begin date counted the whole vnstat history instead of the traffic since that date
• The speed limit now applies to download too, and not only to upload
• Quota shaping takes the SQM shaper over properly instead of silently replacing it, and gives it back when the quota is cleared
• Various fixes in the daemon, the init script and the quota page

Performance, logs and first boot

• omr-schedule, omr-tracker, omr-metrics and the OpenMPTCProuter API cache more values and do less calls: CPU usage at rest is significantly lower
• Log file size is limited and the syslog default script is fixed
• sysctl: net.core.netdev_budgetusecs was refused by the kernel on HZ=100 devices, and BusyBox sysctl stops at the first error, so every setting after it in the file was silently ignored
• Default QoS, SQM, vnstat and quota configurations now follow the real interfaces on platforms where wan1, wan2... do not exist, and the network is not configured again when it already carries a multipath setting

Server (VPS 0.1069 to 0.1081)

• IP forwarding was lost during the migration from Shorewall to nftables, dropping all the traffic forwarded by the VPN; IPv6 masquerading for client addresses is restored too (#4363)
• The omr-admin firewall chains are repopulated after any start, restart or reload of nftables
• Fix the SIP ALG on fresh installs (#4361)
• XRay VLESS Reality can now be applied from the wizard, the server API refused that name
• fail2ban: the omradmin jail could ban a router being set up (a router without VPS key polls the API with an empty password), which showed up as "can ping server VPS, no server API answer". The filter now matches a real authentication failure logged by omr-admin, and the jail is disabled by default
• The MPTCP path manager sent by the router is mapped to a name the running kernel supports, and a wrong value already saved is repaired at start
• The VPS version reported to the router is read correctly, so the update message is no longer permanent or never shown
• MQVPN 0.16.2, users and keys preserved on update, new /mqvpn_users endpoint
• VXLAN: a VNI and port pair already used by another user is rejected, and the addresses derived from the user id are fixed for high user ids
• install_omr-ai.sh fixed with InfluxDB 3.10 and 3.11 (#4366)
• Install fixes: the VPS stayed unreachable over SSH after the port change until the next reboot, xray and mlvpn could end in failed state after a fresh install, the OMR kernel was not set as default GRUB entry, and boot could wait two minutes on systemd-networkd-wait-online (#4367)
• UFW and firewalld are force disabled at install so they cannot conflict with the nftables firewall

Updating the VPS to 0.1081 is recommended.

Highlights

• MQVPN, a new multipath QUIC-based VPN, is now included and is the default VPN
• New MPTCP schedulers: Weight, Weighted Round-Robin and DSCP - steer traffic per interface weight or pin traffic classes to a specific WAN
• VXLAN tunnel between router and VPS, in Layer 2 (bridged) or Layer 3 mode
• New monitoring: metrics with connection health score and quality trend graph, an Events page, and a plain-English MPTCP Diagnose tab
• Optional AI on the VPS: a machine-learning decision engine that scores each connection and recommends routing weights per traffic class
• nDPId deep packet inspection: bypass traffic by detected application/protocol or category
• Linux kernel 6.18 support and many new device images
• Most LuCI pages migrated from Lua to JavaScript

MQVPN (new default VPN)

• New QUIC-based VPN with native multipath support, set as default VPN
• Configurable IP and port, including a port 443 mode
• Packet reordering support (enabled by default) and congestion control selection
• Weighted Round-Robin path scheduler with per-path weights
• New Metrics tab in the MQVPN page showing live per-path data

MPTCP schedulers and traffic steering

• New Weight scheduler: give each interface a weight (up to 256), configurable in Network -> Interfaces and on the MPTCP page
• New Weighted Round-Robin and DSCP BPF schedulers: DSCP lets you pin a traffic class (e.g. video calls) to a chosen WAN
• New DSCP manager, with DSCP support added to Shadowsocks-Rust, OMR-ByPass and the VPS side
• Scheduler and weight/DSCP settings are synchronized between router and VPS; upload settings are mirrored to the download side when unset
• New Weight/DSCP configuration page for the VPS
• TCP VPN/proxy restarts automatically when the scheduler changes so the new scheduler applies immediately
• Existing BPF schedulers (burst, rr, red, first, bkup) updated

VXLAN

• VXLAN tunnel from router to VPS, selectable Layer 2 (bridge) or Layer 3 mode
• Layer 2 mode can bridge into any interface you choose
• Can be enabled/disabled from the settings page

Monitoring and diagnostics

• New omr-metrics service: connection health status, per-subflow MPTCP metrics, quality trend graph, metrics sent to the VPS, optional custom/dedicated metrics server, and optional AI API integration for analysis
• New Events page (luci-app-omr-events) to follow what happens on the router
• New Diagnose tab on the MPTCP page: fallback/blackhole/reset detection explained in plain English, plus a per-subflow table
• Status page improvements: CPU temperature, currently active VPN and proxy, ASN/whois information for the VPS IP, direct output box, only Multipath-enabled interfaces shown, fixed 5G NSA display, fixed temperature display, dedicated ACL for the status page
• Faster and more reliable connection data collection

AI on the VPS (optional)

• New optional AI decision engine on the VPS, installed with a single script (install_omr-ai.sh) - nothing is installed unless you choose to
• Router metrics are stored in InfluxDB 3 on the VPS (60-day retention by default)
• A neural network (PyTorch) scores every WAN from 21 quality features (latency, loss, jitter, congestion, trends...) and recommends a routing weight per interface
• Can predict short-term link quality and recommend the best WAN per DSCP traffic class (voice, video, bulk...)
• Auto-learning: the model keeps training itself in the background from the link quality it actually observes

OMR-ByPass

• Deep packet inspection via nDPId with a new LuCI app: bypass by detected protocol/application and by category
• Per-rule TCP/UDP protocol choice for domains and IPs, better UDP support, V2Ray/XRay supported when UDP is disabled
• Much faster boot and rule reloading (batched UCI writes, hashing, caching), fixed nftables MARK rules
• Configurable rules reload time
• DSCP marking support

OMR-Tracker (connection monitoring)

• Congestion detection: link quality score can flag a congested interface
• Jitter and min/max RTT measurement
• Custom check IP and latency host usable when no VPS is defined
• Configurable post-tracking interval delay
• Reduced CPU usage, better gateway management, and many stability fixes (duplicate trackers, orphaned lock files, endless loops)
• An interface is no longer promoted back to master before its "up" counter is really satisfied

Wizard and web interface

• New wizard and status page
• LuCI apps migrated from Lua to JavaScript: OpenMPTCProuter (wizard, status, settings), MPTCP, OMR-Quota, OMR-DSCP
• More help texts in OMR-Tracker and OMR-ByPass pages, updated translations (French, Russian, Chinese...)
• New qdisc and weight settings in Network -> Interfaces, custom DHCP gateway support restored

OMR-Quota

• Global quota across interfaces
• Bandwidth throttling when quota is reached
• Configurable billing period (begin/end dates)
• Interface picker in the quota page

VPN and proxy

• OpenVPN updated to 2.7 (kernel DCO module on 6.18, no-delay option, passtos enabled)
• XRay updated: VLESS flow and decryption support, GRPC and XHTTP transports, protocol choice in wizard, fixed several start/firewall race conditions
• V2Ray/XRay: fixed restart loop when the server side is disabled
• Shadowsocks-Rust updated: shorter timeouts, DSCP support, crash fix, rules only applied when a password is set
• Glorytun UDP fixes (secondary WAN handling, port, optimizations applied only when enabled)
• VPN/proxy keys (Glorytun, DSVPN) now stored in volatile /var/run instead of flash
• Only the selected VPN/proxy is kept enabled; VPN restart checks prevent duplicated restarts

Hardware and system

• New device images: GL.iNet GL-MT2500 (Airoha), GL-X3000, GL-XE3000, GL-MT5000, Turris Omnia, NanoPi R3S, Z8802, Z8802BE, Z8803BE
• Fixed network configuration on GL-MT2500 (#4293), fixed mt7915e conflict, WED hardware offload enabled on MT7915 WiFi
• Linux kernel 6.18 support (MPTCP settings, kmod-ovpn, CI builds)
• Performance: irqbalance enabled on 4+ core CPUs (with LuCI app), automatic RPS/XPS setup, LRO/TSO/UFO disabled on multipath interfaces, updated sysctl tuning
• bpftune auto-tuning available on x86 (disabled by default) with a LuCI page
• Modems: SIM PIN handling fixed, automatic operator switch when connected without traffic, faster ModemManager startup, more signal information via omr-qmi/omr-modemmanager
• DNS hijacking detection (alerts when the ISP intercepts DNS queries)
• SQM autorate: multiqueue support and fixes
• QUIC is no longer blocked by default (was previously blocked to force traffic onto TCP/MPTCP)

VPS update is required

Changelog:

• Update to kernel 6.12
• Update OpenWRT
• Update BPF schedulers
• Update XRay, Shadowsocks-Rust, ModemManager,...
• Update OMR-ByPass database
• Add countries support in OMR-Tracker
• Many fixes

Changelog:

• Add ZBT z8109ax support
• Add glinet mt2500, mt3000 & mt6000 support
• Add smartdns support
• Add BPI-R4/R3 support
• Add omr-iperf-proxy and omr-iperf-vpn to speed between router and VPS using proxy and VPN
• Update rust, xray, OpenVPN,...
• Lot of fixes on IPv6, proxy, tracker,...

OpenMPTCProuter v0.62 will be available only with Linux kernel 6.6

For more info: https://github.com/Ysurac/openmptcprouter/issues/3828

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

• Add ZBT z8109ax support
• Add glinet mt2500, mt3000 & mt6000 support
• Add smartdns support
• Add BPI-R4/R3 support
• Add omr-iperf-proxy and omr-iperf-vpn to speed between router and VPS using proxy and VPN
• Update rust, xray, OpenVPN,...
• Lot of fixes on IPv6, proxy, tracker,...

OpenMPTCProuter v0.61 is available with kernel 6.6 and kernel 5.4.

Changelog:

Common:

• Update Proxy and VPNs
• MPTCP over VPN fixes
• XRay/V2Ray port forward fix
• Many fix related to ModemManager usage
• IPv6 fixes
• Update ModemManager

Kernel 6.6:

• Fix OMR-ByPass with XRay/V2Ray
• Fix MPTCP support detection
• Update OpenWRT
• Fixes on OMR-ByPass
• N100 support
• Add MPTCP Schedulers via BPF
• More fixes

VPS part:

• Shadowsocks-go update
• Optimization
• Many fixes

OpenMPTCProuter v0.61 will be available with both Linux kernel 6.6 and kernel 5.4

For more info: https://github.com/Ysurac/openmptcprouter/issues/3528

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:

• Update ModemManager

Kernel 6.6:

• Fix OMR-ByPass with XRay/V2Ray
• Fix MPTCP support detection
• More fixes

OpenMPTCProuter v0.61 will be available with both Linux kernel 6.6 and kernel 5.4

For more info: https://github.com/Ysurac/openmptcprouter/issues/3528

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:

• Fixes

Kernel 6.6:

• Update OpenWRT

OpenMPTCProuter v0.61 will be available with both Linux kernel 6.6 and kernel 5.4

For more info: https://github.com/Ysurac/openmptcprouter/issues/3528

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:

• Update Proxy and VPNs
• MPTCP over VPN fixes
• XRay/V2Ray port forward fix
• Many fix related to ModemManager usage
• IPv6 fixes

Kernel 6.6:

• Fixes on OMR-ByPass
• N100 support
• Add MPTCP Schedulers via BPF
• DSCP fixes

VPS part:

• Optimization
• Many fixes

OpenMPTCProuter v0.60 is available.

Stable version is based on Linux kernel 6.1 and legacy version use kernel 5.4

Changelog:

Common:'

• OpenVPN update
• Multiples backups of the router on VPS support
• Download/Upload speed test to VPS support
• VLESS, VMESS and Trojan protocols V2Ray and XRay support
• Shadowsocks-Rust support on router side and Shadowsocks-Go support on server side
• Automatic speedtest option to set download/upload speed for SQM and Glorytun UDP
• OMR-ByPass can be used without nDPI for services bypass
• OMR-ByPass can bypass via a VPN set on server side
• SQM-Autorate update
• GSO/GRO/TSO/LRO & UFO configuration for each network interface
• Many fixes
• All packets updated

Kernel 6.1 only:

• BBRv3 support (replace BBRv2)
• Patch V2Ray, OpenVPN and Glorytun TCP for MPTCP upstream support
• ARM64 is supported on VPS side
• MPTCPd support
• nftables is used instead of iptables
• ZBT z8102ax, Raspberry PI 5, QNAP 301w, RUTX50 support

Both server and router need to be updated

OpenMPTCProuter v0.60 will be available with both Linux kernel 6.1 and kernel 5.4

For more info: https://github.com/Ysurac/openmptcprouter/issues/2961

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:'

• Same as RC1
• Fixes on OMR-ByPass
• Fixes on vnstats and OMR-Quota (Thanks to bdaylik)
• Other fixes

OpenMPTCProuter v0.60 will be available with both Linux kernel 6.1 and kernel 5.4

For more info: https://github.com/Ysurac/openmptcprouter/issues/2961

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:'

• Same as Beta 2
• Some fixes

OpenMPTCProuter v0.60 will be available with both Linux kernel 6.1 and kernel 5.4

For install informations: https://github.com/Ysurac/openmptcprouter/issues/2961

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:'

• Same as Beta 1
• Better ModemManager support
• Many fixes
• All packets updated

Kernel 6.1 only:

• Same as beta1
• nftables is used instead of iptables
• ZBT z8102ax, Raspberry PI 5, QNAP 301w, RUTX50 support

OpenMPTCProuter v0.60 will be available with both Linux kernel 6.1 and kernel 5.4

For install informations: https://github.com/Ysurac/openmptcprouter/issues/2961

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:'

• OpenVPN update
• Multiples backups of the router on VPS support
• Download/Upload speed test to VPS support
• VLESS, VMESS and Trojan protocols V2Ray support
• Automatic speedtest option to set download/upload speed for SQM and Glorytun UDP
• OMR-ByPass can be used without nDPI for services bypass
• SQM-Autorate update
• GSO/GRO/TSO/LRO & UFO configuration for each network interface
• Many fixes
• All packets updated

Kernel 6.1 only:

• BBRv3 support (replace BBRv2)
• Patch V2Ray, OpenVPN and Glorytun TCP for MPTCP upstream support
• ARM64 is supported on VPS side
• MPTCPd support

Changes:

• OMR-ByPass fixes
• SIP ALG fixes and it's enabled by default like release <0.59
• Various small fixes

VPS script need to be updated to 0.1028

Changes:

• VPS script Debian 11 support
• MPTCP-next kernel support on app side (on kernel 5.15)
• Kernel 5.4 updated
• RUTX12 support
• MPTCP redundant fix on 5.4
• SIP ALG is disabled by default on VPS side and option available to enable it in router interface
• Fix multiple server failover
• Speed and duplex settings for each port
• With router using 5.15 kernel, VPS can be 5.4 or 5.15 script
• V2Ray can be used only for TCP (instead of TCP & UDP)
• Update ndpi-netfilter2
• Many fixes

VPS script need to be updated to 0.1027

v0.59 will be a bug fixes release still based on 5.4 Linux kernel.

Changes from previous RC:

• Bug fixes
• Translation update
• Fix on VPS script

I hope RC3 to be latest Release Candidate

Release based on 5.15 kernel is also available to test for all supported platforms.

To test: https://github.com/Ysurac/openmptcprouter/issues/2077

v0.59 will be a bug fixes release still based on 5.4 Linux kernel.

Changes from previous RC:

• ndpi-netfilter2 updated
• Setting to disable V2Ray UDP transport
• Fixes on v2ray with omr-bypass
• Fix additional WAN latency setting
• BBR2 available on Linux Kernel 5.15 based release
• Various bug fixes

Release based on 5.15 kernel is also available to test for all supported platforms.

To test: https://github.com/Ysurac/openmptcprouter/issues/2077

I also made a CDN change: instead of KeyCDN, Bunny CDN is used now.

v0.59 will be a bug fixes release still based on 5.4 Linux kernel.

Changes from previous beta:

• MPTCP out-of-tree updated
• Router part using 5.15 kernel can be used with both script using kernel 5.4 and 5.15
• Various bug fixes

Release based on 5.15 kernel is also available to test for all supported platforms.

To test: https://github.com/Ysurac/openmptcprouter/issues/2077

v0.59 will be a bug fixes release still based on 5.4 Linux kernel.

Changes from previous beta:

• MPTCP updated with a fix on redundant scheduler support
• Better BPI-R64 support
• OpenWrt and kernel updated
• Various bug fixes

Release based on 5.15 kernel is also available to test for all supported platforms.

To test: https://github.com/Ysurac/openmptcprouter/issues/2077