OpenMPTCProuter

OpenMPTCProuter v0.65 is available. This release is built only with the 6.18 kernel. It comes with VPS script v0.1097 (kernel 6.18.59).

Highlights:

• Kernel 6.18.59 on router and VPS, fixing CVE-2026-98432 (use-after-free when a SYN with IPv4 options reaches a listening TCP socket)
• New MPTCP BPF schedulers: ECF, BLEST and overflow. All BPF schedulers fixed, with IPv6 and backup subflow support
• MQVPN 0.19.0, with a path MTU setting, every path bound to a WAN and much faster failover
• Configurable return to the master server after a failover (immediate, delayed or manual)
• Balanced default routes use resilient nexthop groups
• Full bypass by source interface in omr-bypass
• Quota: new "block" action that keeps the WAN up, the last working WAN is never cut
• New LuCI app to set up High Availability with keepalived, and LuCI apps for XRay and V2Ray
• VPS API certificate pinning, many security fixes
• Automatic reserved ports and memory tuning on router and VPS
• Runtime state moved to /var/state: far fewer writes to flash

Router (openmptcprouter-feeds v0.64.2 to v0.65)

Kernel

• Kernel updated to 6.18.59, fixing CVE-2026-98432: a use-after-free when a SYN with IPv4 options (Record Route or Timestamp) reaches a listening TCP socket. It is not related to MPTCP

MPTCP and BPF schedulers

• New ECF, BLEST and overflow BPF schedulers (not installed on small targets)
• Fixed the first, rr, red, weight, weight-rr, dscp and bkup schedulers: retransmit like the default scheduler, keep backup subflows for when the others are down, don't use a backup when the active subflows are only full, read the stale flag through CO-RE (the schedulers failed to load on 6.18.55)
• weight, weight-rr and dscp schedulers handle IPv6 subflows; a DSCP class is pinned to every endpoint id of a WAN
• DSCP and weight schedulers no longer forced on the VPS; DSCP pins and weights kept in sync with the VPS
• A v0.9x BLEST or ECF setting is kept on its BPF port
• Each address of a WAN gets its own endpoint id; fixed endpoint id collisions that left a WAN red
• Never delete another WAN's endpoint, keep a WAN's endpoints when another interface shares its device, don't add back the endpoint of a WAN the tracker has down
• Device options set in LuCI applied; a reload only sets and commits what changed
• BPF scheduler unregistered on stop, kept registered on per-WAN cleanup
• mptcpd updated to 0.14 and provides mptcpize
• LuCI: show the scheduler the kernel actually uses, MPTCP Support Check page in the menu, WAN weight bounded to 1-256, an unset weight stays unset, absolute counters in multipath -m, trace to the master VPS

MQVPN

• Updated to 0.19.0 (was 0.16.x), xquic built with FEC, New Reno, Copa and unlimited congestion controls
• Every MQVPN path bound to a WAN: much faster failover when the primary WAN is loaded or lost (#4401)
• Path MTU setting, synced with the VPS; PMTU discovery on by default
• Reorder settings sent to the VPS; minrtt scheduler by default; every scheduler offered in the wizard
• Server key pinned instead of insecure TLS; config written 0600; no auth key shipped
• Routing left to OpenMPTCProuter; MQVPN moved to the server in use on failover
• Client status logged every 5 minutes, warnings only by default, path failures logged once
• Router tunnel IP sent again to the VPS when it changes (#4408)

omr-tracker (failover)

• Configurable return to the master server: immediate, delayed or manual (#3205)
• Balanced IPv4 default routes through resilient nexthop groups; balanced route rebuilt on a weight change (#4304), one tracker at a time, and no longer replaced by a single WAN when a WAN fails
• New "monitor only" mode per interface
• Servers shown on the status page, new rpcd omr-tracker object
• Fixed server failover: stay on the first backup server that answers, follow the server in use in OpenVPN bonding, keep the new server current while the VPNs restart, the proxy address can trigger a server switch
• WAN routes restored when the link comes back; gateway looked up again when it stops answering
• Glorytun UDP: master WAN path, IPv6 path, a WAN tracked with the glorytun-udp type can recover
• IPv6 checks can no longer hide an IPv4 failure; IPv4 and IPv6 routes of table 991337 tracked apart
• Up streak kept for a tracker restarted while down; modem not reset while tries_up holds the status
• Starts even when MPTCP is disabled
• Server alert scripts run on transitions only; VPS sync retries left to omr-schedule
• Fewer processes per tracking cycle: lower CPU load on small routers
• VPN and proxy LEDs follow the LED page
• LuCI: show the values the trackers run with and the flags taken from the defaults, tracking can be turned off, advanced settings kept on save

omr-bypass

• Full bypass by source interface, better failover support
• Database rebuilt from nDPI with wildcard hosts expanded; wildcard domain rules expanded again
• nDPId: detections DSCP-marked, TCP or UDP only rules go to that protocol's set, consumer reconnects when ndpisrvd restarts, hardened flow tracker
• Sets kept in step with the rules, only changes written, stale set elements deleted before fw4 reload, dnsmasq sets refilled after an fw4 restart
• Address family and TCP/UDP restriction honoured; each destination gets its own dnsmasq ipset
• Rule values validated before reaching a shell or nft; bypass domains validated
• "Disable AAAA IPv6 DNS" works again (#4342)
• Last RIPE answer for each AS kept on flash; ASN prefixes kept out of the firewall config
• DSCP-only rules no longer turned into bypass rules on upgrade
• Bypass rules reloaded by Shadowsocks when they are missing

omr-quota

• New "block" action that keeps the WAN up, and LAN block (forward also blocked)
• The last working WAN is never cut; a cut PPPoE or 3G WAN stays cut
• Daily budget sized to the calculation window; quota reset kept until the period ends; enforced usage never goes down within a period
• Real interface usage between vnstat entries, 5 s quota interval, vnstat month bucket counted only in its own month
• No live metering before a future begin date; settings validated

Proxies (Shadowsocks, XRay, V2Ray)

• XRay 26.10.29, V2Ray 5.54.2, Shadowsocks-Rust 1.25.0
• New LuCI apps for XRay and V2Ray; no-op saves no longer change inbounds or drop options
• VPS certificate pinning on every outbound: pins in hex or base64, only a certificate the VPS CA issued, re-issued certificate followed
• MPTCP set on the sockets on every kernel
• User outbounds, routing rules and error log kept on upgrade
• Restart loops fixed: no restart for rules the last start could not make, restart out of the caller's cgroup
• Public IPs of the VPS usable through the proxy; forward rules applied to proxied connections
• UDP redirected only to an ss-redir that takes it; iptables rules packages dropped
• Shadowsocks-Rust: identity keys in 2022 passwords, every cipher and any SIP002 link importable, DSCP on IPv6 MPTCP sockets, tun mode dropped
• Shadowsocks-libev: obfs options validated, existing servers kept on import, disabled servers marked
• Shadowsocks LuCI apps moved to a Proxy menu; configs readable by root only

VPNs

• OpenVPN 2.7.8; server certificate required from the peer; proto none on omrvpn; no restart on every config pull
• Glorytun UDP: changed tunnel addresses applied on reload, unchanged tunnel kept, persist and timeouts honoured, config kept over upgrade
• Glorytun TCP: instances added from LuCI start
• DSVPN: tunnel address kept on reload
• MLVPN runs under procd; loss tolerance from LuCI sent to the VPS
• SoftEther 5.2.5188: vpncmd arguments quoted, configs 0600, client account set up at start
• MPTCP over VPN keeps working on failover and when no server is in use; tunnels of a deleted WAN cleaned up
• VPNs check if MPTCP is disabled

VPS sync and API

• VPS API called with its certificate key pinned; request body sent on stdin; login url-encoded and key kept off the command line
• Shell injection fixed in the status and settings rpcd calls; write calls granted under the write ACL only
• VPS reached over IPv6; VPS URL built right for an IPv6 address
• Bypass IPs sent from the nft sets to each VPS, as JSON; DSCP sets sent too
• Only ACCEPT and DNAT redirects sent; only the WireGuard peers that point at that server
• Pi-hole: state asked to each server, used with MQVPN too, removed when the tunnel fails, hand-set DNS kept
• VPS backup checked before restoring; Backup page works again
• Failed VPS login logged once per outage; API errors reported in the log
• VXLAN, Pi-hole and pin pushes back off when they cannot make progress

Wizard and status page

• Country and DNS64 in effect shown and compared, pushed only when changed
• Wizard saves no longer rewrite WANs, retype sections or drop per-WAN options, proxies, VPNs or transports it does not list
• A new WAN takes the first free wanN; the VPN starts on the save that adds the first server; VPN and proxy stay off while no server is in use
• Force TTL on the right device; MPTCP not turned on for a LAN
• Debug config masks addresses, IPv6 beyond two groups and every secret; VPS hostname and phone number anonymized on the status page (#1289)
• Backup and restart calls run in the background
• "Disable server http test" removed

System and network

• Automatic reserved ports, network memory sizing (tcp_mem, udp_mem, conntrack) from RAM
• Runtime values moved to /var/state instead of /etc/config
• Local resolver used at boot until the tunnel is up, and put back when the server is disabled
• Unbound trusts the 2024 root KSK; a stale root trust anchor is updated from IANA (#4396)
• Remote syslog: syslog-ng logs sent to the remote log server, local logging kept, log size cap follows log_size
• IPv6 MTU probe ratchet fixed (#4373); IPv4 and IPv6 public IPs no longer shared (#4375)
• FTP helper assigned to what comes from the VPS; new rule to always permit ICMP to the router
• Kept over upgrades: firewall default policies, VPN zone, NTP servers and log levels, UPnP, unbound options, tunnel SQM queue, Shadowsocks redirectors
• ttyd off on upgrades too; package signatures checked again
• omr-schedule: proxy that keeps dying restarted with a back-off, dead sqm-autorate restarted, rpcd/ubus crash detection, latest versions checked hourly
• omr-dscp: forwarded traffic marked, fw4 reloaded only when the rules changed and never restarted
• omr-metrics: VPS decision model weights applied, API key pinned, no more API flooding, busy WANs sent
• sqm-autorate: congestion targets kept off flash, 10 s global ping timeout, configs written only on change
• nDPId 1.7.3, started with its generated config, every instance shown
• Macvlan: only orphaned devices deleted

LuCI

• luci-app-keepalived-ha: new app to simplify HA setup, sync key kept across sysupgrade, DHCP leases synced to backups, push to peers over pinned HTTPS only
• luci-app-sysupgrade: firmware checksum checked, versions compared by number, a flash that did not happen reported
• Synced with upstream: luci-app-firewall, luci-app-smartdns, luci-mod-dashboard, luci-mod-network, luci-proto-modemmanager, luci-proto-mbim
• luci-mod-network: wwan protocol view, duplex and offload flags kept, static leases accept only colon-separated MACs
• Many "a no-op save changes a field" fixes across apps; HTML escaping fixes (argon, openmptcprouter themes, network, sysupgrade)
• luci-app-iperf: download result shown, test runs on the server picked
• Missing translations added

Packages and build

• Updated: Go 1.27, Rust 1.99.0, libbpf 1.8.0, iperf3 3.22, msmtp 1.8.34 (GnuTLS), r8152 2.22.1, systemtap 5.6, bcm27xx-eeprom 2026-05-27
• shadowsocks-v2ray-plugin back to the shadowsocks upstream
• fast-classifier and shortcut-fe removed
• Only 6.18 images built; BPI R4 Pro 8x compiled
• Packages signed with the OMR apk key; package dependencies and conffiles fixed

VPS (openmptcprouter-vps v0.1081 to v0.1097)

• Kernel 6.18.59, fixing CVE-2026-98432 (fixed since v0.1092 with 6.18.57); 6.18.57 also fixed the x64v1/x64v2 kernels that did not boot without AVX2 (#4407)
• omr-admin 0.18+20261102: API in TLS 1.3 (TLS 1.2 with AEAD suites only), certificate pinning support, user suspension (OpenVPN revocation, SoftEther, MQVPN), conntrack flushed on a router's new tunnel address (#4408), GRE, WireGuard, XRay, VXLAN and firewall fixes, CVE-2026-102265 and CVE-2026-53539
• MQVPN 0.19.0 (per-client backlog isolation), V2Ray 5.54.2, iperf3 3.22, MPTCP BPF schedulers 1.5-1 with ECF, BLEST and overflow, DSCP and weight managers from their Debian packages
• Debian 13: OMR's MPTCP patched OpenVPN installed; apt pin limited to the packages OMR builds
• Reserved ports and automatic memory allocation (#4381, #4382)
• omr-bypass with nftables: bypassed traffic forwarded and masqueraded (#4384), run after every nftables start and reload, no failure with an empty list
• FTP through a port 21 redirect gets its conntrack helper back (#4365)
• Public IP announced only on MPTCP if available; GRE forward chain; IPv6 RA default route kept
• Pi-hole v6 support, web interface kept on the tunnels
• Security: omr-6in4-run and omr-vxlan-run read the user config as data, JSON configs rewritten with jq, hardened omr-admin.service and mqvpn-server.service, python3-uvicorn never 0.11.5 or 0.13
• UBOND and tracebox removed
• New omr-uninstall.sh to remove what the installer set up
• omr-update keeps a script-installed VPS on its own channel
• omr-service: lighter, leaves omr-admin time to start before restarting it
• Debian package built and published by GitHub Actions

OpenMPTCProuter v0.64.2 is available. This is a maintenance release for v0.64: no kernel update and no new major feature, but a large set of fixes on how interfaces enter and leave MPTCP, on OMR-Tracker, on port forwarding used together with OMR-ByPass, and a real reduction of CPU and log usage.

The server side moves from 0.1069 to 0.1081 and should be updated too: it restores IP forwarding lost during the migration from Shorewall to nftables, repairs the firewall resync and disables a fail2ban jail that could ban a router from its own VPS.

Highlights

• MPTCP interface handling: a WAN could stay stuck in backup, an interface down for OMR-Tracker could be put back into MPTCP, and DHCPv6 companion interfaces were treated as real WANs
• PPPoE WAN could stay down forever in OMR-Tracker (#4371)
• Port forwarding now works when OMR-ByPass is used (#4369)
• Firewall rules, zones and SNAT no longer lose the options left at their default value (#4365)
• Lower CPU usage at rest and limited log file size
• The status page no longer times out (#4360)
• MQVPN updated to 0.16.2, tunnel MTU fixed
• Server updated to 0.1081, with IP forwarding (#4363), firewall resync and fail2ban fixes

MPTCP and interfaces

• Fix a WAN staying permanently in backup: the interface page dropped a multipath value equal to the default, and the value previously saved by OpenMPTCProuter was applied again at every MPTCP start (#4368)
• Multipath information is no longer removed when saving an interface or the wizard
• An interface set down by OMR-Tracker is no longer added back as an MPTCP endpoint
• DHCPv6 companion interfaces (wan1_{6, wan2}6...) are no longer handled as real multipath interfaces, and multipath is disabled on them
• Better MPTCP path manager support on both sides: only the path managers advertised by the running kernel are used, and an old v0.95 name (fullmesh, ndiffports, binder) is mapped to the mainline kernel path manager instead of failing at every boot
• No more VPN or proxy restart when an MPTCP scheduler change is not actually applied
• MPTCP page: path manager list refreshed, subflow information now read through omr-sockdiag

OMR-Tracker

• Fix PPPoE interfaces staying down: the tracker kept the Ethernet device (eth3.835 for example) because pppd had not published the PPP device yet, and never resolved it again (#4371)
• Fix route replacement and the log line printed at every check when an interface is in balancing and another one in backup (#4358)
• New openmptcprouter.omr.server and openmptcprouter.omr.proxy state, and many values cached: trackers use much less CPU
• Fix the tracker init script

VPN and proxy

• Shadowsocks: fix load balancing between several servers
• Fix ss-local processes left running after a proxy change (#4357)
• The 192.168.1.3 placeholder server address is replaced by 127.0.0.1, so a proxy that is not configured yet can no longer send traffic to a LAN host
• MQVPN updated to 0.16.2: use-after-free fix on the server side, statistics and status available in client mode, default log level raised from error to warn
• MQVPN: a static MTU on the tunnel device overrode the MTU negotiated by MQVPN and could break traffic in one direction, it is now removed automatically
• Glorytun TCP: tunnel addresses are configured once the device exists, and the CPU affinity, multiqueue and sysctl tuning that could break the tunnel is removed

OMR-ByPass and firewall

• Port forwarding and bypass now work together: the reply packets of a connection opened from outside keep the path the connection came in on (#4369)
• Reloading the rules no longer keeps deleted entries in the nftables sets (#4353)
• Less warnings in the log
• LuCI firewall: rules, zones and SNAT keep the options set to a value equal to the default (#4365)
• A rule without target is no longer sent to the VPS, and a port opened with ACCEPT is no longer reopened on the server at every pass

Web interface

• Status page: global time budget on the checks and cached values in the API, the page does not time out anymore (#4360)
• Wizard: changing the server API key now forces the settings to be retrieved from the VPS
• Metrics page: new section for the omrvpn tunnel
• SQM page: new congestion synchronization settings

Metrics and SQM

• New optional integration between OMR-Metrics and SQM autorate: the congestion score of a WAN (queuing delay, loss, jitter, queue backlog, signal quality) tightens the bufferbloat threshold of cake-autorate for that WAN only.
• Metrics are now also collected for the omrvpn tunnel and displayed in the metrics page
• No VPS API call anymore when the server credentials are incomplete: a new router could otherwise fill the fail2ban jail of its own VPS and get banned from it

OMR-Quota

• A quota with a begin date counted the whole vnstat history instead of the traffic since that date
• The speed limit now applies to download too, and not only to upload
• Quota shaping takes the SQM shaper over properly instead of silently replacing it, and gives it back when the quota is cleared
• Various fixes in the daemon, the init script and the quota page

Performance, logs and first boot

• omr-schedule, omr-tracker, omr-metrics and the OpenMPTCProuter API cache more values and do less calls: CPU usage at rest is significantly lower
• Log file size is limited and the syslog default script is fixed
• sysctl: net.core.netdev_budgetusecs was refused by the kernel on HZ=100 devices, and BusyBox sysctl stops at the first error, so every setting after it in the file was silently ignored
• Default QoS, SQM, vnstat and quota configurations now follow the real interfaces on platforms where wan1, wan2... do not exist, and the network is not configured again when it already carries a multipath setting

Server (VPS 0.1069 to 0.1081)

• IP forwarding was lost during the migration from Shorewall to nftables, dropping all the traffic forwarded by the VPN; IPv6 masquerading for client addresses is restored too (#4363)
• The omr-admin firewall chains are repopulated after any start, restart or reload of nftables
• Fix the SIP ALG on fresh installs (#4361)
• XRay VLESS Reality can now be applied from the wizard, the server API refused that name
• fail2ban: the omradmin jail could ban a router being set up (a router without VPS key polls the API with an empty password), which showed up as "can ping server VPS, no server API answer". The filter now matches a real authentication failure logged by omr-admin, and the jail is disabled by default
• The MPTCP path manager sent by the router is mapped to a name the running kernel supports, and a wrong value already saved is repaired at start
• The VPS version reported to the router is read correctly, so the update message is no longer permanent or never shown
• MQVPN 0.16.2, users and keys preserved on update, new /mqvpn_users endpoint
• VXLAN: a VNI and port pair already used by another user is rejected, and the addresses derived from the user id are fixed for high user ids
• install_omr-ai.sh fixed with InfluxDB 3.10 and 3.11 (#4366)
• Install fixes: the VPS stayed unreachable over SSH after the port change until the next reboot, xray and mlvpn could end in failed state after a fresh install, the OMR kernel was not set as default GRUB entry, and boot could wait two minutes on systemd-networkd-wait-online (#4367)
• UFW and firewalld are force disabled at install so they cannot conflict with the nftables firewall

Updating the VPS to 0.1081 is recommended.

Highlights

• MQVPN, a new multipath QUIC-based VPN, is now included and is the default VPN
• New MPTCP schedulers: Weight, Weighted Round-Robin and DSCP - steer traffic per interface weight or pin traffic classes to a specific WAN
• VXLAN tunnel between router and VPS, in Layer 2 (bridged) or Layer 3 mode
• New monitoring: metrics with connection health score and quality trend graph, an Events page, and a plain-English MPTCP Diagnose tab
• Optional AI on the VPS: a machine-learning decision engine that scores each connection and recommends routing weights per traffic class
• nDPId deep packet inspection: bypass traffic by detected application/protocol or category
• Linux kernel 6.18 support and many new device images
• Most LuCI pages migrated from Lua to JavaScript

MQVPN (new default VPN)

• New QUIC-based VPN with native multipath support, set as default VPN
• Configurable IP and port, including a port 443 mode
• Packet reordering support (enabled by default) and congestion control selection
• Weighted Round-Robin path scheduler with per-path weights
• New Metrics tab in the MQVPN page showing live per-path data

MPTCP schedulers and traffic steering

• New Weight scheduler: give each interface a weight (up to 256), configurable in Network -> Interfaces and on the MPTCP page
• New Weighted Round-Robin and DSCP BPF schedulers: DSCP lets you pin a traffic class (e.g. video calls) to a chosen WAN
• New DSCP manager, with DSCP support added to Shadowsocks-Rust, OMR-ByPass and the VPS side
• Scheduler and weight/DSCP settings are synchronized between router and VPS; upload settings are mirrored to the download side when unset
• New Weight/DSCP configuration page for the VPS
• TCP VPN/proxy restarts automatically when the scheduler changes so the new scheduler applies immediately
• Existing BPF schedulers (burst, rr, red, first, bkup) updated

VXLAN

• VXLAN tunnel from router to VPS, selectable Layer 2 (bridge) or Layer 3 mode
• Layer 2 mode can bridge into any interface you choose
• Can be enabled/disabled from the settings page

Monitoring and diagnostics

• New omr-metrics service: connection health status, per-subflow MPTCP metrics, quality trend graph, metrics sent to the VPS, optional custom/dedicated metrics server, and optional AI API integration for analysis
• New Events page (luci-app-omr-events) to follow what happens on the router
• New Diagnose tab on the MPTCP page: fallback/blackhole/reset detection explained in plain English, plus a per-subflow table
• Status page improvements: CPU temperature, currently active VPN and proxy, ASN/whois information for the VPS IP, direct output box, only Multipath-enabled interfaces shown, fixed 5G NSA display, fixed temperature display, dedicated ACL for the status page
• Faster and more reliable connection data collection

AI on the VPS (optional)

• New optional AI decision engine on the VPS, installed with a single script (install_omr-ai.sh) - nothing is installed unless you choose to
• Router metrics are stored in InfluxDB 3 on the VPS (60-day retention by default)
• A neural network (PyTorch) scores every WAN from 21 quality features (latency, loss, jitter, congestion, trends...) and recommends a routing weight per interface
• Can predict short-term link quality and recommend the best WAN per DSCP traffic class (voice, video, bulk...)
• Auto-learning: the model keeps training itself in the background from the link quality it actually observes

OMR-ByPass

• Deep packet inspection via nDPId with a new LuCI app: bypass by detected protocol/application and by category
• Per-rule TCP/UDP protocol choice for domains and IPs, better UDP support, V2Ray/XRay supported when UDP is disabled
• Much faster boot and rule reloading (batched UCI writes, hashing, caching), fixed nftables MARK rules
• Configurable rules reload time
• DSCP marking support

OMR-Tracker (connection monitoring)

• Congestion detection: link quality score can flag a congested interface
• Jitter and min/max RTT measurement
• Custom check IP and latency host usable when no VPS is defined
• Configurable post-tracking interval delay
• Reduced CPU usage, better gateway management, and many stability fixes (duplicate trackers, orphaned lock files, endless loops)
• An interface is no longer promoted back to master before its "up" counter is really satisfied

Wizard and web interface

• New wizard and status page
• LuCI apps migrated from Lua to JavaScript: OpenMPTCProuter (wizard, status, settings), MPTCP, OMR-Quota, OMR-DSCP
• More help texts in OMR-Tracker and OMR-ByPass pages, updated translations (French, Russian, Chinese...)
• New qdisc and weight settings in Network -> Interfaces, custom DHCP gateway support restored

OMR-Quota

• Global quota across interfaces
• Bandwidth throttling when quota is reached
• Configurable billing period (begin/end dates)
• Interface picker in the quota page

VPN and proxy

• OpenVPN updated to 2.7 (kernel DCO module on 6.18, no-delay option, passtos enabled)
• XRay updated: VLESS flow and decryption support, GRPC and XHTTP transports, protocol choice in wizard, fixed several start/firewall race conditions
• V2Ray/XRay: fixed restart loop when the server side is disabled
• Shadowsocks-Rust updated: shorter timeouts, DSCP support, crash fix, rules only applied when a password is set
• Glorytun UDP fixes (secondary WAN handling, port, optimizations applied only when enabled)
• VPN/proxy keys (Glorytun, DSVPN) now stored in volatile /var/run instead of flash
• Only the selected VPN/proxy is kept enabled; VPN restart checks prevent duplicated restarts

Hardware and system

• New device images: GL.iNet GL-MT2500 (Airoha), GL-X3000, GL-XE3000, GL-MT5000, Turris Omnia, NanoPi R3S, Z8802, Z8802BE, Z8803BE
• Fixed network configuration on GL-MT2500 (#4293), fixed mt7915e conflict, WED hardware offload enabled on MT7915 WiFi
• Linux kernel 6.18 support (MPTCP settings, kmod-ovpn, CI builds)
• Performance: irqbalance enabled on 4+ core CPUs (with LuCI app), automatic RPS/XPS setup, LRO/TSO/UFO disabled on multipath interfaces, updated sysctl tuning
• bpftune auto-tuning available on x86 (disabled by default) with a LuCI page
• Modems: SIM PIN handling fixed, automatic operator switch when connected without traffic, faster ModemManager startup, more signal information via omr-qmi/omr-modemmanager
• DNS hijacking detection (alerts when the ISP intercepts DNS queries)
• SQM autorate: multiqueue support and fixes
• QUIC is no longer blocked by default (was previously blocked to force traffic onto TCP/MPTCP)

VPS update is required

Changelog:

• Update to kernel 6.12
• Update OpenWRT
• Update BPF schedulers
• Update XRay, Shadowsocks-Rust, ModemManager,...
• Update OMR-ByPass database
• Add countries support in OMR-Tracker
• Many fixes

Changelog:

• Add ZBT z8109ax support
• Add glinet mt2500, mt3000 & mt6000 support
• Add smartdns support
• Add BPI-R4/R3 support
• Add omr-iperf-proxy and omr-iperf-vpn to speed between router and VPS using proxy and VPN
• Update rust, xray, OpenVPN,...
• Lot of fixes on IPv6, proxy, tracker,...

OpenMPTCProuter v0.62 will be available only with Linux kernel 6.6

For more info: https://github.com/Ysurac/openmptcprouter/issues/3828

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

• Add ZBT z8109ax support
• Add glinet mt2500, mt3000 & mt6000 support
• Add smartdns support
• Add BPI-R4/R3 support
• Add omr-iperf-proxy and omr-iperf-vpn to speed between router and VPS using proxy and VPN
• Update rust, xray, OpenVPN,...
• Lot of fixes on IPv6, proxy, tracker,...

OpenMPTCProuter v0.61 is available with kernel 6.6 and kernel 5.4.

Changelog:

Common:

• Update Proxy and VPNs
• MPTCP over VPN fixes
• XRay/V2Ray port forward fix
• Many fix related to ModemManager usage
• IPv6 fixes
• Update ModemManager

Kernel 6.6:

• Fix OMR-ByPass with XRay/V2Ray
• Fix MPTCP support detection
• Update OpenWRT
• Fixes on OMR-ByPass
• N100 support
• Add MPTCP Schedulers via BPF
• More fixes

VPS part:

• Shadowsocks-go update
• Optimization
• Many fixes

OpenMPTCProuter v0.61 will be available with both Linux kernel 6.6 and kernel 5.4

For more info: https://github.com/Ysurac/openmptcprouter/issues/3528

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:

• Update ModemManager

Kernel 6.6:

• Fix OMR-ByPass with XRay/V2Ray
• Fix MPTCP support detection
• More fixes

OpenMPTCProuter v0.61 will be available with both Linux kernel 6.6 and kernel 5.4

For more info: https://github.com/Ysurac/openmptcprouter/issues/3528

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:

• Fixes

Kernel 6.6:

• Update OpenWRT

OpenMPTCProuter v0.61 will be available with both Linux kernel 6.6 and kernel 5.4

For more info: https://github.com/Ysurac/openmptcprouter/issues/3528

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:

• Update Proxy and VPNs
• MPTCP over VPN fixes
• XRay/V2Ray port forward fix
• Many fix related to ModemManager usage
• IPv6 fixes

Kernel 6.6:

• Fixes on OMR-ByPass
• N100 support
• Add MPTCP Schedulers via BPF
• DSCP fixes

VPS part:

• Optimization
• Many fixes

OpenMPTCProuter v0.60 is available.

Stable version is based on Linux kernel 6.1 and legacy version use kernel 5.4

Changelog:

Common:'

• OpenVPN update
• Multiples backups of the router on VPS support
• Download/Upload speed test to VPS support
• VLESS, VMESS and Trojan protocols V2Ray and XRay support
• Shadowsocks-Rust support on router side and Shadowsocks-Go support on server side
• Automatic speedtest option to set download/upload speed for SQM and Glorytun UDP
• OMR-ByPass can be used without nDPI for services bypass
• OMR-ByPass can bypass via a VPN set on server side
• SQM-Autorate update
• GSO/GRO/TSO/LRO & UFO configuration for each network interface
• Many fixes
• All packets updated

Kernel 6.1 only:

• BBRv3 support (replace BBRv2)
• Patch V2Ray, OpenVPN and Glorytun TCP for MPTCP upstream support
• ARM64 is supported on VPS side
• MPTCPd support
• nftables is used instead of iptables
• ZBT z8102ax, Raspberry PI 5, QNAP 301w, RUTX50 support

Both server and router need to be updated

OpenMPTCProuter v0.60 will be available with both Linux kernel 6.1 and kernel 5.4

For more info: https://github.com/Ysurac/openmptcprouter/issues/2961

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:'

• Same as RC1
• Fixes on OMR-ByPass
• Fixes on vnstats and OMR-Quota (Thanks to bdaylik)
• Other fixes

OpenMPTCProuter v0.60 will be available with both Linux kernel 6.1 and kernel 5.4

For more info: https://github.com/Ysurac/openmptcprouter/issues/2961

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:'

• Same as Beta 2
• Some fixes

OpenMPTCProuter v0.60 will be available with both Linux kernel 6.1 and kernel 5.4

For install informations: https://github.com/Ysurac/openmptcprouter/issues/2961

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:'

• Same as Beta 1
• Better ModemManager support
• Many fixes
• All packets updated

Kernel 6.1 only:

• Same as beta1
• nftables is used instead of iptables
• ZBT z8102ax, Raspberry PI 5, QNAP 301w, RUTX50 support

OpenMPTCProuter v0.60 will be available with both Linux kernel 6.1 and kernel 5.4

For install informations: https://github.com/Ysurac/openmptcprouter/issues/2961

Test and report new issues https://github.com/Ysurac/openmptcprouter/issues/

Changelog:

Common:'

• OpenVPN update
• Multiples backups of the router on VPS support
• Download/Upload speed test to VPS support
• VLESS, VMESS and Trojan protocols V2Ray support
• Automatic speedtest option to set download/upload speed for SQM and Glorytun UDP
• OMR-ByPass can be used without nDPI for services bypass
• SQM-Autorate update
• GSO/GRO/TSO/LRO & UFO configuration for each network interface
• Many fixes
• All packets updated

Kernel 6.1 only:

• BBRv3 support (replace BBRv2)
• Patch V2Ray, OpenVPN and Glorytun TCP for MPTCP upstream support
• ARM64 is supported on VPS side
• MPTCPd support

Changes:

• OMR-ByPass fixes
• SIP ALG fixes and it's enabled by default like release <0.59
• Various small fixes

VPS script need to be updated to 0.1028

Changes:

• VPS script Debian 11 support
• MPTCP-next kernel support on app side (on kernel 5.15)
• Kernel 5.4 updated
• RUTX12 support
• MPTCP redundant fix on 5.4
• SIP ALG is disabled by default on VPS side and option available to enable it in router interface
• Fix multiple server failover
• Speed and duplex settings for each port
• With router using 5.15 kernel, VPS can be 5.4 or 5.15 script
• V2Ray can be used only for TCP (instead of TCP & UDP)
• Update ndpi-netfilter2
• Many fixes

VPS script need to be updated to 0.1027

v0.59 will be a bug fixes release still based on 5.4 Linux kernel.

Changes from previous RC:

• Bug fixes
• Translation update
• Fix on VPS script

I hope RC3 to be latest Release Candidate

Release based on 5.15 kernel is also available to test for all supported platforms.

To test: https://github.com/Ysurac/openmptcprouter/issues/2077

v0.59 will be a bug fixes release still based on 5.4 Linux kernel.

Changes from previous RC:

• ndpi-netfilter2 updated
• Setting to disable V2Ray UDP transport
• Fixes on v2ray with omr-bypass
• Fix additional WAN latency setting
• BBR2 available on Linux Kernel 5.15 based release
• Various bug fixes

Release based on 5.15 kernel is also available to test for all supported platforms.

To test: https://github.com/Ysurac/openmptcprouter/issues/2077

I also made a CDN change: instead of KeyCDN, Bunny CDN is used now.

v0.59 will be a bug fixes release still based on 5.4 Linux kernel.

Changes from previous beta:

• MPTCP out-of-tree updated
• Router part using 5.15 kernel can be used with both script using kernel 5.4 and 5.15
• Various bug fixes

Release based on 5.15 kernel is also available to test for all supported platforms.

To test: https://github.com/Ysurac/openmptcprouter/issues/2077