NDMS updates — Dev Channel

The following improvements have been applied to the Web Interface.

Changed the NXDOMAIN DNS response to NOERROR when querying AAAA records for A-only entries, in accordance with RFC 6147. [NDM-3857]

The OpenSSL library has been updated to version 3.0.18. [NDM-4083]

Changed the packet dump file extension from .pcapng to .pcap in the Packet Capture system component. [NDM-4091]

Implemented safeguards to prevent routing loops when a remote peer sends an invalid IPCP configuration. [NDM-4093]

Devices with weak administrator passwords no longer allow public access to the Web Interface. [NDM-4097]

The following fixes have been applied to the Web Interface.

Fixed the Wi-Fi button so it correctly turns Guest network access points off and back on in certain scenarios. [NDM-4054]

Resolved an issue where KeenDNS names failed to resolve for VPN clients. [NDM-4095] [Forum topic]

Resolved an issue where the auto argument was parsed incorrectly in DNS-Based Routes configuration. [NDM-4096]

Fixed an issue where adding FQDN object group exclusions generated an IPset kernel error in the System Log. [NDM-4101] [Forum topic]

Implemented a CLI option to override the DNS server for clients of the built-in VPN servers. [NDM-4032]

Added support for including IP subnets in the Domain Name Lists, using the object-group fqdn include command in the CLI or via the DNS-Based Routes tab on the Routing page. [NDM-4078]

Command example: object-group fqdn TEST include 10.0.0.1/24

Adjusted the intensity of recurring name resolutions for the currently unclaimed names in the FQDN Object group (object-group fqdn). [NDM-4082] [Forum topic]

Enabled external access to the IPv6 addresses of backup WAN connections. [NDM-4067] [Forum topic]

Fixed an issue that caused multiple Dns::Route::ResolveQueue messages to appear in the System Log when using FQDN object groups with many entries. [NDM-4086] [Forum topic]

The following fixes have been applied to the Web Interface.

Resolved an issue with L2TP traffic handling when the L2TP/IPsec VPN Server application is enabled. [NDM-4068] [Forum topic]

Resolved an issue with forwarding servfail.invalid DNS queries to upstream DNS servers. [NDM-4069] [Forum topic]

Fixed an issue that could cause the system to crash when connecting clients using Wi-Fi OWE (Opportunistic Wireless Encryption) authentication. [SYS-1461]

Fixed an issue on the Routing page that prevented disabling individual static route entries without affecting others. [NDM-4076] [Forum topic]

Implemented a new Enable IPv6 checkbox and an IPv6 configuration section for Home and additional local network segments, providing advanced control over IPv6 parameters and allowing IPv6 to be disabled per segment. [NWI-4373]

Introduced a new design for the Internet card on the System Dashboard page, featuring an updated layout and buttons to manage the display of connection statistics and traffic chart blocks. [NWI-4377]

The following improvements have been applied to the Web Interface.

Added Basic authentication support for the OpenConnect VPN client via the command line interface (CLI). [NDM-4037]

The following fixes have been applied to the Web Interface.

Resolved an issue where the DNS proxy service could enter a busy loop when processing malformed DNS responses, improving stability and performance. [NDM-4034] [Forum topic]

Fixed an issue with the Exclusive Route option in DNS-based Routes. [NDM-4046] [Forum topic]

Fixed inbound Web Interface access via IPv6 on interfaces configured with the private or protected security level. [NDM-4061] [Forum topic]

Fixed the display of remote IP addresses and ports for clients in the WireGuard VPN Server Statistics popup window. [NDM-4064] [Forum topic]

Further improvements to the Mesh Wi-Fi System allow an Extender’s built-in 4G/3G modem to be used as the primary or a backup Internet connection. When a compatible Extender is detected, the Controller automatically creates a dedicated MwsMobile interface and manages the connection like any other, including its use in Connection Policies. SMS and USSD modem options are available directly in the Extender’s Web Interface, which can be opened via a link on the Controller’s Wi-Fi System page. [NDM-4027]

The Port Forwarding page now supports IPv6 Pinholing, letting you open TCP and UDP ports to provide external access from the Internet to devices on your home network that use IPv6 addresses. [NWI-4213]

Added support for the Virtual Router Redundancy Protocol (VRRP) v2 and v3, configurable via the command line interface (CLI). This enables redundant routing across multiple routers. To use it, install the VRRP support system component. [SYS-1443]

The following fixes have been applied to the Web Interface.

Fixed an issue where the identity-local parameter was reset when reconfiguring the IPsec VPN Server. [NDM-4036] [Forum topic]

The new DNS-Based Routes tab on the Static Routes page allows creating custom routing rules via a specified connection or gateway for user-defined lists of domain names and IP addresses. [NWI-4186]

The Diagnostics page now includes an iPerf utility in the Network Connection Test section, enabling bandwidth and performance testing directly from the web interface. To use it, install the iPerf3 system component on your device. [NWI-4371]

Improved the DNS Configuration tab on the Internet Safety page to provide a more convenient layout on mobile devices. [NWI-4375] [Forum topic]

Added support for specifying IP sub-networks with the object-group fqdn exclude CLI command. [NDM-4013] [Forum topic]

Command example: object-group fqdn TEST exclude ::/0

The OS Kernel has been patched to resolve the following CVE security vulnerabilities:

Fixed an issue where the SSH server was not accessible from the Internet over IPv6 in certain conditions. [NDM-4010]

Added the Average speed information to the Traffic Monitor page. [NWI-4212] [Forum topic]

Added the date and time to the filenames of downloaded firmware and startup-config configuration files. [NDM-3999] [Forum topic]

Added an option to exclude sub-domain names for Object Groups via the command line interface (CLI). [NDM-4001] [Forum topic]

The following fixes have been applied to the Web Interface.

Fixed an error causing the ResolveQueue: system failed [0xcffd0046] records to appear in the System log when using the Public DNS resolvers option for content filtering. [NDM-4002] [Forum topic]

Implemented Origin header enforcement for the CrazeDNS Web application proxies. [NDM-3988]

Fixed the End User License Agreement title spacing in the Web Interface. [NWI-4344] [Forum topic]

Fixed a regression introduced with the new manager user role that prevented seamless access to Wi-Fi System Extenders via HTTPS token. [NDM-3981] [Forum topic]

The Internet Safety page now features an Application Filter tab with controls to block traffic from specific applications and categories for individual clients or entire network segments. To use this feature, you must install the Traffic classification engine system component and enable the Application Classification option on the IntelliQoS page. [NWI-4232]

The new WireGuard VPN Server application makes it easier to set up various remote connection scenarios. It enables quick installation on client devices, providing secure access to any part of your network. [NWI-4206]

Implemented UPnP IGDv2 PCP support for the IPv6 protocol. [NDM-3859]

Added a new Manager user role featuring limited administrative rights for ISP deployment scenarios. [NDM-3945]

The following improvements have been applied to the Web Interface.

The following fixes have been applied to the Web Interface.

Fixed configuration issues of the iperf3 system component. [NDM-3972] [Forum topic]