Release Notes (For Branch Series)¶
This release notes page covers RansNet branch series products (HSA, UA, XE, UAP).
20261022-2200¶
Major Changes¶
- Remote SSH through mFusion — one-click CLI access from mFusion to branch routers, including routers behind NAT or CGNAT, with no port forwarding or local firewall rules on the router.
New Features¶
Remote SSH
From a host in mFusion, Remote SSH opens the router's CLI in a browser terminal, logged in as the support account. The router builds a temporary reverse tunnel to mFusion with one-time keys that are destroyed when the session ends. Sessions close after 15 minutes without activity, with a 4-hour maximum, and the router stops retrying once mFusion closes the session. Branch routers have no web GUI, so Remote Web is not offered. See Common Tools — Remote SSH and Remote Web.
Enhancements¶
| Area | Change |
|---|---|
| TCP Acceleration | No longer slows down slow high-latency links (e.g. low-speed VSAT): the client measures the link and sizes its buffers to it, and steps aside when acceleration cannot help. New tcp-accelerate client ... bandwidth <down> <up> option declares the link speed; show tcp-accelerate adds a Link estimate line. See TCP Acceleration. |
| TCP Acceleration on XE-300 | The engine was rewritten for low-end routers: on the XE-300 it uses about 1–3 MB of RAM (was 11–50 MB) and accelerated downloads are faster (10.4 vs 8.0 Mbit/s) at half the CPU. Binary size is 140 KB on XE-300 and 465 KB on HSA/UA/UAP. |
| Default Firewall | Default input rules tidied: loopback traffic is accepted first; DHCP and IPsec IKE/NAT-T are separate rules; UDP 547 (DHCPv6) is no longer opened; a duplicate TCP MSS clamp is removed. Fixed SSH and OSPF permits that were part of the defaults are removed — configure them with firewall-input where needed. |
Bug Fixes¶
| Area | Fix |
|---|---|
| WWAN APN | Restore the apn <name> [backup <name2>] command under WWAN interfaces, which was missing since 20260724 (mFusion APN pushes failed). New no apn removes the APN. Fix the backup SIM's APN being saved empty, so a failover to that SIM came up without an APN; removing the APN now clears all primary and backup values. |
| Firewall Objects | Fix object groups with several FQDN or app entries keeping only the last entry's IP addresses after the periodic refresh, so rules using them missed most destinations. Shared IPs stay while any entry still uses them, and a set that lost entries is repaired on the next refresh. |
| Support Account | Fix console login as support failing with "Permission denied" (introduced in 20261007-2000). Routers are also repaired automatically on boot. |
20261007-2000¶
Major Changes¶
- Unified tracking engine — interface, VRRP, IPsec peer, SSL VPN client, DHCP and hotspot tracking now all use the same
track icmp/track tcp/track routeoptions, and act only after two consecutive failed checks, so a single lost probe no longer triggers a failover. The default ping count is now 3. See Tracking. - Automatic TCP MSS / MTU self-heal for overlays — IPsec (VTI and policy-based), WireGuard, VXLAN and GRE tunnels now detect the path MTU and correct interface MTU and TCP MSS clamping automatically, VRF-aware. Kernel TCP MTU probing (RFC 4821) is also enabled to recover from MTU black holes. This fixes stalled uploads and hanging connections over cellular, PPPoE and nested tunnels without manual MTU tuning.
New Features¶
Full Mesh SD-WAN
Branch routers can join a WireGuard full-mesh VPN orchestrated by mFusion, building direct tunnels to every other site. Supports Static and Dynamic (on-demand) modes, and a choice of endpoint IP the router advertises (Auto Public IP, Auto Private IP or Static IP). New show wg mesh command lists active, pending and dormant peers. See Full Mesh SD-WAN.
TCP Acceleration
New tcp-accelerate command speeds up TCP applications over high-latency links (satellite, long-haul, congested cellular) by splitting each TCP connection at the routers. See TCP Acceleration.
SIM Failover by SINR, and Manual SIM Failover
- WWAN tracking adds
track sinralongsidetrack rsrq— SINR is the better trigger on 5G NR links, and both can run together. See Tracking — SIM Failover by Signal Strength. - New
debug wwan wwan0 failover(orwwan1) forces an immediate SIM slot switch and modem restart, using the same mechanism as automatic tracking-based failover. Also available as a Force SIM Failover button in mFusion.
Other New Commands
| Command | Description |
|---|---|
test aaa |
Send a test RADIUS authentication request to verify AAA server settings |
timezone |
Set the system timezone from the CLI |
test throughput ... length <bytes> |
Set the write buffer size for throughput tests |
ip pbr policy ... src <interface> |
Use an interface name as the PBR source; its IP is tracked live |
| Firewall commands per VRF | firewall-set/input/access/snat/dnat/limit and their show commands now apply to the correct VRF |
Enhancements¶
| Area | Change |
|---|---|
| Performance | Lower background CPU use, most noticeable on the single-core XE-300: monitoring collectors now run one after another at low priority from a single scheduler; the tracking daemon uses far less CPU; and the poll for queued mFusion CLI jobs runs every 20 s instead of 10 s (queued jobs now start within 20 s). |
| Monitoring | Router monitoring data is now sent as structured JSON for much faster processing in mFusion (interfaces, SLA links, DHCP leases, Wi-Fi APs and clients, WWAN signal). Wi-Fi client counts are now calculated from the actual client table, and SLA monitoring can use the default gateway when no target is set. |
| Wireless | Adaptive radio management on standalone APs now selects channel bandwidth dynamically, and reports an optimization summary. |
| IPsec | strongSwan retransmit schedule tuned for faster dead-peer detection; MOBIKE disabled; connections are torn down gracefully before stop; watchdog recovers an unresponsive IPsec control daemon. |
| WireGuard | Status output reformatted to match IPsec, with listening ports and protocol shown in the header; no forms added for peer, mesh and interface commands so mFusion can sync removals. |
| Firewall | show firewall dnat-list all now lists nested NAT chains. |
| Routing | Routes over interfaces with link down are excluded from forwarding; FRR ECMP nexthop recovery workaround; BGP adds neighbor ... filter-list. |
Bug Fixes¶
| Area | Fix |
|---|---|
| Firmware Upgrade | Fix XE-300 firmware upgrade failing. |
| XE-300 Boot Settings | Fix IP forwarding, ECN, MTU probing and TCP buffer settings not being applied at boot on XE-300 — an unsupported setting earlier in the list stopped the rest from loading. |
| VXLAN / WireGuard | Fix LAN uploads stalling over VXLAN-over-WireGuard; fix download blackhole on cellular/PPPoE branches; fix WireGuard remote networks being stored twice; fix mesh peer state lost after reboot. |
| IPsec | Fix VTI endpoint staying stale after a WAN failover; fix IPsec restarting every 10–16 s for responder-only peers; fix leftover XFRM state, routing rules and TCP MSS clamps after a peer is removed. |
| SIM Failover | Fix RSRQ tracking triggering SIM failover regardless of actual signal quality; persistent unreadable RSRQ now counts as a failure; manual SIM failover no longer silently does nothing on hardware without SIM-slot GPIO. |
| DHCP / VRF | Fix manual DHCP client never configuring the interface (plain and VRF); fix DHCP under VRF; fix no interface <if> vrf <id> leaving the device stuck in the VRF; fix interface enable not restoring the DHCP default route. |
| Tracking | Fix stray tracking daemons that were never stopped; fix route tracking failover/recovery state; fix BGP network tracking getting stuck on stale state; fix hotspot tracking using a stale flag instead of the actual hotspot state; fix false config-rollback reboots after mFusion config pushes. |
| Security | Mesh VPN files and keys hardened (owner-only permissions, symlink-safe temp files, validated peer fields); the support account's console login can no longer drop to a shell if the CLI exits or fails to start; the ssh CLI command is hardened against option injection; the telnet CLI command is removed (a full telnet client can open a local shell). |
| QoS | Fix no class rejecting class removals pushed from mFusion as an illegal command, which left the old class in place and failed the whole config push. |
| TCP Acceleration | Fix overlapping configuration changes on a shared TCP Acceleration server interfering with each other. |
20260724-2100¶
New Features¶
5G/LTE Network Scan and Provider Selection
New nr-network interface commands allow scanning available mobile networks and selecting a preferred provider directly from the CLI. The selected provider is saved to startup-config, restored automatically on boot, and displayed in show interface. The implementation is model-aware (HSA-520 and XE-300 use different modem access paths) and supports both Quectel and Fibocom modems. Note: the wwan interface must be disabled before running a scan, as the modem serial port is single-access.
Air Quality Sensor Support — MQTT / IoT Monitoring
MQTT sensor monitoring now routes each sensor type to its own discovery rule, making new sensor types plug-in additions. A new air quality sensor type (smoke/MQ2, PM2.5, CO2) joins the existing smart-plug and environmental sensor types. MQTT listener startup reliability is also improved.
TWAMP Support
Two-Way Active Measurement Protocol (TWAMP) support with CLI configuration, enabling standards-based round-trip latency and SLA measurement against third-party equipment.
Adaptive Radio Management for Standalone APs
Distributed adaptive radio management brings automatic channel, bandwidth, and transmit power tuning to standalone (non-mesh) access points. Pairs with the mFusion Mass WiFi Optimization action for fleet-wide tuning.
Enhancements¶
| Area | Change |
|---|---|
| Cellular (Multi-SIM) | SIM failover speed improved; modem recovery now uses GPIO restart when the module becomes undetectable; crash-detection timing tuned to prevent false module restarts. |
| Cellular (Connection Manager) | Redundant DHCPv4/DHCPv6 sub-interface creation removed; connection manager process is cleaned up when a wwan interface is deleted; general connection management optimisations. |
| WWAN Display | show interface wwan now shows the currently connected band; network information display simplified. |
| IPsec | Configuration changes now restart only the affected tunnels instead of all tunnels. |
| Monitoring | SD-WAN monitoring items added for mFusion; DHCP status report enhanced with client and lease details; ARP and WiFi report formats updated. |
| CLI Cleanup | Deprecated interface commands removed (phase 1). |
Bug Fixes¶
| Area | Fix |
|---|---|
| Startup Config | Fix startup-config becoming empty after power cycle — configuration writes are now synced to flash before completion. |
| Cellular Routing | Fix duplicate default routes after cellular reconnection — routes are flushed before re-adding with the configured metric. |
| IPsec | Fix duplicate CHILD_SAs created on configuration changes and infinite restart loops; fix status display for multi-subnet configurations; fix peer tracking. |
| Secrets | BGP passwords and IPsec pre-shared keys now preserve special characters (e.g. $). |
| Monitoring Scripts | Fix output redirection in system, DHCP, interface, and SD-WAN monitoring scripts. |
| Fibocom Modems | Fix multiline parsing of cell information (GTCCINFO) responses. |
20260512-1200¶
Major Changes¶
- Device monitoring is revamped. Use Template_Branch for base monitoring items (replacing older Template_HSA). If needed, download the latest Template_Branch to import into your private mfusion.
- XE-300 default IP assignment behavior changed — previously WAN is vlan1 and LAN is vlan2, now WAN is vlan2 (port WAN/LAN1) and LAN is vlan1 (port LAN2, LAN3, LAN4). Default config is also changed, eg.
!
hostname XE
!
interface eth0
enable
!
interface wwan0
enable
route-metric 2
!
interface vlan 0 2
description WAN
enable
route-metric 0
ip address dhcp
!
interface vlan 0 1
description LAN
enable
ip address 192.168.8.1/22
dhcp-server
router 192.168.8.1
dns 8.8.8.8 8.8.4.4
range 192.168.8.2 192.168.11.254
enable
!
firewall-input 100 permit all tcp src 192.168.8.0/22 dport 22 remark "SSH from LAN"
!
firewall-access 100 permit outbound vlan2
firewall-access 101 permit outbound wwan0
!
firewall-snat 100 overload outbound vlan2
firewall-snat 101 overload outbound wwan0
!
Bug Fixes & Platform Improvements¶
| Area | Fix |
|---|---|
| HSA-520 DTS | Updated device tree with corrected peripheral definitions and enhanced clock/reset handling for improved stability |
| XE-300 Image Build | Kernel updated with full namespace support (required for VRF, network isolation, and container deployments) |
| XE-300 Kernel | Kernel 4.4.60 now includes full IPsec VRF support patches; validated against Fibocom QMI driver and USB serial ports |
| XE-300 LED | Fixed LAN3 and LAN4 LED status on MT7628 SoC (device tree updates) |
| Modem Support | Unified QMI driver image combining Quectel and Fibocom firmware support in single binary; USB serial port drivers added for Meig and Fibocom modem variants |
| Package Permissions | Fixed missing execute bits on OpenWrt init scripts, CGI binaries, and tools due to NTFS copy issues during build |
| net-snmp Build | Restored mibII/var_route module; fixed undefined var_ipRouteEntry symbol on musl builds |
| FRR (Free Range Routing) | Added kernel-level patches required for BGP/OSPF/route-map integration; improved routing performance |
| Build System | Documented execute-bit restoration workflow and nl80211_copy.h pre-seed step for full rebuild consistency |
20260420-0050¶
New Features¶
DNS Filtering
New dns-group and dns-filter CLI commands provide domain-based DNS filtering with blacklist and whitelist modes. Domain entries automatically cover all subdomains (wildcard matching); more specific entries take precedence over broader ones. Named groups (dns-group) allow bulk domain management — add or remove domains from a group without modifying filter rules.
dns-group adult-sites
domain playboy.com
!
dns-filter 100 deny group adult-sites
dns-filter 200 permit all
See DNS Filtering for full configuration details.
EasyMesh Multi-Fronthaul Support
EasyMesh controller now supports multiple fronthaul SSIDs across different VLANs. Maximum BSS count is derived dynamically from the radio configuration rather than being hardcoded. Combined with improved agent upstream tracking, this enables more flexible mesh deployments with per-VLAN fronthaul segmentation.
IPsec VRF Support
IPsec tunnels can now be bound to a specific VRF for traffic isolation. VRF assignment is supported for both standard IPsec and VTI-mode tunnels. VTI return routes now use an explicit next-hop for correct per-VRF routing.
Fibocom Modem Support
Provider registration updated to support Fibocom FM160 and FG160 modems, in addition to existing Quectel RG520N support.
Enhancements¶
| Area | Change |
|---|---|
| QoS | Traffic shaping class number range moved to 200–279, separated from PBR range 100–199 to prevent fwmark conflicts. HTB priority formula updated accordingly. |
| IP Track | Enhanced system reachability tracking — improved probe interface binding and route persistence for multi-WAN environments. |
| EasyMesh | no interface wifi mesh now fully cleans up all EasyMesh state: clears ieee1905managed flags, removes /tmp/ezmesh-*.conf runtime files, and restores wsplcd/ezmesh configs to defaults. |
| EasyMesh Agent | Upstream tracking optimised — bridge state and veth cross-netns handling improved for more reliable backhaul detection after wifi restart. |
| PBR | PBR features optimised; show ip pbr output improved. |
| Show Interface | show interface vrf, show ip interface, and show interface wwan output improved for clarity and consistency. |
| SLA Monitoring | SLA and system monitoring performance optimisations. |
| Interface Monitoring | Enhanced interface state monitoring for improved link-state accuracy. |
| SSH | SSH daemon hardened — weak KEX algorithms removed, MaxAuthTries tightened, ClientAlive parameters corrected. |
| IPsec VTI | VTI return route now uses ip route replace with explicit via next-hop for reliable per-VRF forwarding. |
Bug Fixes¶
| Area | Fix |
|---|---|
| EasyMesh Agent | Fix CAP↔NonCAP state cycle causing agent registration failure on first boot. |
| EasyMesh Agent | Fix stuck mapsig- SSIDs — WPS re-trigger and bitwise MAP capability checks corrected. |
| EasyMesh Agent | Fix spurious VLAN/eth0 bridge created on first boot. |
| EasyMesh Agent | Fix ubus interface calls — use UCI interface name (lan) and correct down/up method names. |
| EasyMesh Controller | Fix fronthaul VAP (mbox) disappearing when the managed VLAN matches the management network. |
| BGP | Fix XE300 unable to recognise BGP show commands (ticket 71874). |
| IPsec | Fix 7 bugs identified in code review — covering tunnel teardown, status parsing, and VTI route handling. |
| WireGuard | Fix VRF interface display issue in show output. |
| P2P Interface | Fix P2P interface handling in PBR routing. |