Release Notes (For Gateway Series)¶
This release notes page covers RansNet gateway series products (CMG, HSG, mfusion, mlog).
20260731-1700¶
Major Changes¶
- Monitoring pipeline optimisation (Debian 12) — Gateway monitoring items now emit structured JSON, and mFusion dependent items use JSONPath preprocessing instead of regex parsing. This dramatically reduces server preprocessing cost per item and eliminates preprocessing queue buildup on large deployments. Interface, SLA link, DHCP, WiFi (AP/STA), WWAN, and system metrics are covered. Use the updated Template_Gateway.
- mFusion dashboard performance overhaul — RMM dashboards, host pages, topology, and maps are served from a warm host-status cache with a rewritten data-access layer (RAPI2). Item View loading reduced from 18s to 7s; overview and entity pages load progressively with per-section indicators.
- LDAP authentication for mFusion — Full LDAP directory login for the management portal, including 2FA for LDAP users, per-auth-type profile validation, account lockout, and encrypted settings storage.
New Features¶
Mobile (SIM) Monitoring — mFusion RMM
New entity-wide Mobile monitoring page: signal quality summary charts with unified Excellent/Good/Fair/Poor buckets, SINR-based signal reporting, per-SIM data usage breakdown, and automatic discovery of SIM interfaces across hosts.
IoT Monitoring — mFusion RMM
New IoT sub-page on the RMM Dashboard for sensor data (smart plugs, environmental, air quality). Item forms support the Trapper item type with JSONPath preprocessing; sensors get an age-based offline grace period for accurate status.
Netflow SOC Dashboard
New SOC sub-tab in Netflow analytics backed by the nfdump engine: threat-hunting flow table, brute-force detection, and ASN-based application category classification enriched with DSCP and flow-shape signals. The ASN data provider is switchable — IPinfo Lite (default) or MaxMind.
Adaptive Wireless & Mass WiFi Optimization — mFusion RMM
Adaptive wireless channel, bandwidth, and transmit power management for monitored devices, plus a Mass WiFi Optimization action across SD-WAN hosts with per-host skip logging to the admin log.
SMTP / Email Settings Overhaul
Redesigned SMTP settings with dedicated authentication and security options, HELO override, and the SMTP password encrypted at rest. All email send paths are logged, and the mFusion Email media type is automatically synced from mFusion SMTP settings. The Local SMTP Server option is retired; existing configurations are migrated automatically.
TWAMP Support
Two-Way Active Measurement Protocol (TWAMP) support added to the gateway for standards-based round-trip latency and SLA measurement against third-party equipment.
Configuration Restore Modes
Backup restore now offers Full Config Only and Incremental Only modes in addition to the standard full restore, allowing device configuration and historical data to be restored independently.
Hotspot Monthly Quota
New monthly free quota rule (CS-Total-MB-Monthly) joins the existing weekly rules, with multi-cycle quota resolution and period-aware statistics. Quota is adjusted automatically when a user's profession changes.
Clock-Skew Detection
Hosts whose system clock drifts more than 15 minutes from the server are flagged with a new CLOCK-SKEW status, with KPI drill-down to the affected devices.
Enhancements¶
| Area | Change |
|---|---|
| VPN Status Output | show status output for IPsec, WireGuard, and SSL VPN server standardised to a common format; protocol and listening port now displayed in the header. |
| IPsec | Configuration changes now restart only the affected tunnels instead of all tunnels. |
| NTP | Migrated to ntpsec with a refactored architecture that preserves custom configuration across CLI command updates; show ip ntp-server output formatting improved. |
| mFusion Server Tuning | New ultra-tier profile for 128GB+ servers with heavy preprocessing workloads; Tier 2 (16GB/2000 hosts) settings proven stable; dynamic file-descriptor (ulimit) tuning. |
| Dashboard UI | Collapsible dashboard sections with Expand/Collapse All controls; doughnut charts show centre totals; settings pages gain per-portion Save/Cancel with inline results; sidebar collapsed state persists across navigation. |
| Topology | SD-WAN VPN tunnel edges coloured by live IPsec tunnel status, with hover tooltip showing tunnel details; Topology menu moved above Hosts. |
| Audit Log | Audit log archives added; username and source-IP resolution hardened; secret values consistently masked. |
| mFusion Objects | Clone function added for items, triggers, and graphs. |
| Host Mass Update | Pre-flight validation, improved template handling, and consolidated result messages. |
| Switchport (RMM) | Speed/duplex configuration and Shutdown option added; CLI compiler redesigned. |
| PBR (RMM) | Policy-based routing supported in configuration extraction; PBR monitoring added. |
| Hotspot | Guest WiFi login per vessel (EPS deployments); quota rule validation and error messages improved; marketing column added to visitors list. |
| CLI | test aaa gains a nasip option; firewall-disable input/access accept extra options. |
| Security | Apache configuration hardened; special characters (e.g. $) supported in BGP passwords and IPsec pre-shared keys; SQL-injection and dashboard-hijack hardening in mFusion. |
Bug Fixes¶
| Area | Fix |
|---|---|
| IPsec | Fix duplicate CHILD_SAs created on configuration changes and infinite restart loops; fix status display for multi-subnet configurations; fix peer tracking. |
| SLA Monitoring | Fix gateway IP extraction on modern kernel route formats; allow SLA probes to use the default gateway. |
| WiFi Monitoring | Client counts now calculated from the actual client table — the summary section was unreliable and could under-report. |
| Configuration | Fix conditions where running configuration could be lost; fix configuration revival after failure. |
| Hotspot | Fix online-users dashboard showing 1 instead of the actual count; fix negative quota on period switch; fix username search in user management. |
| SMTP | Fix silent password-encryption failure; fix settings save bugs; display fields self-heal on form load. |
| Auto Backup | Fix MySQL connection loss during long runs, concurrent-run conflicts, FTP timeout handling, and first-run status errors. |
| Charts | Fix 95th percentile and Min/Max statistics on interface and item charts; fix SSIDs By HW Mode chart aggregating on the wrong field. |
| mFusion | Fix payment gateway settings save and cross-tab save wipe; fix "Token not match" on manual report send; fix mFusion crashes and watchdog logic on NMS-5000. |
20260512-1200¶
Major Changes¶
- Device monitoring is revamped. Use Template_Gateway for base monitoring items (replacing older Template_mbox).
Improvements & Maintenance¶
| Area | Change |
|---|---|
| Build System | Fixed missing execute bits on OpenWrt init scripts, CGI binaries, and tools due to NTFS copy issues during build process — affects HSG and CMG prebuilt images |
| Package Consistency | Applied standard Makefile execute-bit fixes across the gateway firmware package tree for reliable script execution on device startup |
| net-snmp | Restored mibII/var_route module compatibility; resolved undefined var_ipRouteEntry symbol on gateway systems |
| Security Auditing | Continues SSH hardening and account security enhancements from 20260420 release |
| DNS Filtering Orchestration | Added DNS filtering orchestration using either template or direct filtering rules |
20260420-1700¶
New Features¶
DNS Filtering
New dns-group and dns-filter CLI commands provide domain-based DNS filtering with blacklist and whitelist modes. Domain entries automatically cover all subdomains (wildcard matching); more specific entries take precedence over broader ones. Named groups (dns-group) allow bulk domain management — add or remove domains from a group without modifying filter rules.
dns-group adult-sites
domain playboy.com
!
dns-filter 100 deny group adult-sites
dns-filter 200 permit all
See DNS Filtering for full configuration details.
Netflow Traffic Analytics
New Netflow dashboard in mFusion provides per-entity traffic visibility. Features include: entity-based filter, server-driven date range selection, flow records viewer with time filter, Resolve IP lookup, WiFi client columns, and an hourly raw flow cache backed by RAM for performance. Access is restricted to super-admin accounts.
mFusion Account Security
Comprehensive account security controls for the mFusion management portal:
- Configurable password policy — minimum length, complexity requirements, password history
- Account lockout after configurable failed login attempts, with automatic re-enable timer
- Forced password change on first login or by admin action
- Pre-login banners and per-notice dismissal for compliance messaging
- Full audit log for all account-related events (standardised JSON format)
- LDAP authentication phase 2 enhancements
IPsec VRF Support
IPsec tunnels can now be bound to a specific VRF, enabling traffic isolation for multi-tenant or segmented deployments. Configurable from both CLI and mFusion GUI.
Hotspot Client Sticky — API Mode
Hotspot client session stickiness now supports an API-based mode in addition to the default MySQL mode. API mode allows integration with external session management systems. The mode is selectable from the CLI.
Enhancements¶
| Area | Change |
|---|---|
| QoS | Traffic shaping class number range moved to 200–279, separated from PBR range 100–199 to prevent fwmark conflicts. HTB priority formula updated accordingly. |
| IP Track | Enhanced system reachability tracking — improved probe interface binding and route persistence for multi-WAN environments. |
| Show Interface | show interface (no arguments) reformatted as a commercial-grade summary table; show interface vrf and show ip interface output also improved. |
| SLA Monitoring | SLA and system monitoring performance optimisations. |
| mFusion | Interface state monitoring improvements for more accurate link-state reporting. |
| BGP | AS-path prepend command fix — CLI compiler updated to handle multi-word values correctly (ticket 71419). |
| SSH | SSH daemon hardened — weak KEX algorithms removed, MaxAuthTries tightened, ClientAlive parameters corrected. |
| Audit Log | Admin audit log standardised to JSON format across Device, RMM, and Hotspot modules for consistent log parsing. |
| GUI | Topology map tab renamed from "Topology Map" to "Topology". |
| WiFi Pages | Device WiFi pages use dynamic column parsing for improved compatibility across firmware versions. |
| FTP Logs | FTP process logs improved in Logviewer for better visibility of archive operations. |
| Hotspot | Auto refresh added for self-registration portal. @ character now permitted in string filter fields. |
| Payment | Payment receipt is now standard — CMS toggle removed; receipt is always sent on successful transaction. |
Bug Fixes¶
| Area | Fix |
|---|---|
| PBR | Fix route persistence across reloads, metric grep pattern, and tracking probe interface binding. |
| VLAN | Fix incorrect VLAN interface number assignment in edge cases. |
| WireGuard | Fix WireGuard VPN CLI command error; resolve tunnel state handling bug. |
| FreeRADIUS | Fix quota rejection failure when CS-Total-MB-Weekly / CS-Total-MB-All attributes carry negative values (unsigned overflow). |
| Netflow | Fix redirect on entity switch when no data exists; fix flow records time filter; fix loading indicator position; fix permissions for non-super-admin access. |
| mFusion | Fix re-enable action incorrectly resetting inactivity clock. Fix payment vendor field failing to load in CMS form. |