Release Notes (For Gateway Series)¶
This release notes page covers RansNet gateway series products (CMG, HSG, mfusion, mlog).
20261022-2200¶
Major Changes¶
- Security fix: PHP updated to 8.2.35 — fixes the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (unauthenticated remote code execution through the web service). The fixed packages are included in the firmware and installed automatically during the upgrade, without Internet access. Applies to Debian 12 based mFusion, HSG and LOG units (CMG has no web GUI and is not affected). See Security Notice: PHP Vulnerabilities.
- Remote SSH and Remote Web through mFusion — one-click access from mFusion to managed routers, including routers behind NAT or CGNAT, with no port forwarding or local firewall rules on the router. Replaces the legacy Web-Management access, which used a shared password.
New Features¶
Remote SSH and Remote Web
From a host in mFusion, Remote SSH opens the router's CLI in a browser terminal, and Remote Web (Gateway Series) opens the router's web GUI. Each session uses a temporary reverse tunnel from the router to mFusion with one-time keys that are destroyed when the session ends. Sessions close after 15 minutes without activity, with a 4-hour maximum, and the router stops retrying once mFusion closes the session. mFusion lists open sessions and records each one in the audit log. A firewall in front of mFusion must allow TCP 443, 10051 and 2299. See Common Tools — Remote SSH and Remote Web.
Mass Force SIM Failover
Mass Update in mFusion can now force a SIM failover on many branch hosts at once. You choose the WWAN interface explicitly before confirming; skipped hosts are listed with the reason, and the action is recorded in the admin log.
PBR Source by Interface in mFusion
Traffic Steering (PBR) policies in mFusion accept as Source either one or more networks, or exactly one interface configured on the host (Ethernet, VLAN, bond, bridge or WWAN), matching the ip pbr policy ... src <interface> CLI. Duplicate Source entries are rejected, and CLI import skips a rule with an invalid Source and shows a warning.
System Configuration Alerts
mFusion now checks its own configuration and alerts Super Admins to problems with a red alert bar and a details popup, grouped by category. Checks include matching timezones across the GUI, system, PHP and database; each enabled module's database against its reference schema; and the hotspot RADIUS tables. The alert can be minimized but not dismissed while a problem remains. Results are cached for 5 minutes, and Re-check always runs the checks live.
Enhancements¶
| Area | Change |
|---|---|
| TCP Acceleration | No longer slows down slow high-latency links (e.g. low-speed VSAT): the client measures the link and sizes its buffers to it, and steps aside when acceleration cannot help. New tcp-accelerate client ... bandwidth <down> <up> option declares the link speed; show tcp-accelerate adds a Link estimate line. The engine was rewritten for a much smaller footprint (x86 binary 0.9 MB, was 3.6 MB). See TCP Acceleration. |
| Hosts List | Page sizes up to 500, Show All limited to 1,000 hosts so large lists no longer freeze the page, Full List CSV under Export, Export Bulk back in the Export menu, and Batch Import lists skipped hosts by name. |
| Hotspot Payment | New Confirm Email option under Payment Registration Mode: guests receive their login details and invoice by email after payment. The purchase email text is editable under Message Templates. |
| Default Firewall | Default input rules tidied: loopback traffic is accepted first; DHCP and IPsec IKE/NAT-T are separate rules; UDP 547 (DHCPv6) is no longer opened; a duplicate TCP MSS clamp is removed. Fixed SSH and OSPF permits that were part of the defaults are removed — configure them with firewall-input where needed. |
| Hotspot | Portal audit log labels for account-created events show how the password was provisioned (user-defined, random, OTP or direct access). |
Bug Fixes¶
| Area | Fix |
|---|---|
| Firewall Objects | Fix object groups with several FQDN or app entries keeping only the last entry's IP addresses after the periodic refresh, so rules using them missed most destinations. Shared IPs stay while any entry still uses them, and a set that lost entries is repaired on the next refresh. |
| Firmware Upgrade | Fix GUI database migrations being silently skipped during an upgrade; the upgrade now stops before any change if the installed GUI version cannot be read. The GUI's PHP limits are always set to the RansNet defaults, with a warning when a different value is replaced. |
| Hotspot | Fix portal audit log entries not being recorded on upgraded units (the log table was missing). On an mFusion sync secondary, the table is taken from the primary. |
| Reports | Fix scheduled raw data reports not running from the schedule. |
| Traffic Steering | Fix the policy form blocking unrelated changes when an older rule had an empty Source or Destination; empty entries are now reported on Save with the rule number. |
Security Fixes¶
| Area | Fix |
|---|---|
| PHP | PHP updated to 8.2.35 (CVE-2026-109618, CVE-2026-109619). See Security Notice. |
| SAML SSO | SAML single sign-on is refused over plain HTTP; use HTTPS. |
20261007-2000¶
Major Changes¶
- Unified tracking engine — every tracked feature (interface, VRRP, IPsec peer, SSL VPN client, DHCP, hotspot, mFusion server and System Sync) now uses the same
track icmp/track tcp/track routeoptions, and acts only after two consecutive failed checks. A single lost probe no longer triggers a failover. The default ping count is now 3. The legacy minutes-based hotspottrack-routecommand is removed. See Tracking. - VPN Instances are now managed per entity — the SD-WAN VPN Instance GUI moved from per-host to per-entity, with an automatic migration of existing VPN settings, bulk branch add/remove, VPN status buttons, and a guard that stops the command queue from pushing to disabled hosts. The legacy VPN GUI is retired.
- Automatic TCP MSS / MTU self-heal for overlays — IPsec (VTI and policy-based), WireGuard, VXLAN and GRE tunnels now detect the path MTU and correct interface MTU and TCP MSS clamping automatically. This fixes stalled or hanging connections (e.g. uploads, HTTPS, large downloads) over cellular, PPPoE and nested tunnels without manual MTU tuning.
New Features¶
Full Mesh SD-WAN
WireGuard-based full-mesh VPN orchestrated by mFusion: every site can build a direct tunnel to every other site, with no hub in the data path. Supports Static, Dynamic (on-demand tunnels) and hybrid modes per device, and Auto Public IP / Auto Private IP / Static IP endpoints that are learned and pushed to every peer automatically. New show wg mesh command lists active, pending and dormant peers. See Full Mesh SD-WAN.
System Sync (mFusion High Availability)
New mfusion sync replicates the mFusion databases and files to a second unit. Combined with VRRP or BGP route tracking, the secondary takes over automatically if the primary fails; without tracking, it works as a continuously-synced backup. Peer firewall access is opened and closed automatically. See System Sync.
mFusion Server Tracking
mfusion server now accepts track icmp, track tcp or track route, so the monitoring service starts and stops with the unit's active/standby role — for example, tracking the VRRP VIP alongside mfusion sync. See On-Premise mfusion Installation.
TCP Acceleration
New tcp-accelerate command speeds up TCP applications over high-latency links (satellite, long-haul, congested cellular) by splitting each TCP connection at the routers. Supports hub-and-spoke, point-to-point (tcp-accelerate p2p) and tunnel-less deployments, with optional pre-shared key. See TCP Acceleration.
SAML SSO for mFusion
mFusion now supports SAML 2.0 single sign-on (Azure AD / Entra ID or any SAML 2.0 identity provider), including metadata import/fetch, certificate rollover, single logout, and auto-provisioning of users. See SAML SSO.
Web Filtering Module
New web filtering GUI in mFusion: policies, custom categories, whitelists, assigned IPs, dashboard traffic overview and reports, with policy propagation across entities. See Web Filtering.
Password Expiry
Account Policy adds Require local users to change password after X days. It applies to local accounts only; LDAP and SAML users follow their directory's own policy. See Administration — Account Policy.
Dynamic Routing GUI — Route Maps and Prefix Lists
Route maps and prefix lists can now be configured from the mFusion Dynamic Routing pages, with audit logging of changes. BGP also gains neighbor ... filter-list and a corrected AS-path access-list command.
Hotspot Portal Audit Logs
New Hotspot portal audit log report with configurable retention.
Other New Commands
| Command | Description |
|---|---|
route-metric (interface) |
Per-interface metric for DHCP-learned default routes, now on Debian 12 gateways |
timezone |
Set the system timezone from the CLI |
test throughput ... length <bytes> |
Set the write buffer size for throughput tests |
ip pbr policy ... src <interface> |
Use an interface name as the PBR source; its IP is tracked live |
Enhancements¶
| Area | Change |
|---|---|
| WWAN (mFusion GUI) | Scan and select a preferred 4G/5G provider from the GUI; Force SIM Failover action button; SINR added as a WWAN tracking method; SIM Slot column on the Mobile dashboard. |
| IPsec | strongSwan retransmit schedule tuned for faster dead-peer detection; MOBIKE disabled; connections are torn down gracefully before stop; watchdog recovers an unresponsive IPsec control daemon. |
| WireGuard | no forms added for peer, mesh and interface commands so mFusion can sync removals; show wg displays mesh mode and endpoint source. |
| Firewall | show firewall dnat-list all now lists nested NAT chains. |
| DHCP / VRF | DHCP client and relay are VRF-aware on Debian 12; default routes land in the correct VRF table; stale VRF default routes are withdrawn on carrier loss. |
| Charts & Reports | Monitoring charts migrated to a new chart engine with stacked-graph support, including in PDF reports; report items are kept when the entity list changes. |
| Admin Forms | Host, entity and user forms reworked for clearer layout, with service subscriptions on entities and an inheritance explanation for user entities. |
| Monitoring Objects | Clone now works on discovered and templated items, triggers and graphs; host template sync no longer silently unlinks templates. |
| Ads Manager | Monthly impression cap per campaign; ads pause cascades to child entities. |
| SMS | hSenid gateway updated for the new M1 SDP address. |
| Performance | Monitoring collectors now run one after another at low priority from a single scheduler, instead of all starting together every 5 minutes; the tracking daemon uses far less CPU. Traffic forwarding keeps priority on the CPU. |
| System | Disk-full cleanup can no longer reduce database retention below 31 days; mFusion System Sync logs are rotated. |
Bug Fixes¶
| Area | Fix |
|---|---|
| IPsec | Fix VTI endpoint staying stale after a WAN failover; fix IPsec restarting every 10–16 s for responder-only peers; fix leftover XFRM state, routing rules and TCP MSS clamps after a peer is removed. |
| WireGuard | Fix download blackhole on cellular/PPPoE branches; fix show wg mixing up local networks across multiple instances; fix mesh peer state being lost after reboot. |
| Routing | Fix interface enable not restoring the DHCP default route; fix no interface <if> vrf <id> leaving the device in the VRF; fix route parsing breaking on newer ECMP/nexthop output formats; FRR ECMP nexthop recovery workaround. |
| Tracking | Fix stray tracking daemons that were never stopped; fix daemon single-instance race; fix no vrrp-group leaving a stale tracking entry; fix false config-rollback reboots after mFusion config pushes. |
| Upgrade | Fix upgrades restarting services mid-maintenance (leaving RADIUS down); fix hotspot quota database update failing on every upgrade. |
| Debian 10 / 12 | Fix 30+ minute delay when rebooting from the bash shell; fix GUI sessions expiring after 24 minutes; fix GUI PHP limits never applied; fix OpenVPN failing to start on Debian 10; fix NTP config written to the wrong path on Debian 10; add NTP step-correction for Debian 10 hardware clock drift. |
| DHCP Relay | Fix ip dhcp-helper not working. |
| Security | Fix SQL injection in map data requests; fix locked-field mass-assignment in admin edit forms; webfilter XSS fixes; the ssh CLI command is hardened against option injection. |
| QoS | Fix no class rejecting class removals pushed from mFusion as an illegal command, which left the old class in place and failed the whole config push. |
| TCP Acceleration | Fix overlapping configuration changes on a shared TCP Acceleration server interfering with each other. |
| API | Fix API authentication failing when the Content-Type header includes a charset. |
| RMM | Fix duplicate VPN tunnel IP assignment; fix VPN branch network list showing gateway interfaces; fix VRF ID inheritance between gateway and branch; fix Import CLI action. |
Removed¶
mfusion probeCLI command (obsolete).telnetCLI command — removed because a full telnet client can open a local shell from the restricted CLI.
20260731-1700¶
Major Changes¶
- Monitoring pipeline optimisation (Debian 12) — Gateway monitoring items now emit structured JSON, and mFusion dependent items use JSONPath preprocessing instead of regex parsing. This dramatically reduces server preprocessing cost per item and eliminates preprocessing queue buildup on large deployments. Interface, SLA link, DHCP, WiFi (AP/STA), WWAN, and system metrics are covered. Use the updated Template_Gateway.
- mFusion dashboard performance overhaul — RMM dashboards, host pages, topology, and maps are served from a warm host-status cache with a rewritten data-access layer (RAPI2). Item View loading reduced from 18s to 7s; overview and entity pages load progressively with per-section indicators.
- LDAP authentication for mFusion — Full LDAP directory login for the management portal, including 2FA for LDAP users, per-auth-type profile validation, account lockout, and encrypted settings storage.
New Features¶
Mobile (SIM) Monitoring — mFusion RMM
New entity-wide Mobile monitoring page: signal quality summary charts with unified Excellent/Good/Fair/Poor buckets, SINR-based signal reporting, per-SIM data usage breakdown, and automatic discovery of SIM interfaces across hosts.
IoT Monitoring — mFusion RMM
New IoT sub-page on the RMM Dashboard for sensor data (smart plugs, environmental, air quality). Item forms support the Trapper item type with JSONPath preprocessing; sensors get an age-based offline grace period for accurate status.
Netflow SOC Dashboard
New SOC sub-tab in Netflow analytics backed by the nfdump engine: threat-hunting flow table, brute-force detection, and ASN-based application category classification enriched with DSCP and flow-shape signals. The ASN data provider is switchable — IPinfo Lite (default) or MaxMind.
Adaptive Wireless & Mass WiFi Optimization — mFusion RMM
Adaptive wireless channel, bandwidth, and transmit power management for monitored devices, plus a Mass WiFi Optimization action across SD-WAN hosts with per-host skip logging to the admin log.
SMTP / Email Settings Overhaul
Redesigned SMTP settings with dedicated authentication and security options, HELO override, and the SMTP password encrypted at rest. All email send paths are logged, and the mFusion Email media type is automatically synced from mFusion SMTP settings. The Local SMTP Server option is retired; existing configurations are migrated automatically.
TWAMP Support
Two-Way Active Measurement Protocol (TWAMP) support added to the gateway for standards-based round-trip latency and SLA measurement against third-party equipment.
Configuration Restore Modes
Backup restore now offers Full Config Only and Incremental Only modes in addition to the standard full restore, allowing device configuration and historical data to be restored independently.
Hotspot Monthly Quota
New monthly free quota rule (CS-Total-MB-Monthly) joins the existing weekly rules, with multi-cycle quota resolution and period-aware statistics. Quota is adjusted automatically when a user's profession changes.
Clock-Skew Detection
Hosts whose system clock drifts more than 15 minutes from the server are flagged with a new CLOCK-SKEW status, with KPI drill-down to the affected devices.
Enhancements¶
| Area | Change |
|---|---|
| VPN Status Output | show status output for IPsec, WireGuard, and SSL VPN server standardised to a common format; protocol and listening port now displayed in the header. |
| IPsec | Configuration changes now restart only the affected tunnels instead of all tunnels. |
| NTP | Migrated to ntpsec with a refactored architecture that preserves custom configuration across CLI command updates; show ip ntp-server output formatting improved. |
| mFusion Server Tuning | New ultra-tier profile for 128GB+ servers with heavy preprocessing workloads; Tier 2 (16GB/2000 hosts) settings proven stable; dynamic file-descriptor (ulimit) tuning. |
| Dashboard UI | Collapsible dashboard sections with Expand/Collapse All controls; doughnut charts show centre totals; settings pages gain per-portion Save/Cancel with inline results; sidebar collapsed state persists across navigation. |
| Topology | SD-WAN VPN tunnel edges coloured by live IPsec tunnel status, with hover tooltip showing tunnel details; Topology menu moved above Hosts. |
| Audit Log | Audit log archives added; username and source-IP resolution hardened; secret values consistently masked. |
| mFusion Objects | Clone function added for items, triggers, and graphs. |
| Host Mass Update | Pre-flight validation, improved template handling, and consolidated result messages. |
| Switchport (RMM) | Speed/duplex configuration and Shutdown option added; CLI compiler redesigned. |
| PBR (RMM) | Policy-based routing supported in configuration extraction; PBR monitoring added. |
| Hotspot | Guest WiFi login per vessel (EPS deployments); quota rule validation and error messages improved; marketing column added to visitors list. |
| CLI | test aaa gains a nasip option; firewall-disable input/access accept extra options. |
| Security | Apache configuration hardened; special characters (e.g. $) supported in BGP passwords and IPsec pre-shared keys; SQL-injection and dashboard-hijack hardening in mFusion. |
Bug Fixes¶
| Area | Fix |
|---|---|
| IPsec | Fix duplicate CHILD_SAs created on configuration changes and infinite restart loops; fix status display for multi-subnet configurations; fix peer tracking. |
| SLA Monitoring | Fix gateway IP extraction on modern kernel route formats; allow SLA probes to use the default gateway. |
| WiFi Monitoring | Client counts now calculated from the actual client table — the summary section was unreliable and could under-report. |
| Configuration | Fix conditions where running configuration could be lost; fix configuration revival after failure. |
| Hotspot | Fix online-users dashboard showing 1 instead of the actual count; fix negative quota on period switch; fix username search in user management. |
| SMTP | Fix silent password-encryption failure; fix settings save bugs; display fields self-heal on form load. |
| Auto Backup | Fix MySQL connection loss during long runs, concurrent-run conflicts, FTP timeout handling, and first-run status errors. |
| Charts | Fix 95th percentile and Min/Max statistics on interface and item charts; fix SSIDs By HW Mode chart aggregating on the wrong field. |
| mFusion | Fix payment gateway settings save and cross-tab save wipe; fix "Token not match" on manual report send; fix mFusion crashes and watchdog logic on NMS-5000. |
20260512-1200¶
Major Changes¶
- Device monitoring is revamped. Use Template_Gateway for base monitoring items (replacing older Template_mbox).
Improvements & Maintenance¶
| Area | Change |
|---|---|
| Build System | Fixed missing execute bits on OpenWrt init scripts, CGI binaries, and tools due to NTFS copy issues during build process — affects HSG and CMG prebuilt images |
| Package Consistency | Applied standard Makefile execute-bit fixes across the gateway firmware package tree for reliable script execution on device startup |
| net-snmp | Restored mibII/var_route module compatibility; resolved undefined var_ipRouteEntry symbol on gateway systems |
| Security Auditing | Continues SSH hardening and account security enhancements from 20260420 release |
| DNS Filtering Orchestration | Added DNS filtering orchestration using either template or direct filtering rules |
20260420-1700¶
New Features¶
DNS Filtering
New dns-group and dns-filter CLI commands provide domain-based DNS filtering with blacklist and whitelist modes. Domain entries automatically cover all subdomains (wildcard matching); more specific entries take precedence over broader ones. Named groups (dns-group) allow bulk domain management — add or remove domains from a group without modifying filter rules.
dns-group adult-sites
domain playboy.com
!
dns-filter 100 deny group adult-sites
dns-filter 200 permit all
See DNS Filtering for full configuration details.
Netflow Traffic Analytics
New Netflow dashboard in mFusion provides per-entity traffic visibility. Features include: entity-based filter, server-driven date range selection, flow records viewer with time filter, Resolve IP lookup, WiFi client columns, and an hourly raw flow cache backed by RAM for performance. Access is restricted to super-admin accounts.
mFusion Account Security
Comprehensive account security controls for the mFusion management portal:
- Configurable password policy — minimum length, complexity requirements, password history
- Account lockout after configurable failed login attempts, with automatic re-enable timer
- Forced password change on first login or by admin action
- Pre-login banners and per-notice dismissal for compliance messaging
- Full audit log for all account-related events (standardised JSON format)
- LDAP authentication phase 2 enhancements
IPsec VRF Support
IPsec tunnels can now be bound to a specific VRF, enabling traffic isolation for multi-tenant or segmented deployments. Configurable from both CLI and mFusion GUI.
Hotspot Client Sticky — API Mode
Hotspot client session stickiness now supports an API-based mode in addition to the default MySQL mode. API mode allows integration with external session management systems. The mode is selectable from the CLI.
Enhancements¶
| Area | Change |
|---|---|
| QoS | Traffic shaping class number range moved to 200–279, separated from PBR range 100–199 to prevent fwmark conflicts. HTB priority formula updated accordingly. |
| IP Track | Enhanced system reachability tracking — improved probe interface binding and route persistence for multi-WAN environments. |
| Show Interface | show interface (no arguments) reformatted as a commercial-grade summary table; show interface vrf and show ip interface output also improved. |
| SLA Monitoring | SLA and system monitoring performance optimisations. |
| mFusion | Interface state monitoring improvements for more accurate link-state reporting. |
| BGP | AS-path prepend command fix — CLI compiler updated to handle multi-word values correctly (ticket 71419). |
| SSH | SSH daemon hardened — weak KEX algorithms removed, MaxAuthTries tightened, ClientAlive parameters corrected. |
| Audit Log | Admin audit log standardised to JSON format across Device, RMM, and Hotspot modules for consistent log parsing. |
| GUI | Topology map tab renamed from "Topology Map" to "Topology". |
| WiFi Pages | Device WiFi pages use dynamic column parsing for improved compatibility across firmware versions. |
| FTP Logs | FTP process logs improved in Logviewer for better visibility of archive operations. |
| Hotspot | Auto refresh added for self-registration portal. @ character now permitted in string filter fields. |
| Payment | Payment receipt is now standard — CMS toggle removed; receipt is always sent on successful transaction. |
Bug Fixes¶
| Area | Fix |
|---|---|
| PBR | Fix route persistence across reloads, metric grep pattern, and tracking probe interface binding. |
| VLAN | Fix incorrect VLAN interface number assignment in edge cases. |
| WireGuard | Fix WireGuard VPN CLI command error; resolve tunnel state handling bug. |
| FreeRADIUS | Fix quota rejection failure when CS-Total-MB-Weekly / CS-Total-MB-All attributes carry negative values (unsigned overflow). |
| Netflow | Fix redirect on entity switch when no data exists; fix flow records time filter; fix loading indicator position; fix permissions for non-super-admin access. |
| mFusion | Fix re-enable action incorrectly resetting inactivity clock. Fix payment vendor field failing to load in CMS form. |