Skip to content

Release Notes (For Gateway Series)

This release notes page covers RansNet gateway series products (CMG, HSG, mfusion, mlog).

20261105-1100

Major Changes

  • Data Maintenance — one page, ADMIN → General → Data Maintenance, now sets how long mFusion keeps every kind of data: hotspot and RADIUS, mFusion Monitoring, client flow usage, syslog, admin logs and scheduled reports. A nightly job enforces it, can archive expired data to CSV files (and upload them to an SFTP server) before deleting it, and a disk guard frees space before a disk fills up. It replaces data-lifetime in the CLI, HOTSPOT USERS → Data Maintenance, the Log Collector Archives tab, the audit log archive and the report cleanup setting. Review its settings after upgrading. See Data Maintenance.
  • Client Flow and the Usage dashboard — routers can report how much each hotspot user or LAN device downloaded and uploaded, and to which destinations (host name, app and category). mFusion shows it on a new Monitoring → Dashboard → Usage tab and as a per-session breakdown in Historical Sessions. See Client Flow and Usage Dashboard.
  • Hotspot Account Status page — hotspot users log in at https://<server>/hotspot/acctinfo/ to see their account, quota and usage (with where their data went), and to change or reset their password. See Account Status.
  • Quantum-safe IPsec — IKEv2 tunnels can be protected against future quantum computers with post-quantum preshared keys (RFC 8784). See Quantum-Safe IPSec VPN.

New Features

Data Maintenance

Each area (Hotspot & RADIUS, mFusion Monitoring, Client Flow Usage, Log Collector, Admin & Orchestrator, Scheduled Reports) lists its data with a keep period, allowed range and, where offered, Archive. The large tables are kept in daily partitions, so an expired day is dropped at once.

  • Nightly cleanup at 05:00 by a new periodic jobs runner that runs one job at a time; a missed job catches up, and a failed one is retried and written to the audit log. On an HA pair it runs on the primary.
  • Archive files: expired data is written to gzip CSV files just before it is deleted, kept locally for a set number of days and optionally uploaded to an SFTP server. Syslog archives can get an RFC 3161 trusted timestamp. Archived files are listed on the page for download.
  • Disk guard: checked hourly. Above the warning level, super admins see an alert with the days until the disk is full; above the critical level, space is freed step by step (uploaded archives, temporary files, older reports, then the oldest data, never below each item's minimum). Settings are not changed and every step is audited.
  • Storage Overview: disk use and the largest data, including sync logs, database files, portals and ad media, firmware, backups and reports.
  • Scheduled Jobs: last run, duration and result of every job, and why a job does not run on this unit (module off, HA secondary).
  • Account deletion: optional cleanup of expired and inactive hotspot accounts, and whether deleting a user (GUI or API) also deletes its accounting and quota history. Both "delete history" options are on by default, so a re-created username no longer inherits the old usage for its quota.

Client Flow and Usage Dashboard

  • Router: client-flow under security hotspot <if> (per logged-in user, tied to the RADIUS session) or ip client-flow under a LAN interface (per device, named from DHCP leases). Every 15 minutes the router uploads usage per destination to mFusion; while mFusion is unreachable it backs off (2 to 60 minutes) and caps its memory use at 10% of RAM. New show ip client-flow and show security hotspot client-flow commands. Also available as Client Flow buttons in the Orchestrator interface and hotspot settings.
  • mFusion Usage tab: overview charts, top users/devices and destinations, Clients, Destinations, Apps & Categories and Usage Summary (per user/device and per router) views, "who used" drill-downs, ranges from 1 hour to 45 days or a custom range, CSV export, and router upload health. Read-only users can open it; client views are audit-logged.
  • Destinations are labelled from a new domain classification database (about 111,000 domains in 24 categories, and network owners for IP-only destinations), updated with each firmware release.
  • Historical Sessions: click a session to see where its data went, next to the RADIUS-accounted volume.

Hotspot Account Status Page

A standalone page for hotspot users, at https://<server>/hotspot/acctinfo/, enabled with the RADIUS server:

  • Profile, weekly/monthly quota or account limits, access records, top-up and purchase records, and quota usage.
  • Usage Summary for the last 24 hours, 7, 30 or 45 days: download, upload and online time, with where the data went by category, app and destination; click an access record for that session's top destinations.
  • Change Password and Forgot password? (a new password emailed to the account's address, at most 5 requests per 15 minutes).
  • Login lockout per client IP and per account, 15-minute idle timeout, HTTPS only.
  • Captive portals can show an Account Status link below the login button (CMS: Enable account status link on login page), also on portals made before this release.

Quantum-Safe IPsec

New ppk <ppk-id> <key> [optional] under ipsec peer mixes a post-quantum preshared key into the IKEv2 key exchange, so a recorded tunnel stays confidential even if its Diffie-Hellman exchange is broken later. Required by default (no silent fallback); optional allows peers without PPK support during migration. show ipsec status shows IKEv2(PSK+PPK). Works with VRF/VTI and responder peers and with third-party gateways that support RFC 8784. The required strongSwan components are bundled and installed during the upgrade, without Internet access.

Database and Data Folder on a Data Disk

New disk data <folder> moves the MySQL database and the mbox data folder (backups, reports, firmware images, archives) to a separately mounted disk, keeping their usual paths, with free-space checks, verification and rollback. no disk data moves them back and disk show shows where each one is. It replaces mfusion mysql-server data-path, which the upgrade converts. See Add Data Disk.

mFusion Sync: resync

New resync under mfusion sync, run on the secondary after a firmware upgrade or when replication stops with an "out-of-order sequence number" error: it fetches only the missed changes from the primary, in seconds, instead of copying the whole database as rejoin does. See mFusion Sync — Resync or Rejoin.

Hotspot Single Session and Remote Logout (RADIUS CoA)

  • New hotspot-client-single under security hotspot <if> (Orchestrator: Single Session): a new login logs out the same device's or user's other sessions instead of being rejected as a simultaneous login.
  • When a login exceeds Simultaneous-Use, the RADIUS server can log out the user's oldest session on any hotspot engine with a RADIUS Disconnect-Request (CoA), so the next attempt succeeds. Set up automatically with the hotspot; see Auto Logout.
  • Online Sessions → Logout now also works for sessions on a remote hotspot router.

Prepaid Quota Top-up through a Payment Gateway

Quota users can buy a top-up plan on the portal and pay through the payment gateway; the quota is added to their weekly or monthly cap and recorded with a receipt (by email and on the status page). Configure the plans in CMS Portal Backend Setting → Login Option → Quota Purchase via Payment Gateways (needs the Quota Top-Up feature). PayPal now offers Alipay. Requires portal version 5.57.

Redesigned Hotspot Pages

  • Guest Management: a new Settings tab (account type, username/password or PIN rules, access profile, print options, the user info to ask) and a redesigned Front Desk, which gives any Access Profile, can ask for an expiry date and time, and prints, emails or texts vouchers. See Guest Management.
  • CMS Portal Backend Setting: one Settings tab, a new Login Option tab (login methods, self-registration, payment, email and SMS delivery with test buttons), a Text Customization tab, and a new Allowed recipient mobile numbers setting for SMS OTP.
  • User Management: Access Info tab redesigned (one row per attribute), Quota Mgmt moved in as a tab, account Type column, Profession and Company shown by default, User Info in two sections, and purchased/pre-paid quota records.

Enhancements

Area Change
Hotspot Quota Manual and portal top-up now credit monthly-quota users' own cap; the top-up balance carries over to the next period and across weekly/monthly changes; quota rule changes apply at once; rule profession keys accept prefixes (e.g. GUEST*); clone and rename keep quota consistent.
Hotspot Access Profiles Access Info tab redesigned like the user's; each value is checked before saving.
Hotspot Dashboard Real time: today or a range within the last 3 days.
Historical Sessions Download and Upload columns shown by default.
Hotspot New User Adding a user is all-or-nothing: a failure no longer leaves a half-created account.
Captive Portal New portals ask only for first and last name by default; the purchase captcha follows the User Captcha setting; the portal audit log names the plan in paid-plan rows.
Reports New Hotspot New User Onboarding report item (attempting, onboarded and failed users, with a daily CSV); "Connected Users" renamed Online Users.
SD-WAN Monitoring The SD-WAN report shows route summaries instead of full routing tables and lists tunnels before BGP neighbours, so hubs with about 200 peers stay within the report size limit and keep their tunnel status on the topology map.
mFusion Sync On an HA secondary, RADIUS, mFusion Monitoring and the log server are held until promotion, so their writes no longer stop replication; HA rejoin uses the real database folder, checks free space first and removes its old copies afterwards.
mFusion Monitoring Start and stop wait for the service to be really up or down instead of fixed delays.
Database Large table rebuilds no longer fail with "Temp file write failure"; MySQL starts faster on large databases.
Data Disk A failed or missing data disk no longer blocks boot (disk mount adds nofail).

Bug Fixes

Area Fix
Firmware Upgrade Fix hotspot mFusion units upgraded since 2025-07 losing their RADIUS and syslog maintenance jobs (session partitions, expiry, de-duplicate); affected units get them back with this upgrade.
Firmware Upgrade Fix services stopped for an upgrade or maintenance being restarted by the cron watchdog, and local syslog staying down afterwards until a reboot.
Firmware Upgrade Fix "Database schema mismatch" alerts on upgraded units (missing admin columns and tables; unused Syslog tables).
Remote SSH / Remote Web Fix sessions failing with "Remote access is not available on this mFusion" until a reboot.
IPsec Fix peer changes on a hub (all peers responder-only) not being applied while no tunnel was up, e.g. a corrected pre-shared key.
WireGuard Fix a custom wg-port leaving the firewall open on the default port only.
Captive Portal Fix a retry after a failed login (e.g. simultaneous-use reject) sending the user away without logging in.
Captive Portal Fix failed payments on the main payment path not being written to the portal audit log.
Guest Management Fix Front Desk accounts expiring on 01 Jan 1970 (preset expiry date), and accounts without a profession being refused when no profession is asked.
Hotspot Access Profiles Fix a Hotspot LAN Interface IP added together with another attribute being lost.
Reports Fix scheduled raw data reports failing to deliver their per-day archives, and New User Onboarding counting OTP and direct-access sign-ups as failed.
Disk Check Fix the daily disk check reading the wrong disk when the data is on a data disk.
Admin Backup Fix the nightly admin database purge and backup stopping part-way.
Logs Fix daily log rotation failing on Debian 12.

Security Fixes

Area Fix
Hotspot Online Sessions The MAC address is escaped before the local logout command is run.
Database Reset A full database reset refuses to run when the database folder cannot be determined or the data disk is not mounted.

Removed

  • data-lifetime under security radius-server and mfusion server — deprecated, set in Data Maintenance; the upgrade converts the value and removes the line.
  • mfusion mysql-server data-path — replaced by disk data.
  • Portal Use Simple Reset and the Forget Password link — password change and reset are on the Account Status page.
  • Front Desk Time / Speed / Device / Data / Expire-after profile pickers — replaced by the Access Profile.
  • Hotspot User Groups tab, the Log Collector Archives tab and Reports → Report Settings (now in Data Maintenance), and Current Month on the Hotspot Dashboard.
  • The web GUI on Debian 10 and Debian 7 units: the GUI ships for Debian 12 only (the base system still supports Debian 10).

Upgrade Notes

  • Review Data Maintenance after the upgrade. Existing retention is converted, but some defaults change: monitoring history at the old 12 days becomes 3 days, the monitoring audit log and web sessions 3 days, and client flow daily usage 7 days (raise it to 45 days for the full 30/45-day breakdown on the Account Status page). Values set by hand are kept.
  • Front Desk: a unit that gave every guest a fixed old profile (e.g. Speed-Max-20Mbps) must select an Access profile in Guest Management Settings.
  • Prepaid top-up: reload the portal templates and upgrade each portal in CMS to version 5.57.
  • mFusion Sync: after upgrading both units, run resync on the secondary (see Firmware Upgrade).

20261022-2200

Major Changes

  • Security fix: PHP updated to 8.2.35 — fixes the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (unauthenticated remote code execution through the web service). The fixed packages are included in the firmware and installed automatically during the upgrade, without Internet access. Applies to Debian 12 based mFusion, HSG and LOG units (CMG has no web GUI and is not affected). See Security Notice: PHP Vulnerabilities.
  • Remote SSH and Remote Web through mFusion — one-click access from mFusion to managed routers, including routers behind NAT or CGNAT, with no port forwarding or local firewall rules on the router. Replaces the legacy Web-Management access, which used a shared password.

New Features

Remote SSH and Remote Web

From a host in mFusion, Remote SSH opens the router's CLI in a browser terminal, and Remote Web (Gateway Series) opens the router's web GUI. Each session uses a temporary reverse tunnel from the router to mFusion with one-time keys that are destroyed when the session ends. Sessions close after 15 minutes without activity, with a 4-hour maximum, and the router stops retrying once mFusion closes the session. mFusion lists open sessions and records each one in the audit log. A firewall in front of mFusion must allow TCP 443, 10051 and 2299. See Common Tools — Remote SSH and Remote Web.

Mass Force SIM Failover

Mass Update in mFusion can now force a SIM failover on many branch hosts at once. You choose the WWAN interface explicitly before confirming; skipped hosts are listed with the reason, and the action is recorded in the admin log.

PBR Source by Interface in mFusion

Traffic Steering (PBR) policies in mFusion accept as Source either one or more networks, or exactly one interface configured on the host (Ethernet, VLAN, bond, bridge or WWAN), matching the ip pbr policy ... src <interface> CLI. Duplicate Source entries are rejected, and CLI import skips a rule with an invalid Source and shows a warning.

System Configuration Alerts

mFusion now checks its own configuration and alerts Super Admins to problems with a red alert bar and a details popup, grouped by category. Checks include matching timezones across the GUI, system, PHP and database; each enabled module's database against its reference schema; and the hotspot RADIUS tables. The alert can be minimized but not dismissed while a problem remains. Results are cached for 5 minutes, and Re-check always runs the checks live.

Enhancements

Area Change
TCP Acceleration No longer slows down slow high-latency links (e.g. low-speed VSAT): the client measures the link and sizes its buffers to it, and steps aside when acceleration cannot help. New tcp-accelerate client ... bandwidth <down> <up> option declares the link speed; show tcp-accelerate adds a Link estimate line. The engine was rewritten for a much smaller footprint (x86 binary 0.9 MB, was 3.6 MB). See TCP Acceleration.
Hosts List Page sizes up to 500, Show All limited to 1,000 hosts so large lists no longer freeze the page, Full List CSV under Export, Export Bulk back in the Export menu, and Batch Import lists skipped hosts by name.
Hotspot Payment New Confirm Email option under Payment Registration Mode: guests receive their login details and invoice by email after payment. The purchase email text is editable under Message Templates.
Default Firewall Default input rules tidied: loopback traffic is accepted first; DHCP and IPsec IKE/NAT-T are separate rules; UDP 547 (DHCPv6) is no longer opened; a duplicate TCP MSS clamp is removed. Fixed SSH and OSPF permits that were part of the defaults are removed — configure them with firewall-input where needed.
Hotspot Portal audit log labels for account-created events show how the password was provisioned (user-defined, random, OTP or direct access).

Bug Fixes

Area Fix
Firewall Objects Fix object groups with several FQDN or app entries keeping only the last entry's IP addresses after the periodic refresh, so rules using them missed most destinations. Shared IPs stay while any entry still uses them, and a set that lost entries is repaired on the next refresh.
Firmware Upgrade Fix GUI database migrations being silently skipped during an upgrade; the upgrade now stops before any change if the installed GUI version cannot be read. The GUI's PHP limits are always set to the RansNet defaults, with a warning when a different value is replaced.
Hotspot Fix portal audit log entries not being recorded on upgraded units (the log table was missing). On an mFusion sync secondary, the table is taken from the primary.
Reports Fix scheduled raw data reports not running from the schedule.
Traffic Steering Fix the policy form blocking unrelated changes when an older rule had an empty Source or Destination; empty entries are now reported on Save with the rule number.

Security Fixes

Area Fix
PHP PHP updated to 8.2.35 (CVE-2026-109618, CVE-2026-109619). See Security Notice.
SAML SSO SAML single sign-on is refused over plain HTTP; use HTTPS.

20261007-2000

Major Changes

  • Unified tracking engine — every tracked feature (interface, VRRP, IPsec peer, SSL VPN client, DHCP, hotspot, mFusion server and System Sync) now uses the same track icmp / track tcp / track route options, and acts only after two consecutive failed checks. A single lost probe no longer triggers a failover. The default ping count is now 3. The legacy minutes-based hotspot track-route command is removed. See Tracking.
  • VPN Instances are now managed per entity — the SD-WAN VPN Instance GUI moved from per-host to per-entity, with an automatic migration of existing VPN settings, bulk branch add/remove, VPN status buttons, and a guard that stops the command queue from pushing to disabled hosts. The legacy VPN GUI is retired.
  • Automatic TCP MSS / MTU self-heal for overlays — IPsec (VTI and policy-based), WireGuard, VXLAN and GRE tunnels now detect the path MTU and correct interface MTU and TCP MSS clamping automatically. This fixes stalled or hanging connections (e.g. uploads, HTTPS, large downloads) over cellular, PPPoE and nested tunnels without manual MTU tuning.

New Features

Full Mesh SD-WAN

WireGuard-based full-mesh VPN orchestrated by mFusion: every site can build a direct tunnel to every other site, with no hub in the data path. Supports Static, Dynamic (on-demand tunnels) and hybrid modes per device, and Auto Public IP / Auto Private IP / Static IP endpoints that are learned and pushed to every peer automatically. New show wg mesh command lists active, pending and dormant peers. See Full Mesh SD-WAN.

System Sync (mFusion High Availability)

New mfusion sync replicates the mFusion databases and files to a second unit. Combined with VRRP or BGP route tracking, the secondary takes over automatically if the primary fails; without tracking, it works as a continuously-synced backup. Peer firewall access is opened and closed automatically. See System Sync.

mFusion Server Tracking

mfusion server now accepts track icmp, track tcp or track route, so the monitoring service starts and stops with the unit's active/standby role — for example, tracking the VRRP VIP alongside mfusion sync. See On-Premise mfusion Installation.

TCP Acceleration

New tcp-accelerate command speeds up TCP applications over high-latency links (satellite, long-haul, congested cellular) by splitting each TCP connection at the routers. Supports hub-and-spoke, point-to-point (tcp-accelerate p2p) and tunnel-less deployments, with optional pre-shared key. See TCP Acceleration.

SAML SSO for mFusion

mFusion now supports SAML 2.0 single sign-on (Azure AD / Entra ID or any SAML 2.0 identity provider), including metadata import/fetch, certificate rollover, single logout, and auto-provisioning of users. See SAML SSO.

Web Filtering Module

New web filtering GUI in mFusion: policies, custom categories, whitelists, assigned IPs, dashboard traffic overview and reports, with policy propagation across entities. See Web Filtering.

Password Expiry

Account Policy adds Require local users to change password after X days. It applies to local accounts only; LDAP and SAML users follow their directory's own policy. See Identity Management — Account Policy.

Dynamic Routing GUI — Route Maps and Prefix Lists

Route maps and prefix lists can now be configured from the mFusion Dynamic Routing pages, with audit logging of changes. BGP also gains neighbor ... filter-list and a corrected AS-path access-list command.

Hotspot Portal Audit Logs

New Hotspot portal audit log report with configurable retention.

Other New Commands

Command Description
route-metric (interface) Per-interface metric for DHCP-learned default routes, now on Debian 12 gateways
timezone Set the system timezone from the CLI
test throughput ... length <bytes> Set the write buffer size for throughput tests
ip pbr policy ... src <interface> Use an interface name as the PBR source; its IP is tracked live

Enhancements

Area Change
WWAN (mFusion GUI) Scan and select a preferred 4G/5G provider from the GUI; Force SIM Failover action button; SINR added as a WWAN tracking method; SIM Slot column on the Mobile dashboard.
IPsec strongSwan retransmit schedule tuned for faster dead-peer detection; MOBIKE disabled; connections are torn down gracefully before stop; watchdog recovers an unresponsive IPsec control daemon.
WireGuard no forms added for peer, mesh and interface commands so mFusion can sync removals; show wg displays mesh mode and endpoint source.
Firewall show firewall dnat-list all now lists nested NAT chains.
DHCP / VRF DHCP client and relay are VRF-aware on Debian 12; default routes land in the correct VRF table; stale VRF default routes are withdrawn on carrier loss.
Charts & Reports Monitoring charts migrated to a new chart engine with stacked-graph support, including in PDF reports; report items are kept when the entity list changes.
Admin Forms Host, entity and user forms reworked for clearer layout, with service subscriptions on entities and an inheritance explanation for user entities.
Monitoring Objects Clone now works on discovered and templated items, triggers and graphs; host template sync no longer silently unlinks templates.
Ads Manager Monthly impression cap per campaign; ads pause cascades to child entities.
SMS hSenid gateway updated for the new M1 SDP address.
Performance Monitoring collectors now run one after another at low priority from a single scheduler, instead of all starting together every 5 minutes; the tracking daemon uses far less CPU. Traffic forwarding keeps priority on the CPU.
System Disk-full cleanup can no longer reduce database retention below 31 days; mFusion System Sync logs are rotated.

Bug Fixes

Area Fix
IPsec Fix VTI endpoint staying stale after a WAN failover; fix IPsec restarting every 10–16 s for responder-only peers; fix leftover XFRM state, routing rules and TCP MSS clamps after a peer is removed.
WireGuard Fix download blackhole on cellular/PPPoE branches; fix show wg mixing up local networks across multiple instances; fix mesh peer state being lost after reboot.
Routing Fix interface enable not restoring the DHCP default route; fix no interface <if> vrf <id> leaving the device in the VRF; fix route parsing breaking on newer ECMP/nexthop output formats; FRR ECMP nexthop recovery workaround.
Tracking Fix stray tracking daemons that were never stopped; fix daemon single-instance race; fix no vrrp-group leaving a stale tracking entry; fix false config-rollback reboots after mFusion config pushes.
Upgrade Fix upgrades restarting services mid-maintenance (leaving RADIUS down); fix hotspot quota database update failing on every upgrade.
Debian 10 / 12 Fix 30+ minute delay when rebooting from the bash shell; fix GUI sessions expiring after 24 minutes; fix GUI PHP limits never applied; fix OpenVPN failing to start on Debian 10; fix NTP config written to the wrong path on Debian 10; add NTP step-correction for Debian 10 hardware clock drift.
DHCP Relay Fix ip dhcp-helper not working.
Security Fix SQL injection in map data requests; fix locked-field mass-assignment in admin edit forms; webfilter XSS fixes; the ssh CLI command is hardened against option injection.
QoS Fix no class rejecting class removals pushed from mFusion as an illegal command, which left the old class in place and failed the whole config push.
TCP Acceleration Fix overlapping configuration changes on a shared TCP Acceleration server interfering with each other.
API Fix API authentication failing when the Content-Type header includes a charset.
RMM Fix duplicate VPN tunnel IP assignment; fix VPN branch network list showing gateway interfaces; fix VRF ID inheritance between gateway and branch; fix Import CLI action.

Removed

  • mfusion probe CLI command (obsolete).
  • telnet CLI command — removed because a full telnet client can open a local shell from the restricted CLI.

20260731-1700

Major Changes

  • Monitoring pipeline optimisation (Debian 12) — Gateway monitoring items now emit structured JSON, and mFusion dependent items use JSONPath preprocessing instead of regex parsing. This dramatically reduces server preprocessing cost per item and eliminates preprocessing queue buildup on large deployments. Interface, SLA link, DHCP, WiFi (AP/STA), WWAN, and system metrics are covered. Use the updated Template_Gateway.
  • mFusion dashboard performance overhaul — RMM dashboards, host pages, topology, and maps are served from a warm host-status cache with a rewritten data-access layer (RAPI2). Item View loading reduced from 18s to 7s; overview and entity pages load progressively with per-section indicators.
  • LDAP authentication for mFusion — Full LDAP directory login for the management portal, including 2FA for LDAP users, per-auth-type profile validation, account lockout, and encrypted settings storage.

New Features

Mobile (SIM) Monitoring — mFusion RMM

New entity-wide Mobile monitoring page: signal quality summary charts with unified Excellent/Good/Fair/Poor buckets, SINR-based signal reporting, per-SIM data usage breakdown, and automatic discovery of SIM interfaces across hosts.

IoT Monitoring — mFusion RMM

New IoT sub-page on the RMM Dashboard for sensor data (smart plugs, environmental, air quality). Item forms support the Trapper item type with JSONPath preprocessing; sensors get an age-based offline grace period for accurate status.

Netflow SOC Dashboard

New SOC sub-tab in Netflow analytics backed by the nfdump engine: threat-hunting flow table, brute-force detection, and ASN-based application category classification enriched with DSCP and flow-shape signals. The ASN data provider is switchable — IPinfo Lite (default) or MaxMind.

Adaptive Wireless & Mass WiFi Optimization — mFusion RMM

Adaptive wireless channel, bandwidth, and transmit power management for monitored devices, plus a Mass WiFi Optimization action across SD-WAN hosts with per-host skip logging to the admin log.

SMTP / Email Settings Overhaul

Redesigned SMTP settings with dedicated authentication and security options, HELO override, and the SMTP password encrypted at rest. All email send paths are logged, and the mFusion Email media type is automatically synced from mFusion SMTP settings. The Local SMTP Server option is retired; existing configurations are migrated automatically.

TWAMP Support

Two-Way Active Measurement Protocol (TWAMP) support added to the gateway for standards-based round-trip latency and SLA measurement against third-party equipment.

Configuration Restore Modes

Backup restore now offers Full Config Only and Incremental Only modes in addition to the standard full restore, allowing device configuration and historical data to be restored independently.

Hotspot Monthly Quota

New monthly free quota rule (CS-Total-MB-Monthly) joins the existing weekly rules, with multi-cycle quota resolution and period-aware statistics. Quota is adjusted automatically when a user's profession changes.

Clock-Skew Detection

Hosts whose system clock drifts more than 15 minutes from the server are flagged with a new CLOCK-SKEW status, with KPI drill-down to the affected devices.

Enhancements

Area Change
VPN Status Output show status output for IPsec, WireGuard, and SSL VPN server standardised to a common format; protocol and listening port now displayed in the header.
IPsec Configuration changes now restart only the affected tunnels instead of all tunnels.
NTP Migrated to ntpsec with a refactored architecture that preserves custom configuration across CLI command updates; show ip ntp-server output formatting improved.
mFusion Server Tuning New ultra-tier profile for 128GB+ servers with heavy preprocessing workloads; Tier 2 (16GB/2000 hosts) settings proven stable; dynamic file-descriptor (ulimit) tuning.
Dashboard UI Collapsible dashboard sections with Expand/Collapse All controls; doughnut charts show centre totals; settings pages gain per-portion Save/Cancel with inline results; sidebar collapsed state persists across navigation.
Topology SD-WAN VPN tunnel edges coloured by live IPsec tunnel status, with hover tooltip showing tunnel details; Topology menu moved above Hosts.
Audit Log Audit log archives added; username and source-IP resolution hardened; secret values consistently masked.
mFusion Objects Clone function added for items, triggers, and graphs.
Host Mass Update Pre-flight validation, improved template handling, and consolidated result messages.
Switchport (RMM) Speed/duplex configuration and Shutdown option added; CLI compiler redesigned.
PBR (RMM) Policy-based routing supported in configuration extraction; PBR monitoring added.
Hotspot Guest WiFi login per vessel (EPS deployments); quota rule validation and error messages improved; marketing column added to visitors list.
CLI test aaa gains a nasip option; firewall-disable input/access accept extra options.
Security Apache configuration hardened; special characters (e.g. $) supported in BGP passwords and IPsec pre-shared keys; SQL-injection and dashboard-hijack hardening in mFusion.

Bug Fixes

Area Fix
IPsec Fix duplicate CHILD_SAs created on configuration changes and infinite restart loops; fix status display for multi-subnet configurations; fix peer tracking.
SLA Monitoring Fix gateway IP extraction on modern kernel route formats; allow SLA probes to use the default gateway.
WiFi Monitoring Client counts now calculated from the actual client table — the summary section was unreliable and could under-report.
Configuration Fix conditions where running configuration could be lost; fix configuration revival after failure.
Hotspot Fix online-users dashboard showing 1 instead of the actual count; fix negative quota on period switch; fix username search in user management.
SMTP Fix silent password-encryption failure; fix settings save bugs; display fields self-heal on form load.
Auto Backup Fix MySQL connection loss during long runs, concurrent-run conflicts, FTP timeout handling, and first-run status errors.
Charts Fix 95th percentile and Min/Max statistics on interface and item charts; fix SSIDs By HW Mode chart aggregating on the wrong field.
mFusion Fix payment gateway settings save and cross-tab save wipe; fix "Token not match" on manual report send; fix mFusion crashes and watchdog logic on NMS-5000.

20260512-1200

Major Changes

  • Device monitoring is revamped. Use Template_Gateway for base monitoring items (replacing older Template_mbox).

Improvements & Maintenance

Area Change
Build System Fixed missing execute bits on OpenWrt init scripts, CGI binaries, and tools due to NTFS copy issues during build process — affects HSG and CMG prebuilt images
Package Consistency Applied standard Makefile execute-bit fixes across the gateway firmware package tree for reliable script execution on device startup
net-snmp Restored mibII/var_route module compatibility; resolved undefined var_ipRouteEntry symbol on gateway systems
Security Auditing Continues SSH hardening and account security enhancements from 20260420 release
DNS Filtering Orchestration Added DNS filtering orchestration using either template or direct filtering rules

20260420-1700

New Features

DNS Filtering

New dns-group and dns-filter CLI commands provide domain-based DNS filtering with blacklist and whitelist modes. Domain entries automatically cover all subdomains (wildcard matching); more specific entries take precedence over broader ones. Named groups (dns-group) allow bulk domain management — add or remove domains from a group without modifying filter rules.

dns-group adult-sites
  domain playboy.com
!
dns-filter 100 deny group adult-sites
dns-filter 200 permit all

See DNS Filtering for full configuration details.

Netflow Traffic Analytics

New Netflow dashboard in mFusion provides per-entity traffic visibility. Features include: entity-based filter, server-driven date range selection, flow records viewer with time filter, Resolve IP lookup, WiFi client columns, and an hourly raw flow cache backed by RAM for performance. Access is restricted to super-admin accounts.

mFusion Account Security

Comprehensive account security controls for the mFusion management portal:

  • Configurable password policy — minimum length, complexity requirements, password history
  • Account lockout after configurable failed login attempts, with automatic re-enable timer
  • Forced password change on first login or by admin action
  • Pre-login banners and per-notice dismissal for compliance messaging
  • Full audit log for all account-related events (standardised JSON format)
  • LDAP authentication phase 2 enhancements

IPsec VRF Support

IPsec tunnels can now be bound to a specific VRF, enabling traffic isolation for multi-tenant or segmented deployments. Configurable from both CLI and mFusion GUI.

Hotspot Client Sticky — API Mode

Hotspot client session stickiness now supports an API-based mode in addition to the default MySQL mode. API mode allows integration with external session management systems. The mode is selectable from the CLI.

Enhancements

Area Change
QoS Traffic shaping class number range moved to 200–279, separated from PBR range 100–199 to prevent fwmark conflicts. HTB priority formula updated accordingly.
IP Track Enhanced system reachability tracking — improved probe interface binding and route persistence for multi-WAN environments.
Show Interface show interface (no arguments) reformatted as a commercial-grade summary table; show interface vrf and show ip interface output also improved.
SLA Monitoring SLA and system monitoring performance optimisations.
mFusion Interface state monitoring improvements for more accurate link-state reporting.
BGP AS-path prepend command fix — CLI compiler updated to handle multi-word values correctly (ticket 71419).
SSH SSH daemon hardened — weak KEX algorithms removed, MaxAuthTries tightened, ClientAlive parameters corrected.
Audit Log Admin audit log standardised to JSON format across Device, RMM, and Hotspot modules for consistent log parsing.
GUI Topology map tab renamed from "Topology Map" to "Topology".
WiFi Pages Device WiFi pages use dynamic column parsing for improved compatibility across firmware versions.
FTP Logs FTP process logs improved in Logviewer for better visibility of archive operations.
Hotspot Auto refresh added for self-registration portal. @ character now permitted in string filter fields.
Payment Payment receipt is now standard — CMS toggle removed; receipt is always sent on successful transaction.

Bug Fixes

Area Fix
PBR Fix route persistence across reloads, metric grep pattern, and tracking probe interface binding.
VLAN Fix incorrect VLAN interface number assignment in edge cases.
WireGuard Fix WireGuard VPN CLI command error; resolve tunnel state handling bug.
FreeRADIUS Fix quota rejection failure when CS-Total-MB-Weekly / CS-Total-MB-All attributes carry negative values (unsigned overflow).
Netflow Fix redirect on entity switch when no data exists; fix flow records time filter; fix loading indicator position; fix permissions for non-super-admin access.
mFusion Fix re-enable action incorrectly resetting inactivity clock. Fix payment vendor field failing to load in CMS form.