OpenMPTCProuter News

OpenMPTCProuter v0.65 is available. This release is built only with the 6.18 kernel. It comes with VPS script v0.1097 (kernel 6.18.59).

Highlights:

• Kernel 6.18.59 on router and VPS, fixing CVE-2026-98432 (use-after-free when a SYN with IPv4 options reaches a listening TCP socket)
• New MPTCP BPF schedulers: ECF, BLEST and overflow. All BPF schedulers fixed, with IPv6 and backup subflow support
• MQVPN 0.19.0, with a path MTU setting, every path bound to a WAN and much faster failover
• Configurable return to the master server after a failover (immediate, delayed or manual)
• Balanced default routes use resilient nexthop groups
• Full bypass by source interface in omr-bypass
• Quota: new "block" action that keeps the WAN up, the last working WAN is never cut
• New LuCI app to set up High Availability with keepalived, and LuCI apps for XRay and V2Ray
• VPS API certificate pinning, many security fixes
• Automatic reserved ports and memory tuning on router and VPS
• Runtime state moved to /var/state: far fewer writes to flash

Router (openmptcprouter-feeds v0.64.2 to v0.65)

Kernel

• Kernel updated to 6.18.59, fixing CVE-2026-98432: a use-after-free when a SYN with IPv4 options (Record Route or Timestamp) reaches a listening TCP socket. It is not related to MPTCP

MPTCP and BPF schedulers

• New ECF, BLEST and overflow BPF schedulers (not installed on small targets)
• Fixed the first, rr, red, weight, weight-rr, dscp and bkup schedulers: retransmit like the default scheduler, keep backup subflows for when the others are down, don't use a backup when the active subflows are only full, read the stale flag through CO-RE (the schedulers failed to load on 6.18.55)
• weight, weight-rr and dscp schedulers handle IPv6 subflows; a DSCP class is pinned to every endpoint id of a WAN
• DSCP and weight schedulers no longer forced on the VPS; DSCP pins and weights kept in sync with the VPS
• A v0.9x BLEST or ECF setting is kept on its BPF port
• Each address of a WAN gets its own endpoint id; fixed endpoint id collisions that left a WAN red
• Never delete another WAN's endpoint, keep a WAN's endpoints when another interface shares its device, don't add back the endpoint of a WAN the tracker has down
• Device options set in LuCI applied; a reload only sets and commits what changed
• BPF scheduler unregistered on stop, kept registered on per-WAN cleanup
• mptcpd updated to 0.14 and provides mptcpize
• LuCI: show the scheduler the kernel actually uses, MPTCP Support Check page in the menu, WAN weight bounded to 1-256, an unset weight stays unset, absolute counters in multipath -m, trace to the master VPS

MQVPN

• Updated to 0.19.0 (was 0.16.x), xquic built with FEC, New Reno, Copa and unlimited congestion controls
• Every MQVPN path bound to a WAN: much faster failover when the primary WAN is loaded or lost (#4401)
• Path MTU setting, synced with the VPS; PMTU discovery on by default
• Reorder settings sent to the VPS; minrtt scheduler by default; every scheduler offered in the wizard
• Server key pinned instead of insecure TLS; config written 0600; no auth key shipped
• Routing left to OpenMPTCProuter; MQVPN moved to the server in use on failover
• Client status logged every 5 minutes, warnings only by default, path failures logged once
• Router tunnel IP sent again to the VPS when it changes (#4408)

omr-tracker (failover)

• Configurable return to the master server: immediate, delayed or manual (#3205)
• Balanced IPv4 default routes through resilient nexthop groups; balanced route rebuilt on a weight change (#4304), one tracker at a time, and no longer replaced by a single WAN when a WAN fails
• New "monitor only" mode per interface
• Servers shown on the status page, new rpcd omr-tracker object
• Fixed server failover: stay on the first backup server that answers, follow the server in use in OpenVPN bonding, keep the new server current while the VPNs restart, the proxy address can trigger a server switch
• WAN routes restored when the link comes back; gateway looked up again when it stops answering
• Glorytun UDP: master WAN path, IPv6 path, a WAN tracked with the glorytun-udp type can recover
• IPv6 checks can no longer hide an IPv4 failure; IPv4 and IPv6 routes of table 991337 tracked apart
• Up streak kept for a tracker restarted while down; modem not reset while tries_up holds the status
• Starts even when MPTCP is disabled
• Server alert scripts run on transitions only; VPS sync retries left to omr-schedule
• Fewer processes per tracking cycle: lower CPU load on small routers
• VPN and proxy LEDs follow the LED page
• LuCI: show the values the trackers run with and the flags taken from the defaults, tracking can be turned off, advanced settings kept on save

omr-bypass

• Full bypass by source interface, better failover support
• Database rebuilt from nDPI with wildcard hosts expanded; wildcard domain rules expanded again
• nDPId: detections DSCP-marked, TCP or UDP only rules go to that protocol's set, consumer reconnects when ndpisrvd restarts, hardened flow tracker
• Sets kept in step with the rules, only changes written, stale set elements deleted before fw4 reload, dnsmasq sets refilled after an fw4 restart
• Address family and TCP/UDP restriction honoured; each destination gets its own dnsmasq ipset
• Rule values validated before reaching a shell or nft; bypass domains validated
• "Disable AAAA IPv6 DNS" works again (#4342)
• Last RIPE answer for each AS kept on flash; ASN prefixes kept out of the firewall config
• DSCP-only rules no longer turned into bypass rules on upgrade
• Bypass rules reloaded by Shadowsocks when they are missing

omr-quota

• New "block" action that keeps the WAN up, and LAN block (forward also blocked)
• The last working WAN is never cut; a cut PPPoE or 3G WAN stays cut
• Daily budget sized to the calculation window; quota reset kept until the period ends; enforced usage never goes down within a period
• Real interface usage between vnstat entries, 5 s quota interval, vnstat month bucket counted only in its own month
• No live metering before a future begin date; settings validated

Proxies (Shadowsocks, XRay, V2Ray)

• XRay 26.10.29, V2Ray 5.54.2, Shadowsocks-Rust 1.25.0
• New LuCI apps for XRay and V2Ray; no-op saves no longer change inbounds or drop options
• VPS certificate pinning on every outbound: pins in hex or base64, only a certificate the VPS CA issued, re-issued certificate followed
• MPTCP set on the sockets on every kernel
• User outbounds, routing rules and error log kept on upgrade
• Restart loops fixed: no restart for rules the last start could not make, restart out of the caller's cgroup
• Public IPs of the VPS usable through the proxy; forward rules applied to proxied connections
• UDP redirected only to an ss-redir that takes it; iptables rules packages dropped
• Shadowsocks-Rust: identity keys in 2022 passwords, every cipher and any SIP002 link importable, DSCP on IPv6 MPTCP sockets, tun mode dropped
• Shadowsocks-libev: obfs options validated, existing servers kept on import, disabled servers marked
• Shadowsocks LuCI apps moved to a Proxy menu; configs readable by root only

VPNs

• OpenVPN 2.7.8; server certificate required from the peer; proto none on omrvpn; no restart on every config pull
• Glorytun UDP: changed tunnel addresses applied on reload, unchanged tunnel kept, persist and timeouts honoured, config kept over upgrade
• Glorytun TCP: instances added from LuCI start
• DSVPN: tunnel address kept on reload
• MLVPN runs under procd; loss tolerance from LuCI sent to the VPS
• SoftEther 5.2.5188: vpncmd arguments quoted, configs 0600, client account set up at start
• MPTCP over VPN keeps working on failover and when no server is in use; tunnels of a deleted WAN cleaned up
• VPNs check if MPTCP is disabled

VPS sync and API

• VPS API called with its certificate key pinned; request body sent on stdin; login url-encoded and key kept off the command line
• Shell injection fixed in the status and settings rpcd calls; write calls granted under the write ACL only
• VPS reached over IPv6; VPS URL built right for an IPv6 address
• Bypass IPs sent from the nft sets to each VPS, as JSON; DSCP sets sent too
• Only ACCEPT and DNAT redirects sent; only the WireGuard peers that point at that server
• Pi-hole: state asked to each server, used with MQVPN too, removed when the tunnel fails, hand-set DNS kept
• VPS backup checked before restoring; Backup page works again
• Failed VPS login logged once per outage; API errors reported in the log
• VXLAN, Pi-hole and pin pushes back off when they cannot make progress

Wizard and status page

• Country and DNS64 in effect shown and compared, pushed only when changed
• Wizard saves no longer rewrite WANs, retype sections or drop per-WAN options, proxies, VPNs or transports it does not list
• A new WAN takes the first free wanN; the VPN starts on the save that adds the first server; VPN and proxy stay off while no server is in use
• Force TTL on the right device; MPTCP not turned on for a LAN
• Debug config masks addresses, IPv6 beyond two groups and every secret; VPS hostname and phone number anonymized on the status page (#1289)
• Backup and restart calls run in the background
• "Disable server http test" removed

System and network

• Automatic reserved ports, network memory sizing (tcp_mem, udp_mem, conntrack) from RAM
• Runtime values moved to /var/state instead of /etc/config
• Local resolver used at boot until the tunnel is up, and put back when the server is disabled
• Unbound trusts the 2024 root KSK; a stale root trust anchor is updated from IANA (#4396)
• Remote syslog: syslog-ng logs sent to the remote log server, local logging kept, log size cap follows log_size
• IPv6 MTU probe ratchet fixed (#4373); IPv4 and IPv6 public IPs no longer shared (#4375)
• FTP helper assigned to what comes from the VPS; new rule to always permit ICMP to the router
• Kept over upgrades: firewall default policies, VPN zone, NTP servers and log levels, UPnP, unbound options, tunnel SQM queue, Shadowsocks redirectors
• ttyd off on upgrades too; package signatures checked again
• omr-schedule: proxy that keeps dying restarted with a back-off, dead sqm-autorate restarted, rpcd/ubus crash detection, latest versions checked hourly
• omr-dscp: forwarded traffic marked, fw4 reloaded only when the rules changed and never restarted
• omr-metrics: VPS decision model weights applied, API key pinned, no more API flooding, busy WANs sent
• sqm-autorate: congestion targets kept off flash, 10 s global ping timeout, configs written only on change
• nDPId 1.7.3, started with its generated config, every instance shown
• Macvlan: only orphaned devices deleted

LuCI

• luci-app-keepalived-ha: new app to simplify HA setup, sync key kept across sysupgrade, DHCP leases synced to backups, push to peers over pinned HTTPS only
• luci-app-sysupgrade: firmware checksum checked, versions compared by number, a flash that did not happen reported
• Synced with upstream: luci-app-firewall, luci-app-smartdns, luci-mod-dashboard, luci-mod-network, luci-proto-modemmanager, luci-proto-mbim
• luci-mod-network: wwan protocol view, duplex and offload flags kept, static leases accept only colon-separated MACs
• Many "a no-op save changes a field" fixes across apps; HTML escaping fixes (argon, openmptcprouter themes, network, sysupgrade)
• luci-app-iperf: download result shown, test runs on the server picked
• Missing translations added

Packages and build

• Updated: Go 1.27, Rust 1.99.0, libbpf 1.8.0, iperf3 3.22, msmtp 1.8.34 (GnuTLS), r8152 2.22.1, systemtap 5.6, bcm27xx-eeprom 2026-05-27
• shadowsocks-v2ray-plugin back to the shadowsocks upstream
• fast-classifier and shortcut-fe removed
• Only 6.18 images built; BPI R4 Pro 8x compiled
• Packages signed with the OMR apk key; package dependencies and conffiles fixed

VPS (openmptcprouter-vps v0.1081 to v0.1097)

• Kernel 6.18.59, fixing CVE-2026-98432 (fixed since v0.1092 with 6.18.57); 6.18.57 also fixed the x64v1/x64v2 kernels that did not boot without AVX2 (#4407)
• omr-admin 0.18+20261102: API in TLS 1.3 (TLS 1.2 with AEAD suites only), certificate pinning support, user suspension (OpenVPN revocation, SoftEther, MQVPN), conntrack flushed on a router's new tunnel address (#4408), GRE, WireGuard, XRay, VXLAN and firewall fixes, CVE-2026-102265 and CVE-2026-53539
• MQVPN 0.19.0 (per-client backlog isolation), V2Ray 5.54.2, iperf3 3.22, MPTCP BPF schedulers 1.5-1 with ECF, BLEST and overflow, DSCP and weight managers from their Debian packages
• Debian 13: OMR's MPTCP patched OpenVPN installed; apt pin limited to the packages OMR builds
• Reserved ports and automatic memory allocation (#4381, #4382)
• omr-bypass with nftables: bypassed traffic forwarded and masqueraded (#4384), run after every nftables start and reload, no failure with an empty list
• FTP through a port 21 redirect gets its conntrack helper back (#4365)
• Public IP announced only on MPTCP if available; GRE forward chain; IPv6 RA default route kept
• Pi-hole v6 support, web interface kept on the tunnels
• Security: omr-6in4-run and omr-vxlan-run read the user config as data, JSON configs rewritten with jq, hardened omr-admin.service and mqvpn-server.service, python3-uvicorn never 0.11.5 or 0.13
• UBOND and tracebox removed
• New omr-uninstall.sh to remove what the installer set up
• omr-update keeps a script-installed VPS on its own channel
• omr-service: lighter, leaves omr-admin time to start before restarting it
• Debian package built and published by GitHub Actions