OpenMPTCProuter v0.64.2 is available. This is a maintenance release for v0.64: no kernel update and no new major feature, but a large set of fixes on how interfaces enter and leave MPTCP, on OMR-Tracker, on port forwarding used together with OMR-ByPass, and a real reduction of CPU and log usage.
The server side moves from 0.1069 to 0.1081 and should be updated too: it restores IP forwarding lost during the migration from Shorewall to nftables, repairs the firewall resync and disables a fail2ban jail that could ban a router from its own VPS.
Highlights
- MPTCP interface handling: a WAN could stay stuck in backup, an interface down for OMR-Tracker could be put back into MPTCP, and DHCPv6 companion interfaces were treated as real WANs
- PPPoE WAN could stay down forever in OMR-Tracker (#4371)
- Port forwarding now works when OMR-ByPass is used (#4369)
- Firewall rules, zones and SNAT no longer lose the options left at their default value (#4365)
- Lower CPU usage at rest and limited log file size
- The status page no longer times out (#4360)
- MQVPN updated to 0.16.2, tunnel MTU fixed
- Server updated to 0.1081, with IP forwarding (#4363), firewall resync and fail2ban fixes
MPTCP and interfaces
- Fix a WAN staying permanently in backup: the interface page dropped a multipath value equal to the default, and the value previously saved by OpenMPTCProuter was applied again at every MPTCP start (#4368)
- Multipath information is no longer removed when saving an interface or the wizard
- An interface set down by OMR-Tracker is no longer added back as an MPTCP endpoint
- DHCPv6 companion interfaces (wan16, wan26...) are no longer handled as real multipath interfaces, and multipath is disabled on them
- Better MPTCP path manager support on both sides: only the path managers advertised by the running kernel are used, and an old v0.95 name (fullmesh, ndiffports, binder) is mapped to the mainline kernel path manager instead of failing at every boot
- No more VPN or proxy restart when an MPTCP scheduler change is not actually applied
- MPTCP page: path manager list refreshed, subflow information now read through omr-sockdiag
OMR-Tracker
- Fix PPPoE interfaces staying down: the tracker kept the Ethernet device (eth3.835 for example) because pppd had not published the PPP device yet, and never resolved it again (#4371)
- Fix route replacement and the log line printed at every check when an interface is in balancing and another one in backup (#4358)
- New openmptcprouter.omr.server and openmptcprouter.omr.proxy state, and many values cached: trackers use much less CPU
- Fix the tracker init script
VPN and proxy
- Shadowsocks: fix load balancing between several servers
- Fix ss-local processes left running after a proxy change (#4357)
- The 192.168.1.3 placeholder server address is replaced by 127.0.0.1, so a proxy that is not configured yet can no longer send traffic to a LAN host
- MQVPN updated to 0.16.2: use-after-free fix on the server side, statistics and status available in client mode, default log level raised from error to warn
- MQVPN: a static MTU on the tunnel device overrode the MTU negotiated by MQVPN and could break traffic in one direction, it is now removed automatically
- Glorytun TCP: tunnel addresses are configured once the device exists, and the CPU affinity, multiqueue and sysctl tuning that could break the tunnel is removed
OMR-ByPass and firewall
- Port forwarding and bypass now work together: the reply packets of a connection opened from outside keep the path the connection came in on (#4369)
- Reloading the rules no longer keeps deleted entries in the nftables sets (#4353)
- Less warnings in the log
- LuCI firewall: rules, zones and SNAT keep the options set to a value equal to the default (#4365)
- A rule without target is no longer sent to the VPS, and a port opened with ACCEPT is no longer reopened on the server at every pass
Web interface
- Status page: global time budget on the checks and cached values in the API, the page does not time out anymore (#4360)
- Wizard: changing the server API key now forces the settings to be retrieved from the VPS
- Metrics page: new section for the omrvpn tunnel
- SQM page: new congestion synchronization settings
Metrics and SQM
- New optional integration between OMR-Metrics and SQM autorate: the congestion score of a WAN (queuing delay, loss, jitter, queue backlog, signal quality) tightens the bufferbloat threshold of cake-autorate for that WAN only.
- Metrics are now also collected for the omrvpn tunnel and displayed in the metrics page
- No VPS API call anymore when the server credentials are incomplete: a new router could otherwise fill the fail2ban jail of its own VPS and get banned from it
OMR-Quota
- A quota with a begin date counted the whole vnstat history instead of the traffic since that date
- The speed limit now applies to download too, and not only to upload
- Quota shaping takes the SQM shaper over properly instead of silently replacing it, and gives it back when the quota is cleared
- Various fixes in the daemon, the init script and the quota page
Performance, logs and first boot
- omr-schedule, omr-tracker, omr-metrics and the OpenMPTCProuter API cache more values and do less calls: CPU usage at rest is significantly lower
- Log file size is limited and the syslog default script is fixed
- sysctl: net.core.netdevbudgetusecs was refused by the kernel on HZ=100 devices, and BusyBox sysctl stops at the first error, so every setting after it in the file was silently ignored
- Default QoS, SQM, vnstat and quota configurations now follow the real interfaces on platforms where wan1, wan2... do not exist, and the network is not configured again when it already carries a multipath setting
Server (VPS 0.1069 to 0.1081)
- IP forwarding was lost during the migration from Shorewall to nftables, dropping all the traffic forwarded by the VPN; IPv6 masquerading for client addresses is restored too (#4363)
- The omr-admin firewall chains are repopulated after any start, restart or reload of nftables
- Fix the SIP ALG on fresh installs (#4361)
- XRay VLESS Reality can now be applied from the wizard, the server API refused that name
- fail2ban: the omradmin jail could ban a router being set up (a router without VPS key polls the API with an empty password), which showed up as "can ping server VPS, no server API answer". The filter now matches a real authentication failure logged by omr-admin, and the jail is disabled by default
- The MPTCP path manager sent by the router is mapped to a name the running kernel supports, and a wrong value already saved is repaired at start
- The VPS version reported to the router is read correctly, so the update message is no longer permanent or never shown
- MQVPN 0.16.2, users and keys preserved on update, new /mqvpn_users endpoint
- VXLAN: a VNI and port pair already used by another user is rejected, and the addresses derived from the user id are fixed for high user ids
- install_omr-ai.sh fixed with InfluxDB 3.10 and 3.11 (#4366)
- Install fixes: the VPS stayed unreachable over SSH after the port change until the next reboot, xray and mlvpn could end in failed state after a fresh install, the OMR kernel was not set as default GRUB entry, and boot could wait two minutes on systemd-networkd-wait-online (#4367)
- UFW and firewalld are force disabled at install so they cannot conflict with the nftables firewall
Updating the VPS to 0.1081 is recommended.
