OpenMPTCProuter v0.65 is available. This release is built only with the 6.18 kernel. It comes with VPS script v0.1097 (kernel 6.18.59).

Highlights:

  • Kernel 6.18.59 on router and VPS, fixing CVE-2026-98432 (use-after-free when a SYN with IPv4 options reaches a listening TCP socket)
  • New MPTCP BPF schedulers: ECF, BLEST and overflow. All BPF schedulers fixed, with IPv6 and backup subflow support
  • MQVPN 0.19.0, with a path MTU setting, every path bound to a WAN and much faster failover
  • Configurable return to the master server after a failover (immediate, delayed or manual)
  • Balanced default routes use resilient nexthop groups
  • Full bypass by source interface in omr-bypass
  • Quota: new "block" action that keeps the WAN up, the last working WAN is never cut
  • New LuCI app to set up High Availability with keepalived, and LuCI apps for XRay and V2Ray
  • VPS API certificate pinning, many security fixes
  • Automatic reserved ports and memory tuning on router and VPS
  • Runtime state moved to /var/state: far fewer writes to flash

Router (openmptcprouter-feeds v0.64.2 to v0.65)

Kernel

  • Kernel updated to 6.18.59, fixing CVE-2026-98432: a use-after-free when a SYN with IPv4 options (Record Route or Timestamp) reaches a listening TCP socket. It is not related to MPTCP

MPTCP and BPF schedulers

  • New ECF, BLEST and overflow BPF schedulers (not installed on small targets)
  • Fixed the first, rr, red, weight, weight-rr, dscp and bkup schedulers: retransmit like the default scheduler, keep backup subflows for when the others are down, don't use a backup when the active subflows are only full, read the stale flag through CO-RE (the schedulers failed to load on 6.18.55)
  • weight, weight-rr and dscp schedulers handle IPv6 subflows; a DSCP class is pinned to every endpoint id of a WAN
  • DSCP and weight schedulers no longer forced on the VPS; DSCP pins and weights kept in sync with the VPS
  • A v0.9x BLEST or ECF setting is kept on its BPF port
  • Each address of a WAN gets its own endpoint id; fixed endpoint id collisions that left a WAN red
  • Never delete another WAN's endpoint, keep a WAN's endpoints when another interface shares its device, don't add back the endpoint of a WAN the tracker has down
  • Device options set in LuCI applied; a reload only sets and commits what changed
  • BPF scheduler unregistered on stop, kept registered on per-WAN cleanup
  • mptcpd updated to 0.14 and provides mptcpize
  • LuCI: show the scheduler the kernel actually uses, MPTCP Support Check page in the menu, WAN weight bounded to 1-256, an unset weight stays unset, absolute counters in multipath -m, trace to the master VPS

MQVPN

  • Updated to 0.19.0 (was 0.16.x), xquic built with FEC, New Reno, Copa and unlimited congestion controls
  • Every MQVPN path bound to a WAN: much faster failover when the primary WAN is loaded or lost (#4401)
  • Path MTU setting, synced with the VPS; PMTU discovery on by default
  • Reorder settings sent to the VPS; minrtt scheduler by default; every scheduler offered in the wizard
  • Server key pinned instead of insecure TLS; config written 0600; no auth key shipped
  • Routing left to OpenMPTCProuter; MQVPN moved to the server in use on failover
  • Client status logged every 5 minutes, warnings only by default, path failures logged once
  • Router tunnel IP sent again to the VPS when it changes (#4408)

omr-tracker (failover)

  • Configurable return to the master server: immediate, delayed or manual (#3205)
  • Balanced IPv4 default routes through resilient nexthop groups; balanced route rebuilt on a weight change (#4304), one tracker at a time, and no longer replaced by a single WAN when a WAN fails
  • New "monitor only" mode per interface
  • Servers shown on the status page, new rpcd omr-tracker object
  • Fixed server failover: stay on the first backup server that answers, follow the server in use in OpenVPN bonding, keep the new server current while the VPNs restart, the proxy address can trigger a server switch
  • WAN routes restored when the link comes back; gateway looked up again when it stops answering
  • Glorytun UDP: master WAN path, IPv6 path, a WAN tracked with the glorytun-udp type can recover
  • IPv6 checks can no longer hide an IPv4 failure; IPv4 and IPv6 routes of table 991337 tracked apart
  • Up streak kept for a tracker restarted while down; modem not reset while tries_up holds the status
  • Starts even when MPTCP is disabled
  • Server alert scripts run on transitions only; VPS sync retries left to omr-schedule
  • Fewer processes per tracking cycle: lower CPU load on small routers
  • VPN and proxy LEDs follow the LED page
  • LuCI: show the values the trackers run with and the flags taken from the defaults, tracking can be turned off, advanced settings kept on save

omr-bypass

  • Full bypass by source interface, better failover support
  • Database rebuilt from nDPI with wildcard hosts expanded; wildcard domain rules expanded again
  • nDPId: detections DSCP-marked, TCP or UDP only rules go to that protocol's set, consumer reconnects when ndpisrvd restarts, hardened flow tracker
  • Sets kept in step with the rules, only changes written, stale set elements deleted before fw4 reload, dnsmasq sets refilled after an fw4 restart
  • Address family and TCP/UDP restriction honoured; each destination gets its own dnsmasq ipset
  • Rule values validated before reaching a shell or nft; bypass domains validated
  • "Disable AAAA IPv6 DNS" works again (#4342)
  • Last RIPE answer for each AS kept on flash; ASN prefixes kept out of the firewall config
  • DSCP-only rules no longer turned into bypass rules on upgrade
  • Bypass rules reloaded by Shadowsocks when they are missing

omr-quota

  • New "block" action that keeps the WAN up, and LAN block (forward also blocked)
  • The last working WAN is never cut; a cut PPPoE or 3G WAN stays cut
  • Daily budget sized to the calculation window; quota reset kept until the period ends; enforced usage never goes down within a period
  • Real interface usage between vnstat entries, 5 s quota interval, vnstat month bucket counted only in its own month
  • No live metering before a future begin date; settings validated

Proxies (Shadowsocks, XRay, V2Ray)

  • XRay 26.10.29, V2Ray 5.54.2, Shadowsocks-Rust 1.25.0
  • New LuCI apps for XRay and V2Ray; no-op saves no longer change inbounds or drop options
  • VPS certificate pinning on every outbound: pins in hex or base64, only a certificate the VPS CA issued, re-issued certificate followed
  • MPTCP set on the sockets on every kernel
  • User outbounds, routing rules and error log kept on upgrade
  • Restart loops fixed: no restart for rules the last start could not make, restart out of the caller's cgroup
  • Public IPs of the VPS usable through the proxy; forward rules applied to proxied connections
  • UDP redirected only to an ss-redir that takes it; iptables rules packages dropped
  • Shadowsocks-Rust: identity keys in 2022 passwords, every cipher and any SIP002 link importable, DSCP on IPv6 MPTCP sockets, tun mode dropped
  • Shadowsocks-libev: obfs options validated, existing servers kept on import, disabled servers marked
  • Shadowsocks LuCI apps moved to a Proxy menu; configs readable by root only

VPNs

  • OpenVPN 2.7.8; server certificate required from the peer; proto none on omrvpn; no restart on every config pull
  • Glorytun UDP: changed tunnel addresses applied on reload, unchanged tunnel kept, persist and timeouts honoured, config kept over upgrade
  • Glorytun TCP: instances added from LuCI start
  • DSVPN: tunnel address kept on reload
  • MLVPN runs under procd; loss tolerance from LuCI sent to the VPS
  • SoftEther 5.2.5188: vpncmd arguments quoted, configs 0600, client account set up at start
  • MPTCP over VPN keeps working on failover and when no server is in use; tunnels of a deleted WAN cleaned up
  • VPNs check if MPTCP is disabled

VPS sync and API

  • VPS API called with its certificate key pinned; request body sent on stdin; login url-encoded and key kept off the command line
  • Shell injection fixed in the status and settings rpcd calls; write calls granted under the write ACL only
  • VPS reached over IPv6; VPS URL built right for an IPv6 address
  • Bypass IPs sent from the nft sets to each VPS, as JSON; DSCP sets sent too
  • Only ACCEPT and DNAT redirects sent; only the WireGuard peers that point at that server
  • Pi-hole: state asked to each server, used with MQVPN too, removed when the tunnel fails, hand-set DNS kept
  • VPS backup checked before restoring; Backup page works again
  • Failed VPS login logged once per outage; API errors reported in the log
  • VXLAN, Pi-hole and pin pushes back off when they cannot make progress

Wizard and status page

  • Country and DNS64 in effect shown and compared, pushed only when changed
  • Wizard saves no longer rewrite WANs, retype sections or drop per-WAN options, proxies, VPNs or transports it does not list
  • A new WAN takes the first free wanN; the VPN starts on the save that adds the first server; VPN and proxy stay off while no server is in use
  • Force TTL on the right device; MPTCP not turned on for a LAN
  • Debug config masks addresses, IPv6 beyond two groups and every secret; VPS hostname and phone number anonymized on the status page (#1289)
  • Backup and restart calls run in the background
  • "Disable server http test" removed

System and network

  • Automatic reserved ports, network memory sizing (tcp_mem, udp_mem, conntrack) from RAM
  • Runtime values moved to /var/state instead of /etc/config
  • Local resolver used at boot until the tunnel is up, and put back when the server is disabled
  • Unbound trusts the 2024 root KSK; a stale root trust anchor is updated from IANA (#4396)
  • Remote syslog: syslog-ng logs sent to the remote log server, local logging kept, log size cap follows log_size
  • IPv6 MTU probe ratchet fixed (#4373); IPv4 and IPv6 public IPs no longer shared (#4375)
  • FTP helper assigned to what comes from the VPS; new rule to always permit ICMP to the router
  • Kept over upgrades: firewall default policies, VPN zone, NTP servers and log levels, UPnP, unbound options, tunnel SQM queue, Shadowsocks redirectors
  • ttyd off on upgrades too; package signatures checked again
  • omr-schedule: proxy that keeps dying restarted with a back-off, dead sqm-autorate restarted, rpcd/ubus crash detection, latest versions checked hourly
  • omr-dscp: forwarded traffic marked, fw4 reloaded only when the rules changed and never restarted
  • omr-metrics: VPS decision model weights applied, API key pinned, no more API flooding, busy WANs sent
  • sqm-autorate: congestion targets kept off flash, 10 s global ping timeout, configs written only on change
  • nDPId 1.7.3, started with its generated config, every instance shown
  • Macvlan: only orphaned devices deleted

LuCI

  • luci-app-keepalived-ha: new app to simplify HA setup, sync key kept across sysupgrade, DHCP leases synced to backups, push to peers over pinned HTTPS only
  • luci-app-sysupgrade: firmware checksum checked, versions compared by number, a flash that did not happen reported
  • Synced with upstream: luci-app-firewall, luci-app-smartdns, luci-mod-dashboard, luci-mod-network, luci-proto-modemmanager, luci-proto-mbim
  • luci-mod-network: wwan protocol view, duplex and offload flags kept, static leases accept only colon-separated MACs
  • Many "a no-op save changes a field" fixes across apps; HTML escaping fixes (argon, openmptcprouter themes, network, sysupgrade)
  • luci-app-iperf: download result shown, test runs on the server picked
  • Missing translations added

Packages and build

  • Updated: Go 1.27, Rust 1.99.0, libbpf 1.8.0, iperf3 3.22, msmtp 1.8.34 (GnuTLS), r8152 2.22.1, systemtap 5.6, bcm27xx-eeprom 2026-05-27
  • shadowsocks-v2ray-plugin back to the shadowsocks upstream
  • fast-classifier and shortcut-fe removed
  • Only 6.18 images built; BPI R4 Pro 8x compiled
  • Packages signed with the OMR apk key; package dependencies and conffiles fixed

VPS (openmptcprouter-vps v0.1081 to v0.1097)

  • Kernel 6.18.59, fixing CVE-2026-98432 (fixed since v0.1092 with 6.18.57); 6.18.57 also fixed the x64v1/x64v2 kernels that did not boot without AVX2 (#4407)
  • omr-admin 0.18+20261102: API in TLS 1.3 (TLS 1.2 with AEAD suites only), certificate pinning support, user suspension (OpenVPN revocation, SoftEther, MQVPN), conntrack flushed on a router's new tunnel address (#4408), GRE, WireGuard, XRay, VXLAN and firewall fixes, CVE-2026-102265 and CVE-2026-53539
  • MQVPN 0.19.0 (per-client backlog isolation), V2Ray 5.54.2, iperf3 3.22, MPTCP BPF schedulers 1.5-1 with ECF, BLEST and overflow, DSCP and weight managers from their Debian packages
  • Debian 13: OMR's MPTCP patched OpenVPN installed; apt pin limited to the packages OMR builds
  • Reserved ports and automatic memory allocation (#4381, #4382)
  • omr-bypass with nftables: bypassed traffic forwarded and masqueraded (#4384), run after every nftables start and reload, no failure with an empty list
  • FTP through a port 21 redirect gets its conntrack helper back (#4365)
  • Public IP announced only on MPTCP if available; GRE forward chain; IPv6 RA default route kept
  • Pi-hole v6 support, web interface kept on the tunnels
  • Security: omr-6in4-run and omr-vxlan-run read the user config as data, JSON configs rewritten with jq, hardened omr-admin.service and mqvpn-server.service, python3-uvicorn never 0.11.5 or 0.13
  • UBOND and tracebox removed
  • New omr-uninstall.sh to remove what the installer set up
  • omr-update keeps a script-installed VPS on its own channel
  • omr-service: lighter, leaves omr-admin time to start before restarting it
  • Debian package built and published by GitHub Actions