Firmware v4.9 Preview: What to Expect

[will.qiu]

@Chris5

What I mean by this is that the whitelist is not used and an unauthorized person from outside will break the Wi-Fi network security and monitor the panel page to find out the password

So, do you mean that you would like to configure the router to use an whitelist/allowlist mode?

You can configure this under Admin Panel → Clients → Access Control → Allowlist.

Please refer to the following documentation for more details:

Blocklist - Clients - GL.iNet Router Docs 4

@Chris5

Another thing is that if I have https disabled, I can still access the panel via https. Is this normal?

As far as we know, we should do not provide an option to disable HTTPS.

Could you please clarify how you disabled HTTPS?

[will.qiu]

@knee_mountain523

Apple generally prevent users from downgrading to older OS updates. Will GL.iNet do that or all firmware versions will be available for download and allow the downgrade and upgrade as needed? Given the current situation with the no-VPN option, I hope that v4.8 will continue to be made available for download for the foreseeable future even when v4.9 and v4.10 becomes final.

No, we do not prevent users from downgrading unless there is a specific known issue that would prevent the device from functioning properly.

You can always find previously released firmware versions in our Download Center and download/install them as needed.

However, please note that we cannot guarantee that keeping the existing configuration during a firmware downgrade will work properly.

[will.qiu]

@knee_mountain523

With regards to DPI, I know @will.qiu said there are some issues with extending the retention period beyond a week. I would really like to see a monthly and annual retention period. Even two years would be awesome. Why not permit the storage of the logs on a USB stick to mitigate internal storage capacity concerns and its lifespan? Can this issue be brought up with the GL.iNet team?

Thank you for the suggestion. We’ll discuss it with our product team.

Regarding the differences between DNS-level and DPI-level blocking, please refer to our previous discussion:

Adguard Home Vs DPI Content Filtering

Hi AdGuard Home filters at the DNS level, while DPI operates at the IP packet level. They work independently. However, since DNS queries occur before accessing a domain, AdGuard Home filtering typically takes effect first. All data is processed locally and is not uploaded to Netify or GL.iNet. [image] This feature is already in the roadmap and will be supported in a future firmware update.

[knee_mountain523]

You're misunderstanding me about what I'm trying to do by downgrading. While I wait for your team to sort out the viability of implementing a no-VPN option, if I ever need to do a factory reset of my router, I will downgrade to the latest v4.8 firmware, factory reset it, add a non-VPN tunnel, then upgrade and retain my settings, and finally finetune my router. Then it'll be safe to upgrade from that point forward while retaining my no-VPN tunnel?

I was asking if there were any bugs or security concerns associated with configuring the necessary settings on v4.8, and then upgrading to v4.9 or later while maintaining the configuration. Are you aware of any?

[knee_mountain523]

I really love seeing the data from the DPI log. It reminds me of the statistics from Control D. In a lot of ways, it does seem like DPI is sort of like it.

I personally think the length of the retention period should really be decided by the storage capacity of the external storage. Then, when space is running out, it will make DPI infinitely more useful. GL.iNet has lots of good ideas, but sometimes, you guys don't really expand on it and make it more useful.

[will.qiu]

Upgrading from v4.8 to v4.9 should generally be fine, except for the items already noted in the Release Notes that require attention.

For upgrades to later versions, we generally recommend not keeping the existing configuration, especially when upgrading to a new major version.

[will.qiu]

Hi,

@caicy @subid @denial @Costas

BE6500 v4.9.0 was released yesterday:

GL.iNet download center

[Subi18]

thx, Thanks, I’ve been testing the update and everything is running smoothly so far. The new DPI engine is really good; thanks to it, I can see the traffic and requests the network is making. The wait was worth it—SQM works well for gaming, as my network suffers from significant bufferbloat without it.

[denial]

thanks, i have also my flint3e updated

[knee_mountain523]

How should I configure SQM? Should I enter the advertised rates that my ISP provides? My gigabit plan is actually 940/940.

[Aramil]

Somewhere between 85% to 95% of total, very dependent on the line/ISP, start at 95% and move down and test against buffer bloat site, only really helps on busy networks.

[Costas]

You don't generaly need SQM with these speeds. SQM is mostly usefull for low speed lines.

[knee_mountain523]

What about configuring it on my travel routers at the hotel? I don't know who their ISP is and what kind of connection it's on. How should SQM be configured?

[will.qiu]

You can refer to the following steps:

Difficulties with bufferbloat

Hi, Thank you for sharing your current SQM configuration. To find a suitable SQM setting for your connection, could you please try the following test? Disable SQM first and run a speed test to determine your baseline download and upload speeds. Enable SQM again and set both Download and Upload speeds to around 95% of the baseline values. Run the Bufferbloat test again. If the result is good, you can gradually increase the limits. If the Bufferbloat result is still not satisfactory, reduce th…

However, we do not recommend using SQM in this scenario. SQM is designed to work when the network bandwidth is relatively stable. If the available bandwidth fluctuates significantly, SQM may not be able to function effectively.