... no response ...

[08:31:05.498,000] <wrn> RT555/wifi_conn: signal (-68 dBm) is near / below threshold (-70 dBm), start roaming procedures
[08:31:05.498,000] <inf> RT555/wifi_conn: Signal level dropped, requesting roaming (deferred)
[08:31:05.499,000] <dbg> RT555/wpa_supp: wpa_printf_impl: Calling wpa_cli: wnm_bss_query, argc: 2
[08:31:05.499,000] <dbg> RT555/wpa_supp: wpa_printf_impl: argv[0]: wnm_bss_query
[08:31:05.499,000] <dbg> RT555/wpa_supp: wpa_printf_impl: argv[1]: 16
[08:31:05.499,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: Control interface command 'WNM_BSS_QUERY 16'
[08:31:05.499,000] <dbg> RT555/wpa_supp: wpa_printf_impl: CTRL_IFACE: WNM_BSS_QUERY query_reason=16
[08:31:05.499,000] <inf> RT555/wpa_supp: WNM: Send BSS Transition Management Query to 52:ff:20:a8:57:4b query_reason=16
[08:31:05.500,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wpa_supp: Send Action frame (freq=5240 MHz wait=0 ms no_cck=0)
[08:31:05.503,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wpa_supp: Frame TX status event
[08:31:05.503,000] <dbg> RT555/wifi_supplicant: event_socket_handler: Passing message 16 to wpa_supplicant
[08:31:05.503,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: Event TX_STATUS (16) received
[08:31:05.503,000] <dbg> RT555/wpa_supp: wpa_printf_impl: wlan0: EVENT_TX_STATUS dst=52:ff:20:a8:57:4b type=0 stype=13
[08:31:05.503,000] <inf> RT555/os: 0x300ab2d0 (supplicant_thread):      unused 3572     usage 4620 / 8192 (56 %)
 

... no response ...
```

To translate to human-readable terms query_reason=16 means "Low RSSI" and Event TX_STATUS (16) means event was tx'ed successfully.

The device is correctly listed with k and v support in the client list. I think it is strange that the controller does not respond to BTM queries at all. Any help would be appreciated.

Hello all!

After update to 5.0.4 and later KeeneticOS noticed the following problem with address allocation (as example - connect over wifi) - router not allocated new ip address after connect to wifi. logs have messages:

after reboot router or restart dhcp from cli - the address is given and everything works

 

but after a while the problem repeats itself, until reboot. My configuration:

Has anyone encountered a same problem?

Attaching the output of show interface WifiMaster0 country-codes from both devices for comparison.

Is there a way to add the missing codes?

Giga (KN-1012) EAEU.json Titan (KN-1812) EU.json

I found a reproducible issue on Keenetic Giga KN-1012. Issue support request #654031

Environment:
- Model: Keenetic Giga KN-1012
- KeeneticOS: 5.0.8
- OpenVPN server subnet: 10.84.0.0/24
- WAN interface: GigabitEthernet0/Vlan4

- Home subnet 192.168.1.0/24
- Web UI tested via:
  - http://10.84.0.1
  - http://192.168.1.1
  - http://my.keenetic.net
- SSH access works in all scenarios from Home and OpenVPN1 segments

Current routing/NAT logic:
- WAN NAT is enabled on GigabitEthernet0/Vlan4
- OpenVPN clients are in 10.84.0.0/24

Problem:
It looks like OpenVPN clients need the following directive in order to reach external resources through GigabitEthernet0/Vlan4:
ip static 10.84.0.0 255.255.255.0 GigabitEthernet0/Vlan4

However, when this directive is present, local Web UI access starts failing with HTTP 403 Forbidden.

Reproducible behavior:

Case A — without:
no ip static 10.84.0.0 255.255.255.0 GigabitEthernet0/Vlan4

Observed results:
1. 10.84.0.1 is accessible from OpenVPN client 10.84.0.2
2. my.keenetic.net is accessible from OpenVPN client 10.84.0.2
3. 10.84.0.1 is accessible from Home client 192.168.1.124
4. OpenVPN client 10.84.0.2 cannot access external resources that should go through GigabitEthernet0/Vlan4

Case B — with:
ip static 10.84.0.0 255.255.255.0 GigabitEthernet0/Vlan4

Observed results:
1. 10.84.0.1 is NOT accessible from OpenVPN client 10.84.0.2
2. Web UI returns HTTP 403 Forbidden
3. my.keenetic.net is still accessible from OpenVPN client 10.84.0.2
4. OpenVPN client 10.84.0.2 CAN access external resources through GigabitEthernet0/Vlan4
5. 10.84.0.1 is also NOT accessible from Home client 192.168.1.124

Important note:
- SSH access to Keenetic remains available on all interface addresses in both cases.
- The issue affects Web UI access only.
- A similar effect was previously observed with:
  ip static 192.168.1.0 255.255.255.0 GigabitEthernet0/Vlan4
  In that case, replacing it with normal NAT for the Home segment restored HTTP access to 192.168.1.1.

Expected behavior:
- OpenVPN clients should be able to access external resources via WAN NAT
- Local Web UI access via 10.84.0.1 and 192.168.1.1 should continue working
- Enabling outbound NAT/routing for the OpenVPN subnet should not cause HTTP 403 on local management addresses

Actual behavior:
- The static directive for 10.84.0.0/24 appears to be required for outbound WAN access
- But when enabled, it causes Web UI access to local management IPs to fail with HTTP 403

Could you please confirm whether this is expected behavior, a NAT/static routing side effect, or a Web UI management-plane bug?

If needed, I can provide:
- full running-config
- exact test sequence
- screenshots
- self-test.txt

Thank you.

I would like to:

1. Register clients by IP address instead of MAC.

2. Configure port forwarding rules directly to an IP address, not tied to a registered MAC client.

Is this possible in Keenetic firmware, or is there any workaround for VM environments behind a Buddy extender where MAC addresses are duplicated?

Thanks.

If Xbox is set to first priority, as soon as I enter any value in the speed limit section, the Xbox measures 1% packet loss.

I have a Keenetic Hero 4G+ (KN-2311, EU) running KeeneticOS 4.3.6.3.
On the System Dashboard, I can see:

• an IPv6 address on the WAN interface
• a delegated IPv6 prefix (/56)

However, in My networks → Home segment, there are:

• no IPv6 settings (no "Enable IPv6" option)
• no IPv6 connectivity on LAN devices

Topology:

• Hero 4G+ is the main router
• Connected via Ethernet to ISP optical converter
• PPPoE connection configured (IPv4 + IPv6 both set to "Automatic")
• VLAN ID 42 configured on Internet interface in "Ports and VLANs"
• Mesh enabled with Hopper (KN-3810), Hero is the controller

Questions:

1. How do I enable IPv6 on the Home segment?
2. Should IPv6 settings appear automatically when a delegated prefix (/56) is received?
3. Could mesh mode or segment configuration prevent IPv6 options from appearing?

It seems like IPv6 is working on WAN, but not being distributed to LAN, and the UI does not expose any IPv6-related settings for the Home segment.
Any guidance would be appreciated.

Thanks!

I am experiencing a persistent issue with PlayStation 5 connecting to my Keenetic Titan. While the console passes the built-in "Internet Connection Test", it consistently fails to connect to online services in games (Gran Turismo 7 and F1 25).

1. Wi-Fi Handshake Mismatch: In the Keenetic Device List, the PS5 consistently connects at 11ac 2x2 40MHz or 11ax 2x2 40MHz, even when forced to 5GHz-only and with the router set to manual channels (36, 44, 149) and 80MHz width.

2. The "Extender" Proof: When I connect the PS5 to a TP-Link Wi-Fi extender located in the same spot, the connection immediately stabilizes at 11ac 80MHz, and all games connect to online services perfectly. This suggests the Titan's environmental or "smart" logic is forcing a 40MHz downshift that breaks the game handshakes.

3. Configuration Tested: I have already tried disabling IPv6, setting Static IPs, disabling "Internet Safety" (DNS filters), and manually setting MTU to 1450/1473.

I'm trying to implement a captive portal on a Keenetic router in the guest network. My UAM and RADIUS servers are ready. I've entered the necessary parameters into the captive portal's "my profile" section as follows:
UAM_Server:
http://192.168.1.40:3990/login
UAM_Secret:
secret_2024
Radius Server:
192.168.1.40
Radius Secret:
radius_secret
RADIUS NAS ID:
keenetic

I'm trying to access it from an Android phone. When I connect to the Guest page, I'm redirected to the login page. There, I only authenticate by clicking the "accept" button. And I see "success" in the logs.
10.1.30.6 - - [21/Feb/2026 23:59:47] "GET /login?res=notyet&uamip=10.1.30.1&uamport=3990&challenge=e2fa752793a8de730eb4daebd27f5992&called=52-FF-20-F8-5D-78&mac=B2-D0-DC-7D-9C-B4&ip=10.1.30.6&nasid=keenetic&sessionid=177171836000000005&userurl=http://play.googleapis.com/generate_204&md=23DA19D9D824E0D449FBFA23DD88F63F HTTP/1.1" 200 -
10.1.30.6 - - [21/Feb/2026 23:59:47] "GET /favicon.ico HTTP/1.1" 404 -
10.1.30.6 - - [21/Feb/2026 23:59:48] "POST /accept HTTP/1.1" 302 -
10.1.30.6 - - [21/Feb/2026 23:59:48] "GET /login?res=success&uamip=10.1.30.1&uamport=3990&called=52-FF-20-F8-5D-78&uid=B2-D0-DC-7D-9C-B4&timeleft=300&mac=B2-D0-DC-7D-9C-B4&ip=10.1.30.6&reply=Welcome&nasid=keenetic&sessionid=177171836000000005&userurl=http://play.googleapis.com/generate_204&md=E50C1463B84B2838B5FF3801A094F6C3 HTTP/1.1" 200 -

Then, when I check the router's CLI, I see that the client is connected and packets are being passed through:

(config)> show interface Chilli0  chilli 

             host: 
           session-id: 177174301100000003
                 user: CC-F8-26-D5-00-96
                   ip: 10.1.30.20
                  mac: cc:f8:26:d5:00:96
           start-time: 178
             end-time: 300
            idle-time: 0
      idle-time-limit: 0
             tx-bytes: 37575
       tx-bytes-limit: 0
             rx-bytes: 19874
       rx-bytes-limit: 0
             tx-speed: 0
       tx-speed-limit: 0
             rx-speed: 0
       rx-speed-limit: 0

It's receiving the IP address 10.1.30.20.
However, the Android client still doesn't see itself as connected and can't access web pages. The "Sign in to the network" warning persists. When I ping 10.1.30.20 from the router:

PING 10.1.30.20 (10.1.30.20): 56 data bytes
64 bytes from 10.1.30.20: seq=0 ttl=64 time=79.626 ms
64 bytes from 10.1.30.20: seq=0 ttl=64 time=79.683 ms (DUP!)
64 bytes from 10.1.30.20: seq=1 ttl=64 time=29.208 ms
64 bytes from 10.1.30.20: seq=1 ttl=64 time=29.251 ms (DUP!)
64 bytes from 10.1.30.20: seq=2 ttl=64 time=51.577 ms
64 bytes from 10.1.30.20: seq=2 ttl=64 time=51.641 ms (DUP!)

If I close the captive portal and access the site normally as a guest, I get the same IP address (10.1.30.20) and the ping result is correct:

PING 10.1.30.20 (10.1.30.20): 56 data bytes
64 bytes from 10.1.30.20: seq=6 ttl=64 time=1135.330 ms
64 bytes from 10.1.30.20: seq=7 ttl=64 time=135.173 ms
64 bytes from 10.1.30.20: seq=8 ttl=64 time=10.261 ms
64 bytes from 10.1.30.20: seq=9 ttl=64 time=5.695 ms
64 bytes from 10.1.30.20: seq=10 ttl=64 time=3.116 ms

When I look at the interfaces for the captive portal and the normal guest via the router, I see a difference:
When there is no captive portal, the interface name appears as Guest and "link: up". When there is a captive portal, the interface name appears as Chilli0 and "link: down".

(config)> show interface Chilli0 

               id: Chilli0
            index: 0
   interface-name: Chilli0
             type: Chilli
      description: Guest network

           traits: Ip

           traits: Chilli

             link: down
        connected: yes
            state: up
              mtu: 1500
  tx-queue-length: 1000
       admin-only: no
          address: 10.1.30.1
             mask: 255.255.255.0
           uptime: 35
           global: no
   security-level: protected

           bridge: 
            interface, link = yes: GigabitEthernet0/Vlan3

            interface, link = yes: WifiMaster0/AccessPoint1

            interface, link = yes: WifiMaster1/AccessPoint1

         uam-auth: 192.168.1.40:3990
         max-auth: 1

          summary: 
                layer: 
                     conf: running
                     ipv4: running
                     ctrl: running

(config)>   show interface Guest 

               id: Bridge1
            index: 1
   interface-name: Guest
             type: Bridge
      description: Guest network

           traits: Mac

           traits: Ethernet

           traits: Ip

           traits: Ip6

           traits: Supplicant

           traits: EthernetIp

           traits: Bridge

             link: up
        connected: yes
            state: up
              mtu: 1500
  tx-queue-length: 0
       admin-only: no
          address: 10.1.30.1
             mask: 255.255.255.0
           uptime: 421
           global: no
   security-level: protected

             ipv6: 
            addresses: 
                  address: fe80::50ff:20ff:fef8:5d78
            prefix-length: 64
                    proto: KERNEL
           valid-lifetime: infinite

              mac: 52:ff:20:f8:5d:78
        auth-type: none

           bridge: 
            interface, link = yes: GigabitEthernet0/Vlan3

            interface, link = yes: WifiMaster0/AccessPoint1

            interface, link = yes: WifiMaster1/AccessPoint1

          summary: 
                layer: 
                     conf: running
                     link: running
                     ipv4: disabled
                     ipv6: disabled
                     ctrl: running

(config)>

Because of this difference, the client connecting through the captive portal cannot access the site. Where is the problem? How can I fix it?
 

Is anyone else experiencing the same issue today?

I need to replace ISP router what have this kind of complicated setup in ISP specific router.

Where is possible to buy KN-3611 in Europe/EU?

Today, when I logged into the dashboard, I saw that the new firmware version 5.0.4 was available, so I started the update. The update completed successfully.

After the reboot, however, I noticed something (I’m not sure if this was the case before with firmware 4.x, so it may have been normal): the 2.4 GHz Wi-Fi turns on immediately, while the 5 GHz network remains disabled for several minutes (about 11 minutes), showing the message “Wi-Fi temporarily disabled.” After that time, it finally turns on.

Is this normal behavior, or could I have some incorrect setting?

====================

Ref: The related posting at https://unix.stackexchange.com/questions/400231/how-do-i-upgrade-all-of-my-installed-packages-in-openwrt

Note that, though I am not new to Linux per se, I AM new to OpenWRT, especially as applied to routers and such like.

The referenced article, along with this article on the OpenWRT web page, (https://openwrt.org/docs/guide-user/additional-software/opkg#upgrading_packages), indicates that mass upgrades are potentially dangerous, almost to the point of "Don't even THINK of running e2fsck on a mounted partition" severity - and other sections indicate that individual updates themselves can be a dicey matter.

However, the comments within the original post referenced above vary widely - ranging from "just don't" to others who say that updates are an important part of maintaining system security.

My original assumption, (based on previous "big package" Linux experience), is that package maintainers have a responsibility to ensure that package updates will successfully update an existing package - and if there's a significant incompatibility and/or dependency change, it should be a different, (though related), package.

So, what's the truth of this?  Maybe I should just stick with the stock functionality of my router instead of opening the can of worms that is OpenWRT?

==================

Any comments and guidance would be gratefully appreciated.

I wrote 3 scripts to be used with Keenetic router with Entware installed and set. I tested them with my KN-1812 and all seems to work; I'd be glad to know your feedback and suggestions.

Keenetic Firewall:
https://github.com/mattheweli/keenetic-firewall

Keenetic Pingtool:
https://github.com/mattheweli/keenetic-pingtool

Keenetic vnstat:
https://github.com/mattheweli/keenetic-vnstat

I'm available for any questions you may have

If I have two keenetic routers, the second one used as an extender, and two providers' cables, is the following possible?

ISP1 - Keenetic1 - Keenetic2 - ISP2

One of the interesting features of this router is that it is extremely configurable. So much so that I am beginning to wonder which Linux distribution it's based on!  😉 

One feature is the ability to add additional functionality via both the web interface and Open Packages.

1.  How do I know how much of my router's memory is available for use?
2.  How full is "too full"? (How much "headroom" should I leave?)
3.  Where do I find these Open Packages?
4.  How will I know if a particular package is compatible with my router?
5.  The OPKG package manager configuration page asks for an "initrc script".  What should I provide?

Thanks!

P.S.
I found this: https://openwrt.org/docs/guide-user/additional-software/opkg
It seems both useful and gnarly.

Router: Keenetic Giga (KN-1012) EAEU
System: Linux Mint 22.3

I have been trying to establish a SSH connection to my Keenetic router but I keep getting "Connection Refused".  I found and installed the SSH module and rebooted the router.  Research indicates that I have to issue certain specific commands via the "command line interface", (telnet) to activate it.  The instructions indicate that telnet is enabled by default and that I should open a telnet connection to the IP address of the router - which opens the router's CLI.

Unfortunately, telnet also returns "connection refused".

Every solution I searched for cycles back to needing the CLI to enable/change things, but I have to do something to enable the CLI so that I can change things to enable the CLI to enable things to enable. . . . Etc.

I've installed putty on my system and I've also tried via a Linux terminal window. Neither SSH nor telnet can connect; both return "connection refused".

Update:
Using putty installed on Windows 10, both telnet and SSH also return "connection refused".

What am I missing?

Jim

my qos does not detect my games as gaming. Can I modify qos and add my game ports so that I prioritize them correctly??

I have set the line telephone line with the parameters for sky, the linear register on the sky network but starts rebooting itself continuously. 
Any info and idea about why and hot to stop this?

If a make. Phone call from outside the provider tells the number is unavailable