v3.2.6 — Asuswrt-Merlin 3006.102.9 carry: OpenVPN 2.7.7, tzdata 2026c, a 2048-bit DH floor
- Carried from Asuswrt-Merlin 3006.102.9 (Eric Sauvageau unless noted; cherry-picked with
authorship kept): OpenVPN 2.7.7; IANA tzdata 2026c; Wireless Log fixes for Repeater and Media
Bridge modes, with the follow-up DFS fix; the System Log page stops querying the router while
auto-refresh is off; two MultiWAN help-popup fixes; a parallel libimobiledevice build; amtm 7.0
(Decoderman). The rest of 3006.102.9 was already in the tree (OpenSSL 3.5, Tor 0.4.9.11 with
IPv6, the Brahma-B53 mitigation backport) or is not carried: the hardware AQM QoS mode (Reaper's
Hardware QoS engines cover it), EasyRSA 3 (the existing certificate path is fixed for OpenSSL 3.5
and checked on every build), the FTP TLS upgrade change, and the OpenVPN/Tor switch restyle. - Time zones. The zoneinfo tree dated from a 2017 ASUS GPL merge. About 28 zone names gave the
wrong offset under current rules (Mexico, Egypt, Greenland, Kazakhstan, Mongolia, Paraguay, Sudan,
North Korea and others); US zones were already correct. New names includeEurope/Kyiv,
America/NuukandPacific/Kanton. The router's own clock follows the POSIX rule the GUI writes to
TZ; the database feeds/etc/localtimeand anything that names a region/city zone. - OpenVPN server DH is at least 2048 bits. Upstream raised the weak-DH warning from 1024 to 2048
bits but left the replacement test at 1024, so a 1024–2047-bit DH was warned about and still used,
and OpenSSL 3.x rejects it at the security level OpenVPN requests. Any DH under 2048 bits is now
replaced with the built-in RFC 3526 2048-bit group.
Images & checksums (RT-BE86U)
Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.
This is a beta release. Its filename carries
_BETAand the router reports the same string on the dashboard and the About page, so you can always tell which channel a flashed image came from. Stable releases carry no marker.
| Variant | File | SHA-256 |
|---|---|---|
| + AI Advisor | RT-BE86U_3006_102.8_Reaper_v3.2.6_BETA_nand_squashfs.pkgtb
| 7d3174f65e3e34eb21e6e8815bf7d89d5b710488774d4b5d833a031e050b29d2
|
| Standard | RT-BE86U_3006_102.8_Reaper_v3.2.6_BETA_noMCP_nand_squashfs.pkgtb
| ef9d85ad1277c855db333ce0c291ef4a63386b0c74f7f27ed02d13e9cf931418
|
Verify a download against the attached SHA256SUMS-RT-BE86U-Reaper_v3.2.6.txt.
Corresponding source & reproducibility
The RT-BE86U image for v3.2.6-beta is built from this repository at tag v3.2.6-beta-RT-BE86U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.
- Patches:
patches/ - Provenance record:
provenance/manifest.json - How to verify:
docs/REPRODUCIBILITY.mdanddocs/SOURCE-AVAILABILITY.md
The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.2.6-beta-RT-BE86U (patches + docs).