v3.7.9 — DNS Director works on guest networks again; VPN-bound guest networks keep DNS and IPv6 in the tunnel; AiMesh wired devices stay wired
Everything in v3.7.8 is included. Both lines carry the same changes: RT-BE96U, RT-BE86U, RT-BE88U and GT-BE98 Pro on
3006.102.10; GT-BE98, GT-BE19000, BQ16 and BQ16 Pro on 3006.102.8.
- DNS Director on a guest network. Since v3.7.7, a guest network whose DNS Director rule sent it to a resolver
on the main network (a Pi-hole, AdGuard Home) had no DNS: guest isolation dropped the redirected queries. Those
queries pass again on port 53, as before v3.7.7. The resolver's web page and every other device on the main
network stay closed to the guests. A Guest Portal network keeps its own resolver, and a network with its Kill
Switch on keeps its DNS in the tunnel. - Guest networks bound to a WireGuard client keep DNS after a drop. When a tunnel dropped and came back by
itself, its DNS servers were not put back, so a network bound to it could not resolve names until the client was
restarted. They are now rebuilt with the route. (3006.102.10 models; the 3006.102.8 base has no such recovery path.) - IPv6 on a VPN-bound network goes into the tunnel. The rule that sends a bound network's IPv6 into its VPN client
was never added, so IPv6 left by the WAN. It is added now, for WireGuard and OpenVPN clients alike, and for the main
network with a default VPN client. - Devices cabled to an AiMesh node. When the mesh's wireless client list was missing, devices plugged into a node
lost their wired mark and could show as Wi-Fi clients; a Wi-Fi band remembered from earlier no longer sticks to a
device known to be wired; the dashboard tiles and the AiMesh map (access point mode) check wired first.
Images & checksums (RT-BE86U)
Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.
This is a beta release. Its filename carries
_BETAand the router reports the same string on the dashboard and the About page, so you can always tell which channel a flashed image came from. Stable releases carry no marker.
| Variant | File | SHA-256 |
|---|---|---|
| + AI Advisor | RT-BE86U_3006_102.10_Reaper_v3.7.9_BETA_nand_squashfs.pkgtb
| 2f2f79b15d8c8016dddbc2c2c3eefc5231904f8ce0c8c6a1d066264c460de434
|
| Standard | RT-BE86U_3006_102.10_Reaper_v3.7.9_BETA_noMCP_nand_squashfs.pkgtb
| 6cac9be83d8b83cf72a9c5d6174150b2436dba1a04016139ed1800658e5ca732
|
Verify a download against the attached SHA256SUMS-RT-BE86U-Reaper_v3.7.9.txt.
Corresponding source & reproducibility
The RT-BE86U image for v3.7.9-beta is built from this repository at tag v3.7.9-beta-RT-BE86U: the pinned Asuswrt-Merlin base (3006.102.10, ca72a61f8bc) plus the complete patch series. The tag freezes the exact source that produced it.
- Patches:
patches/ - Provenance record:
provenance/manifest.json - How to verify:
docs/REPRODUCIBILITY.mdanddocs/SOURCE-AVAILABILITY.md
The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.7.9-beta-RT-BE86U (patches + docs).