Release notes

What is new in V7.3.2 since V7.3.1

• Web user levels: every web user has a level, viewer (read-only pages), operator (plus disconnect and unban) or superuser (plus the Config tab). Set from the CLI: set system web login user <name> level superuser; show system web login lists users and levels. New users start as viewer. Web passwords are stored as salted hashes; old accounts keep working until their password is set again. See Web users and levels.
• Config tab in the web panel (superuser only): host name, PPPoE VLANs and service names, NAT (SNAT and DNAT port forwarding) with a sanity check of every rule, interfaces (also on a VLAN), RADIUS, PPPoE DNS and IP pools, DNS redirect, DNS server, IPoE, log server, SNMP, Ookla speedtest server, FastPADO, a Restart page and an Audit Log. Changes are collected, previewed and committed exactly like CLI commits. See Configuring from the web.
• QoS page in the Config tab: the Policy Bypass Rate-limit groups can be managed from the web, in steps (group, networks, ports, priority, speed), with a network list upload from a text file and a live view of what the dataplane applies. Wrong networks (host address instead of network, wider than /8, loopback/multicast, a subscriber pool, overlap with another group) are refused with the reason.
• Service names made clear: show service pppoe-server service-name prints what every port and VLAN accepts in plain words, and deleting the last service name of a VLAN warns you what happens after commit. The web Service names page offers the three rules (a name, blank, anyname) with their meaning and the same "accepts" view; show subscriber names the exact line to fix a refused device. Refused discovery requests are now logged on every install (Logs tab, "Service-name mismatch" filter). See Service-name rules.
• PPPoE packet sizes (MTU / MRU): the PPP size of all users (set service pppoe-server mtu | mru) and the link size of an access port, a VLAN or a VLAN range (set service pppoe-server interface <port> [vlan-id <number>] mtu | mru) are set from the CLI. commit never disconnects a user for it: a link with users online waits (shown as PENDING) and restart service pppoe-server interface <port> [vlan-id <number>] applies it at once after a typed confirmation. The configured PPP mtu is a strict maximum; the MTU column of the web Connections page shows the size each session really uses. See PPPoE packet sizes.
• PPPoE MTU / MRU page in the Config tab: the PPP size and the port / VLAN sizes can be set from the web, with a live table (configured size, size in use now, PPP size of a new login, users) and an Apply button for a size that is waiting. See From the web.
• Web PPPoE VLAN page: a VLAN range (100-200) can be added from the web, and a VLAN with a description or a size is listed once.
• New access port tuned at commit: a port that becomes a PPPoE or IPoE interface gets its NIC rings, offloads and interrupt pinning at commit, not only after the next reboot.
• IPoE: nothing without a RADIUS login: traffic that goes straight through an IPoE port or VLAN without a login is blocked, a commit that puts an IPoE network on the IPoE port itself is refused, and the health check reports both.
• set system cgnat removed: the command had no effect on this product (its kernel module is not part of it). Subscriber NAT is set system snat, see NAT; a cgnat entry left in an older configuration is dropped at the next commit.
• Bonding (LACP) reworked: a bond now comes up in the mode it is configured for (before, a mode 4 bond ran as round-robin without LACP and lacp-rate was refused), it stays in place when another interface is committed and after a reboot, a bond without an address is possible, wrong values are refused with the reason when they are typed, and delete interfaces bonding <name> removes a whole bond. See Bonding.
• Bonding and IPv6 Dual Stack pages in the Config tab: a bond is built from the web with the usual LACP settings filled in, and the IPv6 dual stack settings (DNS, pools, gateway, pools in use) have their own page with a check of every value.
• Web Logs: lines about the box's own files are no longer shown.
• IOMMU passthrough: the kernel boots with iommu=pt, so a server with VT-d enabled in the BIOS no longer translates every network buffer through the IOMMU (about 19 percent of the forwarding CPU measured on a Xeon E5 v4). show system health has a new IOMMU line. See the BIOS settings.
• Forwarding cost cut: interrupt suppression on the dataplane ports (set system auto-tune napi-defer on, default on) removed 90 percent of the network interrupts and 42 percent of the packet-processing CPU in the lab at the same throughput; the VLAN monitor and the discovery watcher no longer make the kernel copy every transmitted packet (97 percent fewer packet copies). set system auto-tune idle c1 lets idle cores halt instead of spinning: about 25 W less per CPU socket with the same forwarding cost (the default stays poll). Conntrack hash buckets follow the table size (half the maximum entries).
• Web panel kept open for hours: Disconnect, Unban, Config and Restart actions no longer fail silently after one hour (the page's security token now lasts for the login session; if it is ever out of date the page reloads itself and says so).
• Web login protection: 5 failed logins from one address lock it for 5 minutes; logins, failures and every web action are logged. Web write actions carry a CSRF token; the session key is random per box.
• Log retention: every log under /var/log rotates daily at 05:40 or when it passes 200 MB, only 7 days are kept. The one-day policy of the PPPoE daemon log is unchanged.
• Installer: a UEFI re-install over a disk that held a BIOS-mode installation no longer hangs in "Preparing disk"; the installer erases the old partition data first. The "Installation needs your attention" screen shows the last installer log lines instead of a tty1 question that never existed.
• Fixes: restart system snmp works (it had no handler); show configuration set printed FastPADO login-fail-ban settings as login users and could swallow a service name containing "web" or "api"; the CLI printer no longer loses a VLAN line in a second printout of the same session.

What is new in V7.3.1 since V7.3.0

• Installer: a System check screen (boot mode, Secure Boot, media, disk, CPU, memory, ports, clock) before the disk is touched, with the BIOS change to make when something blocks; an "Installation needs your attention" screen that shows the step, the last log lines and what to do, instead of a bare E30; the target disk is wiped (first 2 GB, last 1 MB) before partitioning, so a reinstall over an old install no longer stalls in step 1. See Installing from the ISO.
• Web panel, Connections: the Search dropdown gained Service-name and IFNAME (the ppp interface, ppp0, ppp1 ...).
• Web panel, Logs tab: filter buttons (Failed, Account expired, Success, LCP time-out, Service-name mismatch) that show only their lines with counts, Subscriber Logs with the show subscriber text, usernames appended to every attributable line. See Logs tab.
• Service names: "service-name blank disabled" is now enforced at the PADR stage as well. With FastPADO a known device's PADI is answered inside the NIC driver, so the daemon only saw the PADR and used to accept a blank service name there; a device sending a blank name could log in despite the setting. Fixed; refused requests are logged as "Service-Name mismatch".
• Why is a user not connected: show subscriber <username|mac|ip> gives the reason in plain words (wrong password, account not active, VLAN not served, service name refused, no PPPoE discovery from the device, session ended by ...) with what to do and the timeline of the last attempt; show subscriber failures sums up the recent failures. See Why is a user not connected.
• QoS port groups: a QoS group can match TCP/UDP ports as well as networks, e.g. ports 443 and 8080 at 20M per user, on their own lane next to the plan. See QoS.
• QoS group priority (optional): set policy qos group <name> priority <1-63> decides which group wins when a destination is in a network group and a port group at the same time. show policy set now lists every QoS group correctly.
• Subscriber ping (on by default): pings to users, from the BNG and from your NOC, leave with the WAN public address, so routers that ignore the PPPoE gateway address still answer. See Pinging subscribers.
• Installer: V7.3.1 replaces the V7.3.0 images, which could finish without the admin login and the CLI. Boxes installed from V7.3.0 that do log in are not affected.
• FastPADO login-fail ban (off by default): a device whose logins RADIUS keeps rejecting stops getting PADO for a short, growing time; genuine subscribers and "already logged in" rejects are never banned. See FastPADO.
• Auto-tune irq-spread: set system auto-tune irq-spread auto|on|off chooses between NUMA-local interrupts and all cores. See System health and auto-tune.
• Service names: the "Service-Name mismatch" log line now names the service name sent, the MAC, the port and the VLAN; with no service name configured every service name is accepted.
• Card placement: WAN and LAN cards on different CPU sockets is the recommended layout; the health check and the PHYSICAL PORTS card no longer warn about it.
• Web panel: the Dashboard shows the last reboot and last shutdown; the footer year follows the box's clock.
• The iptables package is no longer installed; NAT, nat-guard and the log server work without it.

What is new in V7.3.0 since V7.0.0

• Installer: installs completely offline (all packages and NIC firmware are on the disc), shows the step, a timer and plain error codes, and finishes in aprox 10-15 minutes. See Installing from the ISO.
• Session license: the box runs 100 sessions until a key signed for it is installed. See Session license.
• FastPADO: answers only known subscribers at once, ignores devices that are not yours (RADIUS "not our subscriber") for 10 minutes, works with both port forms, shows each port in show service pppoe-server fastpado. Default off.
• Log server: ... ipfix all / ... netflowv9 all also send byte and packet totals when a NAT entry closes.
• DNS redirect of subscriber DNS queries to your resolver (off by default). See DNS redirect.
• Speedtest server: set system speedtest domain <name> and the certificate for that name is obtained and renewed automatically.
• CLI: a port name that does not exist on the box is refused at set time; restart system web takes a second instead of twenty; show system health reports first-boot errors and network ports without driver or firmware.
• Configuration safety: commit writes the configuration files in one step, so the PPPoE service can never read a half-written file; a reload that finds a damaged configuration keeps the running one instead of stopping.
• Command reference: every CLI command is now listed in one place. See Command reference.
• A deleted access VLAN is stopped at commit (its sessions disconnect, nothing else is touched); the last session on a VLAN no longer leaves the VLAN deaf; RADIUS dae-server changes need restart service pppoe-server.

What is new in V7.0.0 since V4.0.0

• SNMP agent rebuilt: answers instantly with thousands of PPPoE users, exposes only interfaces/VLANs, CPU, memory and disk (no per-session rows), new commands for port, version, SNMPv3, listen address and trap target. See SNMP.
• Traffic Split redesigned: Local AS / within-country / International by measured round-trip time and your own announced prefixes, plus Top 10 organisations (Google, Meta, Akamai ...) per region. Computed only when you click. See Traffic Split.
• DDoS WATCH card and a NAT session limit per user (default 5000) that stops one infected device from filling the NAT table. See NAT session limit.
• PPPoE hardware spread (DDP) for Intel X710/XL710 cards: set interfaces ethernet <port> ddp enable.
• Upload rate-limit fixes: the per-user policer is now armed for every session, once, including after reboots.
• Web panel: HDD card shows the disk make, model, capacity, used and free; PHYSICAL PORTS card shows optics, light levels, errors and slot/NUMA hints.
• VLAN: deleting a vlan-range or vlan-id works in every form; VLAN numbers are validated (1 to 4094).
• NAT pool routing loop fixed; NAT entries are flushed when a session ends; commit no longer restarts snmpd and prints no hot-reload notice.
• Firewall/DPI filtering has been removed from this release.