Reaper v3.7.5-beta — RT-BE86U

v3.7.5 — The firewall log leaves the system log; a failed web login locks one address, not the whole LAN; Custom DDNS with Let's Encrypt; WireGuard client fixes; Encrypted DNS trusted after a reboot

Everything in v3.7.4 is included. Both lines carry the same changes: RT-BE96U, RT-BE86U, RT-BE88U and GT-BE98 Pro on
3006.102.10; GT-BE98, GT-BE19000, BQ16 and BQ16 Pro on 3006.102.8.

• Firewall logging no longer floods the system log. With "Logged packets type" on Accepted or Both, every new
  connection went to the flash system log and could starve the CPU and DNS. Every firewall log rule - the stock
  chains, Warden, the anti-botnet chains and the rules engine - now hands its lines to a small collector,
  rflogd, up to 10000 lines a second per rule. If the collector is not running, the rules fall back on their own
  to a plain log of at most 10 lines a second. The Firewall page shows the collector's state (lines, lost, held
  back), the System Log has a Firewall view, the remote log server still receives the lines, and on a USB
  long-term store the Storage page offers Firewall log: one file a day, up to 30 days or 256 MB. New installs
  keep it there by default; on an existing router tick it on the Storage page.
• A failed web login locks one address, not the whole LAN. Five wrong passwords locked every browser on that
  side of the router for 5 minutes, logged-in admins included, and any IPv6 address counted as the LAN. Now the
  address that failed is refused (the login page says other addresses can still log in); 20 failures on one side
  within 5 minutes still lock that side. A connection on the remote-access listener counts as the WAN side.
• Custom DDNS with Let's Encrypt. With DDNS on Custom, the built-in Let's Encrypt never asked for a certificate;
  it does now. The DDNS page says when /jffs/scripts/ddns-start is missing (and names a file to rename, such as
  ddns-start.sh) or not executable, and that browsers are not served the certificate while the web interface is
  HTTP only. The diagnostic (v1.3.55) says the same and no longer tells log or helper files in /jffs/scripts to
  be made executable.
• WireGuard client. A client's old DNS rule stayed after its DNS was changed or removed and came back after a
  reboot; every restart now clears that client's rules first. A .conf without its keys is refused, saying which
  key is missing, and nothing is changed (it used to reset the client and import half of it).
• Encrypted DNS is trusted after a reboot. The certificate was judged once, at start - often before the
  router's clock was set - so a Let's Encrypt certificate read "Not publicly trusted" until its next renewal. The
  chain is now checked without the clock (expiry is still shown). An untrusted Let's Encrypt certificate is told to
  be issued again, not to "use Let's Encrypt".
• Firewall > Objects: Address groups. An Add on Objects, Zones, Egress or Forwards reported on the hidden Rules
  tab, so it looked as if nothing happened; each add row now shows its own message, and a group member that is not
  an address object is named.
• Security review: a long-term store on FAT, exFAT or NTFS is one note on the dashboard and the Firewall page
  (those volumes keep no file permissions), not a red list of every file; the text names the store beside /jffs.
• Rule Status walker 1.14. The log chains' counter rule had made 35 rows Inconclusive; a rule with no target
  now counts and walks on. A port forward covering a WAN test port is recognised, and the shared fixture masks
  every WAN-side address.
• Pages. Dreadwatch's Test now card explains the test instead of opening with "No list is loaded yet";
  Wallguard's settings and live tables say they are empty rather than "Nothing blocked yet"; a page that gets
  shorter no longer leaves empty scroll below it (the frame shrinks too); ticking Firewall log no longer
  reflows the Storage page.
• Hardening and image. The web API library is built with full RELRO and FORTIFY, and a check in front of its
  input checks refuses line breaks and other control characters in single-line settings, the same on every model.
  About 45 programs and scripts nothing on any supported model uses (test tools, flash tools for other flash types,
  a DNS query daemon whose switches no page sets) left the image. The AiMesh exemption table holds 256 entries
  (64 had been filled by 16 tri-band nodes).

---

Images & checksums (RT-BE86U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

This is a beta release. Its filename carries _BETA and the router reports the same string on the dashboard and the About page, so you can always tell which channel a flashed image came from. Stable releases carry no marker.

Variant	File	SHA-256
+ AI Advisor	RT-BE86U_3006_102.10_Reaper_v3.7.5_BETA_nand_squashfs.pkgtb	744b9460a1b6b26e9bd79c83c1eb0e24fdad22ca877193511a753b659ab336c4
Standard	RT-BE86U_3006_102.10_Reaper_v3.7.5_BETA_noMCP_nand_squashfs.pkgtb	5facbdf76f6c502895ed048364aca20ca8f0fea91e6ba0403b1ef4bf7a7822d6

Verify a download against the attached SHA256SUMS-RT-BE86U-Reaper_v3.7.5.txt.

---

Corresponding source & reproducibility

The RT-BE86U image for v3.7.5-beta is built from this repository at tag v3.7.5-beta-RT-BE86U: the pinned Asuswrt-Merlin base (3006.102.10, ca72a61f8bc) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/
• Provenance record: provenance/manifest.json
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.7.5-beta-RT-BE86U (patches + docs).