Manual New Features

Other New Features

Smaller feature additions that landed alongside the bigger networking work (LAN VLAN Manager, WAN Multi-VLAN, Captive Portal). Grouped by the page they live on.

Independent WiFi encryption per band

Connection → Basic → Wireless

The 2.4GHz and 5GHz radios can now run completely different security: separate Encryption and Password fields for each band (5GHz Encryption: / 5GHz Password: alongside the existing 2.4GHz ones). Options match the main encryption dropdown — None, WPA3/WPA2 SAE/PSK mixed, WPA3 SAE, WPA2 PSK, WPA PSK, OWE — with one difference: the 5GHz-specific dropdown doesn't offer the RADIUS (enterprise) options, since the RADIUS server IP/port fields are shared and tied to the 2.4GHz radio. Only appears on genuinely dual-band hardware. See Basic Setup for the rest of the WiFi panel.

DHCP: alternative gateway + lease time in minutes

Connection → DHCP

Two changes to the DHCP page: lease time is now entered directly in minutes rather than being locked to whole hours, and an alternative default Gateway address option (behind a "Show advanced" disclosure) lets you hand DHCP clients a different default gateway than the router itself — useful for routing a subset of devices through a separate firewall/VPN appliance. Turning it on requires confirming a warning first: devices using the alternative gateway bypass this router's bandwidth monitoring, quotas, restrictions, and QoS entirely, since their traffic never actually routes through it. See DHCP / Known Devices for the rest of the page.

Port forwarding: source-zone selector for extra WAN VLANs

Firewall → Port Forwarding

Every forwarding/opening rule now has a Source Zone selector, populated from your primary WAN connection plus any additional tagged connections from WAN Multi-VLAN. This only becomes useful once you've configured at least one extra WAN VLAN — with just the primary connection, "wan" is the only choice anyway. The duplicate/overlap check is zone-aware, so the exact same port can be forwarded independently on two different WAN VLANs without tripping a false "already forwarded" error.

WireGuard: optional IPv6 (dual-stack)

Connection → WireGuard

The WireGuard server can now hand out IPv6 addresses alongside IPv4: an optional Internal IPv6 address and IPv6 Prefix Length on the server config, and a matching optional IPv6 Subnet / prefix length on a per-client basis for site-to-site routing. Leave both IPv6 fields blank on the server to keep everything IPv4-only — nothing changes for existing IPv4-only configs. If you do set one of a pair (address/prefix), the other becomes required. Client tunnel IPv6 addresses for road-warrior peers are derived automatically from the server's IPv6 prefix, so you don't have to hand-assign them.

Known display bug: in the "Allowed Clients" add/edit modal, several field labels (Client Internal IP, Client Connects To, Subnet Behind Client, and the subnet IP/mask labels) currently render as raw internal names instead of friendly text, due to a missing translation file — only the two new IPv6-specific labels translate correctly. The fields work correctly regardless; only the labels are affected. This is worth fixing upstream — flagged during this manual's research.

Device Groups

Connection → DHCP, referenced from Restrictions / Quotas / QoS

Name a group (e.g. family, iot, kids) directly on a device's entry in the DHCP page — an optional free-text field with autocomplete suggesting groups you've already used. Once at least one device has a group assigned, a Device Group option appears as a targeting choice on Restrictions, Quotas, and QoS rules, letting you write one rule against the whole group instead of listing every device's IP or MAC individually — and the rule automatically covers any device you add to that group later. A device belongs to at most one group.

VoIP / SIP ALG toggle

Connection → VoIP / SIP

A single checkbox — SIP ALG Enabled — replacing what used to require SSHing in and hand-editing kernel module blacklists. The help text under it doubles as troubleshooting advice: "SIP ALG rewrites SIP packet headers to assist with NAT traversal. Most VoIP services and devices work better with SIP ALG disabled. If your VoIP calls fail to connect, audio is one-way, or registration fails, try disabling this option." Disabling it takes effect immediately, live, without a reboot.

CAKE dual-mode QoS

Firewall → QoS Upload and Firewall → QoS Download (two independent pages, one per direction)

Each direction now has a "Use Simple Mode (CAKE) instead of Advanced (HFSC)" checkbox. CAKE is a modern queuing algorithm that automatically prevents bufferbloat and fairly shares bandwidth across devices and traffic types (voice/gaming, video, web, and bulk downloads are auto-prioritized) — no manual class configuration needed, just set your link bandwidth and turn it on. Enabling it hides the Advanced/HFSC manual class tables and shows a Link overhead compensation selector instead (None/Ethernet/PPPoE/VDSL-PTM — match this to your actual connection type so CAKE's bandwidth math is accurate), plus a live status line showing whether CAKE is actually active on the interface right now or just configured-and-waiting-for-a-QoS-restart. Upload and download can independently be in CAKE or HFSC mode — you don't have to pick one for both directions.

Cleaner quota display + instant reset button

Firewall → Quotas / Status → Quota Usage

Two quality-of-life fixes: quota values in the edit form no longer show padded trailing zeros (5 instead of 5.000), and editing an existing quota now shows a Reset Usage Now button that zeroes the running usage meter immediately — no more waiting for the quota's scheduled reset or restarting a service. See Quotas for the full page.

Package manager backend (advanced/technical)

Gargoyle's package manager (gpkg) is being re-backended to use apk-tools v3 — the package format OpenWrt 25.12 itself ships — instead of gpkg's long-standing opkg/.ipk/Packages.gz handling. The design keeps gpkg's own brain (its CLI, multi-destination model, and on-disk bookkeeping) exactly as-is; only the package-format layer underneath changes. This is real, working, tested code, not a stub:

• The core re-backend work is merged (install/remove/update/upgrade paths, local-file install, its own database init).
• It's since been proven against a real booted Gargoyle image, not just a development lab: the actual production Plugins-page flow (plugins.sh, install_gargoyle_package.sh) was exercised end-to-end against a real signed apk feed, backed by an automated test phase in the project's vnet simulator and a full-suite regression run showing no other functionality regressed.
• Signature verification now covers both backends — apk already verified feed signatures, and opkg (still the default) recently gained the same usign-based verification, closing what had been a trust gap in the default path.

It is deliberately still not the default, and there's no web UI toggle for it — switching requires either a backend apk line in gpkg's own configuration file, or exporting GPKG_BACKEND=apk for command-line use. Every existing opkg-based workflow, including the System → Plugins page, runs unchanged unless you explicitly opt in. The project's own stated invariant is that the legacy (opkg) backend stays the default "until the project explicitly flips it" — that flip isn't scheduled; a real-hardware smoke test is still outstanding, and timing is an open decision, not a stub waiting to be finished. Mentioned here for completeness; not something most users need to touch.

See also

• LAN VLAN Manager
• WAN Multi-VLAN
• Captive Portal