New Features 24.10 to 25.12

New Features: Gargoyle on OpenWrt 24.10 → 25.12

This page tracks user-facing feature additions, as opposed to the OpenWrt 24.10 → 25.12 page, which covers the technical work of moving the OpenWrt base itself. Everything below landed on ispyisail/gargoyle (and where noted, was also offered upstream to lantis1008/gargoyle) during the same development window as the 25.12 bump.

---

Networking

• WAN multi-VLAN + LAN VLAN Manager (PR #21) — replaces the old single WAN-VLAN checkbox with an editable table, so an ISP delivering internet + IPTV + VoIP on separate tags can be configured without swconfig-era workarounds. Adds a LAN VLAN Manager for DSA hardware, plus a shared safe-apply auto-revert safety net: network changes that could lock the admin out automatically roll back if not confirmed.
• Port forwarding: source-zone selector for extra WAN VLANs (PR #34) — port forwards and open-port rules can now target a specific WAN VLAN zone instead of always assuming the primary wan connection.
• DHCP: alternative gateway + lease time in minutes (PR #36) — DHCP clients can be handed a different default gateway than the router itself, and lease times can be set in minutes instead of only hours (ports the long-open upstream request from ericpaulbishop/gargoyle#731).

WiFi

• Independent encryption and password per AP band (lantis1008/gargoyle #68, merged) — 2.4GHz and 5GHz radios no longer have to share the same security mode and passphrase.

VPN

• WireGuard optional IPv6 (dual-stack) support (PR #3) — adds an optional internal IPv6 address/prefix on the server config and site-to-site IPv6 subnets on clients. Additive and default-off: a server with no IPv6 configured produces byte-identical IPv4-only output.

Firewall / Access Control

• Device Groups (PR #9) — name a group of devices on the DHCP page, then target that group directly in Restrictions, Quotas, and QoS instead of adding devices one at a time. A reimplementation of the long-stalled lantis1008/gargoyle#403 / #57 for OpenWrt 24.10-era nftables.
• Guest-network captive portal (PR #19) — an nftables-only guest splash/auth page with zero new package dependencies ("Option D"). Guest isolation behavior is unchanged; this only adds an authentication gate in front of it.
• VoIP / SIP ALG toggle page (PR #15) — a new Connection → VoIP/SIP page to disable the nf_nat_sip/nf_conntrack_sip conntrack helpers through the UI, replacing over a decade of forum advice telling users to SSH in and hand-edit /etc/modules.d/.

QoS

• CAKE dual-mode qdisc support (PR #23) — CAKE can now be enabled alongside the existing HFSC stack, independently for upload and download, via a per-direction checkbox.

Quotas

• Cleaner quota display + instant reset button (lantis1008/gargoyle #58, merged) — quota values no longer show trailing zeros, and each quota gets a "Reset Usage Now" button that takes effect immediately without a service restart.

Package management

• gpkg apk backend (Design 1) (PR #39) — adds an apk-tools-backed execution path to Gargoyle's gpkg package manager, selected at runtime via GPKG_BACKEND=apk. Default behavior is unchanged: every existing opkg code path runs exactly as before unless this is explicitly opted into. Lays groundwork for OpenWrt's move away from opkg without forcing it on Gargoyle yet.

Reliability improvements bundled into this window

Not new features on their own, but worth knowing about since they shipped alongside the above: a series of fixes for multi-tab UCI save races across DHCP, port forwarding, routing, station manager, VLAN, quotas, restrictions, and the Basic page — previously, saving a form in one browser tab could silently revert edits made in another tab. See individual PRs on ispyisail/gargoyle for details.

---

See also

• OpenWrt 24.10 → 25.12 — the base-system bump itself (kernel, toolchain, nftables, runtime bugs found along the way)
• Open PRs on ispyisail/gargoyle
• Gargoyle Discussions