Re: New - CAX80 Firmware Version 5.1.1.8 Released

GearNet7 · ‎2024-10-01

Anyone who owns CAX80, do not use this firmware.

Unfortunately for me, the firmware was automatically updated for me last night and it completely brought my unit to its knees, so much so that I reset all my settings!!! For examples, it removed all my port forwarding settings, it changed my LAN settings (instead of 100.0.10.1 to the default 192.168.1.1, etc.

What's worse is that even after I reconfigured everything, I could never get port forwarding to work again. I tried port 80, 21, 443, 3389, you name it. None of those worked.

At the end, I had to manually install the previously known good version and only then I was able to get port forwarding to work again.

In summary, this version of the firmware is NOT READY for prime time yet.

FURRYe38 · ‎2024-10-01

Did you first try a factory reset on the modem after v5 FW was installed to see if your PF configuration would work?

This is a major update from v2 FW and I presume there maybe newer FW code changes that may not be compatible with older v2 FW configurations and such. So a factory reset would be needed and setup from scratch to check this.

Did you also disable uPnP feature since you are configuring PF rules?

GearNet7 · ‎2024-10-01

Sorry if I wasn't clear in my previous post. First off, the automatic update completely ruined my original setup. It was since then I had to perform a factory reset, and only then I tried to reconfigure everything. So yes, I understand this is a major release but still port forwarding was broken, period.

That being said, NG should have thoroughly tested their fw before releasing it to the public. Most consumers who purchased this would not have nearly the same level of knowledge as I do, let alone they would know or even bother to roll back the firmware to the previous version.

Suffice to say, this level of software QA is unacceptable.

Kitsap · ‎2024-10-01

@GearNet7 wrote:
Sorry if I wasn't clear in my previous post. First off, the automatic update completely ruined my original setup. It was since then I had to perform a factory reset, and only then I tried to reconfigure everything. So yes, I understand this is a major release but still port forwarding was broken, period.

That being said, NG should have thoroughly tested their fw before releasing it to the public. Most consumers who purchased this would not have nearly the same level of knowledge as I do, let alone they would know or even bother to roll back the firmware to the previous version.

Suffice to say, this level of software QA is unacceptable.

It is normal for experienced Netgear users to turn off automatic firmware updates. If you were not one before an automatic update blows up your network, you soon become one after.

I am not saying it is right, I am saying it is a cold hard fact with Netgear routers.

GearNet7 · ‎2024-10-02

Needless to say, my unit received the automatic update once again last night and as the result, it screwed up all port forwarding.

I try to find the automatic update option but I cannot find it. Is there any other secret menu option that I can enable to turn it off (like the developer mode on Android phone, for instance)?

Kitsap · ‎2024-10-03

@GearNet7 wrote:
Needless to say, my unit received the automatic update once again last night and as the result, it screwed up all port forwarding.

I try to find the automatic update option but I cannot find it. Is there any other secret menu option that I can enable to turn it off (like the developer mode on Android phone, for instance)?

I do not have a CAX80 available to check on the specific page. Maybe @FURRYe38 can shed some light on this question. There is also a chance that option has been depreciated in the most recent firmware release.

FURRYe38 · ‎2024-10-08

Checking progress on this...

Are you still on older FW or using newer FW?
NG needs to take a look at the debug logs for this issue your seeing with v5 FW loaded. If you can capture the debug logs and the port forwarding problem, please put up on a cloud service and PM me the link so I can forward them to NG for review. Then revert back to working FW.

@GearNet7 wrote:

Anyone who owns CAX80, do not use this firmware.

Unfortunately for me, the firmware was automatically updated for me last night and it completely brought my unit to its knees, so much so that I reset all my settings!!! For examples, it removed all my port forwarding settings, it changed my LAN settings (instead of 100.0.10.1 to the default 192.168.1.1, etc.

What's worse is that even after I reconfigured everything, I could never get port forwarding to work again. I tried port 80, 21, 443, 3389, you name it. None of those worked.

At the end, I had to manually install the previously known good version and only then I was able to get port forwarding to work again.

In summary, this version of the firmware is NOT READY for prime time yet.

GearNet7 · ‎2024-10-08

I engaged with NG support, and they provided me with a guide for all the things that they need. I captured the logs, screenshots, my modem settings, etc. for both firmware versions for their review.

Long story short, I have to install the older version of the fw each morning as the unit would automatically update itself.

FURRYe38 · ‎2024-10-08

Do you get a case number? Please PM me that case #.

FURRYe38 · ‎2024-10-10

NG is now looking into this issue.

FURRYe38 · ‎2024-10-12

Can you post your default LAN side DHCP IP address range on the modem and also please post the Port Forward configuration you have on the modem?

@GearNet7

GearNet7 · ‎2024-10-12

DHCP IP address range: 192.168.0.200 to 192.168.0.254

As for port forwarding, any port number just wouldn't work: 80,443, 21, 22, you name it.

From what I can see in the log that I generated for NG, it seems like the port forwarding clashes with some of the new security fixes that they have implemented for 5.1.1.8.

My biggest request is to add the option where automatic updates can be disabled. Honestly, I don't care about the security features as I have run pfSense and piHole to protect my LAN from external threats.

FURRYe38 · ‎2024-10-12

Are the PF devices IP Addresses you configured outside of the DHCP IP range or with in it?

GearNet7 · ‎2024-10-12

Correct, all PF addresses are outside of the DHCP range. So I think maybe you are onto something here. 🙂

This could very much the reason why the security feature kicks in because the PF addresses are out of the DHCP served range.

FURRYe38 · ‎2024-10-12

Yes, NG told me that those devices with IP addresses are outside of the default DHCP IP address range. Seem there may have been a change that now requires any PF configured devices IP Address to now be with IN the default DHCP IP address range.

Can you change the IP address configuration so that the IPs are with in the range and then see if PF works when you have v5 FW loaded?

GearNet7 · ‎2024-10-12

I can do that but now I have 2 questions:

1/ Do I simply increase my IP range but keep those machines with IP static, or

2/ Do I actually need to map the MAC address and turn off static IP on those machines and let the router to hand out those addresses?

FURRYe38 · ‎2024-10-12

Typically static IP addressed devices are outside of the default DHCP IP address pool. For PF configurations that seem to now require IPs to be within the pool range, maybe best to configure those devices for auto obtain IP addressing from the router, set up some IP address Reservations for those devices then set those IP addresses to the PF configuration.

GearNet7 · ‎2024-10-12

Ok for the quickest test, I include the PF IP range in DHCP, without messing with all the MAC mappings. This seems to fix my issue at a glance.

I'll need to do more testing later but so far this looks promising.

FURRYe38 · ‎2024-10-12

OK, let us know. Give it a couple of days to ensure testing is good.

Kitsap · ‎2024-10-12

@GearNet7 wrote:

My biggest request is to add the option where automatic updates can be disabled. Honestly, I don't care about the security features as I have run pfSense and piHole to protect my LAN from external threats.

So disabling automatic firmware updates is still an open issue?

FURRYe38 · ‎2024-10-15

Not currently supported on CAX series units.

"one reason is related to security concern, we don't want devices to stay at old fw and lack the security patches when customer opt out auto upgrade."

GearNet7 · ‎2024-10-15

Not currently supported on CAX series units.

"one reason is related to security concern, we don't want devices to stay at old fw and lack the security patches when customer opt out auto upgrade."

That's not the right reason for it. Every major company (Unifi, Netgate, Cisco, etc) would provide the ability for customers to opt out of automatic updates. You can certainly have it on by default but at least provide a method to opt-out (conscious decision).

FURRYe38 · ‎2024-10-15

May not be however it's NG. Also not sure if some of those brand develop gateway modems. I can see other non gateway products having update options. Orbi does along with most NG routers. Gateways maybe considered a bit different. Lots goes in to developing gateways since they are a two part unit. Can be very costly. It is what it is.