Keenetic: Part 1 — Router with modular KeeneticOS

What is Keenetic

Keenetic is a line of routers, access points and Wi-Fi extenders with its own operating system, KeeneticOS. The main thing about these devices is not the hardware specifications, but the system: it is assembled from individual components, and the same firmware covers tasks from home Wi-Fi to failover internet channels and VPNs between offices. As of September 2026 the stable update channel runs KeeneticOS 5.1.

Since 2025 in Russia these platform routers have been sold under the Netcraze brand (OOO Netcraze, formerly OOO Kinetic), models NC-xxxx; the firmware is the same — NDMS, so everything described also applies to them.

Modular KeeneticOS

The set of installed components determines what the router can do. Unneeded parts aren’t installed — this saves memory and reduces the number of running services. The only limitation is the memory size of a particular model.

How it works in practice:

• Components are selected in the web interface on the system general settings page (“Component parameters”). To change the set, the router must be connected to the internet.
• Any change to the set rebuilds the system. Even when adding a single component KeeneticOS is updated to the latest version of the selected channel — this should be taken into account before making changes during working hours.
• There are four update channels. The main one is recommended for everyone: major releases appear roughly every two months, intermediate updates — every two to three weeks. The preview channel is updated twice a month and is suitable for those who want to receive new features earlier.
• OPKG and Entware — for things that aren’t available among the components. The package manager installs programs from the Entware repository onto a USB drive, and since KeeneticOS 3.7 on some models — also into the router’s built-in memory.

What Keenetic can do out of the box

Multiple providers simultaneously. The router maintains multiple connections (Multi-WAN) and uses them by priority. The Ping Check function verifies internet availability by polling a specified host and, if the primary channel fails, switches traffic to the backup. For USB modems it also reboots a stuck modem.

Connection policies. This is rule-based routing: you can create up to 16 policies and bind individual devices or network segments to each. For example, the TV goes through a VPN while other devices go directly through the provider. More details — in the third part of the series.

Channel aggregation. Since KeeneticOS 3.9 there is a Multipath mode: connections included in a specific policy transmit traffic simultaneously. This speeds up multithreaded downloads, but can break sites that don’t accept a single session from different addresses, including internet banks.

Mesh Wi-Fi. Several Keenetic devices are combined into a Wi-Fi system with a single controller — the main router. Extenders connect by cable (access point mode) or over the air (repeater mode); clients roam between them with support for 802.11k/r/v roaming. Wireless connection of extenders is available on dual-band models since KeeneticOS 3.1; Buddy series models work only as extenders.

VPN. The router can be both server and client: PPTP, SSTP, OpenConnect, L2TP/IPsec, WireGuard, IPsec, IKEv2 and OpenVPN, and for connecting networks between routers — GRE, IPIP and EoIP tunnels. Servers are covered in the second part of the series, clients in the third.

Remote access by name. The KeenDNS service provides the router with a domain name and a certificate and opens access to the web interface and devices on the home network. If the router has no public address, some functions work through the Keenetic cloud.

USB and services. Network storage with access via SMB, FTP, SFTP and WebDAV, a BitTorrent client, print server, mobile modem as primary or backup channel.

DNS security. Encrypting queries via DNS-over-TLS and DNS-over-HTTPS, content filtering via NextDNS, SafeDNS, AdGuard DNS or Cloudflare.

Mesh VPN on Keenetic

Among the standard components there is a ZeroTier client: the router connects to a ZeroTier network and gives the entire LAN access to it. It is configured from the command line:

(config)> interface ZeroTier0
(config-if)> zerotier network-id 0123456789abcdef
(config-if)> zerotier accept-addresses
(config-if)> zerotier accept-routes
(config-if)> up
(config-if)> system configuration save

In KeeneticOS 5.1 the ZeroTier implementation was updated: support for private management servers was added. Other mesh clients, for example Tailscale or NetBird, are not in the official components list. About mesh networks themselves — in the “Mesh VPN” series, starting with the first part.

Keenetic, MikroTik, or OpenWrt

• Keenetic — when you need a router that is configured via an understandable web interface, but can do more than usual: multiple providers, policies, VPN servers, Mesh.
• MikroTik — when you need fine-grained control of every subsystem and typical corporate schemes; the entry barrier is higher. About it — a separate article, about running both platforms together — analysis of common problems.
• OpenWrt — when full freedom is important and you are ready to be responsible for the stability of your build.

Common mistakes

• Installing all components at once. Memory is limited, and every change to the component set triggers a rebuild and system update.
• Keeping a production router on the developer channel. For an office — only the main channel.
• Enabling Multipath for all devices. The mode is suitable for downloads but not for sites that bind a session to an address.
• Forgetting about DNS in policies. A policy includes only the DNS servers of the connections included in it. If a device’s entire traffic goes through a VPN but DNS remains the provider’s, some requests bypass the tunnel.