keenetic-safe-changes

Changing a Keenetic router without breaking it

Changes are not saved until someone says so

A change through this server applies to the running configuration immediately and is discarded on reboot. That is a safety feature, not a bug: a mistake undoes itself if the router restarts.

Every write tool tells you this in its response:

{ "applied": { "access": "deny" }, "saved": false, "unsavedChanges": true,
  "backup": "/…/192.168.1.1-2026-08-07T01-20-36-000Z.txt" }

save_config is the only thing that makes a change permanent. Call it only when the user has confirmed the result is what they wanted, never automatically as part of a change. If they never call it, nothing is lost that they cared about keeping.

Use get_config_state to see whether anything is pending.

The router's fail-safe protects less than it sounds like

Keenetic arms a three-minute timer when the configuration changes, and reverts to the saved configuration if the management session loses connectivity.

That protects against locking yourself out. It does not protect against a change that is simply wrong: block the wrong device and the router stays perfectly reachable, so nothing reverts.

A backup is taken for you

Before the first change of a session, the startup configuration is downloaded to a local file. The path is in every write response. Mention it to the user the first time something is changed, so they know a way back exists.

backup_config takes one on demand, which is worth doing before a sequence of related changes.

Order matters for devices

A device must be registered before its access, policy, schedule or priority can be set. Setting a name registers it, so if you are configuring a device the router has only seen and not registered, set the name in the same update_device call. The tool already applies name first.

Symptom of getting this wrong: host "..." is unregistered.

What can cut off your own access

set_interface_state with state: "down" is the one genuinely dangerous tool here. Taking down a bridge, the WAN link, or the interface carrying the management session ends the conversation with the router, and the fail-safe reboot is then the only way back.