access WAN after connecting to VPN server on asus? (VPN_client -> VPN_srv_on_asus_merlin -> WAN_on_asus_merlin)

[simaka]

I am about to upgrade my AC66U B1 and have been thinking that I might just
1. Move it to another country where a friend of mine lives and connect it to the LAN port of a said friend's router
2. ask my friend to port-forward the right port to my asus
3. run a VPN server on my asus
4. connect via VPN to my asus
5. utilize its WAN (internet) connection

Is this possible and would it be something which can be configured from the menus? Thx.

 

[royarcher]

I am about to upgrade my AC66U B1 and have been thinking that I might just
1. Move it to another country where a friend of mine lives and connect it to the LAN port of a said friend's router
2. ask my friend to port-forward the right port to my asus
3. run a VPN server on my asus
4. connect via VPN to my asus
5. utilize its WAN (internet) connection

Is this possible and would it be something which can be configured from the menus? Thx.

Why???

 

[simaka]

I want to access streaming services in that language, and unfortunately they are not available out of the country. What's even more unfortunate, is that commercial VPN services which I tested (nordvpn, expressvpn) have their IPs already blacklisted. Most unfortunate, as it's not one of the "big volume" countries, the VPN services don't offer dedicated IPs there. So I can either spin up my own VM in a hosting provider or send over post my old router to a friend, as mentioned above. Hope that justifies the use case enough )))

 

[ColinTaylor]

I am about to upgrade my AC66U B1 and have been thinking that I might just
1. Move it to another country where a friend of mine lives and connect it to the LAN port of a said friend's router
2. ask my friend to port-forward the right port to my asus
3. run a VPN server on my asus
4. connect via VPN to my asus
5. utilize its WAN (internet) connection

Is this possible and would it be something which can be configured from the menus? Thx.

This should work without any special configuration. Just make sure that "Client will use VPN to access" is set to "Internet" or "Both" in the VPN server's General settings.

This does of course assume that your friend's connection has sufficient spare bandwidth (up and down), and that he trusts you with potential access to his LAN.

 

[simaka]

This should work without any special configuration. Just make sure that "Client will use VPN to access" is set to "Internet" or "Both" in the VPN server's General settings.

This does of course assume that your friend's connection has sufficient spare bandwidth (up and down), and that he trusts you with potential access to his LAN.

Thanks a lot, I see it only now, I had already checked the server tab configuration, but it seems I missed that radio button...

I will keep updating this thread with the progress over the next few months, just so that if anyone finds this has all the info.

 

[simaka]

Update:
I upgraded my old (AC66U B1) router with a new one (AC86U).
I configured a VPN server on my old AC66U_B1 and attached it to one of the LAN ports of the new AC86U.

PROBLEM: All works fine if I use the default vpn-server port 1194. I setup port forwarding on the internet-facing AC86U and am able to connect from outside. However, if I set it to a non-default port (and update the port forwarding to that same non-default port) - it doesn't work.
I suspect that the issue is in the test client - iphone running openvpn-connect app - likely can't connect to non-default ports. I will try tomorrow from my workplace where I run also an AC86U (AC86U_work) to have it connect to my home router. First using default ports, then using non-default.

Question: Is there any good guide on the security settings which should be used in a VPN server? I assume the default is not a good config to run...

 

[ColinTaylor]

The default settings are usually fine, that's why they're the defaults. The only thing I would suggest that you change is the port number to something random and non-obvious. Otherwise you'll be perpetually getting bots hitting that port.

 

[Tech9]

I upgraded my old (AC66U B1) router with a new one (AC86U).
I configured a VPN server on my old AC66U_B1 and attached it to one of the LAN ports of the new AC86U.

You can configure the VPN server on RT-AC86U. It has 5x faster CPU for OpenVPN.

 

[ColinTaylor]

You can configure the VPN server on RT-AC86U. It has 5x faster CPU for OpenVPN.

Read post #1.

 

[Tech9]

Read post #1.

Oops... I have one RT-AC66U B1 doing exactly this in another country.

 

[simaka]

You can configure the VPN server on RT-AC86U. It has 5x faster CPU for OpenVPN.

can confirm. With AC66U_B1 I was able to get a max of ~24mbps up/down (AC66U_B1 being a client for NordVPN openvpn). With AC86U I am hitting the max of my connection speed (~100mbps up/down).

 

[simaka]

The default settings are usually fine, that's why they're the defaults. The only thing I would suggest that you change is the port number to something random and non-obvious. Otherwise you'll be perpetually getting bots hitting that port.

that's exactly the issue... can't seem to make it work on the non-default port. Will continue troubleshooting tomorrow, once I have a real client to test with (as opposed to an iphone).

 

[Tech9]

RT-AC86U with current firmware can do about 160Mbps on OpenVPN. I'm getting about 30Mbps from my RT-AC66U B1 OpenVPN server, but replacing the router this summer because it was locked by the Asus bad ASD update some time ago and I don't like that. I'm planning to use GL.iNet GL-MT2500 device for VPN exit point purpose. You can see what it is in the link below and it's only $70 for the plastic case version:

GL-MT2500 / Brume 2

Brume 2 (GL-MT2500/GL-MT2500A) is an industrial security gateway for a network to run add-on programs and act as a VPN client or server before data is transmitted out of the network premise.

www.gl-inet.com

 

[simaka]

OK, non-default port works (used iphone hotspot to have a proper computer with a proper openvpn-client test connectivity).

Thx for the advice, will update once the router reaches its destination some weeks from now.