ASUS Merlin Scripting & T-Mobile

[GWTechTalk]

Please note that scripting required JFFS and scripts to be enabled. you will need to make a services-start file in which you will call the scripts you make that will then execute on boot. Makes setup after a wipe a lot easier. You could potentially script your whole setup and then restore it after boot without all the cache and other items. Feel free to comment if I made any mistakes or there is a better way I have not yet explored!

Recently, I found that by default my router would not allow Wi-Fi calling on multiple devices. I'm not totally sure why, but here is but my journey into the problem. It is very complex when you only have IPV4. If you have IPV6 you'll never have this issue because you have externally routable addresses. I can't say for 100% certainty that I haven't overlooked something, but I wanted to share my script with others.

#!/bin/sh

# =========================
# T-Mobile Wi-Fi Calling and Visual Voicemail support (MERLIN COMPATIBLE)
# =========================

# Allow related and established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Accept incoming traffic from T-Mobile for WFC 2.0 (IPsec)
iptables -A INPUT -p udp --dport 500 -s 208.54.0.0/16 -m comment --comment "T-Mobile IPsec ISAKMP" -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -s 208.54.0.0/16 -m comment --comment "T-Mobile IPsec NAT-T" -j ACCEPT

# Accept SIP over TLS (legacy WFC 1.0 fallback)
iptables -A INPUT -p tcp --dport 5061 -s 208.54.0.0/16 -m comment --comment "T-Mobile SIP TLS TCP" -j ACCEPT
iptables -A INPUT -p udp --dport 5061 -s 208.54.0.0/16 -m comment --comment "T-Mobile SIP TLS UDP" -j ACCEPT

# Allow handset authentication and voicemail sync (usually router forwards this but just in case)
iptables -A INPUT -p tcp --dport 443 -s 66.94.0.0/19 -m comment --comment "T-Mobile HTTPS" -j ACCEPT
iptables -A INPUT -p tcp --dport 993 -s 66.94.0.0/19 -m comment --comment "T-Mobile IMAPS" -j ACCEPT

# CRL access for router itself
iptables -A OUTPUT -p tcp -d 206.29.177.36 -m comment --comment "T-Mobile CRL server OUT" -j ACCEPT
iptables -A INPUT  -p tcp -s 206.29.177.36 -m comment --comment "T-Mobile CRL server IN" -j ACCEPT

This second part is a recent finding with my BE96U. There seemed to be a bit of instability in connections on some devices because the router was constantly trying to move devices to different bands and those devices would essentially say no. Mostly Apple devices, but I did have a few others as well. The BE96U has three bands that are all different where some of you will have three bands but two of them are the same 5Ghz. Here is how I shut off the noise and the results showed almost a 20% throughput improvement and overall connection stability increase over Wi-Fi. As with before, feel free to comment. Please note that if you script certain features, it WILL NOT reflect in the GUI. If you start flipping options in the GUI it can overwrite your script settings.

# =========================
# Router Feature Tuning
# =========================

# Disable Smart Connect and Band Steering
nvram set smart_connect_x=0
nvram set wl0.1_bsd_enable=0
nvram set wl1.1_bsd_enable=0
nvram set wl2.1_bsd_enable=0

# Commit all nvram changes
nvram commit

# Restart services
service restart_firewall
service restart_wireless

Your device will still move to the strongest connection because the disconnect helper will kick in at -70 dBm. Then your device will choose the strongest band assuming you are not leaving the area.