ASUS RT-AC88U VPN WAN Issue After Merlin Flash

[Shaun4BigBlocks]

Hello forum first time poster here. I have never had to ask a question before as this forum’s search function usually does the trick for me. My searches are at a loss, which is good because it gave me an excuse to sign up . Sorry if I overlooked answers using the search engine. Post junkies- feel free to fire away at me for not using the search engine if it is that important for you to raise your post count…


Sarcasm aside, here is my issue. I have experience with DD-WRT and various Tomato flavors and recently got an ASUS RT-AC88U (stock firmware upgraded to 3.0.0.4.384_32799) since I have been wanting to play with Merlin (Tomato-ish) for a while. My issues arise when I upgrade to Merlin 384.7.


First off, I was shocked to see that the firmware does not perform a fresh install, but instead appears to add a layer over the stock firmware (or at least installs fresh and then retains/adds settings from the stock firmware. Not used to this, but it is a handy feature for the more complex your setup becomes.


My issue: when using the stock firmware my various firewall settings work fine (VPN- open VPN client). Upon flashing the Merlin firmware, my internet drops on all my computers except for one unless if I turn the VPN off. All my IP’s are set to auto within the specified range, I have not yet looked into how and why the one computer, always the same one stays connected. It is, however, not the computer that I am administering the router from. Also, the stock firmware changes tabs and applies settings lightning fast. Merlin on the other hand is painfully slow, like 45 sec to a min to change tabs and painfully slow applying settings. Not fun for trial and error style playing around.


I do not get a lot of time to play with it. My wife does medical coding all day so needs the internet for work. I temporarily put her on another network, but my ATT (yes I know ATT sucks) modem gets finicky at times when playing with all this and I need to reset it. In the evening the kids are home and cry whenever I take the internet down. What caused this is what I am referring to as “The Great VPN Block of Oct 2018”- I know a handful of us have felt the sting. Life was good when I ran everything under one routered VPN umbrella. Now the kids cry about Netflix getting blocked and the wife about Amazon Prime (Amazon has proven especially difficult). The problem is that I am not always around to keep playing with different servers- it is getting old.


So, the first attempt at help that I will probably get hurled at me is a band-aid- already done. I am looking for a technical solution, not a band-aid. The band aid is to use another router isolated from the VPN. This is how I am currently doing it but again this is a band aid and aside from my OCD being bothered it is more of a cop-out than a solution. Band-aids, in my opinion, equal no SNB bragging rights. I want the Merlin set up right so as to split tunnel- guest network no VPN. I have found the various ways to do that on this forum, but can’t even get that far as I am having the stupid no internet issue on most of my terminals whenever any of my VPS’s are turned on.


My set up- irrelevant but will provide it if it makes any difference. First off, stuck with the horrible ATTNVG510 that does not offer a true bridge mode, just IP pass through with the ability to turn NAT and DNS off. I live in a rural community, my cable company sucks. They not only monitor all usage, but limit monthly data cap pretty low and cut you off if you are behind a proxy/VPN/Smart DNS (basically if they see too much encryption you get suspended). Satellite- no need to really explain right? But primarily EXTREMELY low data cap. So, at 1TB per month and a lack of being “snoopy” ATT gets my business. I used to be able to use a standard “dumb” modem, but when they upgraded to the VDSL2+ architecture they also decided to have control over MAC addresses. Yes, cloning a MAC address to an old “dummy” brick is on my shelf of projects for another day but until then…


So, ATT NVG510 set for IP pass through, connected to a Linksys EG008W (yes, I said NAT and DNS turned off, but obviously those settings don’t work since the switch will still provide internet/WAN regardless), one switch port to Asus RT-AC88U (double NAT’ed and DSN’ed for VPN purposes, not ideal but a necessary evil – works flawlessly in my case at the expense of a 20ns latency hit), one switch port to my master bedroom feeding another switch (Linksys SE-4008) with various DD-WRT and Tomato routers used for my TOR stuff and for playing with/learning DD-WRT/Tomato, and the remainder of the switches feeding non VPN requirements (the whole Netflix/Amazon Prime “issue”)such as televisions, son’s Xbox, ect. Oh yeah, and one switch port currently feeding one of my WRT-54(X)’s as a repeater so as to provide non VPN’ed internet to my kids wireless devices (the band aid I am trying to resolve) as my master bedroom is too far away to provide a good signal.


My gut instinct is to reset the RT-AC88U to a clean factory state and then perform the upgrade and then set the settings, but I don’t see why I should have to do that. I feel RMerlin would not have designed the firmware upgrade process to be the way he did if he felt it was not a stable way of doing it. For the record, I did try isolating the RT-AC88U directly to the NVG510 after flashing back to factory 3.0.0.4.384_32799 and attempting to re-install Merlin 384.7 with the same issue. Then for sh$ts and giggles I loaded my 3.0.0.4.384_32799 settings backup file over the Merlin 384.7. For five minutes everything worked great and I thought I was ready to start tweaking for the split tunnel and then bam all but one computer lost internet connection. And yes, I wasted time playing with reboots and ipconfig commands (even though I really should not have to do that) wih no success. Finally I just flashed back to 3.0.0.4.384_32799 followed by uploading my backup file and of course all is working… except for without Merlin I can’t play with the split tunnel on the RT-AC88U. That is where I am now. I figured I would reach out, between Martineau and everyone else someone has to have either had or stumbled on this issue. I can re-flash to take any screen shots if that helps. Oh yeah, the RT-AC88U is set to 192.168.2.1 (well at least while I troubleshoot, it will be a bit more creative than that when complete) just to rule conflict out. Oh, and as far as VPN’s I am using Proton, Air, and Express (Express is getting hit just as hard by the blocks BTW so be careful when you see the marketing hype).

 

[ColinTaylor]

TL;DR Got as far as paragraph 5.

Perform a factory reset and manually configure your router.

 

[Shaun4BigBlocks]

Yeah, that is my plan if no one knows what is going on. Sorry it was so long, if to short people yell for not enough detail, if to long they get irritated because if they don't know the answer you don't leave them much opportunity to leave a BS tech wanna be reply Thanks-

 

[skeal]

TL;DR I never read past the first paragraph. In future you may want to propose a question and back the question with the information you have. That way it's not compulsory to read such a long post. IMHO

 

[Shaun4BigBlocks]

Ok the kids are in bed and I finally had a chance to play around. Granted I could have just tried resetting everything, but what fun is that? Plus isn’t that kind of a Best Buy Geek Squad kinda method?? Only if all else fails, but I hadn’t given “all else” a try yet. Sh$t, I have not made a practice of wiping stuff out and starting over since my Win 3.1 amateur days… “LQQk Mom, I fixed it”- I didn’t fix it, I just found another way to make it work… post #6525 for Colin adda boy!!!! And Skeal you master pro you at contradiction… the first paragraph was the rhetorical part of the question, I knew at least a couple of fish would not be able to resist, thanks for self identifying- trollism is a disease. The only thing I hate more than reading through pages of dead end replies consisting mainly of trolls and post junkies is when the OP does not report his/her final solution/course of action.


I found the problem and I am up and running. I looked over the settings again and nothing stood out to me. Pretty much the same as before the Merlin upgrade. So first off I sent a ping from one of the computers without WAN as an initial step to isolate the no internet issue. Ping was successful- so I figured check DNS next. DNS on the router (WAN/Internet Connection/WAN DNS Setting) was set to “Connect to DNS Server automatically- YES” (just like the factory firmware was). I toggled it to ““Connect to DNS Server automatically- No”, manually set primary and secondary DNS addresses, and BAM internet was instantly back.


Not good enough, I still had no explanation as to why one of my terminals had internet and the rest did not. Since it was initially only a problem with either one of the OpenVPN client VPN profiles turned on, so I took a closer look at the VPN configuration page. On the factory firmware user interface the client OpenVPN tab is not extremely power user friendly- not much to analyze. Name the VPN configuration, supply user name and password, upload an .ovpn file and presto it is magic and everything just works. Merlin thankfully gives power users a lot more control over the settings.


Upon closer examination I realized that post Merlin update all of my client VPN profiles “Accept DNS configuration” were set to “Disabled”. This was the problem folks. All I had to do was set (Build 384.7_2) “Advanced Settings/VPN/VPN Client/ Network Settings/Accept DNS Configuration/ Relaxed or Strict or Exclusive” (choose one).


I still had the lone ranger computer to solve. Knowing that I was dealing with DNS issues, I opened up the Ethernet adapter being utilized by the RT-AC88U within Network Connections. I clicked on the following item: “Internet Protocol Version 4 (TCP/IPv4)” within the adapters “Networking” tab. Under the general tab I was able to see that “Use the following DNS server addresses:” was selected (with preferred and alternate DNS servers already in place) as opposed to “Obtain DNS server address automatically”. Since that adapter was manually pointing to DNS servers, DNS resolution was not an issue for that particular terminal. –SOLVED-. Stupid me had been bench testing various DNS servers a few months back and had left it where it was.


Wondering if it was a transfer issue, I reloaded another VPN client configuration to see what would happen. Same thing, it defaults “Advanced Settings/VPN/VPN Client/ Network Settings/Accept DNS Configuration” to “Disabled”. I tried this with three different VPN companies all with the same result. So, pretty much this seems to be the work around unless if Mr. Sauvageau finds the free time to tweak things a bit.


First off- big thanks to Martineau for this contribution: https://www.snbforums.com/threads/openvpn-client-accept-dns-configuration.37999/

I get rusty at times, and couldn’t find “Accept DNS Configuration” definitions within my notes.


Second off- Thanks to Eric for making this all possible and for all of his selfless contributions to the forum! I am more of a SIPRNet/Cisco guy during the day and new to Merlin by night. There is some overlap, but there are way too many contingencies in the civilian networking world- think doing a rack and pinion on a car using a lift vs. lying on the floor. That professional stuff is nice, but just not financially worth it for the little guy… or as fun Back to my reclusive laboratory for now. Hopefully this helps someone down the road as the RT-AC88U is kind of the red headed step child with respect to support... bye-