Asus RT N66u running Asuswrt Merlin change VPN listening port from WAN to LAN

[rodp]

Hi All,

First post hear... I have an old ASUS RT N66u router running the latest version of asuswrt merlin that will work on the router (meaning it's still all rather old and before anyone suggests to just get a new router - I will be investing in a NAS which can do all this but I need an interim solution in the meantime whilst I save up).

The old router is now being used as a wifi access point at the moment as my ISP gave me a new (but more basic) router but one which could handle the faster internet speeds (the PS4 updates as a result are now alot faster) which keeps my kids off my back!

However, the newer router doesn't have VPN but can redirect / port forward so I thought I would find out how I could continue to use the VPN on my old router. After some research, I've tried a few commands but they don't seem to stick on reboot or give some errors when setting up. i also need the Dynamic DNS service to continue to work so that i can continue to connect when away from home, but again need that service to work through the router's LAN port and not WAN. My need is I want to use a home based VPN rather than these online VPN subscription sites, so they are not an option to me.

So a couple of issues there but in theory is this possible?

This is where I got to:

new router gateway is 192.168.1.253
my old router IP is set to 192.168.1.254
DHCP is disabled on the old ASUS router. DHCP on the new router is set from 192.168.1.10 thru 192.168.1.250, subnet mask is 255.255.255.0

After a bit of research these were the commands I used whilst connected to the old router via telnet

nvram set wan0_proto=static
nvram set wan0_ipaddr=192.168.1.254
nvram set wan0_netmask=255.255.255.0
nvram set wan0_gateway=192.168.1.253
nvram set wan_ifname=br0
nvram commit
reboot

so I'm making making sure the wan0 is static and is set to .254. I'm making sure the netmask is the same as the new router and I'm telling it the new router (ie gateway) has an IP ending .253. I'm then telling it that the WAN should be talking through the LAN ports (any: br0) (I did also try changing it to eth1 when I was having issue but this didn't really seem to help). I'm then telling it to save and then reboot.

At first the setup wouldn't stick i kept getting 0.0.0.0 for the IP's and i couldn't ping the outside world eg. 8.8.8.8.

So I tried to update some settings from the webUI of the router. I went to the WAN menu where there was a section called WAN IP Setting and I included the IP address (192.168.1.254) , Subnet Mask (255.255.255.0) and Default Gateway (192.168.1.253). That allowed a few more settings to stick.

wan0_ipaddr=0.0.0.0
wan0_proto=static
wan0_proto_t=
wan0_gateway=0.0.0.0
wan0_gateway_x=192.168.1.253
wan_ifnames=eth0
size: 53416 bytes (12120 left)
wan_ifname=eth1
wan0_ipaddr_x=192.168.1.254

So the (new) router gateway is now sticking but not my old router's IP
so I repeated the setup again (trying eth1 instead of br0).

nvram set wan0_proto=static
nvram set wan0_ipaddr=192.168.1.254
nvram set wan0_netmask=255.255.255.0
nvram set wan0_gateway=192.168.1.253
nvram set wan_ifname=eth1
nvram commit
reboot

and used these commands to check the output

nvram get wan0_ipaddr
nvram get wan0_gateway
nvram get wan_ifname

this is what resulted but pinging the outside world (eg. 8.8.8.8) still wouldn't work

wan0_ipaddr=192.168.1.254
wan0_proto=stati
wan0_proto_t=
wan0_gateway=192.168.1.253
wan0_gateway_x=192.168.1.253
wan_ifnames=eth0
size: 53446 bytes (12090 left)
wan_ifname=eth1
wan0_ipaddr_x=192.168.1.254

I then used the command
route -n
and
ip route
..to show more details which returned the following

Kernel IP routing table                                                                                                                                                                     
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo

so I think the routing table is missing the gateway / a default route so I worked out to use the below command to add a default route but it gave an error:

route add default gw 192.168.1.253 eth1

route: SIOCADDRT: No such process[/CODE]

I also tried this method but it gave another but different error

ip route add default via 192.168.1.253 dev eth1

RTNETLINK answers: No such process[/CODE]

This is the point I got to. Pinging 8.8.8.8 still no success (from within the telnet / old router console). The key thing was to prove that via the old routers interface (via telnet) I could ping the new router (192.168.1.253) and the outside world (8.8.8.8). FYI, connecting via wifi to the old router which is then connected LAN-LAN on my laptop I could ping both the new router and the outside world.

I think there are a number of issues here but the main one being it keeps loosing the info needed in the routing table

the below seems to show progress but it keeps being lost on reboot:

/tmp/home/root# ifconfig eth1 192.168.1.254 netmask 255.255.255.0 up
/tmp/home/root# route add default gw 192.168.1.253 dev eth1
/tmp/home/root# route -n

returns:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         192.168.1.253   0.0.0.0         UG    0      0        0 eth1

It's the 0.0.0.0 → 192.168.1.253 via eth1 is what I need to keep in place I assume?

For some reason after doing the 'nvram commit' and then reboot it is lost again. I did also try 'nvram commit' followed by 'sync' and then 'reboot' but it made no difference.

So... I think I've reached the end of my limited knowledge and am also now confusing myself on what steps I do and don't need... there are signs of me getting there but the problem is it most likely needs a startup script to keep the settings plus I haven't even considered the need to setup the DDNS yet. I have zero knowledge of script writing but if you think it would resolve the issues, please could someone help (so that making sure I can connect LAN-LAN to the old router and from the old router telnet console I can ping 192.168.1.253 and 8.8.8.8 and also ensuring the DDNS (i use the ASUS one) will let me call home plus some some logging would be good to know things have changed.

Thanks in advance

RodP

 

[Tech9]

My need is I want to use a home based VPN rather than these online VPN subscription sites, so they are not an option to me.

If this is really all you need:

- update the firmware to latest much newer Asuswrt (Apr 2025)
- switch to Router Mode in double NAT behind your ISP gateway
- set OpenVPN server on the Asus router as usual
- use DMZ or Port Forwarding on the ISP gateway to access it from WAN

Your mobile devices when outside your home LAN can connect to it and use your home ISP for Internet access.

 

[rodp]

Hi @Tech9,

Thanks for the reply, a couple of questions:

1) So I need to wave goodbye to Merlin?
2) I've found the page with the firmwares on https://www.asus.com/uk/supportonly/rt-n66u (ver.b1)/helpdesk_bios/ (Merlin is version 380.69). Can I ignore the old firmware and go straight to the latest: ASUS RT-N66U Firmware version 3.0.0.4.382_52747?
3) Will I lose the merlin's extra functions and bug fixes? Not actually sure what functionality I may lose but perhaps it's more about the bug fixes? https://www.asuswrt-merlin.net/changelog-380
4) I am assuming that I won't need to do a factory reset AND my vpn settings etc. won't be lost during the update? If i lose them I'll no doubt have to distribute another openvpn key/credentials file to my users.

Regarding your instructions...
1) How shall I wire up the new (FYI a Plusnet Hub 2) and old router? Do i use a network cable from new router LAN port to old router WAN port?
2) The router's operation mode is set to the default 'wireless router mode'. The next point I wasn't too sure what you meant (double NAT). Can you guide me a little please.
3) Re port forwarding. I have setup a port forwarding but my problem is DDNS. The new router won't do ddns / the asus ddns that I'm using (similar to myasusddns.asus.com, which means i will be redirected correctly if the (new) router acquires a new IP (eg. my kids turn if off accidently!) then I'll still be be able to find and use my VPN). Does this double NAT thing get round that?

 

[rodp]

slight update and apologies for the incorrect fact I made above the plusnet hub 2 router does have DDNS but not the Asus. one. So... I would like to stick with Asus if possible but that means I have to get the Asus router seeing the internet. If I have to change then I guess I will also have to change my OpenVPN credentials across the devices so I'm just to keep things the same at first

I looked into NoIP but you have to confirm every 30 days which sounds quite tedious.

 

[Ripshod]

sounds quite tedious

20 seconds of your life every 30 days. Tedious? Really?

 

[Tech9]

I am assuming that I won't need to do a factory reset AND my vpn settings etc.

Upload latest available firmware, do factory reset, basic Router and OpenVPN Server settings take few minutes.

 

[rodp]

20 seconds of your life every 30 days. Tedious? Really?

Ok, point made, i can do that but will have to recreate all the open vpn credential files and get them onto all the devices.

Any suggestions on the ddns provider. I want free with no strings, just like the asus one. Eg changeip.com is free but want you credit card details!

Appreciating the replies so far. Any advice on the double nat thing, port forwarding/dmz query?

Ideally I'd like to continue to use asus ddns and learn more about the routing tables and scripts so replies on this point would be great too.

Thanks

 

[bennor]

Any suggestions on the ddns provider. I want free with no strings, just like the asus one.

Some use https://www.noip.com/. They'll just send an email once a month where you renew the free DDNS name.

Remote Dynamic DNS Access–Connect to Your Devices Anywhere

www.noip.com