How to change my router from AP mode to router mode via ssh?

[CircleCly]

Hi! This is my first post on the forum so please be gentle.

I have a RT-AC68U that is currently in AP mode, and currently do not have access to the LAN it's on (in a physically far place), but I could ssh into it. I would like to set the router back to router mode. I know I could set it using the web interface, but this requires me to be on the LAN that the router's in. I would like to know if I could change this option via ssh.

Please let me know if I need to provide more information, and thanks!

 

[drinkingbird]

Hi! This is my first post on the forum so please be gentle.

I have a RT-AC68U that is currently in AP mode, and currently do not have access to the LAN it's on (in a physically far place), but I could ssh into it. I would like to set the router back to router mode. I know I could set it using the web interface, but this requires me to be on the LAN that the router's in. I would like to know if I could change this option via ssh.

Please let me know if I need to provide more information, and thanks!

I think the only way you're going to be able to do it is get someone onsite to give you teamviewer access through their PC. Even if you could do it via SSH (AFAIK you can't unless you're willing to spend many hours finding all the NVRAM variables, firewall rules, etc, and even then you probably wouldn't be in true router mode), you'd get kicked out and lose access before you could configure it anyway.

 

[Martinski]

Hi! This is my first post on the forum so please be gentle.

I have a RT-AC68U that is currently in AP mode, and currently do not have access to the LAN it's on (in a physically far place), but I could ssh into it. I would like to set the router back to router mode. I know I could set it using the web interface, but this requires me to be on the LAN that the router's in. I would like to know if I could change this option via ssh.

Please let me know if I need to provide more information, and thanks!

I believe it should be possible to access the router's WebGUI via the Dropbear SSH Server using SSH tunneling. Granted, I've never set it up with an ASUS router running in "AP Mode" (done it successfully in the past on a router in "Router Mode"), but it just might work in your particular scenario.

First, provide the basic details such as router model, F/W version, SSH settings, network setup, etc. to have a better idea & context of what we're dealing with. I'm assuming that you're on the most recent (AsusWRT? or Asuswrt-Merlin?) F/W version, and that you've got the SSH server enabled with both "LAN & WAN" access using key-based authentication *and* the "Allow Password Login" option is disabled. Also, I assume that the SSH port is set to a non-standard port number to further mitigate attempted attacks via the SSH port that's exposed to the internet.

Note that under normal circumstances, I would never recommend enabling the Dropbear SSH server with WAN access for several reasons (see this post for my personal thoughts on that), but given that you seem to be already there using it and have (knowingly?) assumed the security risks & responsibilities that come with such setup, I can provide some instructions to configure SSH tunneling via local port forwarding using the existing Dropbear SSH server.

It does require familiarity with SSH & with PuTTY as the SSH client on a Windows PC. If you're interested in trying to set it up to see if it works for you, just let me know.

 

[drinkingbird]

I believe it should be possible to access the router's WebGUI via the Dropbear SSH Server using SSH tunneling. Granted, I've never set it up with an ASUS router running in "AP Mode" (done it successfully in the past on a router in "Router Mode"), but it just might work in your particular scenario.

First, provide the basic details such as router model, F/W version, SSH settings, network setup, etc. to have a better idea & context of what we're dealing with. I'm assuming that you're on the most recent (AsusWRT? or Asuswrt-Merlin?) F/W version, and that you've got the SSH server enabled with both "LAN & WAN" access using key-based authentication *and* the "Allow Password Login" option is disabled. Also, I assume that the SSH port is set to a non-standard port number to further mitigate attempted attacks via the SSH port that's exposed to the internet.

Note that under normal circumstances, I would never recommend enabling the Dropbear SSH server with WAN access for several reasons (see this post for my personal thoughts on that), but given that you seem to be already there using it and have (knowingly?) assumed the security risks & responsibilities that come with such setup, I can provide some instructions to configure SSH tunneling via local port forwarding using the existing Dropbear SSH server.

It does require familiarity with SSH & with PuTTY as the SSH client on a Windows PC. If you're interested in trying to set it up to see if it works for you, just let me know.

They're running it in AP mode, there is no lan or wan or any security for that matter. The assumption here is they must be sshing to the main router then from that to the AP. Even if they can change the mode by tunneling the https, as soon as they change it they'll likely lose access to it?

 

[RMerlin]

You could set it to router mode over SSH, however on the following reboot you'd still need to access the webui to configure it.

 

[Martinski]

They're running it in AP mode, there is no lan or wan or any security for that matter. The assumption here is they must be sshing to the main router then from that to the AP.

You're right, WRT the router in "AP Mode" there is really no "WAN access" to speak of; but, there's certainly "LAN access" via the existing Dropbear SSH server, which can still be properly secure with key-based authentication and a non-standard port number. And yes, I'm aware that there are many unknowns about the OP's network setup, and several assumptions were made (and are still being made); that's why I asked the OP for more detailed information to understand what we were dealing with. So, until actual details and factual info is provided by the OP, it's still not 100% certain that his ASUS router can be switched from "AP Mode" to a fully functioning device operating in "Router Mode."

Even if they can change the mode by tunneling the https, as soon as they change it they'll likely lose access to it?

You could set it to router mode over SSH, however on the following reboot you'd still need to access the webui to configure it.

Yeah, that's ultimately the big question & challenge. Based on 2 experiences I've had with ASUS routers (AC68U & AC86U), I know that if the router had been previously set up in "Router Mode" and operated as such *before* being switched to "AP Mode," and then later on it gets switched back to "Router Mode," the router reboots itself and starts working with the previous "Router Mode" configuration settings *without* waiting for reconfiguration if/when its WAN port was connected to one of the main router's LAN ports; otherwise, it might not be possible to get the connection back and remote access would indeed be lost.