Problem with my New ASUS RT-88U PRO Merlin and NordVPN pre-configured/custom configuration and DNS settings .

[Redskins16]

It seems this is an outgoing problem with Asus RT-AX88U and RT-AX88U PRO. the nordvpn setting and guide are very confusing and some explanation here on the forum also. Keep giving DNS leak not acceptable the setting does someone have a permanent solution?

 

[Crimliar]

This is even after you've followed: https://support.nordvpn.com/Connectivity/Router/1047410642/AsusWRT-Merlin-setup-with-NordVPN.htm
?

 

[Redskins16]

This is even after you've followed: https://support.nordvpn.com/Connectivity/Router/1047410642/AsusWRT-Merlin-setup-with-NordVPN.htm
?

You would not believe me if I told you this especially after following those steps on Nordvpn, because if you follow those steps to the teeth then at the end you will get a message at the Service state that says: “Internet not redirected”. Like the one that is mentioned here in this topic/forum:

Asuswrt-Merlin and Nordvpn

Trying to install the vpn UDP file in Asuswrt-Merlin ver. 386.4 for Asus RT-AC88U. (Having the same issue with RT-AC3100). When I upload the file it clears everything else. I've tried numerous combinations, but the router does NOT redirect. Using Nordvpn. Had great success with earlier versions...

www.snbforums.com

Because those steps from Nord, don’t tell you to change the Redirect Internet traffic through tunnel. From No to Yes (all). Also, nord claims that you’ve to change the Custom Configuration to theirs, but that is also not true.

 

[Redskins16]

I’m not sure but I think that I maybe found the problem. When you use DNS from Nordvpn, the connection between your router and the ISP modem gets an error. You need to reboot the router and then turn the vpn on again. Then everything should work. I notice that if you’ve made some changes in the router that it is better to reboot it afterwards.

 

[L&LD]

Reboot=basic troubleshooting. (And I would suggest this reboot be tried both via the GUI and via a hard power off, i.e. pull the power plug).

Thanks for confirming.

 

[Redskins16]

Reboot=basic troubleshooting. (And I would suggest this reboot be tried both via the GUI and via a hard power off, i.e. pull the power plug).

Thanks for confirming.

You're welcome. I had just one question does rebooting the router often negatively impact the overall quality of the router?

 

[L&LD]

If you're rebooting after changing settings, no. That is the recommended method (to ensure your changes survive a reboot, and to clear anything from RAM/nvram that may affect its expected operation).

If you're using the reboot scheduler for no reason, then I would suggest it does impact the quality of the overall router experience.

If a scheduled reboot is 'required' to ensure a good experience, then the root cause of the issue needs to be found and fixed. Rebooting isn't a solution in this case. It will only allow the situation to get worse, eventually. Either by hardware failure, or, further interactions of old code from newly flashed firmware.

 

[Viktor Jaep]

I've created a short how-to guide for NordVPN here: https://www.snbforums.com/threads/v...-surfshark-perfectprivacy-3.84694/post-836862

 

[Redskins16]

I've created a short how-to guide for NordVPN here: https://www.snbforums.com/threads/v...-surfshark-perfectprivacy-3.84694/post-836862

Thank you for sharing. I really appreciate the info/effort but I have to admit that your guide is a bit difficult to understand. Furthermore, I have a few questions that I hope you can answer. I noticed that you didn’t mention changing the Redirect Internet traffic through tunnel, from No to Yes (all) or in your case the VPN director (policy rules). Why is that? Also, what's the difference between the Custom Configuration from the contents of the .ovpn, and that of the one mentioned in the nordvpn guide, and yours?

 

[Viktor Jaep]

Thank you for sharing. I really appreciate the info/effort but I have to admit that your guide is a bit difficult to understand.

If you have any issues with understanding, please feel free to ask questions below... We are here to help. I tried to make the guide as easy as possible to follow, though you need to know some of the basics of understanding how VPN works. I'm definitely willing to try to make it even easier to follow.

Furthermore, I have a few questions that I hope you can answer. I noticed that you didn’t mention changing the Redirect Internet traffic through tunnel, from No to Yes (all) or in your case the VPN director (policy rules). Why is that?

Because using yes or no in this case is an all or nothing for the clients on your network. Setting it to VPN Director allows you to selectively choose what will or won't get redirected through VPN.

Also, what's the difference between the Custom Configuration from the contents of the .ovpn, and that of the one mentioned in the nordvpn guide, and yours?

What NordVPN provides you in their instructions is garbage, and out-of-date. The config they suggest you use either doesn't work or causes issues. This configuration I posted has been working error-free for me for years, and is based off the config that @Jack Yaz used for his vpnmgr script as well.

 

[Redskins16]

If you have any issues with understanding, please feel free to ask questions below... We are here to help. I tried to make the guide as easy as possible to follow, though you need to know some of the basics of understanding how VPN works. I'm definitely willing to try to make it even easier to follow.


Because using yes or no in this case is an all or nothing for the clients on your network. Setting it to VPN Director allows you to selectively choose what will or won't get redirected through VPN.


What NordVPN provides you in their instructions is garbage, and out-of-date. The config they suggest you use either doesn't work or causes issues. This configuration I posted has been working error-free for me for years, and is based off the config that @Jack Yaz used for his vpnmgr script as well.

I just wanted to say that I really appreciate the offer you put in to and the help you are given. One can always learn new things and expand his knowledge.

Because using yes or no in this case is an all or nothing for the clients on your network. Setting it to VPN Director allows you to selectively choose what will or won't get redirected through VPN.

Is this advised if one uses it only for home and wants total security or in general? can you please elaborate more on it?

What NordVPN provides you in their instructions is garbage, and out-of-date. The config they suggest you use either doesn't work or causes issues. This configuration I posted has been working error-free for me for years, and is based off the config that @Jack Yaz used for his vpnmgr script as well.

Thank you for the clarification. What about the config you get once you upload the .ovpn file? Also doesn't this line:

pull-filter ignore "ifconfig-ipv6"
pull-filter ignore "route-ipv6"

shut off the ipv6 usages? correct me if I'm wrong. And what is the main function of the config what do they exactly do? and who is Jack Yaz? Forgive me for asking I'm new here.

 

[Viktor Jaep]

I just wanted to say that I really appreciate the offer you put in to and the help you are given. One can always learn new things and expand his knowledge.

Absolutely. That's why we're all here!

Is this advised if one uses it only for home and wants total security or in general? can you please elaborate more on it?

Its depending on how granular you want to get with the rules. For instance, if I want my wife and kids devices to be forced across the VPN, but I want my TV excluded so I don't have to deal with Netflix/Disney+ streaming issues, then it's much easier to use the VPN Director in this case.

Thank you for the clarification. What about the config you get once you upload the .ovpn file? Also doesn't this line:

pull-filter ignore "ifconfig-ipv6"
pull-filter ignore "route-ipv6"

shut off the ipv6 usages? correct me if I'm wrong. And what is the main function of the config what do they exactly do? and who is Jack Yaz? Forgive me for asking I'm new here.

Yep. It just ignores any IPv6 traffic before it hits your VPN tunnel. NordVPN doesn't support IPv6 anyways at this point yet. The config are basically switches/options you're using for the OpenVPN application, and choosing how you want it to behave. Some VPN providers require certain options to be set in order to make a successful connection. You can read more on options here:

Reference Manual For OpenVPN 2.4 | OpenVPN

Because OpenVPN tries to be a universal VPN tool offering a great deal of flexibility, there are a lot of options on this reference page for OpenVPN 2.4

openvpn.net

Jack is a developer who created some of the most useful scripts on our routers, still in use by many today... like YazFi, vpnmgr, YazDHCP, spdMerlin, etc... more here:

Asuswrt-Merlin Addon Software Catalog

Asus-Merlin Addon Software Catalog This sticky post functions as a software catalog (with links to threads, scripts, and author names), grouped by functionality, to make it easier for Asus-Merlin users to find and install addons for their Asus routers without having to search through massive...

www.snbforums.com

 

[Redskins16]

Absolutely. That's why we're all here!


Its depending on how granular you want to get with the rules. For instance, if I want my wife and kids devices to be forced across the VPN, but I want my TV excluded so I don't have to deal with Netflix/Disney+ streaming issues, then it's much easier to use the VPN Director in this case.

Yep. It just ignores any IPv6 traffic before it hits your VPN tunnel. NordVPN doesn't support IPv6 anyways at this point yet. The config are basically switches/options you're using for the OpenVPN application, and choosing how you want it to behave. Some VPN providers require certain options to be set in order to make a successful connection. You can read more on options here:

Reference Manual For OpenVPN 2.4 | OpenVPN

Because OpenVPN tries to be a universal VPN tool offering a great deal of flexibility, there are a lot of options on this reference page for OpenVPN 2.4

openvpn.net

Jack is a developer who created some of the most useful scripts on our routers, still in use by many today... like YazFi, vpnmgr, YazDHCP, spdMerlin, etc... more here:

Asuswrt-Merlin Addon Software Catalog

Asus-Merlin Addon Software Catalog This sticky post functions as a software catalog (with links to threads, scripts, and author names), grouped by functionality, to make it easier for Asus-Merlin users to find and install addons for their Asus routers without having to search through massive...

www.snbforums.com

Thank you for all the information.

Yep. It just ignores any IPv6 traffic before it hits your VPN tunnel. NordVPN doesn't support IPv6 anyways at this point yet. The config are basically switches/options you're using for the OpenVPN application, and choosing how you want it to behave. Some VPN providers require certain options to be set in order to make a successful connection. You can read more on options here:

Reference Manual For OpenVPN 2.4 | OpenVPN

Because OpenVPN tries to be a universal VPN tool offering a great deal of flexibility, there are a lot of options on this reference page for OpenVPN 2.4

openvpn.net

I have read the link and have to say it's a lot of information to take in. If you could simplify and explain the difference between this one:

resolv-retry infinite

remote-random

tun-mtu 1500

tun-mtu-extra 32

mssfix 1450

ping 15

ping-restart 0

ping-timer-rem

verify-x509-name CN=ch418.nordvpn.com

remote-cert-tls server

pull

fast-io

cipher AES-256-CBC

and the one you use. That would be of great help.

 

[Viktor Jaep]

I have read the link and have to say it's a lot of information to take in. If you could simplify and explain the difference between this one: and the one you use. That would be of great help.

How about this. How about you do some homework, compare values between the two, look them up in the OpenVPN manual and/or Google, and let us know what questions you have about specific values... and we'll try to answer those?

 

[Redskins16]

How about this. How about you do some homework, compare values between the two, look them up in the OpenVPN manual and/or Google, and let us know what questions you have about specific values... and we'll try to answer those?

Trust me, I did. Even before opening this forum/topic, I already extensively searched all the necessary information that is out there about this issue, so I'm not just asking questions just to ask questions. I'm genuinely lost on what to do next when it comes to the Custom Configuration field/ setup. I just want to know the main difference between the two configurations in my previous post. I hope I haven't complicated my question.

 

[Viktor Jaep]

Trust me, I did. Even before opening this forum/topic, I already extensively searched all the necessary information that is out there about this issue, so I'm not just asking questions just to ask questions. I'm genuinely lost on what to do next when it comes to the Custom Configuration field/ setup. I just want to know the main difference between the two configurations in my previous post. I hope I haven't complicated my question.

The big difference between the two lists is that the generally accepted list doesn't have these items on it:

verify-x509-name CN=ch418.nordvpn.com -- This isn't on there because you would normally already have "Verify Server Certificate Name" selected to NO in the UI. Setting this to yes, or using this option typically tends to cause more headaches for people, and tend to leave it off.

pull -- You don't want that because that would allow the NordVPN server to have control over your routing table... typically a big no-no to let others have control over your environment.

cipher AES-256-CBC -- I had previously written a short post about this here as to why you don't want this in your config... showing how NordVPN even contradicts itself with this setting.

 

[Redskins16]

The big difference between the two lists is that the generally accepted list doesn't have these items on it:

verify-x509-name CN=ch418.nordvpn.com -- This isn't on there because you would normally already have "Verify Server Certificate Name" selected to NO in the UI. Setting this to yes, or using this option typically tends to cause more headaches for people, and tend to leave it off.

pull -- You don't want that because that would allow the NordVPN server to have control over your routing table... typically a big no-no to let others have control over your environment.

cipher AES-256-CBC -- I had previously written a short post about this here as to why you don't want this in your config... showing how NordVPN even contradicts itself with this setting.

Thank you. I now fully understand the main points. I have also read the part about DNS and I'm going to change it from Nord to Quad9. Any advice about that?

 

[Viktor Jaep]

Thank you. I now fully understand the main points. I have also read the part about DNS and I'm going to change it from Nord to Quad9. Any advice about that?

That's the way to go... set your WAN DNS to use DoT... and make sure you configure your VPN client Accept DNS Configuration to "Disabled".

 

[Redskins16]

That's the way to go... set your WAN DNS to use DoT... and make sure you configure your VPN client Accept DNS Configuration to "Disabled".

View attachment 53809

View attachment 53810

Thank you. I already had DNS Configuration Disabled although NordVPN guide says to put it on strict. I didn’t do that. Must the DNS-over-TLS Profile stay on Strict and what must I choose at Preset servers? Because I already have assigned it at DNS Server.

 

[Redskins16]

That's the way to go... set your WAN DNS to use DoT... and make sure you configure your VPN client Accept DNS Configuration to "Disabled".

View attachment 53809

View attachment 53810

Hi Viktor,

Have read my previous messages?