Problem with my New ASUS RT-88U PRO Merlin and NordVPN pre-configured/custom configuration and DNS settings .

[Viktor Jaep]

Thank you. I already had DNS Configuration Disabled although NordVPN guide says to put it on strict. I didn’t do that. Must the DNS-over-TLS Profile stay on Strict and what must I choose at Preset servers? Because I already have assigned it at DNS Server.

Follow my screenshots above. Strict. Choose the Quad9 preset servers, and they will populate the top part of that screen as shown. In DNS Director, make sure it is set to "router". (Different screen under LAN)

 

[Redskins16]

Follow my screenshots above. Strict. Choose the Quad9 preset servers, and they will populate the top part of that screen as shown. In DNS Director, make sure it is set to "router". (Different screen under LAN)

View attachment 53841

Thank You, Viktor I really appreciate it. I understand everything you've said. The only thing is that at the WAN/ Internet Connection/ WAN DNS Setting/ DNS Server. I have also assigned there Quad9. Normally it was on my ISP. Must I leave it like I have it now or change it back to ISP?

 

[Viktor Jaep]

Thank You, Viktor I really appreciate it. I understand everything you've said. The only thing is that at the WAN/ Internet Connection/ WAN DNS Setting/ DNS Server. I have also assigned there Quad9. Normally it was on my ISP. Must I leave it like I have it now or change it back to ISP?

You definitely want to change your WAN DNS settings to use Quad9's DNS servers. Do not give your ISP a leg up on you!

 

[Redskins16]

You definitely want to change your WAN DNS settings to use Quad9's DNS servers. Do not give your ISP a leg up on you!

Thank you Viktor. All is I just had one question about WebRTC leaks. On my PC there are no WebRTC leaks at every test I made and on one phone when using the Bromite browser app, no leaks are shown either. But when I use ipleak.net at duckduckgo app, I see an IP address that I think is a default IP Address of the app (correct me if I'm wrong) because it is not my ISP IP nor that of my router. So I think it’s connected to Duckduckgo. The same result happens when I use another phone with duckduckgo and I see the WebRTC leaks but with a different IP. But when I use browserleaks.com/webrtc for both phones, it shows the following:

! WebRTC exposes your Local IP

✔ No Public IP Leak



I see the Local IP Address and Public IP Address. The logo/image of the Local looks like an LAN Port. Is this something I must leave alone or change into the router or the app itself?

 

[Viktor Jaep]

Thank you Viktor. All is I just had one question about WebRTC leaks. On my PC there are no WebRTC leaks at every test I made and on one phone when using the Bromite browser app, no leaks are shown either. But when I use ipleak.net at duckduckgo app, I see an IP address that I think is a default IP Address of the app (correct me if I'm wrong) because it is not my ISP IP nor that of my router. So I think it’s connected to Duckduckgo. The same result happens when I use another phone with duckduckgo and I see the WebRTC leaks but with a different IP. But when I use browserleaks.com/webrtc for both phones, it shows the following:

! WebRTC exposes your Local IP

✔ No Public IP Leak



I see the Local IP Address and Public IP Address. The logo/image of the Local looks like an LAN Port. Is this something I must leave alone or change into the router or the app itself?

Not quite sure about this one... perhaps someone else can jump in for advice. I'm running on a VPN, and PC clients or mobile phones all show that I'm not leaking any WebRTC... but I am not sure about what IP you're talking about. Could duckduckgo perhaps be using a vpn client or proxy of its own? Not quite sure...

 

[Redskins16]

I've created a short how-to guide for NordVPN here: https://www.snbforums.com/threads/v...-surfshark-perfectprivacy-3.84694/post-836862

I sometimes have problems with my internet connection which disconnects to my VPN settings on the router and returns to my ISP IP even with the KillSwitch on. I have read here and there some topics in regard to the issue like this one:

https://www.snbforums.com/threads/kill-switch-doesnt-work.74948/#post-715690

and this one:

https://www.snbforums.com/threads/vpn-client-and-killswitch.74170/#post-707860

This one is what I found to be more in line with what I want to solve my issue:

https://www.snbforums.com/threads/vpn-director-asuswrt-merlin.83294/post-837941


I wanted your thoughts and knowledge on this issue. Also, I have read your guide again:

https://www.snbforums.com/threads/v...surfshark-perfectprivacy-3.84694/#post-836862

And noticed that I didn't do the VPN Director steps. Will this ensure that if I do the VPN Director steps and my connection again disconnects that setting will force the internet to use another VPN connection instead o the ISP?

Also, I noticed something very odd. At the Redirect Internet traffic through tunnel setting, I have it on Redirect all and I see the killswitch option in which I have it enabled but shouldn't the KillSwitch option only be enabled with the choose and choosing of VPN Director ( Policy rules)?

 

[Viktor Jaep]

I sometimes have problems with my internet connection which disconnects to my VPN settings on the router and returns to my ISP IP even with the KillSwitch on. I have read here and there some topics in regard to the issue like this one:

https://www.snbforums.com/threads/kill-switch-doesnt-work.74948/#post-715690

and this one:

https://www.snbforums.com/threads/vpn-client-and-killswitch.74170/#post-707860

Happy to help... as you read there, the Asus-Merlin FW built-in killswitch has its limits. In certain cases it won't work if your vpn connection stops. This is why, in the other post, @eibgrad suggested creating your own killswitch to get around these limitations. He was successful in building one (here). I had run with his idea, and built KILLMON that takes it a step further, and gives you some other options on protecting your devices in the event your vpn connection goes down, available here.

I had also been dealing with my VPN connection going down all the time, and not having a good way to monitor it, or have it automatically reconnect. I built VPNMON-R2 for that purpose, and that has kept our VPN connection running 24x7 for years now. It really does work well for my purposes, and like the fact that I can randomly pick from 2000+ endpoints to appear from when it reconnects after a failure, or from a scheduled reset. If you haven't already played with that, you can get that here

This one is what I found to be more in line with what I want to solve my issue:

https://www.snbforums.com/threads/vpn-director-asuswrt-merlin.83294/post-837941


I wanted your thoughts and knowledge on this issue. Also, I have read your guide again:

https://www.snbforums.com/threads/v...surfshark-perfectprivacy-3.84694/#post-836862

And noticed that I didn't do the VPN Director steps. Will this ensure that if I do the VPN Director steps and my connection again disconnects that setting will force the internet to use another VPN connection instead o the ISP?

Also, I noticed something very odd. At the Redirect Internet traffic through tunnel setting, I have it on Redirect all and I see the killswitch option in which I have it enabled but shouldn't the KillSwitch option only be enabled with the choose and choosing of VPN Director ( Policy rules)?

The VPN Director is simply a tool to allow you to select which devices need to route over which VPN connection. In the guide I wrote, i recommended that you build one configuration for each of your VPN connections in order to force your local network traffic out over it, incase VPNMON-R2 switches from VPN slot #1 to #3, for instance. That way you're always guaranteed that your network traffic is being forced out through a VPN connection, if there is one present. It works surprisingly well.

The VPN Director is not going to automatically reconnect your VPN connection, if that is what you were asking. You will need a tool, like VPNMON-R2, to perform that reconnection task.

The killswitch setting you are describing acts independent of VPN Director. You can have rules on or off, it doesn't affect whether or not you want to use the built-in killswitch.

Hope that helps!

 

[Redskins16]

Happy to help... as you read there, the Asus-Merlin FW built-in killswitch has its limits. In certain cases it won't work if your vpn connection stops. This is why, in the other post, @eibgrad suggested creating your own killswitch to get around these limitations. He was successful in building one (here). I had run with his idea, and built KILLMON that takes it a step further, and gives you some other options on protecting your devices in the event your vpn connection goes down, available here.

I had also been dealing with my VPN connection going down all the time, and not having a good way to monitor it, or have it automatically reconnect. I built VPNMON-R2 for that purpose, and that has kept our VPN connection running 24x7 for years now. It really does work well for my purposes, and like the fact that I can randomly pick from 2000+ endpoints to appear from when it reconnects after a failure, or from a scheduled reset. If you haven't already played with that, you can get that here



The VPN Director is simply a tool to allow you to select which devices need to route over which VPN connection. In the guide I wrote, i recommended that you build one configuration for each of your VPN connections in order to force your local network traffic out over it, incase VPNMON-R2 switches from VPN slot #1 to #3, for instance. That way you're always guaranteed that your network traffic is being forced out through a VPN connection, if there is one present. It works surprisingly well.

The VPN Director is not going to automatically reconnect your VPN connection, if that is what you were asking. You will need a tool, like VPNMON-R2, to perform that reconnection task.

The killswitch setting you are describing acts independent of VPN Director. You can have rules on or off, it doesn't affect whether or not you want to use the built-in killswitch.

Hope that helps!

Thank you very much for the info I really appreciate it. Maybe one of the reason the connection of vpn sometimes disconnect is because of what is mentioned here:

https://www.snbforums.com/threads/v...nown-on-client-status-panel.80984/post-791153

I have read about the VPNMON-R2 but still find it a bit difficult to understand its uses. is there maybe a guide for simple-minded folk like me to use In my case I want to use it for the problem you had in regard to the VPN connection going down. I hope you can help me with it.

 

[Viktor Jaep]

Thank you very much for the info I really appreciate it. Maybe one of the reason the connection of vpn sometimes disconnect is because of what is mentioned here:

https://www.snbforums.com/threads/v...nown-on-client-status-panel.80984/post-791153

I have read about the VPNMON-R2 but still find it a bit difficult to understand its uses. is there maybe a guide for simple-minded folk like me to use In my case I want to use it for the problem you had in regard to the VPN connection going down. I hope you can help me with it.

Not much you can do about your VPN connection going down... it can literally be a whole host of things... ISP issues, modem issues, VPN provider issues, VPN provider actually just rebooting their server, VPN server getting overloaded, internet weather, you name it... some VPN providers are better than others.

VPNMON-R2 simply monitors your VPN connection, and if it goes down for any reason, it helps reconnect you. Easiest thing to do is play around with it... once you start getting more familiar with how it works, you too can start enjoying 100% VPN uptime.

 

[Redskins16]

Not much you can do about your VPN connection going down... it can literally be a whole host of things... ISP issues, modem issues, VPN provider issues, VPN provider actually just rebooting their server, VPN server getting overloaded, internet weather, you name it... some VPN providers are better than others.

VPNMON-R2 simply monitors your VPN connection, and if it goes down for any reason, it helps reconnect you. Easiest thing to do is play around with it... once you start getting more familiar with how it works, you too can start enjoying 100% VPN uptime.

Yes, I did it I know how to use the AMTM Before I play around with it. Most I use a USB or can I just use it without it?

 

[Viktor Jaep]

Yes, I did it I know how to use the AMTM Before I play around with it. Most I use a USB or can I just use it without it?

You certainly need a USB. Always recommended for storing a swap file and for storage for Entware tools (required) that are needed by vpnmon-r2.

Everything you need to know is documented here... read the instructions, follow them, and let me know where you experience issues.

Instructions:

VPNMON - VPNMON-R2 v2.65 -Jan 27, 2024- DISCONTINUED - Upgrade to VPNMON-R3 Available! (#3)

v2.65 - Now with even more SuperRandom(tm) goodness!! Updated January 27, 2024 ***NOTICE*** VPNMON-R2 is being discontinued. Please upgrade to VPNMON-R3 for further support and new development! Executive Summary: VPNMON-R2 is an all-in-one script that works for any VPN service of your choice...

www.snbforums.com

 

[Redskins16]

You certainly need a USB. Always recommended for storing a swap file and for storage for Entware tools (required) that are needed by vpnmon-r2.

Everything you need to know is documented here... read the instructions, follow them, and let me know where you experience issues.

Instructions:

VPNMON - VPNMON-R2 v2.65 -Jan 27, 2024- DISCONTINUED - Upgrade to VPNMON-R3 Available! (#3)

v2.65 - Now with even more SuperRandom(tm) goodness!! Updated January 27, 2024 ***NOTICE*** VPNMON-R2 is being discontinued. Please upgrade to VPNMON-R3 for further support and new development! Executive Summary: VPNMON-R2 is an all-in-one script that works for any VPN service of your choice...

www.snbforums.com

Thank you very much, Viktor, for your help and great work you've done with the vpnmon-r2. In regards to this part:

2.) Use the AMTM tool - Log into your router using an SSH terminal tool, like PuTTY (for Windows), execute "AMTM", and use the commands "fd" to format your flashdrive, and "sw" to configure a swap file. Minimum recommended size is at least 2GB.

So it is not necessary to format the USB to EXT4? and must I keep the USB in the router or can I pull it out after I'm done? Because I have read that many of the USBs became hot or caught fire or something like that.

 

[Viktor Jaep]

Thank you very much, Viktor, for your help and great work you've done with the vpnmon-r2. In regards to this part:

2.) Use the AMTM tool - Log into your router using an SSH terminal tool, like PuTTY (for Windows), execute "AMTM", and use the commands "fd" to format your flashdrive, and "sw" to configure a swap file. Minimum recommended size is at least 2GB.

So it is not necessary to format the USB to EXT4? and must I keep the USB in the router or can I pull it out after I'm done? Because I have read that many of the USBs became hot or caught fire or something like that.

Use the recommended default.i believe it's EXT4. But yeah, it needs to stay connected at all times. Invest in a nice cheap SSD with a USB enclosure instead for the perfect setup, or a better quality flashdrive. They might get warm if there's a lot of activity but I've never heard of one catching on fire. It will fail long before that.

 

[Redskins16]

The big difference between the two lists is that the generally accepted list doesn't have these items on it:

verify-x509-name CN=ch418.nordvpn.com -- This isn't on there because you would normally already have "Verify Server Certificate Name" selected to NO in the UI. Setting this to yes, or using this option typically tends to cause more headaches for people, and tend to leave it off.

pull -- You don't want that because that would allow the NordVPN server to have control over your routing table... typically a big no-no to let others have control over your environment.

cipher AES-256-CBC -- I had previously written a short post about this here as to why you don't want this in your config... showing how NordVPN even contradicts itself with this setting.

Hi Victor,

I hope you are doing well. I want your opinion on something. I have added these two lines to the Custom Configuration:

cipher AES-256-GCM
setenv CLIENT_CERT 0

I want your opinion on these two lines. I have read that this one: setenv CLIENT_CERT 0 is only used for Android, but there are also others that say you can use it as a whole. Should I use them or ignore them? Also, is the speed only the two differences between mssfix 0 and mssfix 1450 or is there more?

 

[Viktor Jaep]

Hi Victor,

I hope you are doing well. I want your opinion on something. I have added these two lines to the Custom Configuration:

cipher AES-256-GCM
setenv CLIENT_CERT 0

I want your opinion on these two lines. I have read that this one: setenv CLIENT_CERT 0 is only used for Android, but there are also others that say you can use it as a whole. Should I use them or ignore them? Also, is the speed only the two differences between mssfix 0 and mssfix 1450 or is there more?

I suppose you can force the AES-256-GCM, but with mine, it already picks this by default when connecting.

I really have no opinion about the setenv... I don't think it's needed, and like you said, it has to do with Android, and some confusion is has picking client certificates and whatnot.

There's a good article here: https://www.thegeekpub.com/271035/openvpn-mtu-finding-the-correct-settings/ -- and it mentions setting tun-mtu to 1450, and mssfix to 1410... I have not tried those setting yet... Then, on the openvpn reference manual site, it states using these values:

--tun-mtu 1500 --fragment 1300 --mssfix

(https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/)

I'm definitely open to experimenting with these values to see if they provide any kind of performance difference!

 

[Redskins16]

I suppose you can force the AES-256-GCM, but with mine, it already picks this by default when connecting.

I really have no opinion about the setenv... I don't think it's needed, and like you said, it has to do with Android, and some confusion is has picking client certificates and whatnot.

There's a good article here: https://www.thegeekpub.com/271035/openvpn-mtu-finding-the-correct-settings/ -- and it mentions setting tun-mtu to 1450, and mssfix to 1410... I have not tried those setting yet... Then, on the openvpn reference manual site, it states using these values:

--tun-mtu 1500 --fragment 1300 --mssfix

(https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/)

I'm definitely open to experimenting with these values to see if they provide any kind of performance difference!

Thank you for the information. With Regard to WireGuard and OpenVPN, I know that WireGuard offers a faster internet speed than OpenVPN, but is it safer?

 

[Redskins16]

I suppose you can force the AES-256-GCM, but with mine, it already picks this by default when connecting.

I really have no opinion about the setenv... I don't think it's needed, and like you said, it has to do with Android, and some confusion is has picking client certificates and whatnot.

There's a good article here: https://www.thegeekpub.com/271035/openvpn-mtu-finding-the-correct-settings/ -- and it mentions setting tun-mtu to 1450, and mssfix to 1410... I have not tried those setting yet... Then, on the openvpn reference manual site, it states using these values:

--tun-mtu 1500 --fragment 1300 --mssfix

(https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/)

I'm definitely open to experimenting with these values to see if they provide any kind of performance difference!

Viktor didn't you receive a notification regarding this message:

https://www.snbforums.com/threads/p...figuration-and-dns-settings.87320/post-877793

I have read here and there and many say that WireGuard is better than OpenVPN. They don't close out OpenVPN just saying that WireGuard is coming hard and being strong. As someone who has maybe worked with OpenVPN for a long time was wondering your opinion on it.