VPNMON VPNMON-R3 v1.6.3 -Sep 1, 2025- Monitor OpenVPN/Wireguard WAN/Dual-WAN Health & Random Reset Multiple Connections (Available in AMTM!)

[routytout]

Happy to announce the next version of VPNMON-R3 v1.6.0! Super excited to offer "Unbound over Wireguard" with many thanks to @ZebMcKayhan for his awesome guidance and incredible expertise on the subject! I truly appreciate your contributions to this! Also, huge thanks to all of you beta testers! Wouldn't have gotten this far without you - thank you @CaptainSTX , @fourty6and2 , @iTyPsIDg , @Stephen Harrington, and @ZebMcKayhan (and anyone else I may have forgotten)!

Thanks everyone who made Unbound over Wireguard possible. What I'm unsure of is compatibility with VPN providers. I understand that Unbound integration stopped working for NordVPN and that it should work with other VPN providers, although only AirVPN is mentioned by name.

Has anyone had success with anything other than AirVPN? I got it working with AirVPN but Mullvad VPN doesn't seem to work the minute I turn it on, at least over Wireguard, I haven't tried OpenVPN yet. I like AirVPN's approach but speeds are quite disappointing. Speedtests tend to be great but github downloads for instance can be 1MB/s while Mullvad is 10 times that. You'd almost think some of the servers AirVPN is using are prioritizing speedtests over other traffic. So I would like to try other VPN that would work with Unbound over Wireguard.

 

[Viktor Jaep]

Thanks everyone who made Unbound over Wireguard possible. What I'm unsure of is compatibility with VPN providers. I understand that Unbound integration stopped working for NordVPN and that it should work with other VPN providers, although only AirVPN is mentioned by name.

Has anyone had success with anything other than AirVPN? I got it working with AirVPN but Mullvad VPN doesn't seem to work the minute I turn it on, at least over Wireguard, I haven't tried OpenVPN yet. I like AirVPN's approach but speeds are quite disappointing. Speedtests tend to be great but github downloads for instance can be 1MB/s while Mullvad is 10 times that. You'd almost think some of the servers AirVPN is using are prioritizing speedtests over other traffic. So I would like to try other VPN that would work with Unbound over Wireguard.

Glad to hear you are using Unbound over VPN/WG!Both AirVPN and ProtonVPN worked fine for me on both OVPN and WG. Haven't tried Nord for some time now. Their support was clueless and just kept giving me the runaround on when a fix was coming. I don't think they had any incentive to fix.

 

[routytout]

Glad to hear you are using Unbound over VPN/WG!Both AirVPN and ProtonVPN worked fine for me on both OVPN and WG. Haven't tried Nord for some time now. Their support was clueless and just kept giving me the runaround on when a fix was coming. I don't think they had any incentive to fix.

I was just in the process of trying out ProtonVPN next and yes that does work. Thank you for your quick reply. First impressions are that speeds seem much better than AirVPN. It's too bad because I like AirVPN's approach probably best.

 

[Viktor Jaep]

I was just in the process of trying out ProtonVPN next and yes that does work. Thank you for your quick reply. First impressions are that speeds seem much better than AirVPN. It's too bad because I like AirVPN's approach probably best.

No prob! Yeah, AirVPN can be a bit laggy, but it works great for a standalone Unbound connector. They certainly don't have as many servers as Proton. But nothing beats Nord IMO when it comes to choice of servers and their API implementation. Proton was great, but then they retired their API capabilities... such a shame. I haven't tried Surfshark, PerfectPrivacy or PIA when it comes to WG or automation capabilities... they may have something viable as well.

 

[jsbeddow]

@Viktor Jaep This is somewhat off-topic, but I figured if anyone has the expertise to pull this off, you would: any chance you might be able to integrate the backing up/restoring of the AsusWRT Wireguard Server keys and certificates/configuration? I know your script is primarily focused on VPN client side monitoring, but this would be a tremendously helpful add-on capability, particularly for those of us in need to fully factory reset our router but also desperately hoping not to have to make all new Wireguard server configs and having to distribute and install those on our client machines (scattered across various physical locations). This is one area where OpenVPN still has a significant advantage, the backup and restore of certificates and configs function is fully built-in by default.

The topic has been raised a couple of times in these forums, but the solution appears to be quite convoluted (I'm hoping that these might serve as pointers/inspiration):

How to Backup and Restore Wireguard Server Configuration

After finally giving up on being able to get Tailscale to run on my GT-AX6000, I have decided to just sticking with Wireguard implementation for now. I have set up WIreguard Server on the router using the latest Asuswrt-Merlin and all appears to be working quite well (apart from being completely...

www.snbforums.com

which leads to :

Tutorial - Wireguard server tweaks

My old RT-AC86U recently gave up, the 2.4GHz radio died, so I replaced it with RT-AX86U Pro so I figured Id try out the firmware wireguard server and see if I could tweak it to my needs. My primarily problem is that Im behind a cgnat and using a vps (cloud server) to relay wireguard from clients...

www.snbforums.com

Fingers crossed that you might look into this...thanks in advance.

 

[Viktor Jaep]

@Viktor Jaep This is somewhat off-topic, but I figured if anyone has the expertise to pull this off, you would: any chance you might be able to integrate the backing up/restoring of the AsusWRT Wireguard Server keys and certificates/configuration? I know your script is primarily focused on VPN client side monitoring, but this would be a tremendously helpful add-on capability, particularly for those of us in need to fully factory reset our router but also desperately hoping not to have to make all new Wireguard server configs and having to distribute and install those on our client machines (scattered across various physical locations). This is one area where OpenVPN still has a significant advantage, the backup and restore of certificates and configs function is fully built-in by default.

The topic has been raised a couple of times in these forums, but the solution appears to be quite convoluted (I'm hoping that these might serve as pointers/inspiration):

How to Backup and Restore Wireguard Server Configuration

After finally giving up on being able to get Tailscale to run on my GT-AX6000, I have decided to just sticking with Wireguard implementation for now. I have set up WIreguard Server on the router using the latest Asuswrt-Merlin and all appears to be working quite well (apart from being completely...

www.snbforums.com

which leads to :

Tutorial - Wireguard server tweaks

My old RT-AC86U recently gave up, the 2.4GHz radio died, so I replaced it with RT-AX86U Pro so I figured Id try out the firmware wireguard server and see if I could tweak it to my needs. My primarily problem is that Im behind a cgnat and using a vps (cloud server) to relay wireguard from clients...

www.snbforums.com

Fingers crossed that you might look into this...thanks in advance.

Hey @jsbeddow ... so after reading through this, it seems most of what you need is kept in NVRAM, and there may be some custom scripts needed that you'd find under /jffs/scripts. Would BACKUPMON not solve this need for you? Perhaps I'm missing something from the threads you attached, but it captures both NVRAM and /jffs in order to restore your router from scratch, and getting it back up and running, settings and all.

Please let me know if I'm missing anything?

 

[jsbeddow]

Hey @jsbeddow ... so after reading through this, it seems most of what you need is kept in NVRAM, and there may be some custom scripts needed that you'd find under /jffs/scripts. Would BACKUPMON not solve this need for you? Perhaps I'm missing something from the threads you attached, but it captures both NVRAM and /jffs in order to restore your router from scratch, and getting it back up and running, settings and all.

Please let me know if I'm missing anything?

Perhaps BACKUPMON could be a solution (and I have successfully used it in the not too distant past to rescue me from self-inflicted mistakes during the period when AGHome wasn't quite ready to work on the 3006 series of firmware). However, occasionally we are advised to fully reset our firmware back to factory defaults (some new upstream factory AsusWRT firmwares advise this, not yet ported over by @RMerlin ), and the general advice has always been "do not reload previous settings, always configure from scratch". I'm just trying to follow recommended practices, but they are somewhat in conflict here. I was hoping for a more "targeted" restore of just the WireGuard keys and configuration.

 

[ZebMcKayhan]

@Viktor Jaep This is somewhat off-topic, but I figured if anyone has the expertise to pull this off, you would: any chance you might be able to integrate the backing up/restoring of the AsusWRT Wireguard Server keys and certificates/configuration? I know your script is primarily focused on VPN client side monitoring, but this would be a tremendously helpful add-on capability, particularly for those of us in need to fully factory reset our router but also desperately hoping not to have to make all new Wireguard server configs and having to distribute and install those on our client machines (scattered across various physical locations). This is one area where OpenVPN still has a significant advantage, the backup and restore of certificates and configs function is fully built-in by default.

The topic has been raised a couple of times in these forums, but the solution appears to be quite convoluted (I'm hoping that these might serve as pointers/inspiration):

How to Backup and Restore Wireguard Server Configuration

After finally giving up on being able to get Tailscale to run on my GT-AX6000, I have decided to just sticking with Wireguard implementation for now. I have set up WIreguard Server on the router using the latest Asuswrt-Merlin and all appears to be working quite well (apart from being completely...

www.snbforums.com

which leads to :

Tutorial - Wireguard server tweaks

My old RT-AC86U recently gave up, the 2.4GHz radio died, so I replaced it with RT-AX86U Pro so I figured Id try out the firmware wireguard server and see if I could tweak it to my needs. My primarily problem is that Im behind a cgnat and using a vps (cloud server) to relay wireguard from clients...

www.snbforums.com

Fingers crossed that you might look into this...thanks in advance.

When looking around for nvram command reference I stumbled on @Xentrk old script for save/restore nvram:
https://github.com/Xentrk/nvram-save-restore-utility
I know it is dated and should probably not be used in a general way. But it contains a function to specify an ini fil with the nvram variables you wish to save. I'm thinking that it would be very possible to auto create the ini file on the source system and use the tool to save these nvram variables present on the source system move the saved file and restore on the destination system.

Would something like this be worth a try?

 

[Ventola]

@Viktor Jaep Windscribe appears to be using different interface IPs across servers, is it possible to add another optional field?

 

[Viktor Jaep]

@Viktor Jaep Windscribe appears to be using different interface IPs across servers, is it possible to add another optional field?

I was afraid of that. The few VPN providers I've been using to test with all thankfully have been using the same interface IPs. I'll get this added to my list.

 

[Viktor Jaep]

Perhaps BACKUPMON could be a solution (and I have successfully used it in the not too distant past to rescue me from self-inflicted mistakes during the period when AGHome wasn't quite ready to work on the 3006 series of firmware). However, occasionally we are advised to fully reset our firmware back to factory defaults (some new upstream factory AsusWRT firmwares advise this, not yet ported over by @RMerlin ), and the general advice has always been "do not reload previous settings, always configure from scratch". I'm just trying to follow recommended practices, but they are somewhat in conflict here. I was hoping for a more "targeted" restore of just the WireGuard keys and configuration.

When looking around for nvram command reference I stumbled on @Xentrk old script for save/restore nvram:
https://github.com/Xentrk/nvram-save-restore-utility
I know it is dated and should probably not be used in a general way. But it contains a function to specify an ini fil with the nvram variables you wish to save. I'm thinking that it would be very possible to auto create the ini file on the source system and use the tool to save these nvram variables present on the source system move the saved file and restore on the destination system.

Would something like this be worth a try?

Another few things to consider here @jsbeddow ... If you're using VPNMON-R3, you would have a copy of your server keys in its config file. So when you restore your router from scratch, you could do a fresh install of VPNMON-R3, and copy over its old vpnmon-r3 config files (located under /jffs/addons/vpnmon-r3.d. Then, when you get a WG slot up and running, starting VPNMON-R3 will copy these server keys over to keep that established connection going.

Secondarily, BACKUPMON also keeps a plaintext copy of your NVRAM in the root of your backup folder... doing a search for ex: "wgc2" would yield results like this:

wgc2_addr=10.5.0.2/32
wgc2_alive=25
wgc2_desc=NordVPN US Buffalo WG #9037
wgc2_dns=192.168.50.1
wgc2_enable=1
wgc2_enforce=0
...

If you wanted to selectively and manually restore settings like these without importing your complete NVRAM backup, you could modify these easily like this:

nvram set wgc2_addr=10.5.0.2/32
nvram set wgc2_alive=25
nvram set wgc2_desc="NordVPN US Buffalo WG #9037"
nvram set wgc2_dns="192.168.50.1"
nvram set wgc2_enable=1
nvram set wgc2_enforce=0
...
nvram commit

 

[ZebMcKayhan]

@Viktor Jaep This is somewhat off-topic, but I figured if anyone has the expertise to pull this off, you would: any chance you might be able to integrate the backing up/restoring of the AsusWRT Wireguard Server keys and certificates/configuration? I know your script is primarily focused on VPN client side monitoring, but this would be a tremendously helpful add-on capability, particularly for those of us in need to fully factory reset our router but also desperately hoping not to have to make all new Wireguard server configs and having to distribute and install those on our client machines (scattered across various physical locations). This is one area where OpenVPN still has a significant advantage, the backup and restore of certificates and configs function is fully built-in by default.

The topic has been raised a couple of times in these forums, but the solution appears to be quite convoluted (I'm hoping that these might serve as pointers/inspiration):

How to Backup and Restore Wireguard Server Configuration

After finally giving up on being able to get Tailscale to run on my GT-AX6000, I have decided to just sticking with Wireguard implementation for now. I have set up WIreguard Server on the router using the latest Asuswrt-Merlin and all appears to be working quite well (apart from being completely...

www.snbforums.com

which leads to :

Tutorial - Wireguard server tweaks

My old RT-AC86U recently gave up, the 2.4GHz radio died, so I replaced it with RT-AX86U Pro so I figured Id try out the firmware wireguard server and see if I could tweak it to my needs. My primarily problem is that Im behind a cgnat and using a vps (cloud server) to relay wireguard from clients...

www.snbforums.com

Fingers crossed that you might look into this...thanks in advance.

This is as far as I've come:

1. install nvram save restore script:

/usr/sbin/curl --retry 3 "https://raw.githubusercontent.com/Xentrk/nvram-save-restore-utility/master/nsrum" -o "/jffs/scripts/nsrum" && sleep 5 && chmod 755 /jffs/scripts/nsrum && sh /jffs/scripts/nsrum

Install using option 1. You will be prompted which partition to install to. Take a note on the install path. Mine became /tmp/mnt/USB_Drive/nsru/

2. get to the install directory:

cd /tmp/mnt/USB_Drive/nsru/

3. create the nvram ini script:

nvram show | grep wgs1 | cut -s -d '=' -f 1 > wgs1.ini

4. have script to backup the nvram variables in our ini file:

sh nvram-save.sh -i wgs1.ini

thats it! backups could now be found at:

/tmp/mnt/USB_Drive/nsru/backup/
    jffs-<date>_<model>-<mac> #a complete backup of jffs catalogue.
    nvram-all-<date>_<model>-<mac>.txt #a full dump of all nvram variables
    nvram-ini-<date>_<model>-<mac>.txt #a copy of the init file
    nvram-usr-<date>_<model>-<mac>.txt #a nvram dump on the requested nvram variables
    nvram-restore-<date>_<model>-<mac>.sh #a script to restore requested nvram variables.

backup to a different router model does not appear to be allowed. If you still want to do this, change the backup file name to include your new router output of "nvram get model" and the last 4 digits
"nvram get et0macaddr" (without the ':' )

So far everything seems to check out but as I have no need to do this I have not moved further, so continue at your own risk.

4. restore the wgs1 nvram variables i.e after a factory reset:

cd /tmp/mnt/USB_Drive/nsru/
sh nvram-restore.sh

you will be presented with options about which backup you wish to restore. Make sure the one you choose points to the wgs1.ini one, which should be the only existing.

 

[Viktor Jaep]

New VPNMON-R3 release v1.6.3 -- IMPORTANT UPDATE: For those using this with Wireguard Server List Automation, this release will require you to add a field to the WG Server List layout. Please be prepared as it might require some effort... read more below:

What's new?!
v1.6.3 - (September 1, 2025)
- PATCH: As discovered by @Ventola, Windscribe HAD to be different, and issues a different Interface IP for each of their server connections. This has now forced another required WG Server List field, as I could see other providers using similar tactics down the road. These are now the required fields in a comma delimited row: ConnectionName,InterfaceIP/Sub,EndpointIP,EndpointPort,PrivateKey, PublicKey, PreSharedKey(Opt) -- Example: City WG,10.50.0.2/32,143.32.55.23,34334,fasdkaffkasdjfj=,221t949as2323kf=,23fj39fffjdaf=

**PLEASE NOTE**: for Wireguard users using server list automation, this update will require you to add this InterfaceIP/Sub information to your current WG Server Lists. Not doing so will break the ability for VPNMON-R3 to insert the correct information into your WG slots. Sorry for the extra work. Hopefully this will be the last time we need any updates to this format.

Download link (or update directly within VPNMON-R3 or AMTM):

curl --retry 3 "https://raw.githubusercontent.com/ViktorJp/VPNMON-R3/main/vpnmon-r3.sh" -o "/jffs/scripts/vpnmon-r3.sh" && chmod 755 "/jffs/scripts/vpnmon-r3.sh"

Significant Screenshot:

Showing the new required additional field under the WG Client Slot Server List Maintenance screen:

Final note... for anyone using NordVPN WG Server automation through the API, here's a modified version of the CURL statement that includes the new InterfaceIP/Sub field:

curl --silent --retry 3 --connect-timeout 3 --max-time 6 --retry-delay 1 --retry-all-errors "https://api.nordvpn.com/v1/servers?limit=16354&filters\[country_id\]=228&filters\[servers_groups\]\[identifier\]=legacy_standard&filters\[servers_technologies\]\[identifier\]=wireguard_udp" | jq --raw-output '.[] | . as $parent | .technologies | .[] | select(.identifier == "wireguard_udp") | [$parent.locations[].country.city.name, ($parent.name | split("#") | .[1]), $parent.station, .metadata[0].value] | "NordVPN US \(.[0]) WG #\(.[1]),10.5.0.2/32,\(.[2]),51820,PFJKDFJ3Fjdflkkd2insertyourownprivatekey4baf232w50zetW4=,\(.[3])"'