VPNMON VPNMON-R3 v1.9.1 -Mar 14, 2026- Monitor OVPN/Wireguard + Multi/Double-Hop VPN + WAN Health + Random Reset (Available in AMTM!)

[Tarek Yag]

Super incredible. Congrats @Viktor Jaep for this great new release full of improvements and new additions!!
Updating my instance now...

 

[Viktor Jaep]

Super excited to tease a brand new VPNMON-R3 feature... coming to a BETA your way soon! Double-Hop VPN!

Capable of selecting and configuring an inner and outer VPN tunnel, and when using 2 different VPN providers, gives you some of the best possible privacy available. Unique to VPNMON-R3 and this Asus Merlin Community, this feature also lets you use straight OVPN and pair it with a WG tunnel, or WG with OVPN, WG with WG or OVPN with OVPN.

Still doing lots of testing and cleanup... but hoping to get this out in your hands within a few more days!

 

[Viktor Jaep]

Shhhh... For anyone interested in wanting to test the first pre-release beta1... I've made it available. This is practically Alpha... All menus look clean, functionality looks good, will be making a few more tweaks here & there. Use at your own risk, and let me know how it goes!

VPNMON-R3 v1.9.0 Beta 1- (February 25, 2026)
- MINOR: Added an extremely unique feature to VPNMON-R3. Multi/Double-Hop VPN! While this kind of functionality is available using major VPN providers, this is not a feature I have come across in the Merlin FW world as of yet. This feature is capable of selecting and configuring an inner and outer VPN tunnel, and when using 2 different VPN providers, gives you some of the best possible privacy available. Unique to VPNMON-R3 and this Asus Merlin Community, this feature also lets you use straight OVPN and pair it with a WG tunnel, or WG with OVPN, WG with WG or OVPN with OVPN. This option is available under the configuration menu -> Option #17. A full menu to manage this feature has been added that lets you pick which VPN/WG slots, Hop Clients, and Advanced Settings if need be, along with the ability to enable/disable, rebuild, and tear down routing rules.

Beta Download Link

curl --retry 3 "https://raw.githubusercontent.com/ViktorJp/VPNMON-R3/develop/vpnmon-r3.sh" -o "/jffs/scripts/vpnmon-r3.sh" && chmod 755 "/jffs/scripts/vpnmon-r3.sh"

Significant Screenshots:

 

[Viktor Jaep]

Getting VPNMON-R3 v1.9.0 out the door after a few weeks of testing Multi/Double-Hop VPN on my end. Everything seems to be functioning as advertised. Would love to hear your feedback. Hope you all enjoy!

What's new!?
v1.9.0 - (March 8, 2026)
- MINOR: Added an extremely unique feature to VPNMON-R3. Multi/Double-Hop VPN! While this kind of functionality is available using major VPN providers, this is not a feature I have come across in the Merlin FW world as of yet. This feature is capable of selecting and configuring an inner and outer VPN tunnel, and when using 2 different VPN providers, gives you some of the best possible privacy available. Unique to VPNMON-R3 and this Asus Merlin Community, this feature also lets you use straight OVPN and pair it with a WG tunnel, or WG with OVPN, WG with WG or OVPN with OVPN. This option is available under the configuration menu -> Option #17. A full menu to manage this feature has been added that lets you pick which VPN/WG slots, Hop Clients, and Advanced Settings if need be, along with the ability to enable/disable, rebuild, and tear down routing rules. PLEASE NOTE: Double-Hop VPN Client redirection is handled within the VPNMON-R3 interface, not through the VPN Director in the main Merlin UI.
- PATCH: Various inconsistencies and bug fixes around bandwidth measurements.

Download link (or update directly within VPNMON-R3 or AMTM):

curl --retry 3 "https://raw.githubusercontent.com/ViktorJp/VPNMON-R3/main/vpnmon-r3.sh" -o "/jffs/scripts/vpnmon-r3.sh" && chmod 755 "/jffs/scripts/vpnmon-r3.sh"

Significant Screenshots:

Showing the main UI with the new Multi/Double-Hop VPN section added on the bottom:

The new Multi/Double-Hop VPN item #17 in the configuration menu:

The interface for configurating the Multi/Double-Hop VPN:

 

[Viktor Jaep]

Small bug fix day on one of my favorite days of the year... 3.14 - happy Pi-Day!

What's new!?
v1.9.1 - (March 14, 2026)
- PATCH: Because it's Pi-Day, we're celebrating with a small patch release along with a nice slice of Pizza pie! This bug fix resolves an issue that I thought I caught last go-around, but it was still showing bad behavior. Primarily related around the connection throughput indicator visuals, when the figure exceeded the lower and medium display bounds (configurable using option #14) only for the OVPN, it would use the TX values instead of the RX values. This all stems around the fact that for some reason, RX and TX values are reversed for OVPN, but not for WG, when gathering these stats from the underlying system.

Download link (or update directly within AMTM/VPNMON-R3):

curl --retry 3 "https://raw.githubusercontent.com/ViktorJp/VPNMON-R3/main/vpnmon-r3.sh" -o "/jffs/scripts/vpnmon-r3.sh" && chmod 755 "/jffs/scripts/vpnmon-r3.sh"

Significant Screenshots:

Call it what you will, OCD or whatever, but just making sure when everything is supposed to be green, everything is green. Fixed!

 

[kfahoo]

since (I think) v1.8.3 app stays with this after launch:

and it's killing working vpn connections even manually started

 

[Viktor Jaep]

since (I think) v1.8.3 app stays with this after launch:

View attachment 70872
and it's killing working vpn connections even manually started

Sounds like it's having problems determining if your WAN is up on your router. Until we've sorted this out, you could just disabling that functionality in the setup (vpnmon-r3 -setup -> 1 -> 8 add'l WAN monitoring)

You doing anything unusual when it comes to your WAN? What are you using for your Ping host? Could you be blocking anything?

 

[kfahoo]

Sounds like it's having problems determining if your WAN is up on your router. Until we've sorted this out, you could just disabling that functionality in the setup (vpnmon-r3 -setup -> 1 -> 8 add'l WAN monitoring)

You doing anything unusual when it comes to your WAN? What are you using for your Ping host? Could you be blocking anything?

no, behavior just changed with 1.8.3, I think it may be related to dual wan

 

[Viktor Jaep]

no, behavior just changed with 1.8.3, I think it may be related to dual wan

So you are running dual WAN? What are you using for your pinghost? Do you know what network interfaces are assigned to WAN0/WAN1?

I'll compare versions and see what might be different that could be affecting you.

I'll also send you a link to see if you can try 1.8.3 (or a version prior) to see if they work for you, which could help troubleshoot this.

 

[Viktor Jaep]

no, behavior just changed with 1.8.3, I think it may be related to dual wan

I have compared the main functions dealing with WAN outages between 1.9.1 and 1.8.3, and have not found any differences. Perhaps it is something else!?

Please give v1.8.3 another try, and see if this doesn't cause the same behavior that you're seeing - run the command below to overwrite your current version of VPNMON-R3 with v1.8.3:

#!/bin/sh
########################################################################
# Detects router identity, Wi-Fi band-to-interface mappings, and WAN
# interface assignments from NVRAM on Asus-Merlin routers.
#
# Exports the following globals on success:
#   IFNAME_WAN0, IFNAME_WAN1
#   IFNAME_24, IFNAME_24_2, IFNAME_24_3
#   IFNAME_5,  IFNAME_5_2,  IFNAME_5_3
#   IFNAME_6,  IFNAME_6_2,  IFNAME_6_3
########################################################################

detect_wifi_bands() {
    NVRAM="${NVRAM:-nvram}"

    local idx=0
    local max_radios=4
    local nband ifname band_label
    local count_24=0 count_5=0 count_6=0

    # -- Router identity -----------------------------------------------------
    local router_model router_fw

    router_model=$(${NVRAM} get productid 2>/dev/null)
    [ -z "${router_model}" ] && router_model=$(${NVRAM} get model 2>/dev/null)
    [ -z "${router_model}" ] && router_model="Unknown"

    # On 3006.x branch (Wi-Fi 7) routers, the full version must be assembled
    # from firmver (e.g. 3006.102) + buildno (e.g. 7) + extendno (e.g. 0).
    # os_version alone only returns the trailing portion (e.g. 102.7.0).
    local firmver buildno extendno
    firmver=$(${NVRAM} get firmver  2>/dev/null)
    buildno=$(${NVRAM} get buildno  2>/dev/null)
    extendno=$(${NVRAM} get extendno 2>/dev/null)

    if [ -n "${firmver}" ] && [ -n "${buildno}" ]; then
        router_fw="${firmver}.${buildno}${extendno:+.${extendno}}"
    else
        router_fw=$(${NVRAM} get os_version 2>/dev/null)
        [ -z "${router_fw}" ] && router_fw="Unknown"
    fi

    clear
    echo "==========================================" >&2
    echo "  Make:     Asus"                           >&2
    echo "  Model:    ${router_model}"                >&2
    echo "  Firmware: ${router_fw}"                   >&2
    echo "==========================================" >&2

    # -- Wi-Fi bands ---------------------------------------------------------
    echo ""
    echo "Detecting Wi-Fi band-to-interface mappings..." >&2

    while [ "${idx}" -lt "${max_radios}" ]; do

        # No ifname means this radio index doesn't exist; stop scanning
        ifname=$(${NVRAM} get wl${idx}_ifname 2>/dev/null)
        [ -z "${ifname}" ] && break

        # wlX_nband NVRAM key: 1=5GHz, 2=2.4GHz, 4=6GHz
        nband=$(${NVRAM} get wl${idx}_nband 2>/dev/null)

        case "${nband}" in
            2)  # 2.4 GHz
                count_24=$((count_24 + 1))
                band_label="2.4GHz"
                if [ "${count_24}" -eq 1 ]; then
                    IFNAME_24="${ifname}"
                else
                    eval "IFNAME_24_${count_24}='${ifname}'"
                    band_label="2.4GHz-${count_24}"
                fi
                ;;
            1)  # 5 GHz
                count_5=$((count_5 + 1))
                band_label="5GHz"
                if [ "${count_5}" -eq 1 ]; then
                    IFNAME_5="${ifname}"
                else
                    eval "IFNAME_5_${count_5}='${ifname}'"
                    band_label="5GHz-${count_5}"
                fi
                ;;
            4)  # 6 GHz
                count_6=$((count_6 + 1))
                band_label="6GHz"
                if [ "${count_6}" -eq 1 ]; then
                    IFNAME_6="${ifname}"
                else
                    eval "IFNAME_6_${count_6}='${ifname}'"
                    band_label="6GHz-${count_6}"
                fi
                ;;
            *)
                band_label="Unknown (nband=${nband:-<empty>})"
                ;;
        esac

        echo "  wl${idx} -> ${ifname} [${band_label}]" >&2
        idx=$((idx + 1))
    done

    # -- WAN interfaces ------------------------------------------------------
    echo ""
    echo "Detecting WAN interface mappings..." >&2

    local wan_idx wan_ifname wan_proto

    for wan_idx in 0 1; do
        wan_ifname=$(${NVRAM} get wan${wan_idx}_ifname 2>/dev/null)
        wan_proto=$(${NVRAM} get wan${wan_idx}_proto 2>/dev/null)

        # Skip entirely if no interface is assigned (WAN1 absent on single-WAN models)
        [ -z "${wan_ifname}" ] && continue

        eval "IFNAME_WAN${wan_idx}='${wan_ifname}'"
        echo "  wan${wan_idx} -> ${wan_ifname} [${wan_proto:-unknown}]" >&2
    done

    # -- Summary -------------------------------------------------------------
    echo "==========================================" >&2
    echo ""
    echo "Interface Mapping:" >&2
    [ -n "${IFNAME_WAN0}" ] && echo "  WAN0:     ${IFNAME_WAN0}  ($(${NVRAM} get wan0_proto 2>/dev/null))" >&2
    [ -n "${IFNAME_WAN1}" ] && echo "  WAN1:     ${IFNAME_WAN1}  ($(${NVRAM} get wan1_proto 2>/dev/null))" >&2
    [ -n "${IFNAME_24}"   ] && echo "  2.4GHz:   ${IFNAME_24}"   >&2
    [ -n "${IFNAME_24_2}" ] && echo "  2.4GHz-2: ${IFNAME_24_2}" >&2
    [ -n "${IFNAME_24_3}" ] && echo "  2.4GHz-3: ${IFNAME_24_3}" >&2
    [ -n "${IFNAME_5}"    ] && echo "  5GHz:     ${IFNAME_5}"    >&2
    [ -n "${IFNAME_5_2}"  ] && echo "  5GHz-2:   ${IFNAME_5_2}"  >&2
    [ -n "${IFNAME_5_3}"  ] && echo "  5GHz-3:   ${IFNAME_5_3}"  >&2
    [ -n "${IFNAME_6}"    ] && echo "  6GHz:     ${IFNAME_6}"    >&2
    [ -n "${IFNAME_6_2}"  ] && echo "  6GHz-2:   ${IFNAME_6_2}"  >&2
    [ -n "${IFNAME_6_3}"  ] && echo "  6GHz-3:   ${IFNAME_6_3}"  >&2
    echo ""
    echo "==========================================" >&2
    echo ""
}

detect_wifi_bands

 

[kfahoo]

So you are running dual WAN? What are you using for your pinghost? Do you know what network interfaces are assigned to WAN0/WAN1?

I'll compare versions and see what might be different that could be affecting you.

I'll also send you a link to see if you can try 1.8.3 (or a version prior) to see if they work for you, which could help troubleshoot this.

sorry for delay

ok, so I turned off dual wan and behavior didn't change so that's not it,

I'm pinging my isp gateway and it's responding when pinging by hand

I've checked previous versions and last working is 1.8.2

my interfaces:

==========================================
  Make:     Asus
  Model:    RT-AC86U
  Firmware: 3.0.0.4.386.14.2
==========================================

Detecting Wi-Fi band-to-interface mappings...
  wl0 -> eth5 [2.4GHz]
  wl1 -> eth6 [5GHz]

Detecting WAN interface mappings...
  wan0 -> eth0 [static]
==========================================

Interface Mapping:
  WAN0:     eth0  (static)
  2.4GHz:   eth5
  5GHz:     eth6

==========================================

 

[Viktor Jaep]

sorry for delay

ok, so I turned dual wan and behavior didn't change so that's not it,

I'm pinging my isp gateway and it's responding when pinging by hand

I've checked previous versions and last working is 1.8.2

my interfaces:

==========================================
  Make:     Asus
  Model:    RT-AC86U
  Firmware: 3.0.0.4.386.14.2
==========================================

Detecting Wi-Fi band-to-interface mappings...
  wl0 -> eth5 [2.4GHz]
  wl1 -> eth6 [5GHz]

Detecting WAN interface mappings...
  wan0 -> eth0 [static]
==========================================

Interface Mapping:
  WAN0:     eth0  (static)
  2.4GHz:   eth5
  5GHz:     eth6

==========================================

Ok I'll take a look at 1.8.2 and compare. Will let you know.

I'm surprised it didn't identify your WAN1 interface with this script? Hum. ;(

 

[kfahoo]

I'm surprised it didn't identify your WAN1 interface with this script? Hum. ;(

it ate the “off”. I meant “I turned it off”

 

[Viktor Jaep]

it ate the “off”. I meant “I turned it off”

Thanks. The other bit of information I was still hoping to get from you was what you were using for the ping check? Please realize that these hosts should not only be able to respond a ping, but they should be able to respond with a valid TLS certificate on port 443. Google's DNS (8.8.8.8) and Cloudflare's DNS (1.1.1.1) are able to do this. If you're pointing it to something that isn't capable of this, then you may want to switch it.

And what do you have set for your Recovery timeout?

 

[kfahoo]

I'm pinging my isp gateway

 

[Viktor Jaep]

"I'm pinging my isp gateway"

There's a good chance that is your problem right there. A gateway is not likely to produce a TLS cert. Try changing it to a common standard high speed DNS server away from your ISP.