Asus RT-AC68 router OpenVPN setup

In addition to the aforementioned post, if you happen to have an ASUS router, I suggest to have a look at Home | Asuswrt-Merlin (codename Rmerlin Asuswrt). It includes the "standard" gui stuff from ASUS, plus tons of add-ons!
 
I've just bought one of those, and I have yet to plug it in. The main reason for the purchase was to set up VPN on the router, so the above links will be very useful. Thanks.
 
The nice thing about the Merlin is it lets you do a site survey so you can see whats taking up the real estate in bandwidth world and change your channels so you and your other equipment or neighbors are not in conflict. As of late the Asus routers are a pain in the rear to get stable, I had to do a LOT of tweaking that I never had to do with any other router to get it somewhat stable. It still has latency issues in the 2.4 world and it is known problem with them right now. I run a AC-68u right now but not really happy with its performance. I sent my first one back hoping it was a bad router but had the same issue with the second one too.
 
c hris527 said:
The nice thing about the Merlin is it lets you do a site survey so you can see whats taking up the real estate in bandwidth world and change your channels so you and your other equipment or neighbors are not in conflict. As of late the Asus routers are a pain in the rear to get stable, I had to do a LOT of tweaking that I never had to do with any other router to get it somewhat stable. It still has latency issues in the 2.4 world and it is known problem with them right now. I run a AC-68u right now but not really happy with its performance. I sent my first one back hoping it was a bad router but had the same issue with the second one too.
Click to expand...

That's interesting - I pretty much feel the complete opposite. I came from a tp-link router which, while decent, seemed a little flaky at times. The ac-68u was a breeze to setup and it's been rock solid for a few months now. I know about Merlin but have yet to go down that path as the standard firmware has been good to me. I just noticed noticed yesterday when I was logged into the router that there is a firmware update... :)
 
  • Like
Reactions: looney2ns
teamRAVEGREEN said:
That's interesting - I pretty much feel the complete opposite. I came from a tp-link router which, while decent, seemed a little flaky at times. The ac-68u was a breeze to setup and it's been rock solid for a few months now. I know about Merlin but have yet to go down that path as the standard firmware has been good to me. I just noticed noticed yesterday when I was logged into the router that there is a firmware update... :)
Click to expand...
I would say this, If your router is working fine, I would not update unless I saved a copy of what you have, I bought mine on amazon(Mistake) and have been nothing but frustrated with this box. Read some reviews about the latency and dropping of this router and it goes on and on, I see I am not alone with this issue, who knows perhaps I got one or two in my case of crappy chipsets or something.
 
  • Like
Reactions: teamRAVEGREEN
c hris527 said:
I would say this, If your router is working fine, I would not update unless I saved a copy of what you have, I bought mine on amazon(Mistake) and have been nothing but frustrated with this box. Read some reviews about the latency and dropping of this router and it goes on and on, I see I am not alone with this issue, who knows perhaps I got one or two in my case of crappy chipsets or something.
Click to expand...

I had the same experience on my AC87U after some Rmerlin update. Opened a case with ASUS, "sorry you are on Rmerlin, flash the original FW back". Did it, and worked flawlessly during two weeks. Flashed Rmerlin back, and hoppa, with factory reset, it went back live without any issue, running stable now since 4 months (except one reboot with the latest firmware off course :p)
 
I already had a couple of Asus routers, and I did not experience issues with them. I always use Merlin firmware.
The only one that hasn't be stable, is the latest one, for the AC3100. I still have two AC-68 set up as media bridge and I don't have issues with them. One is for the living room devices, and the other, for the cameras (temporarily).
 
My AC68U is still going strong, no issues at all, although I run Tomato firmware on it and I do not use its wifi!
 
Hi all, I have the RT-AC68U and have set up openvpn as per the instructions in the OP. I can see that I am connected to my LAN through the router OpenVPN page as well as I can log into my router page via the IP Adress through a browser on my smartphone however I am unable to connect to my NVR/IP CAM as it shows as failed connection in iDMSS and I also can't access it if I were to type the device IP Address.

I am able to view everything when I am on the home wifi.

Any ideas? Thanks in advance
 
te2k said:
Hi all, I have the RT-AC68U and have set up openvpn as per the instructions in the OP. I can see that I am connected to my LAN through the router OpenVPN page as well as I can log into my router page via the IP Adress through a browser on my smartphone however I am unable to connect to my NVR/IP CAM as it shows as failed connection in iDMSS and I also can't access it if I were to type the device IP Address.

I am able to view everything when I am on the home wifi.

So if what you are saying is true, you can ping and see your NVR when connected through your phone on the home wifi lan ? If that is also true then once you start your VPN connection you should be able to ping your NVR's IP address through a browser on your phone (Disconnected from your home lan). To eliminate the phone or a carrier issue you could set up a client on a laptop and try to connect from a friends house or work to see if you can connect that way. I have it set up both way's and have no issues.
Click to expand...
 
te2k said:
Hi all, I have the RT-AC68U and have set up openvpn as per the instructions in the OP. I can see that I am connected to my LAN through the router OpenVPN page as well as I can log into my router page via the IP Adress through a browser on my smartphone however I am unable to connect to my NVR/IP CAM as it shows as failed connection in iDMSS and I also can't access it if I were to type the device IP Address.

I am able to view everything when I am on the home wifi.

Any ideas? Thanks in advance
Click to expand...

Are you connecting to your OpenVPN server by 4g/3g? If you try to connect FROM your (private) wifi signal and connect TO your OpenVPN infrastructure, your routing (gateways) may be confused to find a way to your NVR (on your LAN). Always disconnect from local LAN, connecto to 4g/3g or wifi from the neighbours, and open the tunnel from there. Bottom-line is that if you are locally connected in the same subnet as your local lan (eg nvr), you are entering a room with pitfalls. That's the reason why I advice to use an "exotic" internal subnet range.
 
So if what you are saying is true, you can ping and see your NVR when connected through your phone on the home wifi lan ? If that is also true then once you start your VPN connection you should be able to ping your NVR's IP address through a browser on your phone (Disconnected from your home lan). To eliminate the phone or a carrier issue you could set up a client on a laptop and try to connect from a friends house or work to see if you can connect that way. I have it set up both way's and have no issues.
 
catcamstar said:
Are you connecting to your OpenVPN server by 4g/3g? If you try to connect FROM your (private) wifi signal and connect TO your OpenVPN infrastructure, your routing (gateways) may be confused to find a way to your NVR (on your LAN). Always disconnect from local LAN, connecto to 4g/3g or wifi from the neighbours, and open the tunnel from there. Bottom-line is that if you are locally connected in the same subnet as your local lan (eg nvr), you are entering a room with pitfalls. That's the reason why I advice to use an "exotic" internal subnet range.
Click to expand...

I am utilizing OpenVPN when I am on 4G.

c hris527 said:
So if what you are saying is true, you can ping and see your NVR when connected through your phone on the home wifi lan ? If that is also true then once you start your VPN connection you should be able to ping your NVR's IP address through a browser on your phone (Disconnected from your home lan). To eliminate the phone or a carrier issue you could set up a client on a laptop and try to connect from a friends house or work to see if you can connect that way. I have it set up both way's and have no issues.
Click to expand...

Yes I can see my NVR through my phone on home Wifi Lan. However I am unable to ping NVR IP address through a browser on my phone (4G) through OpenVPN but am able to ping or access my router and other device. I reckon this is because I have block internet access from router client page for all Dahua equipment (which is highly recommended here). Is there any other way where I can block internet access of the Dahua equipment with the Asus router but still enables me to connect to the devices via VPN?
 
How did you add the NVR in iDMSS Plus? Did you add it by IP address?

I would use your VPN and try to re-add the NVR in the IDMSS program.
 
te2k said:
Yes I can see my NVR through my phone on home Wifi Lan. However I am unable to ping NVR IP address through a browser on my phone (4G) through OpenVPN but am able to ping or access my router and other device. I reckon this is because I have block internet access from router client page for all Dahua equipment (which is highly recommended here). Is there any other way where I can block internet access of the Dahua equipment with the Asus router but still enables me to connect to the devices via VPN?
Click to expand...

Ok so I've tested with disabling the "block internet access" to the NVR and it still wouldn't connect via OpenVPN. I am at wit's end :(

toolazyforalogin said:
How did you add the NVR in iDMSS Plus? Did you add it by IP address?

I would use your VPN and try to re-add the NVR in the IDMSS program.
Click to expand...

I've tried this however it tells me failed to connect if I do it through OpenVPN. It will allow me to add the device just fine if I am on local wifi.
 
Hi all, still having issues trying to connect to my Dahua devices via OpenVPN. It seems very much like a setting missing on the Dahua NVR / IP CAM since I am able to ping other devices on my LAN via VPN. Any advice would be much appreciated. Thanks.
 
te2k said:
Hi all, still having issues trying to connect to my Dahua devices via OpenVPN. It seems very much like a setting missing on the Dahua NVR / IP CAM since I am able to ping other devices on my LAN via VPN. Any advice would be much appreciated. Thanks.
Click to expand...

Only advice I can give at this point: switch the network port, cabling and IP settings (ip address, subnetmask & gateway) EXACTLY the same as the NVR to a PC. Disable firewall and other security related stuff on that PC. Try to ping that IP address from your device. Does that work? Good, connect to VPN, ping it again. Does it work? Then you know it has something to do with the TCPIP stack in your NVR (eg bad gateway/subnetmask/routing/...). If it doesn't work, you have to look somewhere else (asus firewall, cabling etc)
 
catcamstar said:
Only advice I can give at this point: switch the network port, cabling and IP settings (ip address, subnetmask & gateway) EXACTLY the same as the NVR to a PC. Disable firewall and other security related stuff on that PC. Try to ping that IP address from your device. Does that work? Good, connect to VPN, ping it again. Does it work? Then you know it has something to do with the TCPIP stack in your NVR (eg bad gateway/subnetmask/routing/...). If it doesn't work, you have to look somewhere else (asus firewall, cabling etc)
Click to expand...

After several days cracking my head trying to get this to work, I have narrowed down my problem. It seems there is something with the TUN configuration my network / router / switch does not like. I just created a TAP configuration and used it on my laptop tethered to my mobile 4G network and was able to access my LAN with the TAP configuration. However I've also learnt that there are no OpenVPN mobile apps that work with TAP configuration. Any ideas guys?
 
te2k said:
After several days cracking my head trying to get this to work, I have narrowed down my problem. It seems there is something with the TUN configuration my network / router / switch does not like. I just created a TAP configuration and used it on my laptop tethered to my mobile 4G network and was able to access my LAN with the TAP configuration. However I've also learnt that there are no OpenVPN mobile apps that work with TAP configuration. Any ideas guys?
Click to expand...
Hi te2k,
TAP are mostly used for same-segment extensions (eg having the same subnet information left side and right side) - basically for site2site VPN situations. That's the reason why mobile apps don't support TAP. My conclusion so far is that your OpenVPN server does work well (otherwise you wouldn't be able to connect by TAP either). So it comes down to either the post-routing when tun VPN is opened, either firewall inbetween (eg block internet access on NVR), or a combination of both.

I suggest you work in a pragmatic step by step approach, between 2 "more debugable" devices, eg 1 PC (win/lin) and NAS (samba share).
Step 1: put pc on 100% LAN and open samba share: this should work
Step 2: configure openvpn tun for router, put pc on tethered 4G, and connect VPN client: this should work
Step 3: try to open samba share: this should work
Step 4: put NAS in "block internet access mode"
Step 5: try to open samba share: this should work

If In between step 3 and step 5, the services are broken, you have discovered the "root cause". Finding a solution is more difficult (eg vlanbased which is not something OOTB with Rmerlin).

Good luck!
CC
 
You must log in or register to reply here.
Top Bottom