Asus RT-AC68 router OpenVPN setup

arlobillz · Feb 19, 2018

Anyone struggling with OpenVPN setup; Ive found a great guide which cracked it for me just here:

Randy : OpenVPN on a Asus router

Apologies in advance if this link has already been posted or this is deemed the wrong forum

catcamstar · Feb 19, 2018

In addition to the aforementioned post, if you happen to have an ASUS router, I suggest to have a look at Home | Asuswrt-Merlin (codename Rmerlin Asuswrt). It includes the "standard" gui stuff from ASUS, plus tons of add-ons!

Cookie Monster · Feb 19, 2018

I've just bought one of those, and I have yet to plug it in. The main reason for the purchase was to set up VPN on the router, so the above links will be very useful. Thanks.

c hris527 · Feb 19, 2018

The nice thing about the Merlin is it lets you do a site survey so you can see whats taking up the real estate in bandwidth world and change your channels so you and your other equipment or neighbors are not in conflict. As of late the Asus routers are a pain in the rear to get stable, I had to do a LOT of tweaking that I never had to do with any other router to get it somewhat stable. It still has latency issues in the 2.4 world and it is known problem with them right now. I run a AC-68u right now but not really happy with its performance. I sent my first one back hoping it was a bad router but had the same issue with the second one too.

teamRAVEGREEN · Feb 19, 2018

c hris527 said:
The nice thing about the Merlin is it lets you do a site survey so you can see whats taking up the real estate in bandwidth world and change your channels so you and your other equipment or neighbors are not in conflict. As of late the Asus routers are a pain in the rear to get stable, I had to do a LOT of tweaking that I never had to do with any other router to get it somewhat stable. It still has latency issues in the 2.4 world and it is known problem with them right now. I run a AC-68u right now but not really happy with its performance. I sent my first one back hoping it was a bad router but had the same issue with the second one too.

That's interesting - I pretty much feel the complete opposite. I came from a tp-link router which, while decent, seemed a little flaky at times. The ac-68u was a breeze to setup and it's been rock solid for a few months now. I know about Merlin but have yet to go down that path as the standard firmware has been good to me. I just noticed noticed yesterday when I was logged into the router that there is a firmware update...

c hris527 · Feb 19, 2018

teamRAVEGREEN said:
That's interesting - I pretty much feel the complete opposite. I came from a tp-link router which, while decent, seemed a little flaky at times. The ac-68u was a breeze to setup and it's been rock solid for a few months now. I know about Merlin but have yet to go down that path as the standard firmware has been good to me. I just noticed noticed yesterday when I was logged into the router that there is a firmware update...

I would say this, If your router is working fine, I would not update unless I saved a copy of what you have, I bought mine on amazon(Mistake) and have been nothing but frustrated with this box. Read some reviews about the latency and dropping of this router and it goes on and on, I see I am not alone with this issue, who knows perhaps I got one or two in my case of crappy chipsets or something.

catcamstar · Feb 19, 2018

c hris527 said:
I would say this, If your router is working fine, I would not update unless I saved a copy of what you have, I bought mine on amazon(Mistake) and have been nothing but frustrated with this box. Read some reviews about the latency and dropping of this router and it goes on and on, I see I am not alone with this issue, who knows perhaps I got one or two in my case of crappy chipsets or something.

I had the same experience on my AC87U after some Rmerlin update. Opened a case with ASUS, "sorry you are on Rmerlin, flash the original FW back". Did it, and worked flawlessly during two weeks. Flashed Rmerlin back, and hoppa, with factory reset, it went back live without any issue, running stable now since 4 months (except one reboot with the latest firmware off course

)

tibimakai · Feb 22, 2018

I already had a couple of Asus routers, and I did not experience issues with them. I always use Merlin firmware.
The only one that hasn't be stable, is the latest one, for the AC3100. I still have two AC-68 set up as media bridge and I don't have issues with them. One is for the living room devices, and the other, for the cameras (temporarily).

bp2008 · Feb 22, 2018

My AC68U is still going strong, no issues at all, although I run Tomato firmware on it and I do not use its wifi!

te2k · Sep 17, 2018

Hi all, I have the RT-AC68U and have set up openvpn as per the instructions in the OP. I can see that I am connected to my LAN through the router OpenVPN page as well as I can log into my router page via the IP Adress through a browser on my smartphone however I am unable to connect to my NVR/IP CAM as it shows as failed connection in iDMSS and I also can't access it if I were to type the device IP Address.

I am able to view everything when I am on the home wifi.

Any ideas? Thanks in advance

c hris527 · Sep 17, 2018

te2k said:
Hi all, I have the RT-AC68U and have set up openvpn as per the instructions in the OP. I can see that I am connected to my LAN through the router OpenVPN page as well as I can log into my router page via the IP Adress through a browser on my smartphone however I am unable to connect to my NVR/IP CAM as it shows as failed connection in iDMSS and I also can't access it if I were to type the device IP Address.

I am able to view everything when I am on the home wifi.

So if what you are saying is true, you can ping and see your NVR when connected through your phone on the home wifi lan ? If that is also true then once you start your VPN connection you should be able to ping your NVR's IP address through a browser on your phone (Disconnected from your home lan). To eliminate the phone or a carrier issue you could set up a client on a laptop and try to connect from a friends house or work to see if you can connect that way. I have it set up both way's and have no issues.

catcamstar · Sep 17, 2018

te2k said:
Hi all, I have the RT-AC68U and have set up openvpn as per the instructions in the OP. I can see that I am connected to my LAN through the router OpenVPN page as well as I can log into my router page via the IP Adress through a browser on my smartphone however I am unable to connect to my NVR/IP CAM as it shows as failed connection in iDMSS and I also can't access it if I were to type the device IP Address.

I am able to view everything when I am on the home wifi.

Any ideas? Thanks in advance

Are you connecting to your OpenVPN server by 4g/3g? If you try to connect FROM your (private) wifi signal and connect TO your OpenVPN infrastructure, your routing (gateways) may be confused to find a way to your NVR (on your LAN). Always disconnect from local LAN, connecto to 4g/3g or wifi from the neighbours, and open the tunnel from there. Bottom-line is that if you are locally connected in the same subnet as your local lan (eg nvr), you are entering a room with pitfalls. That's the reason why I advice to use an "exotic" internal subnet range.

c hris527 · Sep 17, 2018

So if what you are saying is true, you can ping and see your NVR when connected through your phone on the home wifi lan ? If that is also true then once you start your VPN connection you should be able to ping your NVR's IP address through a browser on your phone (Disconnected from your home lan). To eliminate the phone or a carrier issue you could set up a client on a laptop and try to connect from a friends house or work to see if you can connect that way. I have it set up both way's and have no issues.

te2k · Sep 17, 2018

catcamstar said:
Are you connecting to your OpenVPN server by 4g/3g? If you try to connect FROM your (private) wifi signal and connect TO your OpenVPN infrastructure, your routing (gateways) may be confused to find a way to your NVR (on your LAN). Always disconnect from local LAN, connecto to 4g/3g or wifi from the neighbours, and open the tunnel from there. Bottom-line is that if you are locally connected in the same subnet as your local lan (eg nvr), you are entering a room with pitfalls. That's the reason why I advice to use an "exotic" internal subnet range.

I am utilizing OpenVPN when I am on 4G.

c hris527 said:
So if what you are saying is true, you can ping and see your NVR when connected through your phone on the home wifi lan ? If that is also true then once you start your VPN connection you should be able to ping your NVR's IP address through a browser on your phone (Disconnected from your home lan). To eliminate the phone or a carrier issue you could set up a client on a laptop and try to connect from a friends house or work to see if you can connect that way. I have it set up both way's and have no issues.

Yes I can see my NVR through my phone on home Wifi Lan. However I am unable to ping NVR IP address through a browser on my phone (4G) through OpenVPN but am able to ping or access my router and other device. I reckon this is because I have block internet access from router client page for all Dahua equipment (which is highly recommended here). Is there any other way where I can block internet access of the Dahua equipment with the Asus router but still enables me to connect to the devices via VPN?

toolazyforalogin · Sep 17, 2018

How did you add the NVR in iDMSS Plus? Did you add it by IP address?

I would use your VPN and try to re-add the NVR in the IDMSS program.

te2k · Sep 18, 2018

te2k said:
Yes I can see my NVR through my phone on home Wifi Lan. However I am unable to ping NVR IP address through a browser on my phone (4G) through OpenVPN but am able to ping or access my router and other device. I reckon this is because I have block internet access from router client page for all Dahua equipment (which is highly recommended here). Is there any other way where I can block internet access of the Dahua equipment with the Asus router but still enables me to connect to the devices via VPN?

Ok so I've tested with disabling the "block internet access" to the NVR and it still wouldn't connect via OpenVPN. I am at wit's end

toolazyforalogin said:
How did you add the NVR in iDMSS Plus? Did you add it by IP address?

I would use your VPN and try to re-add the NVR in the IDMSS program.

I've tried this however it tells me failed to connect if I do it through OpenVPN. It will allow me to add the device just fine if I am on local wifi.

te2k · Sep 19, 2018

Hi all, still having issues trying to connect to my Dahua devices via OpenVPN. It seems very much like a setting missing on the Dahua NVR / IP CAM since I am able to ping other devices on my LAN via VPN. Any advice would be much appreciated. Thanks.

catcamstar · Sep 19, 2018

te2k said:
Hi all, still having issues trying to connect to my Dahua devices via OpenVPN. It seems very much like a setting missing on the Dahua NVR / IP CAM since I am able to ping other devices on my LAN via VPN. Any advice would be much appreciated. Thanks.

Only advice I can give at this point: switch the network port, cabling and IP settings (ip address, subnetmask & gateway) EXACTLY the same as the NVR to a PC. Disable firewall and other security related stuff on that PC. Try to ping that IP address from your device. Does that work? Good, connect to VPN, ping it again. Does it work? Then you know it has something to do with the TCPIP stack in your NVR (eg bad gateway/subnetmask/routing/...). If it doesn't work, you have to look somewhere else (asus firewall, cabling etc)

te2k · Sep 24, 2018

catcamstar said:
Only advice I can give at this point: switch the network port, cabling and IP settings (ip address, subnetmask & gateway) EXACTLY the same as the NVR to a PC. Disable firewall and other security related stuff on that PC. Try to ping that IP address from your device. Does that work? Good, connect to VPN, ping it again. Does it work? Then you know it has something to do with the TCPIP stack in your NVR (eg bad gateway/subnetmask/routing/...). If it doesn't work, you have to look somewhere else (asus firewall, cabling etc)

After several days cracking my head trying to get this to work, I have narrowed down my problem. It seems there is something with the TUN configuration my network / router / switch does not like. I just created a TAP configuration and used it on my laptop tethered to my mobile 4G network and was able to access my LAN with the TAP configuration. However I've also learnt that there are no OpenVPN mobile apps that work with TAP configuration. Any ideas guys?

catcamstar · Sep 24, 2018

te2k said:
After several days cracking my head trying to get this to work, I have narrowed down my problem. It seems there is something with the TUN configuration my network / router / switch does not like. I just created a TAP configuration and used it on my laptop tethered to my mobile 4G network and was able to access my LAN with the TAP configuration. However I've also learnt that there are no OpenVPN mobile apps that work with TAP configuration. Any ideas guys?

Hi te2k,
TAP are mostly used for same-segment extensions (eg having the same subnet information left side and right side) - basically for site2site VPN situations. That's the reason why mobile apps don't support TAP. My conclusion so far is that your OpenVPN server does work well (otherwise you wouldn't be able to connect by TAP either). So it comes down to either the post-routing when tun VPN is opened, either firewall inbetween (eg block internet access on NVR), or a combination of both.

I suggest you work in a pragmatic step by step approach, between 2 "more debugable" devices, eg 1 PC (win/lin) and NAS (samba share).
Step 1: put pc on 100% LAN and open samba share: this should work
Step 2: configure openvpn tun for router, put pc on tethered 4G, and connect VPN client: this should work
Step 3: try to open samba share: this should work
Step 4: put NAS in "block internet access mode"
Step 5: try to open samba share: this should work

If In between step 3 and step 5, the services are broken, you have discovered the "root cause". Finding a solution is more difficult (eg vlanbased which is not something OOTB with Rmerlin).

Good luck!
CC

Asus RT-AC68 router OpenVPN setup

Young grasshopper

Known around here

Young grasshopper

Known around here

Young grasshopper

Known around here

Known around here

Known around here

n3wb

Known around here

Known around here

Known around here

n3wb

Getting the hang of it

n3wb

n3wb

Known around here

n3wb

Known around here