[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Wired router with VPN performance similar to Ax88u Pro?

Hi,

I have an AC86U with disabled wifi that I’m using with unifi AP.

I have 1Gb/s fiber and get 800mb/s on vpn (openvpn on the router, latest Merlin firmware)

I’m looking to replace the AC86U with a wired router…
I expected to easily get something as powerful but cheaper, but it seems every wired model I find is slower. For example: Tp-link ER605 v2, which is often suggested here, is shown as being limited to 21mb/s

I could get the AX88U Pro and turn off wifi… but I hate paying that much for features I will disable.

Any suggestion that would fit the bill?

Thanks!

[Assistant]
Vieux said:
I have 1Gb/s fiber and get 800mb/s on vpn (openvpn on the router, latest Merlin firmware)

No, you don't get 800Mbps on OpenVPN. This CPU can do about 250Mbps. If you have IPv6 enabled what you get is called IPv6 leak.

Vieux said:
I’m looking to replace the AC86U with a wired router…

Want to play beta tester of a new product? The same CPU as your RT-AC86U wired only Gigabit router from Asus:

ASUS ExpertWiFi EBG15｜Business WiFi Solutions｜ASUS Canada
ExpertWiFi
www.asus.com

Hmmmm… IPv6 is disabled

Speed test done on the router

Every leak test I’ve tried showed no problem.

I’m connected to Mullvad with default settings from their config files.

Would love to learn what is wrong with my setup if that speed is not possible on vpn with my hardware…

You perhaps test your WAN interface, not VPN. Test from a client routed through VPN instead. BCM4906 CPU can't do this speed on OpenVPN. For close to Gigabit OpenVPN you need appliance with x86 CPU, something like Intel i5/i7 or multithreaded OpenVPN on something like pfSense Plus on supported hardware.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: EdgeRouter Lite - i need help, or another router recommendation

In my enthusiasm to upgrade my home network i went out and bought a 2nd hand Netgear GS724Tv3 switch and an EdgeRouter Lite to replace my RT-AC88u which has been giving grief on port 5-8 and i was running out of ports anyways.

After some tinkering i got the switch to run almost perfect. I had some lag issues with connecting to the internet via one WiFi AP but a factory reset of the switch seems to have fixed it. The only thing remaining a mystery is that i cannot access the router interface via my desktop that is connected via UTP to the switch whilst i can access from every other device including my iPad and macbook air so it is not a big deal right now but at some point i need to figure it out.

The big issue now is getting the EdgeRouter configured. I watch all the tutorials on youtube and got as far as having it connected to the internet and setting up a VLAN to get the devices connected to the switch an IP via DHCP. For the rest i am completely stuck. I cannot access the router from any device except when plugging it directly into Eth2 (switch is connected to Eth1) and i cannot seem to set up static routes for the devices connected to the switch that i want to have a static IP. This router is really a challenge whilst setting up the RT-AC88u router was a piece of cake.

I have looked on the net to find a config file to upload but i don't find anything that resembles my specific network situation.

This is my current situation but the intent is to connect the EA6400 AP directly to the switch (which will require a UTP cable extension) and also add the Asus to the switch configured as AP.

Maybe i should have done more research before buying the EdgeRouter as i really feel this piece equipment goes beyond my network knowledge so either i find some real expert help to get this set up properly or alternatively a recommendation for a router that is way easier to set up and sell the EdgeRouter again.

[Assistant]
Your network plan has nothing resembling VLANs.

"i cannot seem to set up static routes for the devices connected to the switch that i want to have a static IP", shows you don't know the difference between a static route and static IP.

Ubiquiti Edgerouters are intended for SOHO and SMB use, require above average network knowledge beyond initial plug and play, and support mainly comes from the Ubiquiti community. From your starting point, you will continue to face challenges that will consume much of your time and there will be even more to learn beyond that, when your network scales up. If you actually want experts, try "r/ubiquiti" for your home networking setup or ubnt forums for the professionals.

Alternatively, choose a good consumer router replacement like the TP-Link Archer C7, Asus RT-AC66U B1, Synology RT2600ac, or the Netgear R7800.

umarmung said:
Your network plan has nothing resembling VLANs.

"i cannot seem to set up static routes for the devices connected to the switch that i want to have a static IP", shows you don't know the difference between a static route and static IP.

I agree that it does not but i did mention that the EA6400 is to be connected to the switch once have the UTP extension done. with regards to the sentence you quoted, I do know the difference, i just made a mistake on what i wanted to explain English not being my native language. What i meant was that i cannot seem to find how to configure the router to allow static IP's connected through the switch to get internet access.

umarmung said:
Ubiquiti Edgerouters are intended for SOHO and SMB use, require above average network knowledge beyond initial plug and play, and support mainly comes from the Ubiquiti community. From your starting point, you will continue to face challenges that will consume much of your time and there will be even more to learn beyond that, when your network scales up. If you actually want experts, try "r/ubiquiti" for your home networking setup or ubnt forums for the professionals.

Alternatively, choose a good consumer router replacement like the TP-Link Archer C7, Asus RT-AC66U B1, Synology RT2600ac, or the Netgear R7800.
Click to expand...

I do agree that i went in over my head with buying the EdgeRouter Lite without doing further research but i don't give up easily and don't want to replace the RT-AC88u by another consumer wifi router. Then i might as well leave all as-is as the whole point is to replace the wifi router by a stand-alone router as i have no use for a Wifi AP where it is currently located and i cannot move the router location as it would require me to reroute a bunch of UTP cables which is not an option.

The edgerouter is an amazing piece of equipment. Take the time to learn your way around edgeos. Look up willie howe on youtube, he has lots of tutorials on edgeos from basic first time power up to advanced configuration. I got stuck creating firewall rules and his vids cleared it right up for me.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Solved router connected to ISP router

Where I live all the available ISP provide you with a pretty poor wifi router as your connection.

So I connect the WAN port on my own wifi router to one of the LAN ports on the ISP wifi router. I then connect the rest of my network devices to my own wifi router.

There are very few settings i can change with the access level i have to the ISP router, I have disabled the wifi and that's all.

I am wondering if there are any settings i should change in my own router with this set up? for example I can see NAT is enabled on the ISP router should i disable it on my own router?

My network consists of

TP-Link Archer AX55 AX3000 4-Stream Wi-Fi 6 Router
TL-SG108PE Smart Switch connected to the above router
TP-Link AP WA 901ND connected to the above switch

All devices on my network either connect to the switch or to the AP wifi

[Assistant]
Leave it as it is. It's a common double NAT setup used by many. If you have no specific issues or needs - no further configuration is needed.

Is the ISP's router causing you identifiable problems? If not, leave the setup as-is. You've effectively got two levels of protection against intrusions into your LAN, which is not a bad thing.
If the ISP's router is causing you identifiable problems ... do they require you to use their router? Maybe you could just take it out of the picture and connect your own router directly to the incoming line. Of course, that makes you fully responsible for your own network security.

Tech9 said:
Leave it as it is. It's a common double NAT setup used by many. If you have no specific issues or needs - no further configuration is needed.
The most common case where a double NAT will cause you difficulties is if you want to run some type of server on the network connecting to your second router.

The other issue is when you contact support for a network issue they may try and blame all the problems on the double NAT.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: OPNsense + Omada SDN Proxmox container

I've been running an OPNsense router for about a year, and it's been quite stable. I thought I would now add the Omada SDN software controller to the network since two of my APs are TPlink EAP225s. The Omada SDN is virtualized in a Proxmox container, and OPNsense is on bare metal.

I am having trouble configuring the Omada software. I first configured VLANs in the WLANs section in Omada, then adopted the EAP225s, so they configure with the SSIDs and VLANs from the WLAN group I created, but the setup does not seem correct.

In Omada, all clients accessing the EAP225s show an IP within the correct subnet, but the corresponding VLAN shown is always "0". For example, the IP address xxx.xxx.15.x should be VLAN "15", but it's shown as "0" when viewed from the summary of clients. -- If I go to the "config" tab of the individual APs, the VLAN section is greyed out. If I try to enable VLANs in that tab , I get the message that an SSID with that name already exists. Does this make sense?

If I tinker too much in trying to solve this, I get a "missed heartbeat" status. Re-adopting the APs once that happens is impossible, so I have to factory reset them, and start again. Kind of annoying.

Also, my network components are not all TPlink products, and I recognize that Omada will only be able to configure and control devices from it's own ecosystem, but is the Omada controller able to monitor ALL the traffic in a network? Is it possible to configure the Omada (or OPNsense) so Omada can produce statistics on all the traffic, not just from it's own ecosystem (two EAP225s in my case)?

Does anyone use the Omada controller in this way? Is it worth the trouble adding it to a network if not all the APs and switches are TPlink products? Maybe I should mess with something that currently works?

Any help is appreciated!

[Assistant]
The smartest folks I know for Proxmox are over on ServeTheHome...

ServeTheHome Forums
A place to discuss servers, storage and networking
forums.servethehome.com

they should be able to sort things fairly quickly...


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: cctv settings in router

Hi only basic knowledge of changing router settings

There is a cctv system in my bar / restaurant they are not ip cameras its a stand alone system, it does however need a LAN connection in order that the owners can access the cameras visa an ap on their phones.
Does the cctv system require any special settings inside the router?
thanks for any help / advice

[Assistant]
Check the CCTV system User's Manual. It perhaps says what it needs to work properly with the App. Most just need Internet connection.

Tech9 said:
Check the CCTV system User's Manual. It perhaps says what it needs to work properly with the App. Most just need Internet connection.
bit of back ground my location is in Indonesia and the guy that installed the system is no longer contactable. The cameras are all accessible its just my plan to add another network and move the cctv to a different router i guess just try it...

paque1960 said:
guy that installed the system is no longer contactable

And Google doesn't know anything about this system? It has manufacturer and model number, no?


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Logging inbound connections on Edgerouter X

I have configured my Edgerouter X using the default setup wizard, so there is a rule in place to drop inbound traffic. I would like to log any inbound connection attempts. I have set up a remote log server, and it is logging activity from the Edgerouter. It is not logging any inbound connection attempts, including my own Netcat port probes directed at my public IP from another machine on the WAN. Should I expect to see this traffic logged? I have tried several logging levels including Information, Warning, and Debug. When I set it to Information I get a flood of log entries, so the logging is definitely working.

[Assistant] That's certainly not the default behavior, IME. If you poke around you might find a way to enable such logging. There is a per-rule counter as to how many packets get dropped by a particular rule --- you might want to watch that for awhile before deciding if you really want to see details of every packet.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: [Ars] Kremlin-backed hackers are infecting Ubiquity EdgeRouters

The FBI and partners from 10 other countries are urging owners of Ubiquiti EdgeRouters to check their gear for signs they’ve been hacked and are being used to conceal ongoing malicious operations by Russian state hackers.

The Ubiquiti EdgeRouters make an ideal hideout for hackers. The inexpensive gear, used in homes and small offices, runs a version of Linux that can host malware that surreptitiously runs behind the scenes. The hackers then use the routers to conduct their malicious activities. Rather than using infrastructure and IP addresses that are known to be hostile, the connections come from benign-appearing devices hosted by addresses with trustworthy reputations, allowing them to receive a green light from security defenses.

Continue reading on Ars Technica

[Assistant]
With the ever expanding power of the internet, consumer-grade hardware has been quite a concern to me for some time already. The companies in this arena heavily rely on sales volume rather than price point so the speed to market is increasing fast which leaves only limited time for firmware maturing and vulnerability verification- and improvement. Same reason why i don't want network devices with cloud-based interfaces. Too many points of entry...

For this very reason I swapped out my EdgeRouter Lite 3 for a TP-Link ER605 v2.... but I would like to flash OpenWRT to the ERL 3 and try to use it...

I have already flashed OpenWRT to the router, but have not been able to get any connection to the Internet through it

The "security hole" that was being exploited here was very simple: routers whose admin passwords hadn't been changed from the factory default. Ubiquiti deserve some blame for not forcing users to change that (which I think they fixed in more recent firmware builds) but really this is mostly on the users. Switching away from EdgeRouters because of this report is pretty misguided.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: OpenWRT on EdgeRouter Lite 3

Hello to everyone!

OK, I have successfully flashed OpenWRT to my ERL 3, was able to access it via the GUI, was also able to update to the latest firmware.

What I have NOT been able to do is gain Internet connectivity. My laptop is connected to the eth0 port and in the GUI OpenWRT calls that port the LAN port, which is different from EdgeOS setup where eht0 is supposed to be the WAN port.

eth1 and eth2 are WAN ports according to the GUI, I connect a cable from my modem to either eth1 or eth2 but do not have any connection to the net...

Is there a tutorial for the ERL3 anywhere? The YouTube videos about setting up OpenWRT on an EdgeRouter X are nothing like what I see on my ERL 3

[Assistant]
sfx2000 said:
Is ERL3 even supported by OpenWRT?
Sure is. Just got an update a few months ago

cdzo72 said:
Sure is. Just got an update a few months ago

Are you certain of that?

ERL3 is different than the Edge Router Lite - and I'm not seeing a target there...

sfx2000 said:
Are you certain of that?

ERL3 is different than the Edge Router Lite - and I'm not seeing a target there...
Are YOU sure about that? I've never seen ERL 3 and Edge Router Lite 3 differentiated... ERL3/ERL 3/ERL-3 to the best of my knowledge are all the same references to an Edge Router Lite 3... there ARE 2 versions... the old has the beveled upper edges and the second is rectangular but hardware is the same


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Something to place in-between modem and router for traffic stats?

Using a UDM Pro and the Traffic stats are just useless. Looking for something like vnstat day/month/year and possibly current live usage in a web-gui. Currently using pfsense in bridge mode but its been giving weird issues lately and its a bit of a waste.

I've tried using OpenWRT but only way I've been able to get stats to work is DoubleNAT.

Are there any managed switches that I can run some form of vnstat on?

Thanks!

[Assistant]
Sounds dangerous. I would think you would want your router connected to your modem.

Bump in the Wire approach might fit here...

A little bump in the wire that makes your Internet faster
My parents live in a rural area, where the usual monopolist Internet service provider provides the usual monopolist Internet service: DSL, r...
apenwarr.ca

Author there was one of the architects for Google Fiber...

coxhaus said:
Sounds dangerous. I would think you would want your router connected to your modem.
Huh? Pfsense in bridge mode for just traffic stats > UDM Pro (which IS a router)


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: advice needed regarding a new wired router

Hi,

I need advice.
I'd like to get a wired-only router that *only* routes. Is this possible now?
All it needs to do is:

a. run pppoe for the fttp connection
b. route static ipv4 (/29)
c. route "static" [1] ipv6

[1] when it connects, for ipv6 it gets a /64 for ND (neighbour discovery) and a /48
for PD (prefix delegation). The machines on the dmz with ipv6-only get their
ipv6 with SLAAC. The router I'd expect to run some type of dhcpcd, issuing the
/48 to the slaac ipv6 machines.

The ipv4 &6 are "static" in the sense that they linked to my account - in other words
they are not returned to the ISP's pool if the connection goes offline.

I don't want the router to do anything else like traffic shaping or firewalling or
dect phone or any of the other bells and whistles typical of all the routers i've seen.
It doesn't even need sshd, or a webby frontend. I'd be happy with just console access
via console cable. Firewalling is done within each of the connecting machines, which
have their own rules.

It only requires 2x NICs @1GB, though 2.5GB would be good.
The connection, currently, is 110/21 via FTTP, termination is ethernet.

thanks,

[Assistant]
if you just need simple router up to 1Gbit - UBIQUITI ER-X cost in EU 50eur

alternative will be MikroTik for example

another option is to buy on amazon miniPC with 2/4/6x NIC i226 2.5Gbit and build system with OpenWRT or OPNsense/pfSense.

In sub $100 category - TP-Link ER605, Ubiquiti ER-X, MikroTik hEX

All about the same hardware capabilities, pick the one easier for you to configure. ER605 is the most user friendly.

ER605 GUI emulator here:
Opening...
emulator.tp-link.com

It's an Omada integrated router, but has stand alone mode. Some of advanced features are available only with SDN controller.

Tech9 said:
In sub $100 category - TP-Link ER605, Ubiquiti ER-X, MikroTik hEX

All about the same hardware capabilities, pick the one easier for you to configure. ER605 is the most user friendly.

ER605 GUI emulator here:
Opening...

It's an Omada integrated router, but has stand alone mode. Some of advanced features are available only with SDN controller.
Click to expand...
thanks! the ER605 looks like a winner in standalone mode, at that price point.

I didn't mention it before, and really should have, but am looking to go 990/110
in the near future and am anxious that the device would be able to handle that speed.
I'm unsure a sub-$100 router would be able to handle that speed even if all it was
doing was dhcpv6 to the dmz and pppoe

What would you suggest above that price point? $100-$200?

I was considering one of those micro-pcs with say 2x 2.5GB ethernet. That would be properly
near-term future proof I guess. Expensive though.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: 2 Huawei H122-373 routers!

Hi all. I have 2 of these units, both with 5g sims operating in different locations in my house..if I connect both by ethernet to the back of a Slate travel router will I benefit from improved reception and Internet from the travel router ?? Just an idea, thanks.
Alternatively, how can I benefit from improved performance with 2 of these fine units? Cheers

[Assistant]
Welcome to the forums @B3000.

Does the Slate router have Dual WAN capabilities?

Any one client won't see any benefit, but the network that the Slate router servers (assuming it can do Dual WAN), will be in aggregate 'more'.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Airtel Dasan h660gm-a

I have a spare unlocked Dasan h660gm-a from airtel and I'd like to use it as a wifi range extender or a bridge. Any help is appretiated.

[Assistant]
Welcome to the forums @guest.

Don't think Bridge or AP mode is possible (has GPON input).

Doesn't seem it has Repeater mode either (from a quick search).

Thank you for your answer @L&LD
that's very sad know, it's nothing more than e-waste now?

From my limited research, possibly (for your use case).

Wait for others to respond who may know that hardware better.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: VyOS for Home

Is anybody running this at home? How are you finding it for home use?

I think once I make a configuration, I can use it over and over again like using a Cisco configuration.

Do you find switching snapshots of the OS easy?

I am thinking about using it for home. I do not want to compile my own code. I am a complete noob to this.

[Assistant]
So a regular home user only has access to nightly snapshot builds? I wouldn't trust that kind of model when wanting a stable environment.

I'm currently running OPNsense and wondering why I need it over a lean, mean OpenWrt build on x86. Generally, I'll try any router OS once, but I don't really see VyOS as a desirable free alternative for me.

Depends how comfortable you are with command line networking...

VyOS is very capable, but a steep learning curve even for a networking pro - for home use, it's probably overkill...

dave14305 said:
lean, mean OpenWrt build on x86

Because x86/amd64 is not a priority for OpenWRT...

Says much that OpenWRT is the basis for Qualcomm and Mediatek BSP's, and FreeBSD/NetBSD are foundations for many commercial devices...

In a FOSS LAN/WLAN - I'm ok with a BSD based router (pfSense/opnSense), and a a linux BSP (openwrt/dd-wrt) for the Access Points, as this plays to strengths of both.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Problem with port forwarding.

Hello! I'm new here and I dont really know if im posting in the right place. Basically I have 2 routers at home one of which I use as an extender. The one I'm using as an extender my pc is connected to it. I need to start a server from my pc and do I need to open the port on the extender router and the main router or just the main router?
Thank you!

[Assistant] You have one device acting as Router - the one connected to your ISP provider. Port forwarding has to be done there. There is no routing on an Extender.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Router that can handle 1000Mbit Full duplex WAN-LAN

Hello everyone,
I tried searching the forum for a relevant topic that covered my question, but could not find any. If i have missed it, please move the thread or refer me to the thread

I'm getting a 1gbit Full Duplex fiber connection to my home within a couple of weeks and trying to find a suitable router that can handle the of 1gbit up and down at the same time. I have looked at UniFi routers and on some MikroTik products, but its difficult to find any testing results on MikroTik .
I have looked at UniFi Edgerouter 4 but im not 100% convinced. It did not have any switch chip in it, but i also realized its not a deal breaker if it lacks a switch chip.
Have looked at UniFi Edgerouter X as well, but it does not seem to have 1gbit Full Duplex possibility.

But do you have any recommendations?

Thanks for your help!

[Assistant]
Welcome to the forums @Orbih.

Any current router you can buy today will give you full 1GbE speeds (full duplex) with a suitable ISP plan and hardware (ONT).

The 'gotcha' will be if you want to enable any features on that router to enhance your network experience. At that point, all bets are off.

The RT-AX88U Pro, which features 2.5GbE WAN/LAN Ports, will do this, even with a few features/options (and scripts, on RMerlin firmware) enabled and used.

As for Mikrotik and UniFi, I would shy away.

To give you better suggestions, you may want to outline what your final network and network usage are expected to be (when fully fleshed out).

L&LD said:
Welcome to the forums @Orbih.

Any current router you can buy today will give you full 1GbE speeds (full duplex) with a suitable ISP plan and hardware (ONT).

The 'gotcha' will be if you want to enable any features on that router to enhance your network experience. At that point, all bets are off.

The RT-AX88U Pro, which features 2.5GbE WAN/LAN Ports, will do this, even with a few features/options (and scripts, on RMerlin firmware) enabled and used.

As for Mikrotik and UniFi, I would shy away.

To give you better suggestions, you may want to outline what your final network and network usage are expected to be (when fully fleshed out).
Click to expand...
Thanks for having me

Why would you shy away from UniFi and MikroTik?

Anyway, the set up is nothing fancy. Have a UniFi AP6 Long Range access point so I don’t need any router with WiFi integrated in it. Would prefer not, but it’s not a deal breaker (easy to just disable it).
Other than that there is lots of streaming and online gaming in the household. I won’t be running any servers or those things, but a simple firewall would be nice.
Have looked at UniFi gateway light (UXG-lite) since it has some nice throughput even with security measures on, but it can be a little overkill. Also it only has 1 port and no switch chip in it so would need to complement with a switch.
Sadly the wiring in my home is only cat5e so not sure it will manage 2,5gbit anyway

if the installation was done correctly, actually you should be able to use 2.5 Gb ethernet gear.
Beyond Gigabit: 2.5 Gigabit Ethernet and 10 Gigabit Ethernet | Cable Matters Blog
Before setting up your 2.5 gigabit or 10 gigabit Ethernet connection, there are a few things you’ll want to consider. Read on to learn more.
www.cablematters.com


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Half speed

Hi , I have a Asus RT-AX86U running Merlin. Internet speed 1G/1G
In the router Adaptive Qos speed test I m getting near the promissed speed.

But in the macbook connect to the lan port just getting halv speed (a litle more but not near).

Any tips where to look?
Thanks

[Assistant]
Different test servers. For a true comparison test with the same server - you can manually select the server at speedtest.net

Turn off QoS? With that fast internet connection QoS tends to hinder more than help.

Ripshod said:
Different test servers. For a true comparison test with the same server - you can manually select the server at speedtest.net
I m testing with the same server


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Linksys port forwarding

I'm attempting to do port forwarding. I added 3 ports for an NVR. The ports are open but when I connect with browser it goes to the router login page, not the NVR. I'm also using DDns.

[Assistant]
Post a screenshot of your port forwarding rules so that we can understand the problem better.

ColinTaylor said:
Post a screenshot of your port forwarding rules so that we can understand the problem better.
Thanks for responding. Sorry, I don't know what to post.

ColinTaylor said:
Post a screenshot of your port forwarding rules so that we can understand the problem better.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Speed for second router in LAN got capped in half

Greetings. Hope someone give me a hint or two about this.

Sites like Youtube/Netflix/Spotify/Google are blocked in my current country. To bypass the blockage I tried to install some tproxy software on an old Netgear WNDR4300 which then wired (CAT 7, very near) into the main router ASUS AX86U which is behind the ISP’s modem device with a 500 Mbps downlink speed.

The AX86U (stock firmware) handles all things but the tproxy which runs on the WNDR4300 (Openwrt). The tproxy works fine in term of bypassing the ban, only it has a poor link speed. Under this topology, the YouTube static shows me a link speed about 10,000 Kbps. I can get more than 80,000 Kbps when using same devices without the WNDR4300 cabled.

Tried to change the WNDR4300 for a Netgear R7000(Freshtomato+entware), things didn’t turn better. Several iperf tests showed that the link speed between devices in LAN and the WNDR4300 was a little above 150 Mbps, the R7000 gave me 350 Mbps. (With no tproxy or other 3rd-party apps running)

I understand the link speed between cable-linked LAN devices could be less than the theoretical 1 Gbps, but 150 Mbps and 350 Mbps seem a little bit too low to be normal, aren’t they? Any help?

[Assistant]
for R7000 with FT you need turn on CTF (Cut-Through Forwarding) to have speed above 350-400Mb/s up to about 920-960Mb/s - I do not know if CTF can be used with tproxy if not you will not see any improvement. It is not working with QoS, bandwidth monitor etc.
https://wiki.freshtomato.org/doku.php/advanced-misc

FT for MIPS old routers like Asus RT-N16 is using bcm_nat and you need to add to init script
Code:
modprobe bcm_nat

@Adooni, thanks for the swift and kind reply. Before posting the thread, I did try R7000 with CTF enabled (when tproxy not running), which in turn gave me a poor 250 Mbps ( R7000 <===> AX86U <===> macbook with wifi n/ac ), even less than the 350 Mbps with CTF disabled. I don't know why but I am going to try the CTF thing again to make sure.

Another thing, according to what you described and from what I understand that 350 - 450 Mbps is quite acceptable and perfectly normal for this R7000 (wired in LAN, CTF diabled), am I right?

hm I could be too optimistic about speed w/o CTF - it will be max 280-300Mbit for R7000. I had AC56U @1400MHz to get it faster . This is speed you have w/o any router configuration.
to check you shall back to factory setting (just to check nothing will impact your speed) and check speed with and w/o CTF and then add tproxy. CFT is not working when QoS or BW monitoring or BW limiter are enabled - if you make test at "clean" router you will be sure nothing will impact it.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Invalid credentials error when trying to open network samba drive on Windows 11

Hi!

I have been struggling a few evenings with something I thought would be an easy task. In short, I want to create a samba drive with an external hard drive connected to an old router (Inteno DG301A). Everything seems fine on the router, however, when I try to map the drive in Windows I keep getting an incorrect network password error.

I have already tried:
Clearing Windows Credentials,
Doubled-checked that SMB 1.0 features are turned on in Windows Features,
Tried whether it makes any difference to turn off Windows Firewall,
and a few other things that were less likely to cause the issue, but were worth a try anyway.
If anyone can suggest what else I could try, that would be awesome.

[Assistant]
Welcome to the forums @J_2024.

Is your main router also using 192.168.1.1?

Hi, thanks!

No, the main router uses 192.168.0.1 and I have also tried to connect the samba drive while disconnected from the main router.

That is why it's not working. They need to be on the same subnet.

Put the DG301A in the 192.168.0.2 address, and test again.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Is it possible to get some kind of hardware firewall which only allows outbound connections on a whitelist?

As topic really. (Is it possible to get some kind of hardware firewall which only allows outbound connections on a whitelist?)

I currently use Malwarebytes Windows Firewall, which notifies me if anything attemps to connect out, whereupon I can create a rule to allow/block. Is there a hardware firewall which can o the same? And if there is, how easy is it to configure?

Thanks.

[Assistant]
Welcome to the forums @noob8472.

An RMerlin-supported Asus router with Skynet (script) installed may be able to do what you need.

Home | Asuswrt-Merlin
asuswrt-merlin.net

Skynet - New Skynet 7.5.8 Release
Edit New Release 7.5.8, see post #93 Edit New Release 7.5.7, see post #92 Edit: Minor Update 7.5.6, see post #36 and #38 Edit: New Release 7.5.6, see post #16 and #18 Edit: New Release 7.5.5, see post #14 EDIT: New Release 7.5.4, see post #13 EDIT: New Release 7.5.3, see post #12 EDIT...
www.snbforums.com

noob8472 said:
As topic really. (Is it possible to get some kind of hardware firewall which only allows outbound connections on a whitelist?)

I currently use Malwarebytes Windows Firewall, which notifies me if anything attemps to connect out, whereupon I can create a rule to allow/block. Is there a hardware firewall which can o the same? And if there is, how easy is it to configure?

Thanks.
Click to expand...
Not really. The router will not be able to notify you of outbound connections, and you will be facing an uphill battle trying to manually allow new connections every time they happen. Just think for example of the multiple rules that would be required just to allow Windows Update to work.

@noob8472 You can buy hardware firewalls but they tend to be expensive as they are aimed at enterprise users. Home routers have their own built-in firewalls, some of which allow for custom rules.

However, I suspect that neither of these are really what you're after. You say you get an alert from Malwarebytes when there's an outgoing connection attempt. This type of firewall is an application firewall that allows you to block/allow specific applications (e.g. a game). A separate firewall running on another piece of equipment can't do this because it has no knowledge of the application running on the client.

So for example, a hardware firewall may see traffic from your PC trying to connect to a server on port 443. Based on just that information it has no idea whether that should be allowed or not. It could be legitimate browser traffic or it could be from another application (e.g. a game) that you don't want to allow access for.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Network Overloaded with NAS + wifi? Is is possible?

I'm having network problems here at my video production company.
We have a modem with internet of 500 Mpbs download and 250 Mpbs upload.
On a daily basis, we are 15 people connected to the Ubiquiti wifi network + 4 people via cable
Here's my setup:

Modem+Router -> switcher (connected to 10 cameras + Unfi Cloud Key + TpLink 8-port switcher)

This TpLink switcher connects the QNAP TS 264 + 4 wired computers, all with Cat6.

When the 4 computers are connected to the NAS, the internet starts to "overload" and the internet connection becomes very bad, no Google opens.

What do you believe it could be? How can I resolve this?

[Assistant]
Welcome to the forums @onerbbbb.

Transferring huge files between a PC and a NAS will do that. Particularly if it is x4 PCs...

The PCs are transferring files, correct? Not just 'connected', as you state above?

Is the 'switcher' a Switch?

Is the NAS capable of greater than 1GbE connections? Is the Switch similarly capable?

For a video production company, I would imagine a 10GbE LAN network to be the minimum.

Please provide a diagram of how all the equipment is connected/configured. There may be a way to fix this with your existing equipment, even if you don't have 10GbE hardware.

onerbbbb said:
I'm having network problems here at my video production company.
All else you'd mentioned aside, your declared Internet connection is suspiciously lacking as a starting point. You've got "more-professional" hardware than most folks here. Have you yet consulted a local networking professional about this matter?


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Using 2 routers (no bridge), DDNS configuration not working

Hi all,

I'll try my best to explain the configuration I have here.

What I'm trying to achieve is: Be able to access my apache server using DDNS as I was before (When using only one router).

So, I have an ISP modem/router that cannot go to bridge (the reason is not relevant). He receives the fiber cable from ISP and has 4 LAN ports (and all the things a normal router has)

Also, I have a TPLINK router that is the one I use to everything inside my network.

For the sake of simplicity, I'll call them ISP and TPLINK from now on.

ISP is connect via PPPoE and has his internal IP as 192.168.15.1. DHCP, wifi, is all OFF (I just want this to be the one who receives the internet, it's for the better).

TPLINK is connected via LAN1 to ISP, he is configured to receive a static IP, 192.168.15.100 (from gateway 192.168.15.1). DHCP, wifi, is all ON (He will be the one who I'll use to manage my internet).

TPLINK has his internal IP as 10.0.0.1 and DHCP is serving from 10.0.0.10 -> 10.0.0.249

All my computers, mobiles, servers are connected to this TPLINK and the internet is working flawless, top max connections and no issues.

I have 2 services I expose to the internet (Plex and Apache).

TPLINK has port forward configuration for those (10.0.0.10 32400 <-> 32400, this is for Plex for example)

They were not working, but yesterday I went to the ISP and enabled the DMZ pointing to TPLINK (192.168.15.100). Plex started to work.

The issue is, Apache is configured to open if I go to my DDNS and use it:

mypage.ddns.net:20080

TPLINK has the port forward as well (10.0.0.30 20080 <-> 80)

I thought DMZ should make this work as well, but it's not.

Also, the DDNS is updated with my current IP (I made it manually to test).

My questions are:

- Who, of the two, should be configured to update the DDNS configuration? (So I can have always the external IP updated correctly there?)
- How can I configure so the Apache starts to work?

- DMZ is the best idea for this? (or should I do port forward as well at the ISP?) (I'm asking it even for Plex that is current working with DMZ)

Thanks!!!

[Assistant]
For DDNS, whichever has an implementation that will actually poll a remote server to determine your WAN IP rather than just reuse the IP of that router's WAN interface. If in doubt, install a DDNS client line inadyn on a LAN device (like your web server).

You might have a delay depending on at which frequency the DDNS client checks the current WAN IP. Some routers will let you adjust that, some won't. Inadyn on your LAN server would let you adjust that.

Maybe consider Tailscale or ZeroTier... and break out to a low-cost VPS...

I also have a setup where the ISP HGW (Home Gateway) has an integrated router with DHCP where one of the LAN ports is connected to the WAN side of my pfSense box which manages the entire LAN-side of my home network. To enable access from the outside to my Nextcloud, i had to configure port forwarding in the HGW for port 80 and 443 using the IP address that the HGW DHCP has assigned to the LAN port which is connected to the WAN of pfSense. DMZ didn't work for me either. I do need to point out though that this is not favorable in terms of network security if you do not have a solid firewall in your 2nd router and preferably https set up using a reverse proxy.

Hope this is helpful.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Pfsense wins awards

pfSense Takes Home 45 Awards in the G2 Winter 2024 Report
pfSense® software from Netgate® received 45 awards in the G2 Winter 2024 report.
www.netgate.com

[Assistant]
It's a little disturbing that they give themselves awards a year in advance.

The few times I've tried this software has always been disappointing, in my networks.

And the latest kerfuffle isn't confidence inspiring to try this software ever again.

Glad it works due those that use it.

L&LD said:
It's a little disturbing that they give themselves awards a year in advance.

The few times I've tried this software has always been disappointing, in my networks.

And the latest kerfuffle isn't confidence inspiring to try this software ever again.

Glad it works due those that use it.
Click to expand...
It is definitely more complex than a simple ASUS router so I can see it giving you trouble.

I didn't try to do 'complex' with it. It failed to stay performant at its defaults (WAN speeds would tank after a few days). I've described this already on these forums.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Question re: router that doesn't require compromising security

I have multiple routers in my house. The most recent (and smallest) was a Linksys combo, added to give more functionality for something we needed and for some mobile devices. I had to reset the Linksys router. . I was trying to set it up again but now am required to have it on the internet so I can use the linksys smart setup. Even though I'm going through the router, when I try to log in Linksys says it can't see my router. I'm done with them. Not only do I need to use their interface, but the fact that I must use their setup on the web means everything is shared with them, including passwords, etc.. GIven how many scammers there are in the world I'd prefer to not have to share my info with anyone.
I'm looking for a combo router, wired and wifi, that >>> I CONTROL<<< not some company who changes software and makes it so we must do setup through their website.
Thanks in advance.

[Assistant]
fstein said:
I have multiple routers in my house. The most recent (and smallest) was a Linksys combo, added to give more functionality for something we needed and for some mobile devices. I had to reset the Linksys router. . I was trying to set it up again but now am required to have it on the internet so I can use the linksys smart setup. Even though I'm going through the router, when I try to log in Linksys says it can't see my router. I'm done with them. Not only do I need to use their interface, but the fact that I must use their setup on the web means everything is shared with them, including passwords, etc.. GIven how many scammers there are in the world I'd prefer to not have to share my info with anyone.
I'm looking for a combo router, wired and wifi, that >>> I CONTROL<<< not some company who changes software and makes it so we must do setup through their website.
Thanks in advance.
Click to expand...
Asus works well for many of us. They do have an app for Android and iOS but the preferred way to set the router up is to use a web browser. There is also custom firmware for some Asus routers that can provide more functions if you need them. The most recommended Asus routers are the GT- AX6000, the RT-AX88U Pro and the RT-AX86U Pro.

bbunge said:
Asus works well for many of us. They do have an app for Android and iOS but the preferred way to set the router up is to use a web browser. There is also custom firmware for some Asus routers that can provide more functions if you need them. The most recommended Asus routers are the GT- AX6000, the RT-AX88U Pro and the RT-AX86U Pro.
Thanks for the response. So just to confirm, I can set the Asus routers up w/o a connection to the manufacturer? Thanks again!

fstein said:
So just to confirm, I can set the Asus routers up w/o a connection to the manufacturer?

Yes you can, but with some functionality limitations.

Some firmware features require Trend Micro data sharing agreement:
AiProtection, Traffic analyzer, Apps analyzer, Adaptive QoS, Game Boost, Web history

Other firmware features require Asus data sharing agreement:
Asus DDNS, Remote Connection used in Asus Router App, Lyra App, AiCloud, AiDisk

If you want no 3rd party data sharing you have to keep all of the above disabled.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Could a router be used as a linux server?

Hello everyone,

Some people think that I'm trying to ask if a Linux can be used as a router but no, my question is would it be possible to ssh to the router, for example install ubuntu and install docker and add containers etc...

The answer will probably be no, but I still wanted to know Instead of connecting a raspberry Pi and set it as a linux server, would the routers internal cpu, drive and memory be used to operate our own custom linux server? Of course without loosing the router's own features acting as a router as always.

Thanks.

[Assistant]
I prefer to optimize the device to the task at hand...

Most routers are going to be just that - they're embedded devices, and while somewhat capable, they're not going to have all that one would need to run Docket and add containers, etc - QNAP, Synology, and others over in NAS space have tried to do that, but it's been rather sub-optimal, as Docker and containers are better suited for a general purpose machine...

RPi5 (or similar) is likely a better place to explore these kind of activities - it's not just because of more CPU horsepower (but it does help) but also the base Linux is updated much more often...

Next step up would be the Intel NUC's (or similar)... one can do a lot there with a desktop/server version of debian/redhat derivatives - and one can do much there without compromising the capability designed in to your Router/AP...

There are two problems here.

1: the router almost certainly doesn't have enough spare disk space or spare CPU capacity to do anything very interesting. The manufacturers have every interest in not spending too much on those components.

2: if you mess up the system configuration, which is quite likely if you try to install new software on it, your router is dead and you're in for a lot of unpleasantness trying to get back to a working network.

Get yourself a separate box to run generic Linux on. RPIs are cheap enough, and I concur with @sfx2000 that Intel NUCs are a good choice if you need more horsepower (I've got a new one coming tomorrow, in fact).

kaanaslan said:
Hello everyone,

Some people think that I'm trying to ask if a Linux can be used as a router but no, my question is would it be possible to ssh to the router, for example install ubuntu and install docker and add containers etc...

The answer will probably be no, but I still wanted to know Instead of connecting a raspberry Pi and set it as a linux server, would the routers internal cpu, drive and memory be used to operate our own custom linux server? Of course without loosing the router's own features acting as a router as always.

Thanks.
Click to expand...

Turris - Overview
Explore Turris Omnia - open-source, high-performance and secure router / home server / NAS / print server to your home or office.
www.turris.com

Virtual server :

Thanks to the 2GB RAM of Omnia you can use a built-in virtual server to run any Linux distribution (even Ubuntu or Debian) without risk to the main system.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Networking Issue

Hey Everyone,
I am new to computer networking, which is why I am here. This is my first post and I hope I'm in the correct group.
I am trying to set up a bird cam system and I keep running into issues that I didn't anticipate and I'm hoping I might get a little help.

I have a couple of miniture cameras I am installing inside of some bird boxes. They are PoE cameras, and I bought a PoE NVR that was supposed to be able to support 3rd party cameras. After I got the NVR, I found out that in order to support these cameras, I must plug them into a PoE switch and plug that into a router and then plug the router into the NVR, rather than plugging the cameras directly into the NVR. There is only 1 ethernet port on the NVR, so I won't be able to use it to connect a Wi-Fi Bridge so that I could access this system on my home internet. I want to keep the cameras and NVR on a seperate network so they won't be using bandwith on my home network, and will always be working regardless of my internet connection, but I would like to be able to access my NVR remotely so I can share videos and live shots with others.
For a switch, I am looking at the ANNKE 8FE PoE+2FE UP.
For a router, I am looking at the TP-Link AC1900.

I have attached a picture of what I was hoping to do, and a picture of what I have right now and would like to get some feedback on my plan before I invest another $160 on network equipment that I don’t know much about.

Thanks for any advice you might be able to share.

[Assistant]
Lucky said:
After I got the NVR, I found out that in order to support these cameras, I must plug them into a PoE switch

Why is this needed? Non-standard PoE on the NVR?

I don't know why this is the case. The NVR is an ANNKE and has 8 (supposedly) standard PoE ports. However, they say that a 3rd party camera won't work if its plugged directly into the PoE ports. I have attached the instructions from ANNKE for using 3rd party cameras and I've verified that the camera specs meet the requirements of the NVR, and I've also tested the camera to see if it works on any of the ports, and it doesn't. I've indicated the model NVR I have on the attached instructions.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: One router, two segments desired.

I have followed the Two Segment Lan Isolation Tutorial without success. I believe I am simply configuring all the network pieces wrong.
I would actually like to have two lan segments on the router without isolation (if there is a way to do this) and use a VLAN on the managed switch I have to isolate the segments.
I have enough network knowledge to shoot myself in the foot. I am just now trying to learn iptables.
i really need some help with this. I've spent hours and hours trying to figure this out and it seems to be beyond my technical knowledge.

I have an ASUS RT-AC86U running merlin 386.12_4 (latest version).
I have a TL-SG116E managed switch with ethernet cables to the AC86U.
My main segment is 192.168.1.0/24 (generally VPN routed) and I have a second segment for 192.168.2.0/24 (non-VPN going to WAN) such as cameras.
- My main laptop is 192.168.1.101 (I control everything from here)
- My BlueIris software laptop is 192.168.2.107 (I see all my cameras here)
- My AC86U router is 192.168.1.1 with subnet 255.255.252.0
- Tried both 255.255.252.0 and 255.255.255.0
I want to have two lan segments with WAN connected on the 192.168.2.0/24 segment and VPN connected on the 192.168.1.0/24 segment.

When I reboot the router to try new settings both my Windows 10 laptops change to unidentified network/public with no internet access.
When I update the subnet mask on the Windows 10 devices from whatever it happens to be to the other (see above), they (most of the time) reconnect to the Internet.
- 255.255.255.0 to 255.255.252.0 and vice versa
This seems to indicate I am configuring my network wrong somewhere.
I am using NordVPN and most traffic is going through that.

I have tried to use port based vlan and put TL-SG116E Port 2 in a VLAN to isolate 192.168.2.0/24.
Without the VLAN, I get
Jan 11 13:48:02 kernel: br100: received packet on eth3 with own address as source address
With the VLAN I no longer get that message but other things break.

I have a network cable running from Port 4 on the Router directly to my main laptop where I configure/run everything.
I have a network cable running from Port 2 to the TL-SG116E managed switch. (port 2)
192.168.2.0/24
I have a network cable running from Port 1 to the TL-SG116E managed switch (uplink/port 1).
192.168.1.0/24
I have 6 ethernet cables from various devices/managed & unmanaged switches to the TL-SG116E's other ports.
I have dozens of devices on my home network (phones, tablets, TV, cameras, ...)

Initially, I am trying to have two separate segments that can "see" each other (i will try to isolate them later).

I get different results. I run Amcrest Surveillance Pro on my main laptop (192.168.1.101)
- Depending on router/laptop subnet mask (I've tried 255.255.252.0 & 255.255.255.0), & my Asus scripts
I can see all my cameras on the 192.168.2.0/24 segment -or- not
- I want to be able to see all cameras using software on:
- my laptop (internet connected) Amcrest Surveillance Pro
- my cellphone (BlueIris App & Amcrest App) both when I am on cellular data & when I am Wifi Connected
- My BlueIris Laptop when Internet connected

SCRIPTS
C:
NAT-START

#!/bin/sh
# Make sure the script is indeed invoked
logger -s "br100" "nat-start: applying POSTROUTING rules for br100"
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.2.0/24 -j MASQUERADE

SERVICES-START

#!/bin/sh
# Physical port to interface map for RT-AC86U:
# eth0   WAN
# eth1   LAN 4
# eth2   LAN 3
# eth3   LAN 2 PORT CONNECTED TO TL-SG116E Port 2
# eth4   LAN 1 PORT CONNECTED TO TL-SG116E Uplink Port 1
# eth5   2.4 GHz Radio
# eth6   5 GHz Radio
# Delete those interfaces that we want to isolate from br0
logger -s "isolate_port" "services-start: deleting LAN 1 (eth3) from br0"
brctl delif br0 eth3
# Create a new bridge br100 for isolated interfaces
logger -s "br100" "services-start: creating br100 with LAN PORTS 2 (eth3)"
brctl addbr br100
brctl stp br100 on # STP to prevent bridge loops
brctl addif br100 eth3
brctl setfd br100 2 # STP Forward Delay 2 sec (Default: 15 sec)
# Set up the IPv4 address for br100
# Here we set the subnet to be 192.168.2.0/24
logger -s "br100" "services-start: setting up IPv4 address for br100"
ifconfig br100 192.168.2.1 netmask 255.255.255.0
ifconfig br100 up

FIREWALL-START
#!/bin/sh
# Make sure the script is indeed invoked
logger -s "br100" "firewall-start: applying fw rules for br100"
# Drop all incoming traffic to br100
iptables -I INPUT -i br100 -j drop
# Allow br100 access to various ports
iptables -I INPUT -i br100 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br100 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br100 -p tcp --dport 5353 -j ACCEPT
iptables -I INPUT -i br100 -p udp --dport 5353 -j ACCEPT
iptables -I INPUT -i br100 -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -i br100 -p tcp --dport 81 -j ACCEPT
iptables -I INPUT -i br100 -p tcp --dport 443 -j ACCEPT
iptables -I INPUT -i br100 -p tcp --dport 8890 -j ACCEPT
iptables -I INPUT -i br100 -p tcp --dport 8999 -j ACCEPT
iptables -I INPUT -i br100 -p tcp --dport 8099 -j ACCEPT
iptables -I INPUT -i br100 -p tcp --dport 8443 -j ACCEPT
iptables -I INPUT -i br100 -p tcp --dport 8554 -j ACCEPT
iptables -I INPUT -i br100 -p tcp --dport 44399 -j ACCEPT

# Allow established, related incoming connections from br100
iptables -INPUT -i br100 -m state RELATED, ESTABLISHED -j ACCEPT

# Forbid packets from br100 to be forwarded to other interfaces
# iptables -I FORWARD -i br100 -j DROP <-- Future Lan Isolation?
# But allow packet forwarding inside br100
iptables -I FORWARD -i br100 -o br100 -j ACCEPT

# Allow packet forwarding between br100 and eth0 (WAN)
iptables -I FORWARD -i br100 -o eth0 -j ACCEPT
# temporarily allow connection between segements
iptables -I FORWARD -i br100 -o br0 -j ACCEPT

# Forbid packets from br0 to be forwarded to br100, isolating new br100 from default br0
# iptables -I FORWARD -i br0 -o br100 -j DROP <-- Future Lan Isolation?
# But allow one-way traffic from br0 to br100 only for restricted ports - Synology NAS and PLEX
iptables -I FORWARD -i br0 -o br100 -p udp --dport 53 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p tcp --dport 53 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p udp --dport 5353 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p tcp --dport 5353 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p tcp --dport 81 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p tcp --dport 8443 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p tcp --dport 8890 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p tcp --dport 8999 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p tcp --dport 8099 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p tcp --dport 8443 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p tcp --dport 8554 -j ACCEPT
iptables -I FORWARD -i br0 -o br100 -p tcp --dport 44399 -j ACCEPT
iptables -I FORWARD -i br100 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# Drop icmp ping requests to br100
iptables -A OUTPUT -d 192.168.2.1/24 -p icmp --icmp-type echo-request -j DROP

[Assistant]
I commented out
# Drop all incoming traffic to br100
iptables -I INPUT -i br100 -j drop
and added
# Allow packet forwarding between br100 and eth0 (WAN)
iptables -I FORWARD -i br100 -o br0 -j ACCEPT

Here is some output from commands:

ifconfig
br0 Link encap:Ethernet HWaddr 3C:7C:3F:30:8C8
inet addr:192.168.1.1 Bcast:192.168.3.255 Mask:255.255.252.0
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:47655 errors:0 dropped:294 overruns:0 frame:0
TX packets:43164 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:7674147 (7.3 MiB) TX bytes:35004980 (33.3 MiB)

br100 Link encap:Ethernet HWaddr 3C:7C:3F:30:8C8
inet addr:192.168.2.1 Bcast:192.168.2.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:2878 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:122854 (119.9 KiB)

eth0 Link encap:Ethernet HWaddr 9C:5C:8E:24:51:90
inet addr:ISPPUBLICIP Bcast:ISPPUBLICIP Mask:255.255.255.0
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:26997 errors:0 dropped:0 overruns:0 frame:0
TX packets:25249 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:13958838 (13.3 MiB) TX bytes:5759279 (5.4 MiB)
ip route
default via ISPPUBLICIP.1 dev eth0
VPN.0/24 dev tun12 proto kernel scope link src 10.8.3.2
ISPPUB.0/24 dev eth0 proto kernel scope link src ISPPUBLICIP
ISPPUB.1 dev eth0 proto kernel scope link
103.86.96.100 via ISPPUB.1 dev eth0 metric 1
103.86.99.100 via ISPPUB.1 dev eth0 metric 1
127.0.0.0/8 dev lo scope link
192.168.0.0/22 dev br0 proto kernel scope link src 192.168.1.1
192.168.2.0/24 dev br100 proto kernel scope link src 192.168.2.1

Code:
iptables -vnL INPUT
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:44399
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8554
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8443
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8099
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8999
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8890
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:81
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    0     0 ACCEPT     udp  --  br100  *       0.0.0.0/0            0.0.0.0/0            udp dpt:5353
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5353
    0     0 ACCEPT     udp  --  br100  *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:44399
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8554
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8443
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8099
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8999
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8890
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:81
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
   14  1631 ACCEPT     udp  --  br100  *       0.0.0.0/0            0.0.0.0/0            udp dpt:5353
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5353
    0     0 ACCEPT     udp  --  br100  *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  br100  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    1    60 INPUT_PING  icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
48178   16M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
  440 22215 logdrop    all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
 3088  515K PTCSRVWAN  all  --  !br0   *       0.0.0.0/0            0.0.0.0/0
 3813  434K PTCSRVLAN  all  --  br0    *       0.0.0.0/0            0.0.0.0/0
    0     0 logdrop    tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5152
 3813  434K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0            state NEW
 2891  481K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0            state NEW
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
    0     0 INPUT_ICMP  icmp --  *      *       0.0.0.0/0            0.0.0.0/0
  197 33999 OVPNSI     all  --  *      *       0.0.0.0/0            0.0.0.0/0
  197 33999 OVPNCI     all  --  *      *       0.0.0.0/0            0.0.0.0/0

iptables -vnL FORWARD
Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  br100  br0     0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:44399
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8554
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8443
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8099
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8999
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8890
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8443
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:81
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:5353
    0     0 ACCEPT     udp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            udp dpt:5353
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     all  --  br100  br0     0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br100  eth0    0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br100  br100   0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br100  br0     0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:44399
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8554
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8443
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8099
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8999
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8890
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:8443
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:81
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:5353
    0     0 ACCEPT     udp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            udp dpt:5353
    0     0 ACCEPT     tcp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  br0    br100   0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     all  --  br100  br0     0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br100  eth0    0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  br100  br100   0.0.0.0/0            0.0.0.0/0
62430   19M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
 7922 2868K OVPNSF     all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 other2wan  all  --  !br0   eth0    0.0.0.0/0            0.0.0.0/0
 1871  396K ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0
  112  5452 logdrop    all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
    1    40 SECURITY   all  --  eth0   *       0.0.0.0/0            0.0.0.0/0
 5939 2467K NSFW       all  --  *      *       0.0.0.0/0            0.0.0.0/0
 5938 2467K ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0
    1    40 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate DNAT
    0     0 OVPNCF     all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 VPNCF      all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 logdrop    all  --  *      *       0.0.0.0/0            0.0.0.0/0

iptables -vnL OUTPUT
Chain OUTPUT (policy ACCEPT 71397 packets, 59M bytes)
 pkts bytes target     prot opt in     out     source               destination
 1402 96516 OUTPUT_DNS  udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 u32 "0x0>>0x16&0x3c@0x8>>0xf&0x1=0x0"
    2   232 OUTPUT_DNS  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x8>>0xf&0x1=0x0"
87615   66M OUTPUT_IP  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  254 15240 DROP       icmp --  *      *       0.0.0.0/0            192.168.2.0/24       icmptype 8
   0     0 DROP       icmp --  *      *       0.0.0.0/0            192.168.2.0/24       icmptype 8

iptables -t nat -vnL POSTROUTING
Chain POSTROUTING (policy ACCEPT 1586 packets, 134K bytes)
 pkts bytes target     prot opt in     out     source               destination
 3739  960K MASQUERADE  all  --  *      tun12   0.0.0.0/0            0.0.0.0/0
 1381 90018 PUPNP      all  --  *      eth0    0.0.0.0/0            0.0.0.0/0
  681 43193 MASQUERADE  all  --  *      eth0   !ISPPUBLIC        0.0.0.0/0
 2148  299K MASQUERADE  all  --  *      br0     192.168.0.0/22       192.168.0.0/22
    0     0 MASQUERADE  all  --  *      eth0    192.168.2.0/24       0.0.0.0/0

Please copy/paste your posts above into

Code:
General Code boxes.

To make them much more readable.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Long shot but worth a shot? WFH using CISCO phone audio delay 5-10 seconds

Hello! So I WFH and I hear people when they call in no problem in real time the issue is when I talk they wont hear me for 3-5seconds then that delay grows to 8-10 seconds and kind of tops out there. My work has no clue how or why its happening thought maybe I could find help here. I tried enabling and disabling QoS no luck ether way. I do have to use a device called "Aruba" thru work that records our calls. I hooked up a crappy 5G t-mobile internet and it works just not all the time because its about 1MB LOL. My home setup is below

https://gyazo.com/f6340730dd08a2c16220bbf670f642fe

[Assistant]
There really is not enough information to even start to figure it out. How are your phones handled? Who is your provider and what software do you use? How many workers? You need to figure out if it is inside your network or outside?

Aruba is a brand. What switches do you have? I used Cisco advice and setup 19 IP phones for a small business using Cisco voice vlan on their small business switches that worked fine.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Who does DualWAN load balancing + failover RIGHT?

Hello,

Simple question: who is still doing DualWAN load balancing + failover Right?

A few years back I bought an AX86U for its DualWAN "feature". I needn't say more.
I have read about options from MikroTik, TP Link, Ubiquiti, etc. Some models appear to have been around for a decade. I'm looking for a solution that:
is not EOL or near EOL
still gets firmware updates
isn't known for exploits (I saw stuff that made me wary about MikroTik the first time I started researching this.)
is easy enough to set up for a tech-savvy non IT-pro
is cost effective as this is for a home office
I found a great post from almost a year ago recommending TP-Link's ER605 and some other hardware. Is this still a relevant top choice?

Connectivity:
I live in the boons. The only option was/is PTP wireless. In the decade we've been here, that's gone from 1.5Mbit to a 50Mbit connection. A second service provider added a tower so now I have:
50/20 - primary WAN
50/10 - secondary WAN

[Assistant]
Try this script from Ranger802004, it works well with Asus

WANFailover - Dual WAN Failover ***v2 Release***
WAN Failover is designed to replace the factory ASUS WAN Failover functionality, this script will monitor the WAN Interfaces using a Target IP Address and pinging these targets to determine when a failure occurs. When a failure is detected in Failover Mode, the script will switch to the...
www.snbforums.com

I use pfSense dual wan fail over with my cable internet and a LTE connection.
simple to configure and pfSense community edition is free open source software.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Upgraded Opnsense Firewall Router hardware

So I have been talking about it for a while now and finally did a fully upgrade revamp of my Opnsense Firewall. Major upgrade to the firewall that will last for a very long time. I have the Intel NICs also setup in Bridge mode as it made complete sense with my home network and the CPU is more than capable of running it that way. I have 1 port of the 10G NIC running directly into the 10G Aquantia card on my gaming and NAS server that also host my Lancache. Currently have the main feed of my devices running from one of the I350-T4 gigabit ports to a 24-port L3 Switch that route out to the various hardwired devices and to 2 Asus Routers in AP mode for the wireless devices. I will probably be making some changes to the way devices are connected at some point and possibly look at adding multigig 2.5G/5G/10G Switches to the mix within the next year. The difference in hardware alone and specifically the CPUs, sees a nice power reduction and with that a huge heat difference, which is a good thing. As for the OS, Opnsense has been working quite well and really gets the job done and for anyone on the fence, this has been a great project I can speak too as well and wanted to share.

Previous hardware
Intel Q6600 2.4Ghz CPU (95W)
4GB DDR3 Dual-Channel Memory
240G SATA SSD (OS)
Gigabyte G41MT-USB3 motherboard
Intel I350-T4 Quad Gigabit NIC
Dual 2.5G Realtek NIC

Upgraded hardware
AMD Ryzen 5700G 3.8Ghz Base/4.6Ghz (Single Core)/4.2Ghz (All Core) (65W)
Asrock B550M Steel Legend Motherboard
16GB DDR4-3200Mhz Dual-Channel Memory
512GB M.2 NVMe SSD (OS)
2.5G Onboard Realtek NIC (Modem/Internet connection)
1G Intel I350-T4 Quad Gigabit NIC
10G Intel X540-T2 Dual NIC
Opnsense 23.7.6

[Assistant]
What L3 switch?

I had a Intel Q6600 CPU many years ago. It was my first quad processor. They did run hot.

I am using PCI_E 4xLAN cards as LAN bridge with OPNsense and it is working very well (LAN Bridge do not work OK with pfSense). I did not needed additional switches sry.

I am planning to change HW to miniPC with 6LANs and i3 N305 CPU

I don't really care about bridging as it is slower than layer 3 switching. There is too much baggage with bridging. And if that was not true then we would all be bridging and layer 3 switching would not exist.

Bridging does work. And maybe that is a reason to run OPNsense. Me I am always going to use layer 3 switching.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Allowing Remote Desktop Connection between VLAN's

Greetings,

Am new to routers, but trying to isolate two computers connected to router via ethernet. Router gives me option to create VLAN's so I was thinking to create two VLANs for home and work computer. Both would be plugged into router in specific ethernet ports. Separate VLANs would be created for home computer port and work computer port.

I would need to be able to remote desktop (RDC) from home computer to work computer but not sure how to do this since the computers cannot see each other being on different VLAN's. Is it possible to do what I am trying to do?

[Assistant]
Welcome to the forums @j3tz.

If you segregate them just to link them, just put them on the same network.

L&LD said:
Welcome to the forums @j3tz.

If you segregate them just to link them, just put them on the same network.
I was hoping they could only be linked through Remote Desktop Connection and not sitting on the same network. In fact, I would like to restrict the communication between the devices solely to Remote Desktop Connection.

What are the expected benefits of your wish?

Is Quick Assist a possibility?


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: No remote connection to Asus AX88U due to private WAN IP address

Hi, I am trying to create a remote connection to my AX88U. However, on the DDNS page of the router GUI it says the router is using a private WAN IP address, possibly due to Multi-NAT, and that this is not supported by DDNS.

iplookup.asus.com provides me an IP address for the DDNS, nevertheless. But when I try to connect via Safari (using ASUS's WAN access via port 8443 - trying this since OpenVPN wasn't successful, either), I get no response using a mobile LTE connection.

The router is connected to a modem of the ISP, who provides me a dynamic IP. I haven't found any further configuration of the ISP settings than what can be managed with the router. Unfortunately it is an Italian ISP and people only speak Italian - hardly got the installation of the antenna managed...

What can I do to trace the problem?

[Assistant]
If your router does have a private IP address like the message says then you won't be able to get remote access unless you can bridge the upstream router that's creating the double NAT, or configure port forwarding on that upstream router.

Thanks. My assumption is, it is the wrong message. How can I check whether the IP is private? The router would then need to be on the ISP side, I only have a small modem upstream

Within the Asus router there is no configuration that could create a double NAT? I was wondering, because in the general WAN configuration, I have „activate NAT“ on (without I have no Internet), and in addition I have the LAN-DHCP server activated. Both seem to do the same thing to my understanding - sorry, I am no router expert, until now it was always plug and play

w461 said:
Thanks. My assumption is, it is the wrong message. How can I check whether the IP is private? The router would then need to be on the ISP side, I only have a small modem upstream

Within the Asus router there is no configuration that could create a double NAT? I was wondering, because in the general WAN configuration, I have „activate NAT“ on (without I have no Internet), and in addition I have the LAN-DHCP server activated. Both seem to do the same thing to my understanding - sorry, I am no router expert, until now it was always plug and play
Click to expand...

Easiest way to tell is to go to whatsmyip.net and see if the IP reported there matches the WAN IP of the Asus. If not, there is a NAT happening somewhere.

If the IP reported by the asus starts with any of the following it is a private IP:
10.
192.168.
172.16 through 172.31
100.64 through 100.127

If it is one of the first 3, your "modem" is probably actually a router. So you could go in there and do port forwarding or put the asus in DMZ. You may even be able to set it to bridge mode from the management interface. With bridge mode, DDNS will just work as your Asus will now get a real IP. With DMZ or port forwarding you'll still need to work around the DDNS issue. I could have sworn the asus had an option somewhere to check the IP remotely rather than grab it from local WAN interface, but can't find it. But there are clients you can run on a PC, NAS, etc that can do the updates for you based on retrieving the IP from a site like whatsmyip. Won't be as fast to update as looking at the WAN, but it works.

The 4th one is CGNAT so that would mean your modem is a modem and your carrier is doing NAT on their side. Some will let you request a "real" IP, some charge for it, some don't.

If you have any of those, you cannot remotely access your router or anything behind it unless your ISP offers a public IP or possibly a NAT mapping for you. If not, you can see if your ISP supports IPv6, if so it will be a routable IP and you can use that for remote access.

If none of that, then your only option is to use a VPN. Ones that allow you inbound access/port mapping will most likely have a monthly fee though. You must establish the VPN from within your network (behind the private IP) then you will be able to have remote access. If you have a second location, you could create your own VPN from the problematic site to that second site and route the traffic through there.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Securing work computer on home LAN

Hello all!

My wife is now working from home, her employer is shipping a computer and peripherals next week. I'm always concerned about the integrity of our home network, so much that when guest come to the house I pass out a "guest network" card just in case they have something funky on their phone. I'd like to also isolate my wife's work computer really because I don't know the employer or their employees - if one of their computers is compromised I don't want something propagating to our network. I can't see a way to do this simply though, since their cyber security policy specifies the computer must be always on connected via ethernet, not wifi.

Our home router is a ASUS AC86U.

Any suggestions?

[Assistant]
Major Payne said:
My wife is now working from home, her employer is shipping a computer and peripherals next week. I'm always concerned about the integrity of our home network, so much that when guest come to the house I pass out a "guest network" card just in case they have something funky on their phone. I'd like to also isolate my wife's work computer really because I don't know the employer or their employees - if one of their computers is compromised I don't want something propagating to our network. I can't see a way to do this simply though, since their cyber security policy specifies the computer must be always on connected via ethernet, not wifi.
Click to expand...

You could isolate it with a VLAN, given a VLAN-aware switch ...

Major Payne said:
Our home router is a ASUS AC86

... but current ASUS gear doesn't do VLANs, as far as I've heard. Are you prepared to spend money on guaranteeing extra isolation?

Major Payne said:
Hello all!

My wife is now working from home, her employer is shipping a computer and peripherals next week. I'm always concerned about the integrity of our home network, so much that when guest come to the house I pass out a "guest network" card just in case they have something funky on their phone. I'd like to also isolate my wife's work computer really because I don't know the employer or their employees - if one of their computers is compromised I don't want something propagating to our network. I can't see a way to do this simply though, since their cyber security policy specifies the computer must be always on connected via ethernet, not wifi.

Our home router is a ASUS AC86U.

Any suggestions?
Click to expand...

Weird that they require you to use wired, my company is pretty strict and allows either (they have a special wifi port guard and we use VPN anyway). I would tell them that your cyber security policy requires it to be connected to wifi

There is a relatively simple script to put one of the wired ports into the guest network which will isolate it from the main LAN, but not sure you want to get into scripting. If not you will need a vlan aware router and switch. Asus is supposedly releasing VLAN aware Pro routers but you may want to look at Ubiquiti (edgerouter X plus an access point) or TP-Link pro stuff. Both are pretty reasonably priced.

Or you could use any cheap router and put her behind that, plugged into your main router. If it has a firewall, block your main LAN subnet in that firewall so it can't communicate with it. Or the opposite, put her only on the first router and everything else on the second router.

I guess another idea is to do it "backwards". As long as you don't have any wired devices, put her on the main LAN and all your other stuff on guest wifi with access intranet disabled. But that would leave her able to access the router GUI (not a huge deal) and none of your other stuff would be able to hit it.

I have a script to put one of my ports into the guest VLAN on the asus and my work PC is plugged into that. Then a custom firewall rule to allow it to print to my printer on the main LAN.

There are some switches out there that can do filtering to block her access to the main LAN subnet, but they are relatively expensive, probably more than a router+AP from one of the ones I mention above.

There are some Ethernet to WIFI devices out there such as this: https://www.amazon.com/dp/B018YPWORE/?tag=snbforums-20

You could also build a media bridge from an old router and connect that to a guest WIFI on the AC86U. I used to travel with an old WRT54G that ran DD-WRT configured as a promiscuous router to access motel WIFI with my non-WIFI laptop. The government cyber police never caught me doing anything wrong.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Asus RT-AX86U Pro Merlin Child Protection

Child protection is limited to 16 devices, is it possible to change that to a greater number?

Klaus

[Assistant]
"Child protection"? Are you talking about Parental Controls? If so the answer is no.

That is what i mean, thank you.
So I have to go back to FritzBox because it's not possible for me to use the Asus-Router with this Limitation.

Thank you.

Actually the client list on the AX86U Pro Parental Controls has a limit of 64 devices. Where do you see 16 devices?

Edit: The 64 client limit is on the Asus firmware. Merlin firmware should be the same but if it isn't. come back to the Asus Firmware.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: How to get v6plus on Asus RT-AX86U

I moved to Japan and brought my Asus RT-AX86U with me. I've updated the firmware to the latest version, which v6plus support was supposedly added, but I cannot find it under WAN Connection Type.

Am I missing something or does the North American version of this router not support v6plus at all?

[Assistant]
I have the same situation. I have the AX11000 US version. The ISP wants v6plus for my WAN but it is not an option. To buy the JP version, they want $340 us. $600 for the AX16000 which is $395 in the US.

Were you able to figure it out?

A couple of things. My router is reporting it is on the latest version. However, 3.0.0.4.388_23285-g5068da5 is not the latest. I am updating to 3.0.0.4.388_24328. I will see how that goes.

**Update** No change. I still can't select V6plus

betaix said:
I moved to Japan and brought my Asus RT-AX86U with me. I've updated the firmware to the latest version, which v6plus support was supposedly added, but I cannot find it under WAN Connection Type.

Am I missing something or does the North American version of this router not support v6plus at all?

As a side note - your US/FCC-approved router is not legal to transmit in Japan, as it is missing the ARIB approvals for radio and commercial applications...

You should consider your options - buy a local router or just use the provider's gateway - you'll be better off, and there, with local hardware, you'll get a measure of support...

Thanks for the info. I'll just wait until the J version of the Asus AX11000 drops in price. We use NTT West which is more of a nuisance than East. Because I'm using a mesh network, I'm not willing to drop all my hardware and start new. One of my mesh routers is a j/version Asus that fortunately came loaded with English language. I'm just shocked over how much Asus routers cost here.