[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Tutorial Repeaters vs Bridges vs Routers

TL;DR - If it's TL, then DR!

Since there has been some confusion recently, figured I'd post a high/medium level summary for any that are interested in knowing more about the differences and networking technology in general.

The further up you go in the "layers" of the OSI model, the more processing power is needed and the more overhead is added.

Starting at the lowest layer:

1. A *traditional* repeater (NOT your AP/Router running in repeater mode, more on that in a second) operates at layer 1 (Physical) and blindly duplicates or "repeats" a signal (electrical, optical, RF, etc). It connects two or more layer 1 segments together into a single one. A multiport repeater is called a Hub. The data type here is going to be raw 1's and 0's and the carrier for them is going to be volts, watts, db, etc, i.e. "raw" signals. The average home user isn't going to encounter a traditional repeater these days. The most common use for repeaters today is on long fiber or microwave/wireless spans where they simply want to regenerate and amplify a dirty, degraded signal to a fresh new one, but without actually caring about or looking at the data passing through it. Multiple stations on the same Layer 1 segment are known to be in the same Collision Domain.

NOTE - Your router or AP running in repeater mode is a bit more complicated. The most basic (single radio used to connect to the main AP and to clients, cutting your usable bandwidth in half) is going to be somewhere between a traditional repeater and a bridge. I guess you could call it an intelligent repeater. It does not blindly duplicate all wifi signals as that would be a mess, you have to tell it the SSID and password that you want it to repeat and it is aware of and interacts with all the clients connected to it (mostly for collision detection/avoidance since it is half duplex). But at the same time, it doesn't necessarily have to interact with the actual data being passed. On the other hand, a dual radio repeater (i.e. one radio for backhaul and another for clients) is, in most cases, literally just a wireless to wireless bridge.

2. A bridge operates at layer 2 (Data Link) and connects two or more layer 2 devices or segments into one, aka "bridges" them together. A multiport bridge is called a switch. The data type here is frames (ethernet frames being the most common these days) and endpoints are differentiated using MAC/hardware addresses. Instead of blindly duplicating data, it uses MAC addresses or other hardware IDs to send data only where it is needed. Technically a 2 port bridge doesn't need to track hardware IDs, anything that comes in one port goes out the other, and vice versa, but they will still be aware of the MACs connected generally. A modem (even dial up) is a type of bridge. If you have cable or 5G (or fiber with MOCA/coax between ONT and router) then your ISP router is actually a modem, bridge, and router in one unit, and when you run it in "bridge mode" all that means is that you are disabling the router, leaving the modem/bridge active. In reality, it is ALWAYS bridging either way. If you just have a plain modem from them, that's just a bridge (with modem for the ability to convert the signal from say DOCSIS to Ethernet or LTE to Ethernet etc). A bridge can connect identical media types (i.e. an ethernet switch) or disparate ones (i.e. your cable modem coax to ethernet, your fiber ONT converting WDM light waves to copper ethernet, etc). But the conversion and interconnection is always done at layer 2 with some intelligence involved. Multiple stations on the same Layer 2 segment are known to be in the same Broadcast Domain.

Another good example is your Asus router. It is a bridge/switch with a router connected to it (actually it is even more than that, but bear with me). In traditional networking it would be considered a Layer 3 switch, in linux terms it is a "Brouter". When you run it in AP mode (or media bridge/ethernet bridge mode) that is just a plain bridge, the router portion is simply disabled. When you run it in router mode, it is a bridge and a router in one unit.

3. A router operates at layer 3 (Network) and "routes" traffic between multiple layer 2 networks, separating them into different "broadcast domains" but still allowing communication between them. Layer 3 switches are technically routers, just stripped down versions that can perform much faster due to less support for features and interfaces. The data type here is packets, and endpoints are differentiated using IP addresses. In the case of your home router, the WAN is one L2 segment and the LAN is another, with the router routing traffic between them.

4. Firewalls are mainly layer 4 (Transport) and most routers and even Layer 3 switches are able to do some layer 4 operations (such as port filtering, PAT, etc). Most firewalls/security devices can do some operations at layer 5 and up also.

5. Layer 5-7 is mostly going to be related to client devices and the applications that run on them, not really getting into that here.

Every layer includes the layers below it. For example, a router must operate at layer 3, 2, and 1. It specializes in layer 3 but has to be able to pass things out a physical port, which means it has to encapsulate the layer 3 packet into a layer 2 frame, then the layer 2 frame into a voltage/series of 1s and 0s to feed the physical port. The switch hanging off that router doesn't need to know about anything at layer 3 or IP addressing, and it will specialize in layer 2 operations, then convert the data to voltage to pass out the port.

It can get confusing as the terms are often used somewhat incorrectly. For example, your Asus "router" is actually a full layer 7 computing device. It runs an OS, applications, and also has a hardware bridge/switch and chip based (hardware accelerated software) router in it, plus a firewall capable of doing NAT, etc. But this is a perfect example of how as you move up in the layers, you lose performance. Two devices connected to two LAN ports can easily hit full wire speed with very little CPU impact on the Asus. That same data passing through to the WAN will likely be slower and peg the CPU at 100%. Running applications on it will show the biggest performance limitations as they will rely almost totally on the relatively slow CPU.

To put that another way, on a typical home-oriented "router" the main functions would roughly correspond as:
Layer 1 - Physical - Volts and 1's & 0's - the physical ports and the voltage they put out (and the wifi radios and their RF).
Layer 2 - Data Link - Ethernet Frames - the internal bridge that connects those ports/radios together
Layer 3 - Network - IP Addresses - the internal router that connects the LAN and WAN (and in some cases, guest wifi) together
Layer 4 - Transport - TCP/UDP ports (and other protocols too) - the basic firewall port filtering and NAT'ing, also handles buffering/congestion mitigation so basic QOS happens here too
Layer 5 - Session - Sessions (makes sense right) - connection control (establishing and tearing down connections) and more advanced firewall/application operations such as session and state monitoring/enforcement
Layer 6 - Presentation - Data/Codec (ASCII is one example, there's many others) - Encryption mostly happens here, not much else on the Asus
Layer 7 - Application - "Pictures and Human Readable Text" - Lots happens here, from the linux OS, to the Web GUI, to advanced QOS, to aiprotection, to scripts, etc etc. Due to the low powered nature of these devices, the OS and code are very stripped down and optimized, and as many functions as possible are assisted or offloaded onto lower layers or dedicated sub-processors/ASICs. For example when you enter a QOS rule in the GUI, that is actually sent down (in most cases) to be handled at layer 4, taking advantage of some hardware acceleration in the network chipset instead of purely relying on the CPU. Layer 7 actually has two definitions, one in the OSI stack and one in the TCP stack. Fairly similar in nature just focused on different aspects.

A final but worthwhile note - the lines between these layers are far more blurry now than when this model was developed. It is now more of a guideline than a rule and it is open to interpretation/opinion (I'm sure there will be a few posts with differing interpretation/opinion on some of the above).

One example is IGMP snooping. IGMP is a layer 3 IP/Router protocol for Multicast. Dumb switches interpret multicast as broadcast making them very inefficient since it essentially turns them into hubs. But to increase efficiency, smart switches have been coded to be able to look into (snoop) the IP/UDP header, see the multicast group info, and make a decision using that knowledge (stopping sending the data to a port that isn't asking for it, and sending it to ports that do ask for it). It can't modify the header, it doesn't even really know what an IP address is (since it is not a Layer 3 router) but it has been given the ability to look at a specific spot for a specific pattern.

Another example is encryption. It can happen as low as Layer 2 (MACSEC) or as high as Layer 7 (Password protecting a file). Heck, it technically originated at Layer 1 with morse code and can still be done today (in crude fashion) with modulation and encoding at the physical layer. Remember squiggle porn on cable TV? That was essentially layer 1 encryption. Injecting noise that you could remove with a bandpass filter (or length of coax with a coke can properly placed). But in reality most encryption spans many layers, especially when you consider that you can be on a wifi network with WPA encryption, going over a VPN with IPSEC or SSL encryption, and finally hitting a website with SSL/TLS encryption.

[Assistant]
So if an ASUS router with multiple radios per band and is in repeater mode, is the outgoing bandwidth still half of incoming?

Justinh said:
is the outgoing bandwidth still half of incoming?

There is no incoming and outgoing bandwidth. The radio sharing backhaul with clients has to do retransmissions sharing air time for both tasks. Channel bandwidth is the same, but the throughput up and down will be 1/2 as a result of this time sharing. The bridged radios serving clients only will have close to full (different) channel bandwidth for the single task they are doing and the throughput will be close to whatever is possible at the moment. Wi-Fi spectrum is shared between all the clients - yours and someone else's using the same channels (backhaul channel and clients channel).

drinkingbird said:
TL;DR - If it's TL, then DR!

Since there has been some confusion recently, figured I'd post a high/medium level summary for any that are interested in knowing more about the differences and networking technology in general.

The further up you go in the "layers" of the OSI model, the more processing power is needed and the more overhead is added.
Click to expand...

Interesting post - so where do the Meshes like Eero, Google Nest, Netgear Orbi, etc...

They're not repeaters, they're not bridges, and they're definitely not routers...

Hint - they operate mostly in layer 3....


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: installing TDS 1 Gbit fiber, what equipment and prep work do I need?

I live in southern New Hampshire, in a house built in the 1970s. Up till now I've had Internet service through the local cable TV company, Charter Spectrum (www.spectrum.com). Their co-axial cable comes off the telephone pole into my house. I've been overall pretty happy with Spectrum's service, but it's fairly expensive for only 200 Mbit down.

So, I just scheduled an install of 1 Gbit fiber Internet plus phone service from tdstelecom.com. But how does TDS actually do the install, and what equipment do they provide vs. expect me to have? There certainly is no fiber optic cable running to my house yet, TDS will have to add that. What else is involved and what should I do to get ready?

The TDS website wanted to charge me an extra $12/month for "Standard Wi-Fi", but I am NOT paying that. I signed up over the phone, and avoided the silly $12/month charge by agreeing to instead provide my own "equipment". But the saleswoman was vague on what they mean by "equipment". I already have my own router, running OpenWRT. TDS has some info on their "Understanding TDS Equipment" page here:

Understanding TDS Equipment | TDS Internet Support
Your TDS modem provides your connection to the Internet. It connects from your home to our broadband network. Get answers to your questions about your TDS modem.
tdstelecom.com

From that, I'm fairly sure that TDS will install their own ONT (Optical Network Terminal) inside my house. When they say "modem" they seem to mean router, NOT the ONT. Thus they expect me to have my own router but NOT my own ONT, right? Can anyone confirm that?

I assume TDS will install the ONT in my basement where the electrical, phone, and coaxial cables already enter the house. (Is there any reason I should want it somewhere else?) I'll call that the "entrypoint". My router is in my first-floor home office, along with the cable modem from Spectrum. Unfortunately, this house does NOT have Ethernet cabling, and I have no connection at all from the basement entrypoint to my office, except for the coax. (I intend to use the coax later on for MoCA networking, with the ScreenBeam ECB7250K02 Bonded MoCA 2.5 Network Adapter.)

Will TDS actually run an ethernet cable from my basement entrypoint up to my office? Or should I try to get that done myself ahead of time?

I'm also ordering $25/month phone service from TDS. Will they correctly wire up their ONT into my old house's existing POTS phone jacks? Or will I have to do that myself? How does the connection even work anyway? Does the ONT simply have an RJ-11 phone jack coming out of it in addition to an RJ-45 for Ethernet? Or is there more "equipment" involved than that?

Thanks in advance for your help and advice!

[Assistant]
Welcome to the forums @atp.

Their end should provide everything up to and including the ONT. They won't use/touch POTS. Including all required Ethernet standards all the way.

Plug your router into the ONT and continue to have the network you're used to, with upgraded ISP speeds. Depending on your current router's capabilities, of course.

Check with them if you need any important information to configure your router:

- Do they use a VLAN?
- Are they using DHCP, PPPoE (which will require login credentials) or something else to establish the connection?

RMerlin said:
Check with them if you need any important information to configure your router:

- Do they use a VLAN?
- Are they using DHCP, PPPoE (which will require login credentials) or something else to establish the connection?
Well when Conexon comes the six hopefully RT-AX86U can deal with the former. Already ran the drop, but no ONT.

Came and went. All I had to do was swap the Ethernet cables on the WAN from theirs to mine.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Can only access a website by direct connection to router. Not through switch

In short, I am able to access a website when I connect my PC directly to the modem, but not when I use a switch in between.

To login to that website, we need to register our IP addresses first through our HQ. We registered 3 out of 5 static IP addresses allotted by our ISP. The ISP gave us a modem with only 1 working port, so that we had to use a switch to use those 5 IP addresses. Everything works fine except that website (lets call it xyz.com) gives us a license error saying that our IP address is not registered. Its the same IP address I used to login to the website while directly connecting to the modem. Another thing is that "findmyip" website gives a different IP address other than the ones we set in the control panel. This is the case even with direct connection to the modem, but I can login to xyz.com fine. Any help in solving this problem?

[Assistant]
FrankRunnerDrebin said:
In short, I am able to access a website when I connect my PC directly to the modem, but not when I use a switch in between.

To login to that website, we need to register our IP addresses first through our HQ. We registered 3 out of 5 static IP addresses allotted by our ISP. The ISP gave us a modem with only 1 working port, so that we had to use a switch to use those 5 IP addresses. Everything works fine except that website (lets call it xyz.com) gives us a license error saying that our IP address is not registered. Its the same IP address I used to login to the website while directly connecting to the modem. Another thing is that "findmyip" website gives a different IP address other than the ones we set in the control panel. This is the case even with direct connection to the modem, but I can login to xyz.com fine. Any help in solving this problem?
Click to expand...

Have you consulted with your ISP on proper use of their service?

OE

By chance are you using a smart switch which has DHCP on and it is grabbing an outside IP, one of your statics? Try setting the switch up with a private IP address in a network that you are not using. You should be able to access the switch as long as it is not a network inside one of the LANs. This is just a guess.

You say modem, not router, which could be the issue. A switch doesn't replace a router.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: why have a domain name in a home LAN?

I see some users on this forum implementing a domain for their LAN, like "bobs.lan". Got a couple of questions:
1`) Why do this, what problem does this solve?
2) Some users even have Internet domains, like "coolbeans.com" that is even used to hit local devices from within the LAN, or connect to their router from the WAN side. How can an Internet domain be used for internal hosts from inside the LAN?

[Assistant]
Justinh said:
I see some users on this forum implementing a domain for their LAN, like "bobs.lan". Got a couple of questions:
1`) Why do this, what problem does this solve?
If you'd like to be able to connect to your devices by name not IP address, it's useful.
Justinh said:
2) Some users even have Internet domains, like "coolbeans.com" that is even used to hit local devices from within the LAN, or connect to their router from the WAN side. How can an Internet domain be used for internal hosts from inside the LAN?
Um ... you just do it. Assuming you own "coolbeans.com", then anything prefixed onto that belongs to you too. So for example "myprinter.coolbeans.com" is a valid DNS name that you could choose to assign to your printer, with confidence that that won't conflict with any real site out on the internet. You do have to set up a local DNS server that knows that name and knows what address the printer is supposed to have, and point your local machines at that server. Typically, having done so, you'd also configure your machines with "coolbeans.com" as their default DNS search domain, meaning that you only need to type "myprinter" to refer to your printer.

(Note that with the setup I'm describing here, "myprinter.coolbeans.com" would not be a name visible to anyone outside your LAN. At least for the purposes I use this for, that's what I want. If you want say "www.coolbeans.com" to be externally visible, you have to set up an externally visible DNS server, and I'd strongly suggest farming out that job to a service provider who knows what they're doing.)

I actually just registered to ask for some advice on this. I hope this doesn't thread-jack things too severly, but maybe you'll appreciate seeing the use-case. I have been using the domain name setting to tell my VMs which datacenter they've been deployed to. Consider the domain `dc1.example.com` It's handy to keep that kind of information outside of the VM image baking progress so that the same image can be deployed to multiple places without needing to be re-packed for a specific site. I generally have been following an approach where if I omit the datacenter name, dnsmasq will still resolve to the local machine with that name. So if I really need to check on something in another DC, I can use the fully qualified name and get to it.dc2.example.com just fine. This is just to make the URL cleaner when using applications in the local datacenter. An added benefit is the split-horizon DNS layout; I can set the public DNS records for external-facing services and the apps will work in the datacenter as well as off premises (using the WAN IP instead of the datacenter's LAN IP).

I hit a serious problem though related to DNS. My k8s cluster was having trouble resolving registry.dc1.example.com, whereas my local was able to ping it fine. I eventually came up with a test command which looked like this:

This command works correctly.
Code:
$  host machine.example.com
machine.example.com has address 192.168.1.10

This shows the errors and it occurs whenever the fqdn name is used which includes the router's domain name (dc1.example.com).
Code:
$  host machine.dc1.example.com
machine.dc1.example.com has address 192.168.1.10
Host machine.dc1.example.com not found: 3(NXDOMAIN)
Host machine.dc1.example.com not found: 3(NXDOMAIN)

I believe these problems emerged after I migrated to a dual stack ipv4/6 setup because I noticed that I could workaround the issue by defining an ipv6 address to the dns record and the errors from `host` went away. I traced the DNS queries to my router which oddly, seemed to check in with an external DNS provider for ipv6's AAAA records matching that domain name. Not checking upstream for internal DNS names is a configuration setting I have selected in the router's UI.

If anyone has any insights on this behavior I'd love to hear them because I'm out of ideas as to what to try next.

sg808 said:
I actually just registered to ask for some advice on this.
Welcome!
sg808 said:
This command works correctly.
Code:
$  host machine.example.com
machine.example.com has address 192.168.1.10

This shows the errors and it occurs whenever the fqdn name is used which includes the router's domain name (dc1.example.com).

I believe these problems emerged after I migrated to a dual stack ipv4/6 setup
Click to expand...

Hm. It seems like a good bet that "host" is finding your machine's A (ipv4) record fine and then having trouble trying to look up an AAAA (ipv6) record. So there is something wrong with the nameserver setup for the intermediate domain level dc1.example.com. You might see if "host -t NS dc1.example.com" yields any useful clues. I'm a bit out of my depth though because I don't use ipv6 on my LAN.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: SOHO network upgrade: XT9 vs XT12 vs DECO vs switches

Hi! I've been having issues with my Orbi Pro, so they're getting replaced and I'd like some opinions on where to put my money.

This is my current network:

List of gear I've been looking at:
XT12 - 450€
XT9 - 365€
DECO XE75 Pro - 240€
D-Link DMS-107/E - 72€
Netgear MS305 - 110€
Tenda TEM2010F - 75€

So, my initial plan would be to replace the Orbis (A) with the ASUS XT12, one of the reasons being the 2.5Gb ports. But as there's only two and one is reserved for WAN, it's pretty much useless because it won't link from my desktop to my local NAS (C) at 2.5Gb, even If I upgrade the switch (B) and my NAS ethernet card.
As alternatives, I could use Link Aggregation with 2x1Gb from the router to my local NAS or I could place a second 2.5Gb switch right after the router. But by doing that, is it worth it to go for the XT12 or the XT9 or even the DECO would be fine?
Other requirement for the router would be VPN server, preferably WireGuard, so that the remote NAS connects to my home network. I've read that both XT support it, but TP-Link is still rolling out the feature for DECO line.

[Assistant]
I assume, perhaps incorrectly, that you care about the speed of the connection from the local NAS to the desktop? I'd try to get them both plugged into the same switch, preferably a 2.5G switch. That won't help much if the NAS can only do 1G, but it sounded like it might be able to link-aggregate two 1G ports? If so, get a managed switch that can handle link aggregation, and you're starting to get somewhere. I would try to have all the local equipment including the two APs plugged into that one switch.

Having done that, the 2.5G ports on the XT12 would only be useful if you're anticipating better-than-1G service from your ISP sometime soon. On the whole I'd be inclined to pinch pennies there for now and stick to the XT9. In a year or two when the price of wifi 6E or wifi 7 has come down out of the stratosphere, it'll make more sense to get a top-of-the-line AP.

You assume correctly, however at the moment it's not possible to plug both the NAS and desktop to the same device.
As for the NAS, both options are on the table: add a second 1Gb card for link aggregation or add a 2.5Gb card to upgrade the link. With the former, I can use two 1Gb ports from the XT12 and then use the 2.5Gb LAN port to connect to a new 2.5Gb switch on (B). Or get the XT9 and two 2.5Gb switches and link everything with 2.5Gb ethernet.
I think final cost would be about the same, just one option brings a higher end router while the other exchanges that for full 2.5Gb ethernet all the way without using LAG.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Ubiquiti network or all-in-one router?

Anybody have thoughts on Ubiquiti products or network setup (Unifi, EdgeRouter X)? Is an all-in-one wireless router a better option?

[Assistant]
Home All-In-One routers are made for home use. They are cheaper, user friendly, mostly plug and play. Work good enough when one access point is needed serving 20-30 wireless devices. Business routers, switches, access points offer different features and cover different requirements. Usually more expensive and not that user friendly to setup. There is no universal “better” solution. It depends on the needs.

How many businesses and public places you have seen with home routers hanging off the walls? How many of your friends run Cisco, Aruba or even Ubiquiti or TP-Link Omada at home? Must be some difference, no?

I agree there's definitely a difference. I've read some articles that say it's better to invest in business network hardware (better than all-in-one). I'm talking small business, not IBM.

Business systems have better hardware and software quality and are more flexible, but also more expensive and more networking knowledge is required to setup. Not a good option for average home users.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Hotspot to WAN Port Wired Connection

Anyone find a wired usb-to-ethernet adapter that connects a single-port (usbc) hotspot to a router's WAN port?

Driving this is T-mobile's recently-mounted 5G data-only (incl sms) campaign. (Most in the US have likely noticed by now? Or maybe not lol.) It offers 30 GB/mo for $10 postpaid, incl taxes (connection fee easily waived). Measured speeds here rival those of cable (Tmo often way faster) and it's noticeably quicker (much lower latency), though YMMV as performance is highly dependent on location and network congestion.

Data-holics will laugh at the 30 GB unit, but two (or even three) hotspots plugged into the router (running Merlin of course) in dual-WAN config can provide sufficient bandwidth to replace cable for many households. Better performance at lower cost is a strong motivator. (Not to mention longterm profound resentment at heretofore forced dealings with ISP monopoly.)

So with one hotspot connected to router's usb port, just need the second connected via ethernet (WAN port, most readily). After a long search, I find the Internet clogged with devices that will mechanically make the connection but, don't work for two reasons:
Power is not supplied to the usb side, which causes the hotspots to shut off wired data
Carrier signals are discovered only on the ethernet side and ignored on the usb end
The first limitation can be overcome by providing power to the device's internal bus (at least on the two units I tried), but the second kills it in every case. The hotspot continues to make its usb data connection available, but the adapter ignores it.

So the challenge is finding a powered, or powerable, adapter that is either bidirectional or intended for use with a hotspot. It's hard to believe that identifying such a simple and obvious piece of hardware is so difficult, hence my question here.

Alternate configurations that (may) work:
Easiest is just buy a hotspot with ethernet port and wire it up. - But costs are much higher; single-ports are $20 used, and widely available.
Unplug one hotspot, or its SIM, each month when that data runs out and plug in the other. - Haha, gimme a break! Who's going to do that?
Bridge through an intermediary device such as a laptop or rpi. - Obviously not optimal.
Plug hotspots into separate usb ports on router, or in hub. - Asus-based FW allows only one usb source for dual-WAN. Workaround?
Do 4., but manually configure an internal bridge between one of the hotspots and the WAN port. - Possible?

Keeping this question general (not limited to my hardware) since most any hotspot is usable with Merlin and the hardware bridge between devices should be nonspecific. All suggestions welcome.

Posting here as this concerns 'other' hardware, but please move if it better fits elsewhere.

[Assistant]
Best source of info for T-Mobile as an ISP...

https://www.reddit.com/r/tmobileisp/

Good info there...

u2n.snb said:
in dual-WAN config

Good luck with this Dual WAN config on Asus router. Search the forum for Dual WAN issues.

Why do you think this custom script exists?

WANFailover - Dual WAN Failover ***v2 Release***
WAN Failover is designed to replace the factory ASUS WAN Failover functionality, this script will monitor the WAN Interfaces using a Target IP Address and pinging these targets to determine when a failure occurs. When a failure is detected in Failover Mode, the script will switch to the...
www.snbforums.com

Some folks give up and are using SMB routers in front of their Asus for Dual WAN management.

Thanks for the help, guys, and sorry for the delayed response. Got avalanched soon after writing.

Dual WAN being essentially nonfunctional was the final nail in the coffin for both the hardware arrangement and the need for my requested device (which doesn't exist anyway BTW lol).

But they were on the way out after finding we needed to swap in the third hotspot in heavier-use months. The whole idea was to make the system work like cable -- no hardware touches. If that wasn't possible, why bother?

Also found something totally unexpected in the experience. Having to routinely handle any device(s) was unacceptable, initially. But after getting used to these hotspot gadgets, we've found it's really NBD. The mobility makes it a good tradeoff.

Now working on DDNS...


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Explain IP pools to me like i'm seven years old

Hi all. I'm trying to set up a VPN server using PPTP protocol on my TPLink ER605 router to access things on my local network remotely, a mac mini in particular. I need to choose an allowable set of IP addresses that the VPN clients can use.

What do I choose for these? Anything I want? Are these local IP addresses, as in, on my LAN only? Or do they need to include the pulbic IP addresses of computers that I'll want to use as clients?

The videos I've found on YT are remarkably unhelpful; they just walk you through the steps on how to set it up, but don't explain the meaning or application of what they are demonstrating. (like my question above) If there's some white paper or VPN setup for dummies video I could review, that might be helpful too.

Thanks
Geoff

[Assistant]
Don't use the PPTP protocol. It is obsolete and insecure.

An IP pool is a range of internet addresses, public or private. See: https://en.wikipedia.org/wiki/IP_address
For your use, an address pool is assigned by your router's DHCP (Dynamic Host Configuration Protocol). Usually like 192.168.x.x which is a non route-able address range or private address. You can also use addresses in the 10.x.x.x range as private. Normally your VPN server will use a range different from the router. For example: if the router address is 192.168.50.1 and its address pool is 192.168.50.2 to 254 with a subnet mask of 255.255.255.0 the VPN could use an address pool of 10.6.x.x. Usually your router will assign an address pool when setting up a VPN. If it dosen't I would look for a better router.

If you try to explain IP pools to a seven-year-old, you get jello up the walls, and end up sleeping in the garage when the other half finds out!


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Port Forwarding With Two Routers

Stumped at what I think should be working

Two routers:
Verizon TCL Linkzone hotspot
RT-AX86U (Merlin firmware)

The Asus is hardwired to the Linkzone via the ethernet port
Asus IP is set in the DMZ of the Linkzone

Application running on a PC hardwired to the Asus on port 54321
Application loads fine with localhost:54321

DDNS is setup in the Asus and the dns ip is correctly getting set in ZoneEdit

In the Asus 54321 is port forwarded to the PC IP both source/dest

I've tried with the PC firewall on and off

From another PC on another network, trying to connect via the domain name or IP + 54321 never connects.

Something I am missing?

[Assistant]
Are you sure that your Linkzone has a public IP address? Often mobile providers only give you a CGNAT address. What are the first two octets of the Linkzone's WAN IP?

kramttocs said:
In the Asus 54321 is port forwarded to the PC IP both source/dest
What do you mean by "both source/dest"? Can you post a screenshot of your port forwarding rules.

Hey Colin.

174.210

Sorry, I should have used 'external/internal'. Meaning I am mapping the same port value all the way through to simplify it further.

I read over the guide prior to getting this device and while it doesn't talk about a second router being a client to it, these settings made me assume it should handle this:

DDNS
WAN IP address is needed when some functions of your LINKZONE are enabled. If the WAN IP address of your LINKZONE changes, these functions may not work properly. The Dynamic Domain Name Server (DDNS) function allows you to map a dynamic WAN IP address (public IP address) to a static domain name, helping internet users (WAN side) access the LINKZONE network by static domain name.

DMZ
The DMZ separates LAN from the public internet. Certain network services in DMZ cannot be accessed by external users. You can enable the DMZ function and set a new host IP address to allow access .

IP in Asus (cut off the DDNS value but it is populated correctly with xxxxx.xxxxxx.com)
For what it's worth in my home setup I am allowing wildcards and just yyyyyy.com. Don't expect that factors in but...

Localhost working (This is BlueIris security camera software)

TCL DMZ
I also tried just port forwarding 54321 to 192.168.1.180 so only that port would hop twice but no luck

Well it looks like you've done everything correctly and the 174.210 address should be ok.

Have you confirmed that you can reach 192.168.50.207:54321 from another PC on your LAN?

Also, disable any VPN clients you have on the PC or router when testing.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Wireguard - set peer IP from LAN IP range?

Running pfsense + wireguard VPN.

Is it possible to assign static IP from remote LAN's range?

Let's say wireguard is running on 192.168.111.1 and it's peer get's 192.168.111.11 IP
I can access 192.168.0.0/24 LAN IP's, but only as 192.168.111.11. Gateways work fine, pings and so on works.

But. Routers on remote LAN treats VPN peer as WAN and denies queries to web admin.
Is it possible to assign VPN peer IP with something static from 192.168.0.x range?

[Assistant]
Review the Docs and if you have any questions...

Netgate Forum
A place to discuss Netgate products and projects such as pfSense, TNSR, and hardware
forum.netgate.com


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Setting up Router and Bridge with with a Cable Modem

Hello, I went with Sparklight yesterday and supplied my own Modem, a Netgear CM1000v2. I connected my ASUS RT-AX68U router with Merlin Firmware to that, and am using 192.168.0.1 for the LAN IP with a subnet mask of 255.255.254.0, which is the same subnet as my modem. I can access the internet like this, but it shows that the internet status is disconnected on my ASUS router network map.

After that, I have an ethernet bridge in another room with another ASUS router with Merlin Firmware. I haven't been able to get the bridge working by choosing bridge mode and using the quick internet setup method which automatically assigns IP addresses for itself.

I had these same routers working with no issues at all with my AT&T setup behind the gateway NVG510 in the IP passthrough mode.

Here is what ipconfig shows for my cable modem.

I access my cable modem using 192.168.100.1.

Any hints or help getting this working correctly would be greatly appreciated. Thanks.

[Assistant]
Transer said:
which is the same subnet as my modem

You modem only device doesn't have LAN IP. It only has management IP - access to UI on 192.168.100.1.

Why did you change the Asus default LAN IP subnet mask 255.255.255.0 to 255.255.254.0, any specific reason?

Transer said:
haven't been able to get the bridge working

No changes to this device were needed. If it's in Media Bridge mode - it's a wireless client to your main router.

Post a screenshot of your WAN settings page on your main RT-AX68U router, perhaps something is wrong there.

Tech9 said:
You modem only device doesn't have LAN IP. It only has management IP - access to UI on 192.168.100.1.

Why did you change the Asus default LAN IP subnet mask 255.255.255.0 to 255.255.254.0, any specific reason?

No changes to this device were needed. If it's in Media Bridge mode - it's a wireless client to your main router.

Post a screenshot of your WAN settings page on your main RT-AX68U router, perhaps something is wrong there.
Click to expand...
I misunderstood something I read about subnets and have changed it back to 255.255.255.0. I do believe changes were needed for the media bridge because my old setup was with ATT worked. Now it doesn't.

Changing your ISP with Automatic IP doesn't require any changes on your network. You just swap the modem and if the new one is activated - you get connected. Your Media Bridge is unrelated to your WAN issues. I don't know why your Asus router shows WAN disconnected. The WAN detection is ping and/or DNS query.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: ppoe error with 2 routers

Hello,
I have a speedport smart 3 Router from the provider that supplies the first floor with wifi and DECT for one telephone. Connected from the speedport lan connection to the 2nd router Asus GT-AX6000 WAN connection which is on the 2nd floor.
I use the Asus router to have Qos on the 2nd floor.

Everything works finde, no bufferbloat
But after a while the Speedport on the first floor gets "ppoe" errors and restarts the DSL connection

Is it because of this setup?
I can set AP mode on the asus router, but then the QoS settings disappear

What can I do?

[Assistant]
How is your second router getting Internet? Private IP WAN from the first or PPPoE passthrough?

Tech9 said:
How is your second router getting Internet? Private IP WAN from the first or PPPoE passthrough?
from the lan port of the first router to the wan port of the asus router
and dsl cable to the dsl port of the first router, its vdsl if its matters

I dont set anything on the asus router, its on automatic ip setting which is default

In this case your Asus router is in Double NAT behind the ISP provided router. It has nothing to do with PPPoE connection.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Any way around double NAT?

I’m hoping to change ISP soon, as current one with Openreach is only about 50 meg and new FTTP being installed will give either 1 or 2 gig. Doing a little research into them and the current router they provide, at the moment doesn’t provide a “modem only mode”. I want to use my current Asus 16000 AXE but this will cause a double NAT I believe, is there any other way around this?

thanks.

[Assistant]
Not really unless you use your Asus router as a access point instead of a router.

Most ISPs in the uk you'll be able to connect your asus directly to the ONT. A lot of those use pppoe for which you'll need your login details.
Don't tell me you're thinking vodafone.

Analog-1 said:
Not really unless you use your Asus router as a access point instead of a router.
Would I still be able to access the router externally (My asus) also I didn’t mention I have my router connected to an older ac5300 as a mesh.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Domain coming up for renewal

In just a couple of months, my SquareSpace (was Google) domain comes up for renewal. The current domain name is pretty identifiable, as is the hostname of the router. While there are usually no open web-facing services on the network I had been considering using a long randomly generated domain name instead, to maybe add a little more obfuscation. But it seems as if this technique also used by rogue actors, may end up causing me problems.
So, any guidance on good practice for picking a new domain name and possibly hostname?
*My current (main) domain name is already unavailable in one country as it inadvertently contains a word considered very offensive there!

[Assistant]
Don't overthink it - just get something that is easy for you to type and/or remember. Obfuscating the domain name or the hostname is a waste of time, as nobody is going to devote time trying random FQDNs. It would be faster for them to just scan entire IPv4 subnets than going through this - far fewer combinations to try out.

A lot of those apparently obfuscated names are just randomly generated for the sake of uniqueness.

RMerlin said:
A lot of those apparently obfuscated names are just randomly generated for the sake of uniqueness.

And some of those could get one black flagged as a suspected SPAM or malware host...


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Neither Arris SB8200 or Netgear CM1100 are providing me with 1000Mbps

I have a 1000Mbps plan with Buckeye Broadband (local/regional provider). I've tried both the Netgear CM1100 and Arris SB8200 modems, but neither have been able to provide me more than 400Mbps download speed. Tech support has said they aren't detecting any issues on their end of things, and they've been pretty confident it's an issue with my equipment. Since I didn't purchase either modem from them, they aren't able to provide any additional support. Does anyone know of any reason why neither of these modems would be providing me with my maximum speed? I purchased both because they were DOCSIS 3.1 modems (and therefore should support my plan).

[Assistant]
How are you testing the speed? If you have an Asus router you can use the built-in speed test, otherwise use an ethernet cable connected to your router. This will give you the true speed to the router. Using a laptop or desktop via wifi will not give you those full speeds.

bluzfanmr1 said:
How are you testing the speed? If you have an Asus router you can use the built-in speed test, otherwise use an ethernet cable connected to your router. This will give you the true speed to the router. Using a laptop or desktop via wifi will not give you those full speeds.
I'm using the speed test on my Asus RT-AX86U (running Asuswrt-merlin).

murrman said:
I'm using the speed test on my Asus RT-AX86U (running Asuswrt-merlin).
That can be misleading, depending on how you have configured the router. Always test from a PC/laptop that is connected to the router by ethernet.

If you still have the same low speed unplug the router from your modem and plug your PC/laptop directly into the modem. This is the only true test of your ISP speed.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: AX 2.4G Any future?

Missed this as a possible improvement to 2.4G and wondering if it will take off.

What is the benefits of 2.4 GHz Wi-Fi 6? | TP-Link
What is the benefits of 2.4 GHz Wi-Fi 6?
www.tp-link.com

Causing issues but might be workable. From Netgear CS:

"2.4Ghz is just another frequency that some devices can use, if there dual band supporting. AX mode on 2.4Ghz is just another mode that, if devices support this mode on 2.4Ghz, can use this mode. Not all devices support this mode. May cause some problems as well.

Set 20/40Mhz Coexistence to 40Mhz only. Set CTS to 2347. Set Short preamble instead of Long preamble modes. Save settings and reboot the router and satellite(s). Under Advanced Tab/Advanced Settings/Wireless Settings

Then try enabling AX mode on 2.4ghz. You don't have to have this mode enabled on 2.4Ghz all the time as well."

[Assistant]
Any questions here?

This future has been here for a while now.

Depends on your clients.

Personally, I always treat the 2.4 GHz band as a legacy band. A lot of IoT devices only support 2.4 GHz, and these often use older wifi interfaces that will have compatibility issues when dealing with more modern Wifi features, like Airtime Fairness or Beamforming. Therefore, it's generally best to keep the 2.4 GHz band configured with any advanced features disabled to ensure optimal compatibility with these older/cheaper clients.

Also, the 2.4 GHz band might have better coverage, however it will also have slower speeds due to the large amount of radio interference in that frequency, plus the fact that most of the time you will be limited to 20 MHz channel width. I can't remember the last time I've seen a stable 40 MHz connection established on the 2.4 GHz band. That means almost a quarter of the speed of the 5 GHz band.

Agreed with @RMerlin and @L&LD

I got two Androrid Tablets I picked them up cheap on Amazon thinking because they listed WiFi6 that they had 5Ghz, they didn't (surprise to the seller, they refeunded me and let me keep them) but they do support 802.11ax on 2.4Ghz and they've been working them in AX mode on my AX88 (with a stable 40 MHZ channel width) for well over a year now. I use them to montor my Nest cams and they work just fine for that.

I don't get the Tx/Rx rates of my AX Latops on 5Ghz and 160 Mhz channel width (2402/2402) but they do the job just fine for their intended purpose, but it's a very limited market/use case I agree. I just figured out a way to make use of them getting the most out of them, the best way possible that work in my envronment. I'm fortunate to live where I have very stable WiFi with little interference across both bands.

Your Mileage may vary


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Home networking

Not exactly router-related, but the folks here know way more about home LANs than any other group I have seen (including the Microsoft help forum), and I trust your advice.

Has anyone found a method that allows Windows 11 PCs to communicate with each other on a LAN? I was able to transfer files between Win 10 PCs because each of them was reachable in the "Network" section of File Explorer. I have enabled "PC Discovery" for all of the machines (1 Win 10 and 2 Win 11), and also marked the hard drives as "shared" -- but only the Win 10 PC appears in "Network", neither Win 11 device.

I have also tried adding the by using the File Explorer "Search" option with the syntax "\\PCNAME." no go.

Thanks!

[Assistant]
Strange. I haven't had any problems like that between Windows 10 and 11 PCs. One thing that comes to mind is that the Windows 11 PCs have their network profile set as public rather than private.

I was going to suggest looking at firewall settings, as @ColinTaylor mentioned, if the network profile is public all inbound connects will be blocked and the machines won't advertise any 'shares'.

ColinTaylor said:
One thing that comes to mind is that the Windows 11 PCs have their network profile set as public rather than private.
Thank you, I will try that.
.
.
.
Nope, both set to Private. And:


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: How do I find out why my router has stopped assigning LAN ip addresses ?

Router and dhcp info:
Code:
Router Firmware: DD-WRT v3.0-r52459 std (05/08/23)

udhcp info:
$ ./sbin/udhcpc
udhcpc: started, v1.36.0

$ ps -w | grep dhcp
1206 root      1248 S    udhcpc -i eth0 -p /var/run/udhcpc.pid -s /tmp/dhcpc -O routes -O msstaticroutes -O staticroutes -x hostna

Hi
I was not entirely sure where to post this query, but I figured someone on this forum may have seen this sort of issue before and have an idea what the cause is.

I have been using a netgear nighthawk r7800 with dd-wrt (Firmware: DD-WRT v3.0-r52459 std (05/08/23)) for a quite a while now, and it has been working fine until recently it suddenly stopped
providing ip addresses and thus there is no way I can connect any more. It appears that if a device already has an ip address it is fine.

The router appears to be running udhcpc on busybox, though I am not 100% sure whether this is specific to the nighthawk hardware, or whether the it's something to do with the dhcp software.

I have tried to look at the logs on connection, but all I have managed to see so far is the dhcp request(s) from device(s) trying to connect. There does not

Has anyone seen a problem like this before ? Or have any idea what might have caused it to stop supplying ip addresses ?

One possibility that occured to me is that the number of address leasses had maxed out - the max is set to 50 and there are nowhere 50 devices in the house, but I guess if the leases are not
properly released they will stack up and eventually run out. However in the logs I have not seen any messages regarding there being no leases left - though I do not know what I should expect
to see if they did run out.

If I look for files on the router related to dhcpc I see the following:
Code:
$ find . -name "*dhcp*"
./udhcpc.expires
./dhcpc
./var/run/udhcpc.pid

The uducp.expires file is a bit odd - it is dated about the same time the ip addresses stopped being assigned, anyone know what it is ?

If this is not a known thing, does anyone have any hints as to how I should go about debugging this ?
(It's quite possible that if I reset and re-configure the router it'll start working again, but I'd like to try to get to the bottom of the problem so I can prevent it from happening again)

[Assistant]
I'm not that familiar with DD-WRT but udhcpc is a DHCP client. It's typically used by a router to obtain its WAN IP address from the upstream ISP DHCP server.

I think you are talking about your router's DHCP server which allocates IP addresses to devices on the LAN. This is often a task performed by dnsmasq, which is both a DNS and DHCP server. I don't know whether DD-WRT uses dnsmasq of some other software.

I believe DD-WRT have their own forums so you might get better or faster advice there.

For fun, I tried asking ChatGpt 4...
Reply edited to extract the most relevant content. Assuming you have CLI access.

Check DHCP Leases:
Once logged in, you can use specific commands to view the DHCP leases. The common command for this is cat /tmp/dnsmasq.leases or cat /var/lib/misc/dnsmasq.leases.
This command will display the current DHCP leases, including the MAC address, IP address, hostname, and lease expiration time for each connected device.

Thank you very much for the replies.

> I think you are talking about your router's DHCP server which allocates IP addresses to devices on the LAN
That is indeed what I am talking about - it's LAN side assignment that is the problem.

Being used to dhcpd as a dhcp server I was simply searching for that and blindly assumed udhcpc was doing both client and server. Knowing it's dnsmasq is a big help - at least I'll be researching the correct tool!. I'll have a look how it works and will hopefully be able to use it to generate dhcp discover messages and see what happens to them in the logs (and tcpdump). Then I can go to dd-wrt forums (or maybe Netgear forums if they exist - still a bit of a worry that it might be related to hardware).

It appears dnsmask.leases is empty, so that probably is not the problem (though I get the impression you can change the leases file(s) so I will look a bit further in to it).

Thank you again for your help.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Curious packet loss when connecting my modem to a switch

Hey all.

I have a curious issue when connecting my modem to a switch in order to access the web UI page.

I have a Draytek Vigor 167 (VDSL2 modem/router) which is set in bridge mode and has the IP 192.168.1.1.

I then have an Asus ZenWiFi XT8 router which has the IP 192.168.1.10. This uses PPPoE to authenticate the DSL connection and the router is the gateway for my LAN.

There are two RJ-45 ports on the Draytek modem P1 and P2. P1 is connected to the WAN port on the Asus ZenWiFi and this works as expected, it can authenticate the connection. However, I cannot access the Draytek modem Web UI page to check stats and connection settings.

If I connect the Draytek P2 port to either a TP-Link unmanaged switch (which is, in turn, connected to the switch ports on the Asus) or connect P2 directly into the Asus switch ports, I can access the web UI as expected.

However, if I do this, I get packet loss on the entire connection. Confirmed using the VOIP settings of https://packetlosstest.com, I get around 5% to 30% packet losses. If I remove the aforementioned connection, packet loss is 0%. It's quite consistent.

I'm not a networking expert but nor am I a newbie, but I cannot for the life in me figure this out.

[Assistant]
If the switch is connected to the router, when you connect the switch to the modem on P2, you may be creating a loop on the ethernet. To configure the modem from P2, just plug in a pc directly or unplug the switch from the router and plug the pc into the switch.

degrub said:
If the switch is connected to the router, when you connect the switch to the modem on P2, you may be creating a loop on the ethernet. To configure the modem from P2, just plug in a pc directly or unplug the switch from the router and plug the pc into the switch.
I had suspected the loop issue which is how I managed to diagnose what was happening.

What I'm doing currently is simply connecting it in and out of the switch when I want to check the line speeds, but I wondered if there wasn't something else I could do to stop the loop entirely.

Don't connect it that way. This is a physical ethernet issue, not a config issue.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: what speed is good

does this speed
and up down seems good im on coax but it seems fine i have seen worse on virgin media forun

[Assistant]
With nothing to compare it to, it is fine.

What are your paid-for speeds? What are other users on your ISP getting? What device was this test done on?

Too many variables to answer if this is 'good', or not.

robinjoo1 said:
does this speed and up down seems good

This speed is good for few families with multiple active devices at the same time. If it matches ±10% to what you pay for - good.

i mean good as in bufferbloat latency

i pay around 100 euro for the package i have compare that to virgin media uk users its verry expensive

i hope soon we will get full docsis 3.1 benefits there arent fully utlizing it for now
still eurodocsis 3.0 backwards compatible

cant wait for low latency docsis 3.1 rollout
they wont upgrade to XGS-PON like virgin media
instead docsis 4.0 field testing will begin shortly


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Hitron CODA56 modem LAN IP address?

I am considering updating my old cable modem to a new Hitron CODA56 to obtain better upstream speed.

I cannot find out what LAN IP address the CODA56 uses. I have looked through all its documentation and it just isn't there. I'd like to know it in order to ensure it doesn't conflict with anything on my existing LAN.

Does anyone out there have a CODA56 and can tell me its LAN IP address? Thanks.

[Assistant]
RocketJSquirrel said:
Does anyone out there have a CODA56 and can tell me its LAN IP address? Thanks.

192.168.100.1 But if your on comcast all the signal stats and logs are not accessible by the customer.

Thanks. So it's Comcast's firmware that prevents an http(s) connection? That's annoying. But I suppose if it just works, there's little need to see its innards.

Does the CODA56 at least respond to ping so you can tell it's alive?


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: I am trying to understand vlans

I have 45 devices on my LAN using a GT-AX11000 router with 3 Asus access points. I want to separate the network for the security wired and Wi-Fi devices from the entertainment devices from the productivity devices. I do not know much about vlans, but I am thinking this is the way to go, multiple networks. Is this a vlan application?
My Asus GT-AX11000 does not support vlan. What are my options in concept? A vlan router, a managed switch,...? But a managed switch does not control wifi, correct?
So before I pull out the credit card and go to the store, I want to be sure I know what I am doing.
I can use some advice.
Dave

[Assistant]
Seems like you have the difficult part accounted for i.e. you have existing wiring in your house ? Knowing that, your options are as follows:
Purchase a PfSense appliance which will serve as your firewall and router combo
Purchase VLAN aware switches like Netgear GS308E
You can put your WIFI on a separate VLAN, Asus' AI MESH will work in this setup
Just note that consumer grade Asus Routers like the ones you have are not VLAN aware i.e. you will not be able to transmit different SSIDs for different VLANs
Technically you can put wired devices on a different VLANs
You can also put different access points on different VLANs and then transmit them on different frequencies such as VLAN1 on 2.4GHZ and VLAN2 on 5GHZ
Hopefully this gives you a start.

Thank you for the start.
Is pfsense a product name?
Could I purchase a GT-AX11000 Pro router? Would that get me there?
Thank you.
Dave

davekstl said:
Thank you for the start.
Is pfsense a product name?
Could I purchase a GT-AX11000 Pro router? Would that get me there?
Thank you.
Dave
PfSense is open source firewall; you can buy either a Netgear appliance which will cost you more, or buy something like Protectli

I am not sure if the pro version of the 11000 is a VLAN-aware router.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Advice needed on proper static credentials in my apartment complex

I live in an apartment complex that has fiber. My speeds are 300/300 but they do give me more which is dope.

However I pay for a static IP.

However based on some ping plotter data (shows an additional hop) and observing my routing table (asus router table built in the Be96u)

I don’t think my packets are effectively going through the right path.

Anyone have some insight on what commands I can run?

The company who runs the apartment complex (massive mesh), says they have done everything right on there side. (The engineer was a kid in college)

[Assistant]
What is the WAN address shown in the ASUS interface?

Justinh said:
What is the WAN address shown in the ASUS interface?
it’s public :WAN IP =72.0.129.65 ( mixed some #s for obvious reasons but it’s very ssimilar)

Subnet 255.255.255.240
Gateway 72.0.129.61

Xrsenal said:
I don’t think my packets are effectively going through the right path.
And why do you think this? Is it causing a problem? Got a trace route?

You asked about commands - what are you wanting the commands to tell you?


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Xfinity & Motorola 8611 bandwidth bleed

Hi folks,

Having a recurring issue---my motorola 8611 paired with xfinity gig service degrades over a two week period--from 1.4gigs bandwidth on a reboot to around 85mbs two weeks later. A reboot solves the problem, but it recurs. Rinse and repeat. Any ideas on whats going on? Cant control the firmware, its controlled by xfinity.

[Assistant]
Where are you measuring this bandwidth ?
between what two devices ?
anything in between them ?


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: trace route shows private IP range after router

I don't understand why trace route is showing 10.x.x.x (entire address range is private, right?) after the router, which goes to a pass-thru cable modem. How can this be?

Tracing route to cnn.com [151.101.67.5]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms RT-AC68P-D9B8 [192.168.1.254]
2 20 ms 18 ms 20 ms 10.198.96.1
3 21 ms 19 ms 20 ms 172.30.31.129 <-- my ISP's address block
4 25 ms 34 ms 28 ms 10.16.64.89
5 25 ms 27 ms 37 ms 10.16.64.5
6 28 ms 27 ms 34 ms 68-66-73-220.client.mchsi.com [68.66.73.220]
7 27 ms 27 ms 26 ms po10.atlga001er1.mchsi.com [68.66.72.29]
8 25 ms 25 ms 27 ms 157.52.127.116
9 30 ms 16 ms 13 ms 151.101.67.5

[Assistant]
Perfectly normal. Internal ISP routing. 172.30.31.129 is a private address just like 10.16.64.89 is.

Private network - Wikipedia
en.wikipedia.org

Right, I didn't closely look at the 172.x address. Those hops really surprise me - didn't realize that kind of thing happened. Thank you.

Private IP 1st hop after your router means most likely you have a PPPoE connection.
I would say impossible without PPPoE and a public IP (no CGNAT)


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Advice Needed for Isolating My Network Setup From Landlord's Network

Hello everyone,

I'm looking to create a private network setup within my rented space that is separate from my landlord's network, but still uses the same internet connection. I've attached a diagram to illustrate my current setup and would appreciate any guidance on how to achieve my goals.

Current Setup:
The landlord's setup includes a fiber box connected to an internet router switch, which then provides a Wi-Fi network through the router itself in addition to a Google Wifi mesh system.
My setup will be wired from the same internet router switch, intending to use my own Wi-Fi.
My Objectives:
I want to ensure that my network is completely isolated from the landlord's so they cannot access my devices.
I need to connect my devices to the internet through the wired connection from the router switch.
My network will have its own Wi-Fi setup using Asus RT-AC86U and RT-AX53U routers.
The network must support gaming traffic (I guess double NAT could cause problems with that)
Ideally, I would like to have the capability to do port forwarding and set a custom DNS (not a requirement)
Constraints:
I do not have access to the landlord's device settings or configurations. (I might get temporary access if I ask nicely, but I'm not sure about this)
Given these conditions, can anyone suggest the best way to set up my network to be private and secure? I've done a few different setups in the past, but this time the landlord also has kids gaming and I'm afraid of causing double nat problems which may result in them not being able to game without interruptions, which would be a bad start for us in our new home.

I look forward to your advice!

[Assistant]
By "internet router switch" I assume you mean a regular wireless router.

As you have no control over you landlord's network what you have at the moment is the best you can achieve. I'm assuming your RT-AC86U is in router mode with its firewall still enabled.

You cannot avoid double NAT so you'll have to live with that. Port forwarding will not be possible without control of your landlord's router. Even if you did gain access to his router you could break his children's internet gaming if you start forwarding ports for your personal use.

Your landlord won't have access to your network as he will be blocked by your RT-AC86U's firewall. Ironically you could potentially have access to devices on his network. You won't be fully isolated as your traffic is still traversing his network so he can theoretically do anything he wants with it, like packet shaping, blocking, or even snooping (if he's a l33t h4x0r ).

ColinTaylor said:
By "internet router switch" I assume you mean a regular wireless router.

As you have no control over you landlord's network what you have at the moment is the best you can achieve. I'm assuming your RT-AC86U is in router mode with its firewall still enabled.

You cannot avoid double NAT so you'll have to live with that. Port forwarding will not be possible without control of your landlord's router. Even if you did gain access to his router you could break his children's internet gaming if you start forwarding ports for your personal use.

Your landlord won't have access to your network as he will be blocked by your RT-AC86U's firewall. Ironically you could potentially have access to devices on network. You won't be fully isolated as your traffic is still traversing his network so he can theoretically do anything he wants with it, like packet shaping, blocking, or even snooping (if he's a l33t h4x0r ).
Click to expand...

Thank you for the insightful response!

Indeed, the 'internet router switch' is an ISP-provided router that governs all the network traffic.

I wanted to clarify that my setup is not yet operational—apologies if that wasn't clear earlier. But as you surmised, my plan is to configure the Asus RT-AC86U in router mode and enable its firewall for added security.

Acknowledging that double NAT is inescapable in my scenario, I'm relieved to hear that it's manageable, as I do not rely heavily on port forwarding.

However, I'm concerned about the potential for IP conflicts within my private network. Since I can't coordinate with the main router's IP assignments, is there a way to configure my router to prevent any possible overlap and the issues it might cause? Any specific settings or DHCP range you'd recommend would be greatly appreciated.

And while the landlord may not be a 'l33t h4x0r,' it's a humorous thought that his kids might take an interest in network exploration—hopefully not at my network's expense! In any case, taking precautions seems wise.

Looking forward to any further advice you could share!

Master Pain said:
However, I'm concerned about the potential for IP conflicts within my private network. Since I can't coordinate with the main router's IP assignments, is there a way to configure my router to prevent any possible overlap and the issues it might cause? Any specific settings or DHCP range you'd recommend would be greatly appreciated.

Your router is smart enough to avoid conflicts. (Double NAT actually takes care of this)
Click to expand...


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Arris SB8200 or S33?

I'm going to up my internet speed from 400 to 800 which means I need to replace my Docsis 3.0 modem (Arris SB6183) with a 3.1 version. I've always used Arris (and Motorola before that) and never had an issue so I'm going to stick with the brand. I don't envision ever needing more than a 1Gbit connection. Any compelling reasons to pick an SB8200 over an S33 or vice versa? The S33 is $43 more but that's not a concern. Main usage is web surfing. The only time I really take advantage of higher speeds is Windows updates. It will be connected to my AX86U and my desktop connection is wired but all others are wifi. I probably don't even need the higher speed but it's only 12% over what I'm currently paying for double the speed so why not?

[Assistant]
Lee MacMillan said:
I'm going to up my internet speed from 400 to 800 which means I need to replace my Docsis 3.0 modem (Arris SB6183) with a 3.1 version. I've always used Arris (and Motorola before that) and never had an issue so I'm going to stick with the brand. I don't envision ever needing more than a 1Gbit connection. Any compelling reasons to pick an SB8200 over an S33 or vice versa? The S33 is $43 more but that's not a concern. Main usage is web surfing. The only time I really take advantage of higher speeds is Windows updates. It will be connected to my AX86U and my desktop connection is wired but all others are wifi. I probably don't even need the higher speed but it's less than 10% over what I'm currently paying so why not?
Click to expand...

I would get the S33 today..why limit the WAN port. That said my SB8200 has been super solid.

Go with the S33. I have an S33 but came from a SB8200 when my wired clients went to 2.5Gbps. The Arris S33 supports maximum wired speeds of up to 2.5Gbps for a single port, as opposed to the standard 1Gbps offered by the Arris SB8200. The former is, therefore, better equipped to handle high-bandwidth requirements like gaming and 4K streaming.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: LAN separate from apartment LAN

My mom lives in an apartment building that supplies Wi-Fi to everyone. I have a few old routers (ASUS and others) around and was thinking about using one make another LAN just for my mom's use to improve her networking security.

Would it be possible to connect a router to the apt's wireless and still use the router's firewall? Is this even a practical idea?

[Assistant]
Justinh said:
Would it be possible to connect a router to the apt's wireless and still use the router's firewall? Is this even a practical idea?
Not without additional hardware. There are numerous posts asking this question. Asus routers don't support wireless WAN.

If you have another spare Asus router you could configure it as a Media Bridge between the apartment's Wi-Fi and the main router's ethernet WAN port.

Does each apartment get any WiFi equipment within it? Or is just wireless access available?

If you have access to the equipment, and it has a LAN port, use the AiMesh Router in AP mode in Administration (Asus router).

If you don't have access to the equipment, you need to look for a model such as the GL.iNet router.

Or, use two routers; one in Media Bridge mode, and the other as the WiFi router for the apartment.

ColinTaylor said:
If you have another spare Asus router you could configure it as a Media Bridge between the apartment's Wi-Fi and the main router's ethernet WAN port.
Sorry, I don't follow. I do have a spare ASUS router to give my mom, but I don't have access to the apt owner's router. I was thinking about the media bridge, but is the bridge's firewall in effect in that case?

L&LD said:
Or is just wireless access available?
All we have is the Wi-Fi SSID, no equipment is provided. What is special about the GL.iNet router?


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Reset Netgear Nighthawk CM2050V Modem via command-line?

I have an idea to write something (script/app) that works entirely w/out internet connection (i.e. modem powered off, but with the router working fine; so all LAN devices can still talk to each other, there's just no WAN), and will check the modems status every X amount of time, say every 5 or 10 minutes for example:

(up or down? Probably have to login to it's page at http://192.168.100.1 and parse the text)

If it's down, send a command to it to reset; or power off and then on; whatever works.

Reason being: lately out of nowhere my brand new Nighthawk modem has been going offline and staying there (it just shows the power on and the downstream icons lit up, but the rest dark), until I get home and manually power cycle it. Often times I'm not home, and without internet at home because the modem is offline it's impossible for me to reboot it remotely. Even going to Xfinity's status page to try to send a modem reset from there tells me it can't connect, so it doesn't reset. Until I can "officially" sort out that issue I'm trying to do a simple local monitor; write a script or utility to check if it's up or down, and if down, power cycle for me.

Unfortunately, after lots of google-fu I still can't find out how I can:

- check the modem's status via LAN
- reset the modem via some sort of command I can send it

Do any of the guru's here have any ideas how to accomplish this? Or better yet, something out there already existing to do this so I don't have to re-invent the wheel?

TIA!

[Assistant]
AppleBag said:
I have an idea to write something (script/app) that works entirely w/out internet connection (i.e. modem powered off, but with the router working fine; so all LAN devices can still talk to each other, there's just no WAN), and will check the modems status every X amount of time, say every 5 or 10 minutes

Likely can't happen because of security concerns...

Is this a carrier provided modem (e.g. you rent) or one that you have purchased (you own).

This is not normal behavior, and one that is not widely reported, so the core issue here is that either

1) you have a defective modem

or...

2) you have poor connectivity on the WAN side

The best path to sort this is to unfortunately call Comcast and deal with their customer care folks... if your modem is also providing dial tone for voice services, it's on them to sort it out.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Optomizing SOHO network

I know there are tons of basic networking questions, so hopefully I did not miss answers to anything that I am asking.

I'm trying to rework my network to get the best performance from all devices and I'm not feeling I am doing very well. My network consists of a Unifi EdgeRouter 4 connected directly to my ONT on port 0. Port 1 connects to a Netgear ProSafe 5160PE switch. Feeding WiFi is a TP-Link AC2300 which exposes 2 access points. Devices connected to these are what I consider critical for happy family life: Computers, streaming devices that cant be hard wired, cell phones, tablets. I also have a Unifi AP-Pro wired to the switch. It also exposes 2 access points for non-critical devices, IOT devices, and camera feeds. I am not using ports 2 or 3 of the EdgeRouter. All 16 ports are occupied and used on the switch, and only 3 are IOT devices (hubs for various vendors). I run a Plex server and Home Assistant server (HA is a virtual machine on the windows environment) on a Dell micro pc with a i7 - 7th gen processor connected via lan.

I do not have any vlans set up, everything sits on the same IP range and I have about 12 ports forwarded for external access.

My issue is streaming video content from my library is choppy on devices that don't have a lot of buffer (smart Tv's, dongles) even if hard-wired. Streaming to my older Nvidia Shield never seems to have an issue. WiFi streaming usually requires transcoding for smooth play.

Do I gain anything in segregating the AP-Pro which contains 5 video feeds from my cameras into a QNap NAS into a vlan or directly to port 2 on the EdgeRouter? How about isolating the switch to one port, TP-Link to another port, and the AP-Pro to the third? Any advice?

-- Joel

[Assistant]
Seems like a sound setup.. you could try a new router or access point to replace the tplink.. Try a streaming device right next to the TPLink to see if it's choppy to see ?

Sounds like you need a need router that supports better stream at a distance? That router is know for it's weak long-range throughput performance and file transfer speeds.

What dB should I be looking for at 2.4g and 5g for decent wifi streaming?


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Impossible speed tests

Hi,
i want to start off by saying hi to everyone and telling you abit about myself im an it admin specialized in network security in Finland.

So this has nothing to do with my workplace but my parents just got a fiber connection installed and so did my neighbor so this weekend i reconfigured their networks for fiber (they had 4g modems before) but when it came to test their speeds they are impossibly high.
Both my parents and their neighbor pay for 100 down and around 20 up (atrociously low ik but its really expensive here) but speed tests with different target servers and different providers had a result between 400-800 Mb/s.
So my leading theory is bc our isp is known for scummy behavior maybe they have whitelisted speed tests from their throttling profile or they are doing something on their end to artificially bump the results.
What im wondering is what do you guys think? and what would be a good approach to get realistic result ?

[Assistant]
Try downloading a large file from a server you know is usually fast. A Linux distribution for example.

Welcome to the forums @Bloop.

What test are you using? I would try multiple test sites and also download directly from a known/fast server (MS, etc.).

While I might not believe a single test, I would believe what many are indicating.

Bloop said:
Both my parents and their neighbor pay for 100 down and around 20 up (atrociously low ik but its really expensive here) but speed tests with different target servers and different providers had a result between 400-800 Mb/s.

That's odd - but it mirrors to some extent on what I've seen with business broadband...

Home Broadband in my market - they sell "up to" uplink/downlink values that are potentially there... speedtest results look really nice, but as @L&LD mentions, pull a longer download, and it should reveal what the endpoint is really provisioned at..

Business Broadband - they sell a minimum committed value...


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: subnet of home LAN - did I overlook anything important?

Network / LAN
For hobby purpose, a web-server is run at home. To improve security the web-server is on a subnet seperate from pc’s and phones.

In the future IOT devices will be added to the guest wifi.

Subnet LAN into 192.168.50.0/24 and 192.168.100.0/24
Two routers: Router_A and router_B.

Router_A:
Router_A is gateway to internet.

LAN IP: 192.168.50.1/24

LAN - DHCP Server: Manually assign IP 192.168.50.200 for router_B.

Physically connect the routers. LAN port of router_A to WAN port of router_B.

Router_B:
LAN IP: 192.168.100.1/24

Later I’ll add NAT on router_A for the web server.

The setup appears to work fine, but perhaps I've got some lesson to learn, that I didn't think about.

[Assistant]
If you want to completely isolate Router A's subnet from Router B's LAN devices you could block access to 192.168.50.0/24 on router B's firewall. Router B's LAN devices would still have access to the internet.

Thank you, I've checked right a way.
As far as I can tell, the router firewall, doesn't require blocking rules. I think it's blocks all on default.
There is no Merlin Wrt for this model.

You didn't say what routers you were using so I was speaking in general terms.

If Router B is an Asus router you can use its Network Services Filter to block access to the upstream 192.168.50.0/24 network.


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Problems accessing home network from external networks.

Hi

I have been trying to setup things up so I can access a web server running on my home network from external networks and also trying to figure out what is happening to the traffic under different circumstances.
I was wondering someone may be able to help me interpret/debug what I am seeing.

Network Setup:
==============
I have a Netgear Nighthawk dd-wrt router on which I have configured NAT such that I can access the ipaddress/port my server is running on.

I have a VPN client running on the router and use an external VPN supplier to encrypt traffic,. The dns server on my router is configured as the ip address of my pihole dns server which in turn is configured to use my vpn dns servers. So outgoing traffic goes via the VPN server before being forwarded to my ISP. For the puposes of testing connections I have also enabled WAN ping on my router.

Externally I have registered a DN whose AAA record points to the WAN ip address of my router.

(As a side note: I have setup letsencrypt to provide CA signed certificate to allow use of https)

With this setup I see the following:

From a laptop within my local network:
--------------------------------------------------------------------------------
I can ping the WAN ip address of my router.
I can accesss my webserver using my DN

From a laptop on neighbour1s network who uses the same ISP as me:
--------------------------------------------------------------------------------
I can ping the WAN ip address of my router and when I do (at least if my interpretation of tcpdump packets is correct - which it may well not be) I see icmp traffic come in on my WAN, and going out of
both my routers vpn tunnel interface and my routers WAN interface. I do receive replies.
I can access my webserver using my DNort from a browser

From a laptop on neighbour2s network who uses a different ISP (vodaphone):
-----------------------------------------------------------------------------
When VPN is enabled:
I cannot ping the WAN ip address of my router. I can see icmp packets received on the WAN interface of my router. I see also (I think - above tcpdump caveat) the icmp reply packets go out on the vpn tunnel interface. I see no icmp packet replies go out on the routers WAN interface. I receive no replies back at the laptop.
I cannot access my webserver using my DN/port from a browser.

If I disable the VPN:
I can ping the WAN address of my router. I see icmp packets received at my WAN and replies transmitted through my WAN interface. (vpn tunnel itf does not exist!)
I can acccess my web server using my DN/port from a browser.

From a phone using 02 network with VPN enabled and disabled:
--------------------------------------------------------------------------------
When I attempt to accesss my webserver using DN/port from a browser I get a message:
"This site cant be reached
refused to connect
ERR_CONNECTION_REFUSED"

Has anyone got a possible explanation for these observations ?
Does anyone know how I might be able to chenage things so I can access my web server from anywhere ?

[Assistant]
Maybe my making a mess of this will motivate one of the hyper-knowledgeable members to come to your rescue.
So you probably want to be running a VPN server on the router, not a client that connects to a remote provider! When you remotely use the DDNS to find your WAN IP it'll give IP address from your ISP, not the one connected to the tunnel your router is sending its data through. So you initiate a remote connection direct to your router, and your router sends the info not back to you directly but through the VPN (appears as a different IP address to the client). In a perfect world, your remote device would probably reject that data as a security risk. But the world isn't perfect, and on O2 (UK I presume) you'll also be using CGNAT (Carrier Grade Network Address Translation) and now the data you are receiving is technically a "mess"!
Run a VPN server on the router (WireGuard usually makes Mince meat of CGNAT) and a VPN client on your remote device, and it'll all probably work!

Thank you very much for your reply. I was certainly getting a bit confused about what was going on.

> So you probably want to be running a VPN server on the router

Yes I suspected I might need to do that - a bit of inertia there since I'll need to upgrade my firmware to do so.
Also not sure how this would work with outgoing data connections initiated from with in the LAN (which use an external supplier).
Do I/Can I run client for external supplier (in my case NordVPN) as well as a vpn server on my router ?

Since having a vpn server would require a client to be running on the connecting device (which is generally what I would want), to allow general access for a particular webserver/port in my LAN do you know if it is possible to (and if it would work) tell the router (in the vpn client conifg ?) not to use vpn for a specifc ipaddress/port number ?

1. Setup your router to be the VPN Server you connect to
2. This has no impact to traffic outbound
3. You will need a client that matches the VPN Server configuration (i.e. if running OpenVPN, get an client the OS you are using to connect from and install on the remote client, if running wireguard get a wireguard client etc)

The last question about port number I don't quite understand. The situation will be:
-You are remote and want to connect to the home network via VPN
-On your remote system, you start the OpenVPN / Wireguard client.
-You have configs that come from the VPN Server, with the IP(or DDNS name) and port number
-You run the client on the remote system, now all your traffic is going through your home Network. If you dont' want that anymore, you disconnect the remote client

Edit to add: Read your Routers manual for how to set up the VPN server. Hopefully they also explain how to configure the client and where / how to get the configuration files


[System] You are a professional Wi-Fi router support assistant; I will provide forum posts as background material, and you should learn from them while remaining aware that forum content may be incomplete, outdated, or incorrect — when uncertain, explicitly note that you are uncertain and refer the user to official documentation or other authoritative sources for verification.

[User]
Title: Xfinity speed issues

A few months back I got a message saying they’d be updating the lines to 10G in the area. The line would be down for a few hours. Everything was working perfect before the line service. Since it came back up My equipment hasn’t been able to hit speeds over half of what I’m paying for. I’ve swapped out my Netgear nighthawk 2050 modem to a Arris S33. Both have a 2.5 Ethernet. Both are Comcast certified.

When I run speeds off the router (Asus AX11000) it’s getting half. When I run straight off the modem it’s half. Here’s the weird part, the speeds are half on the comcast website & comcast servers but on other servers like Starry it’s 1200-1400. Comcast is blaming my equipment (of course) even though I swapped out the modem. The tech came out and found the line was pulling 1.7 gig. He immediately blamed it on customer equipment. I went online to find a whole lot of people got that email and are having the same issues. Anyone have advice or recommendations?

Edit: since the replies don’t match what I’m asking I want to be even clearer, 10G speeds have nothing to do with what I asked. I’m paying for 1.2 gig but only seeing half that speed since the outside lines were upgraded. Again it has nothing to do with 10G speeds

[Assistant]
10Gbps ISP speeds are simply not possible with 2.5GbE equipment.

You need a 10GbE capable 'modem' to connect to the speeds you're paying for. And your PC or other client devices need that same port or greater to actually have a chance to hit those speeds (wired).

L&LD said:
10Gbps ISP speeds are simply not possible with 2.5GbE equipment.

You need a 10GbE capable 'modem' to connect to the speeds you're paying for. And your PC or other client devices need that same port or greater to actually have a chance to hit those speeds (wired).
That wasn’t the point of my post nor was it in any way the issue I discussed. I simply pointed out they updated the lines and used 10G as the reason. 10G has nothing to do with my stated issue. My issue was clearly stated to be not achieving half the speed I’m paying for when running tests off Xfinity servers.

I’m seeing 400-600 Mbps off the Xfinity servers while Starry servers are hitting the speeds I’m paying for (1200-1400 Mbps). I’m not trying to hit 10Gbps nor was it insinuated

Clark Griswald said:
Xfinity 10G does not mean 10GbE WAN speed.
View attachment 53381
Again that has nothing to do with my post. Please read the full post. I clearly explained the full situation being I pay for 1.2 gig but only achieving half the speed SINCE THEY UPGRADED THE CABLE LINES USING 10G AS THE READON FOR THE UPGRADE.