Xentrk

Trendmicro Security is installed in AsusWRT routers. I would have to research some more to see if there are any feature differences. Most OpenSource router firmware has additional packages for security that are free at no additional cost. These include ad blockers and firewall add ons that also block sites that track you, malware and bad sites.  AsusWRT Merlin and pfSense firmware are excellent for this. Have not looked specifically for this topic at some of the other firmware forums lately to know what is going on there, such as DD-WRT.  There are two active projects on AsusWRT Merlin for blocking ads, bad sites and malware and an enhanced firewall functionality program. The project names are Skynet (enhanced firewall) and Diversion (malware and ad blocking).  Since the Asus router has TrendMicro built in, your network will be well protected.

6 hours ago, KhunHeineken said:

I have been meaning to ask this question for a while.  I will not start a new thread for it because it's all to do with VPN's.

 

My router has a function that allows me to create a VPN that I can access from anywhere.  It's a common feature on a lot of routers, so it's nothing special, and I think you can even set one up through Windows.

 

My qestions are:  once set up, and you access your router from a remote location, does all your browsing use the IP address of the remote router? (the one in my house, in my home country, that I have set up the VPN on)

 

Next question:  is there any security issues with this?     

 

Next question:  once connected to my home country router, are download and upload usage counted towards my home's internet account, with VPN traffic flowing through it?

 

I am currently paying for a VPN, and I am very sastified with their speeds and reliability, but am I paying for something that I can just do myself, through a router I have in my home country, and couldn't anyone do this through a friend or relative's router, back in their home country?

There is a Configuration setting on the server that controls the connection. It may depend on the firmware. On Asuswrt-Merlin, one setting will use the VPN connection of the server for all your internet browsing. The other setting allows you to use your local WAN interface for internet browsing yet still creates a connection to the server so you can access resources on the remote server. 

Security issues would be nominal. The sites you visit may be logged on the dnsmasq logs on the router. I never thought of this until now. I will have to test this one.

Plans vary greatly by internet provider. But good point to check the data plan limits and the impact of the VPN connection to bandwidth.

Also, is there someone at the remote location than can power cycle it or help if there is a problem? 

One good point of this solution is the ability to avoid blocks some streaming media services and other sites have on known shared VPN servers. You will appear as coming from a residential IP address.

On the downside, you will loose the flexibility to connect to different geo locations for those out of market football games for example.

Luckily for us, the VPN market is very competitive which helps keep prices low. The monthly costs of some one or two year plans is very low. 

Good question and interesting pros and cons. Something I also considered doing at one point.

Here is an example of how to configure the server and client devices

OpenVPN Server Setup Asuswrt Merlin

On 2/7/2019 at 10:07 AM, suzannegoh said:

 

isn’t the reason that Cloudfare's DNS servers are not giving away your geo location because you are using it with a VPN? The behavior that i’m seeing with the free version of Cloudfare's DNS is that when I use it without a VPN that websites like whatsmyip show me as being in Thailand. And when i test with ipleak.net it shows my DNS servers as being in Singapore.

When connected to Cloudflare DNS, ipleak.net only reported the DNS in a location that was the same as the VPN connection. But dnsleak.com reported the same server plus the C.F. DNS in Thailand. But I now realize my test was flawed and will retest tomorrow. I had also implemented DNS over HTTPS in Firefox. It will take priority over DNS over TLS running on the router. Will report back later with results.

See below 

I have been using Cloudflare DNS over TLS for the past two months over my WAN interface.  I have three VPN tunnels for streaming media and for privacy concerns.  I am not seeing any evidence where the services are using your DNS location to determine your geo location. They are only using your WAN endpoint IP address that is reported from sites like iplocation.net, whatismyip.com, etc.  When I do an ipleak test (dnsleak.com, ipleak.net), it reports my end point as being the location of my VPN server and the DNS location as the Cloudflare Data Center in Bangkok.  No issues with the streaming services or sites that check your geo location so far. 

I have been researching how to configure firewall rules to route DNS over the same VPN tunnel I am connected to on pfSense though.  I can get it to work if I only have one OpenVPN tunnel.  But since I have three tunnels, DNS Resolver (Unbound), selects one of the three VPN tunnels in random order.  I found a possible solution on a forum. Need time when no one is using the internet to experiment with it though.   

Regarding WireGuard vs. OpenVPN.

I'm a TorGuard subscriber. They currently support four WireGuard servers in NYC. They have instructions on how to install on the gl-inet travel router. I currently own the AR-300M model.

Had issues with their instructions as I was on the current production 2.27 firmware and their instructions use the Beta firmware. I did some searching and found the beta link here https://docs.gl-inet.com/en/3/release_notes/gl-ar300m/. I had to install the tar file on this page http://download.gl-inet.com/firmware/ar300m/nand/testing/

Once, I upgraded the firmware, the configuration was a snap.

Unfortunately, I can't report great speeds when compared to the AC86U. The travel router is probably constrained by the Qualcomm QCA9531 SoC, 650MHz CPU along with the location of the servers in NYC, which is half way across the globe from my location. However, notable difference when compared to OpenVPN.

            WireGuard  OVPN aes-128-gcm

Down        32.97               5.96

Up            18.59               8.27

Latency   316.00            305.00

Still, good to see some progress being made and it will be interesting to see how things progress. If I get some time later this week, I will test using the Android client.  Windows 10 client is not ready yet. 

If you have a VPN provider that supports WireGuard, the list of currently supported client packages are listed on the page https://www.wireguard.com/install/.

And it looks like NordVPN is testing WireGuard as well.

https://www.takesontech.com/nordvpn-is-testing-the-adoption-of-the-wireguard-protocol

 

Here is some information regarding OpenVPN performance for the Asus RT-AC86U and RT-AX88U routers with the Broadcom CPUs that support hardware acceleration. I have no personal experience with these models, only passing on information I have read. The CPU in the RT-AX88U is the same as the CPU in the RT-AC86U. So, the performance reported by the AC86U users should also apply to the AX88U.

hardware-acceleration-is-here-for-routers-using-openvpn

2 hours ago, suzannegoh said:

I’m tempted to setup a pfSense device to have a project to work on but I’m not so sure that it would be solving a problem that I presently have.  One thing I’m not sure of it whether it makes more sense to do that rather than to just wait for Asus’s AX routers to become more widely available.  Would you expect a performance improvement from using pfSense on an i5 machine versus the newer Asus routers that you mentioned?  Also, now I’m using PIA’s windows client app on each of my PCs and android devices.  Usually when I benchmark to speedtest servers in the US I get 20 to 40 Mbps download speeds with or without being connected to the VPN.  There aren’t  a lot of things that I do online that actually need faster internet than that, so it occurs to me that taking on a project like that would just be for the sake of learning and perhaps getting better benchmarking results.
 

Incidentally, I love your blog.  There’s lots of useful information there.

Thank you @Suzannegoh,

I asked a new owner of an Asus RT-AX88U to run some performance benchmarks for me so we can compare with my pfSense build.  I'll post the results once I get the numbers. 

One major item I use to gauge performance in addition to the speed test results, is the ability to watch streaming media without experiencing buffering. Despite the poor OpenVPN performance of my RT-AC88U, I was able to watch streaming media from half way across the globe with no buffering. 

I helped an expat here in Chiang Mai with her streaming media needs.  She has a 50 up/30 down DSL package from 3BB installed.   We installed the TorGuard VPN app on her Amazon FireTV device.  I helped her configure the settings to use the lowest encryption levels.  She is able to watch streaming media with no buffering issues.  One thing I really like about the FireTV devices is their small size and portability.  I have one that I take with me when traveling.  It allows me to watch content that I like in my hotel room and not be restricted to the channel choices on the local TV.  Most TVs in hotel rooms are high def with an HDMI port.  But, I did stay in a dated resort last year that had the old tube style TV.  So, my streaming was limited to my iPad or Laptop. 

I'll post the metrics on the AX88U once I get them.  Stay tuned..

@tallguyjohninbkk

Yes, the OpenVPN and legacy protocols will continue to reign. For how long, I can’t predict. The new protocols are not yet supported by commercial VPN providers. The only exception I know of that support WireGuard are:

AzireVPN, Mullvad, IVPN + TorGuard

AzireVPN https://www.azirevpn.com/cfg/wg
Mullvad https://mullvad.net/en/servers/#wireguard
IVPN https://www.ivpn.net/wireguard
TorGuard https://torguard.net/knowledgebase.php?action=displayarticle&id=250

I am monitoring a group of Asus RT-AC86U users who are testing with it on another forum.  Early reports on performance and speed are excellent. WireGuard supports multi core whereas OpenVPN is single core threaded. WireGuard is a work in progress while OpenVPN remains stable, in wide use, secure and very portable.

For those who like to tinker and want to chase bandwidth when using OpenVPN on a router, I encourage you to look into pfSense firmware. Bit of a learning curve but there are good blog and YouTube set up guides on the net. Go to your local computer mall and pick up a used PC with at least an Intel i5. Make sure the CPU supports AES-NI. You may also have to buy a second network card. You then download the firmware img file on a USB and boot up with the stick plugged it. You follow a few prompts and the web GUI will be installed. There are guides on how to flash on the net. I’ve also seen some small desktop units made by third parties on two major Chinese Amazon type stores on the net. The units are not endorsed by the Netgate, the company that supports pfSense development.

The past year also brought about an improvement of CPUs that support encryption acceleration in a few models of consumer grade routers. So, things are starting to look up for the dreaded OpenVPN performance issue. 

A search on the net for “poor OpenVPN performance” will show how widespread the issue is.

The other point I forgot to mention is the architecture of OpenVPN. It is single core threaded. As a result, OpenVPN can't take advantage of multi-core processors. 

Here is a quick summary of the different VPN protocols.

1) OpenVPN is probably the most in use when compared to others - mostly due to heavy advertising by the VPN Service Providers and the portable nature of the OVPN stack.  Just too bad that performance is a bit of a challenge with OVPN.  But it is very secure when properly configured.

2) Shadowsocks - probably number 2 - because of the Great Firewall - size matters, and the mainland is what it is.

3) Wireguard - creeping up the chart. I am seeing more support for client platforms by some of the VPN providers.  You can install the package on OpenWRT and Asus RT-AC86U routers.  Very fast performance when compared to OpenVPN.  Some AC86U users I know have been experimenting with it.  However, WireGuard is not yet complete. You should not rely on this code. It has not undergone proper degrees of security auditing and the protocol is still subject to change. They are working toward a stable 1.0 release, but that time has not yet come.

4) ZeroTier - This might be the one to keep an eye on - concept wise it's a bit different, as it's an SD-WAN approach - which is a different step, and takes a mind readjustment perhaps to understand what their doing.  Looks like a better for for an enterprise implementation.

5) Legacy approaches - Obviously we have legacy and proprietary approaches as well - legacy like PPTP. PPTP should just go away, except that's it fast, and private enough for some uses (not everyone in a coffee shop is a blackhat hacker), and then the business oriented stuff like AnyConnect from Cisco and similar from Juniper, etc...

Standalone stuff like L2TP/IPSec - which is supported by many OS's on the client side, is still relevant...
 

Unfortunately, the moderator deleted my post regarding this topic. I asked why to better understand what rule I violated to avoid the problem in the future.  As a result, I will give a more consolidated version of my deleted post. 

It is not so much the VPN provider as it is the client machine.  A desktop or laptop computer with an Intel CPU will get much better VPN performance when compared to a consumer grade router.  My first adventure was installing VPN on a D-Link router so all of the devices in my household could use the VPN tunnel.  But I got poor download speed.  The CPUs in most consumer grade routers can't handle the workload of encrypting the traffic which results in the slow VPN speed.  I could get much better speed using the VPN Desktop Client on my laptop.

To solve my problem, I converted an old Windows 7 PC to a pfSense appliance.  The box has an Intel i5 CPU that supports AES-NI.  AES-NI is able to accelerate the encryption and speed up performance. This past year, Asus has released two routers with CPUs that have encryption built in: RT-AC86U and RT-AX88U.  Users of these models have reported improved VPN performance. 

The other issue is the level of encryption you select.  In my own testing and benchmarking with other VPN users, I have determined that the GCM ciphers will give you the best performance.  AES-128-CBC used to be the go to cipher for speed.  But, AES-128-GCM has now replaced it.

Lastly, distance to VPN server is a big factor. For example, I get 2x the speed if I connect to a server in Bangkok compared to a server in LA.

My blog post contains an article on OpenVPN performance and the factors that influence it. 

There is another option for those of you who don't have an Asus router running Asuswrt-Merlin firmware. Cloudflare recently introduced apps in the iOS and Android stores that you can install on your mobile devices  See https://1.1.1.1/?utm_medium=website&utm_source=hmc&utm_campaign=resolver-mobile-app-launch

Similarly, you can configure DNS-over-DOT if you use a Firefox browser. See https://www.internetsociety.org/blog/2018/12/dns-privacy-support-in-mozilla-firefox/

for the instructions.

My father has a laptop that can't access 5 GHz devices.  Most newer devices are 5 GHz compatible.  What is the make and model of the router?  Perhaps the 5 GHz settings need to be modified.  Can you log into the router?

If you have an Android phone, you can download some apps that will help debug the issue.

There are some apps with the same name:  WiFi Analyzer

I have two analyzer apps and they each display the information in a slightly different way.

You can filter by 2.4 GHz and 5 GHz channels to see what is broadcasting in your general area.

20 hours ago, Mario666 said:

What are you using to connect to the Fire TV Box or is that just a set top box with a remote?

 

 

I have both a Fire TV Stick and Fire TV with 4K Ultra HD.  The primary reason was to use them when traveling.  There is no option to connect via Ethernet cable.  It is all done over WiFi.  To load iPlayer, you need to follow these instructions if you did not purchase the Fire TV in the UK http://www.aftvnews.com/how-to-install-geographically-restricted-apps-from-amazon/

If you have an Android box, you need to do a similar technique, but using the Android (Google) Play store.

Yes, the ISP will need to install.  They run fiber into the house.  I am very happy with 3bb customer service.  I have the 200 Mbps package.  Make sure you use at least CAT 6 cable for any devices connected via Ethernet cable.  A CAT 5e will limit your speed to 100 Mbps.  You will also need a router that supports 5 Ghz band in order to get the 200 Mbps over WiFi.  Just recently, 3bb now has modem/routers that have 5 Ghz band.  But you have to ask for it if they don't offer it to you.  Otherwise, you will not get the 200  Mbps speed when using the 2.4 Ghz band.

As being discussed on the forum in another thread, my recommendation is to place the ISP supplied modem/router in Bridge mode and use your own Router.  I recommend the Asus AC86U for most people.  It has many features, including the ability to block ads http://ab-solution.info/. 

13 minutes ago, Mattd said:

I have True Fibre (VDSL) in Bangkok, using a Humax HV100-02 and subscribed to the 14 day free trial with SmartDNS, religiously followed the setup instructions to the letter, using their Singapore (DNS 1) and Japan (DNS 2) DNS servers, as these are the closest to Thailand, as per their advice.

I have tried manually setting the DNS setup in Windows, Fire TV box and in the Humax, disabling the True DNS routing, both separately for each device and all together, none of this is working for me at all, any ideas why not?

SmartDNS have been very good support wise, so far they cannot work it out either, if I do a DNS leak test, then it shows that it is True BKK.

I only tested SmartDNS one time about two years ago.  I did not work for me as I have a dynamic IP address and could not be bother with updating it every time I wanted to watch geo restricted content.  A fourm member on snbforums told me this morning that they have a way to handle that now.  You may want to ask him for his advice https://www.snbforums.com/threads/selective-routing-for-netflix.42661/page-7#post-407823

The first thought that comes to mind is the location of the SmartDNS servers.  Ask SmartDNS if they have servers in the UK if it is BBC you are trying to access, or the geo location you are trying to watch from.  That may be the issue.  Did you see if you can change DNS settings in the router?

In addition to Bridge Mode,  I recommend turning off the WiFi as you won't need it anymore, and DHCP server.  Before making the changes, you should first assign a static IP in your laptop and connect using an ethernet cable. 

On windows, Control Panel -> Network & Internet -> Network & Sharing Center -> Change Adapter Settings -> Right click on the ethernet adapter  and select Properties -> Move down to the Internet Protocol Version 4 (TCP/IPv4) and select Properties.  More than likely, the ISP modem/router IP is 192.168.1.1. So, set up so the fourth number is something other than 1 e.g. 192.168.1.10.  See pic below

Here is a pic of BBC iPlayer that I installed on my Fire TV.  I need to install on my Android box when I have some time.

I have harvested all of the BBC iPlayer domain names for my selective routing program.  Let me know if you need them.  With my program, I can be connected to the WAN or a VPN server in the USA.  But if I chose to watch BBC, the rules for BBC traffic will get a higher priority than my primary device which allows me to connect and watch BBC no matter what my device is configured to use by default. I plan to post the code to github soon once I wrap up some other projects.

I recently configured an Asus RT-AC86U for a friend.  I configured the OpenVPN client to TorGuard's private streaming media server in USA so he can watch all kinds of geo restricted content from USA on his Apple TV.  Just make sure you configure the Region setting on the Apple TV to be the country you are trying to access.  I assign a static DHCP address for the Apple TV.  I then configure the Apple TV to use the OpenVPN client in the Web menu.  All of his other devices use native WAN.  You can read more about how this works using the links to my blog site below.

https://x3mtek.com/why-i-use-torguard-as-my-vpn-provider/

https://x3mtek.com/torguard-openvpn-2-4-client-setup-for-asuswrt-merlin-firmware/

https://x3mtek.com/router-firmware-supported-by-torguard/

Let me know if you have questions. I recommend the Asus AC86U for most people as it has the best CPU for OpenVPN performance for a consumer grade router and is packed with many features.  I have written some programs to perform selective routing for the Asus routers running Asuswrt-Merlin firmware.  I route some traffic to LA, some to my private streaming IP and BBC to my private streaming IP in the UK.  My provider is TorGuard.  They are able to get around the VPN blocks of Netflix, Hulu and BBC.   

On 5/27/2018 at 6:15 PM, Pib said:

And this is one reason why I'm glad I have my ISP-provided router set to bridge mode which feeds my ASUS router that gets frequent firmware updates for cyber vulnerabilities/malware.   My ASUS router is guarding the wall and not the ISP-provided router. 

 

ISP-provided routers are rarely, if ever, receive firmware updates after they are installed at your residence.   For the TOT, True, or AIS provided routers I've had over the years those routers never got a firmware update.

I confirmed with 3bb that they do not provide firmware updates. I also place my 3bb router in Bridge Mode and advocate all users do the same.  3bb made a change last year.  A phone call to 1530 is now required.  It takes about 10 minutes. I have done this at four sites I support. 

On the Asus routers, you have to make sure you do not enable access from the WAN.  The author of Asuswrt-Merlin now has this setting configured to off by default.  Many on snbfourums.com have reported being hacked when they had this setting turned on.   Same with SSH access.  It should be set to only allow access from the LAN.  If one needs to have access to the router remotely, setting up an OpenVPN server is the way to do it.  I provide the instructions on my blog site here.

https://x3mtek.com/torguard-openvpn-2-4-client-setup-for-asuswrt-merlin-firmware/

I recently battled a Windows update on a laptop.  I finally got it to work. But I lost the users files!  I found them in the C:\Widows directory in a folder called windows.old.  Whew!  At that point, I should have backed up the directory.  But I did not. Instead, I proceeded to apply all of the Windows patches that were pending.  I lost the files. Ugh.  I was able to recover them using data recovery software I purchased online from the site minitool.com.

I used to run into people who have laptops with bogus windows on them all the time.  I won't help them anymore.  They can't get updates and have other issues.  I recommend you go the Open Source route if you want to save money.  Install the Ubuntu Deskop operating system.  You can use many of the free Open Source office products that are compatible with Microsoft's office products. See the link below for more information.

https://tutorials.ubuntu.com/tutorial/tutorial-install-ubuntu-desktop#0

If you are a 3bb fiber customer and have the 200 Mbps plan, you may want to contact 3bb to obtain a new Fiberhome modem/router that has a 5 Ghz radio.  My friend was just provided one.  The issue with the current Fiberhome modem/routers is that you will never be able to get the 200 Mbps using the 2.4 Ghz Wifi connection.  You need to use a 5 Ghz WiFi radio to get the 200 Mbps.  That is my experience from testing I've performed.

For the past few months, my friend has only been getting 100 Mbps speed over an Ethernet cable despite having the 200 Mbps plan.  I tested this morning and found I have the same issue.  They were able to fix the problem by issuing a reset on the Fiberhome mode/router from their office.  I have the Fiberhome modem/router placed in Bridge mode and use my own router.  I converted a Windows 7 PC with an Intel i5 CPU to a pfSense router.  The AES-NI feature of the CPU has greatly accelerated my OpenVPN client speeds. 

Something that can also affect internet speeds is the Ethernet cable.  I found out with my testing this morning that the CAT 5E can only support speeds up to 100 Mbps.  Whereas CAT 6 supports 1 Gbps.  So, if you have the 200 Mbps plan, and connect a laptop or computer to the router using a CAT 5E, you will only get 100 Mbps.  To check your network adapter on a Windows PC or laptop, open the Control Panel.  Navigate to Control Panel -> Network and Internet -> Network Connections.  Select Change Adapter Settings on the left.  Double-click on the network adapter you are using.  Look for the line marked as speed.  It will show you the max speed the network adapter will support. 

This is the speed test site the 3bb tech used to verify my problem was fixed:  http://speedtest.adslthailand.com/.

I prefer it when compared to the other sites I have used in the past. 

3bb was very responsive to my concerns.  They also had a customer service representative call me back this evening to confirm my issue was resolved.  I am happy with their customer service.

You can also try the reader view in a browser.  It is a work around for websites that detect ad blockers. 

If you need a VPN, I recommend TorGuard. See https://x3mtek.com/why-i-use-torguard-as-my-vpn-provider/