ASUS Router Operations
Facts verified as of 2026-07.
Authoritative guidance for configuring and hardening ASUS routers — stock Asuswrt and Asuswrt-Merlin firmware — via the web UI and SSH/nvram. Covers security hardening, encrypted DNS, VPN, network segmentation, AiMesh, AiProtection, and JFFS scripting.
Safety first. Changes here can lock you out or drop the network. Test during low-usage windows, document the before value, and know how to undo. Cite official docs, not folklore.
Stock Asuswrt vs Asuswrt-Merlin
|
Stock Asuswrt |
Asuswrt-Merlin |
| Base |
ASUS official |
Community fork of ASUS source (same core, more control) |
| Scripting |
Limited |
JFFS custom scripts, cron, services-start, firewall-start, nat-start |
| DNS control |
Basic |
DNS Director (per-client/global DNS redirection, DoT) |
| VPN |
OpenVPN/WireGuard server+client |
+ VPN Director (policy/split-tunnel routing) |
| Best for |
Most users |
Power users wanting scripts, fine-grained DNS/VPN routing |
Never mix stock and Merlin nodes in the same AiMesh network. Keep the firmware family consistent across mesh nodes.
Security hardening checklist
Do these on every new router, in order:
- Change defaults immediately — both the admin/login password and the WiFi password.
- Disable WPS — it's a brute-force surface.
- Disable UPnP unless an app genuinely needs it (it creates unpredictable port forwards).
- Use explicit port forwarding, never DMZ — DMZ exposes the entire device.
- Disable remote WAN admin access — use a VPN to manage remotely instead.
- Enable AiProtection (two-way IPS + malicious-site blocking) where available.
- Set up a guest network with intranet access disabled (proper isolation).
- Enable firewall logging for security monitoring; forward to syslog if you have a collector.
- Apply ingress filtering (BCP38/84 anti-spoofing) where supported.
- Keep firmware current — security fixes land in point releases.
See references/hardening-and-network.md for the full hardening rationale, VLAN/IoT
segmentation, AiMesh backhaul tuning, QoS, and dual-WAN.
DNS privacy stack
| Layer |
What |
Notes |
| Transport |
DoT (DNS over TLS) or DoH (DNS over HTTPS) |
Stops plaintext port-53 hijacking. Merlin DNS Director can enforce DoT |
| Provider |
Cloudflare (1.1.1.1), NextDNS, ControlD, AdGuard |
Choose for filtering/analytics needs |
| Validation |
DNSSEC |
Validates record authenticity |
| Per-client policy |
DNS Director (Merlin) |
Different DNS per device/profile; split-horizon |
| Rebinding protection |
On by default |
Can break local services (Plex, smart home) — whitelist specific domains rather than disabling wholesale |
Avoid plain DNS (port 53) — unencrypted and hijackable. Move to DoT/DoH.
VPN decision table
| Need |
Use |
| Fast modern tunnel, low overhead |
WireGuard server/client (preferred where supported) |
| Maximum compatibility / legacy clients |
OpenVPN server/client |
| Route only some clients/traffic through VPN |
VPN Director (Merlin) — policy-based split tunnel |
| Remote admin of the router |
VPN in, then manage on LAN (never expose WAN admin) |
Common clients: NordVPN, Surfshark, Mullvad via OpenVPN/WireGuard config import.
Network segmentation
| Goal |
Approach |
| Visitor isolation |
Guest network with "Access Intranet" off |
| IoT containment |
Dedicated guest/VLAN SSID; block lateral movement to main LAN |
| Consistent guest across mesh |
Enable guest on AiMesh deliberately; mind "Access Intranet" per node |
| Smart-home discovery |
mDNS/Bonjour may need controlled cross-VLAN allowances — scope narrowly |
| Segmented routing |
VLAN segmentation + routing policies (capability varies by model) |
Patterns to avoid
| Anti-pattern |
Why |
Instead |
| DMZ mode |
Exposes the whole device to the internet |
Explicit per-port forwarding |
| UPnP globally on |
Unpredictable auto port forwards |
Enable only when required, understand the risk |
| Plain DNS (port 53) |
Plaintext, hijackable |
DoT/DoH |
| Mixing stock + Merlin in AiMesh |
Inconsistent behavior |
Keep firmware family uniform |
| Disabling DNS rebind protection wholesale |
Reopens rebinding attacks |
Whitelist the specific local domains that break |
| Wireless mesh backhaul on congested channels |
Throughput collapse |
Wired backhaul or dedicated DFS 5GHz channel |
| Default admin/WiFi credentials |
Trivial compromise |
Change both immediately |
| Remote WAN admin enabled |
Major attack surface |
Manage via VPN |
Operating principles
- Reversibility — record the current value before changing; know the undo path.
- Testability — change during low-usage windows; verify before walking away.
- Trade-offs — note privacy-vs-functionality costs (rebind protection vs local services).
- Verification — confirm via system log, client-side test (e.g. DNS leak test), or
nvram get.
- Cite official docs — avoid unverified tweaks.
SSH / JFFS scripting (Merlin)
Merlin runs user scripts from JFFS at lifecycle points. Enable JFFS custom scripts and
configs (Administration → System) first.
| Script |
Runs at |
Use for |
services-start |
After services start |
Start custom daemons |
firewall-start |
After firewall (re)builds |
Add custom iptables rules (survives firewall restarts) |
nat-start |
After NAT rules load |
Custom NAT/port rules |
dnsmasq.postconf |
Before dnsmasq starts |
Inject dnsmasq config |
Inspect/set persistent config with nvram get <key> / nvram set <key>=<val> + nvram commit
(commit sparingly — it writes flash).
The assets/firewall-start.sh template shows the canonical safe shape for custom firewall
rules. See references/hardening-and-network.md for placement and gotchas.
Assets
| File |
Use |
assets/firewall-start.sh |
Annotated Merlin /jffs/scripts/firewall-start template — idempotent custom iptables rules with safe-by-default examples |
See also
net-ops — general networking: subnets, DNS, TLS, firewalls, packet inspection
Key external resources
1---2name: asus-router-ops3description: "ASUS router config and hardening: Asuswrt-Merlin, security hardening, encrypted DNS (DoT/DoH), VPN (WireGuard/OpenVPN), guest networks, VLAN/IoT isolation, AiMesh, AiProtection. Triggers on: asus router, asuswrt, merlin, wireguard router, AiProtection, AiMesh, nvram, jffs, IoT isolation."4license: MIT5allowed-tools: "Read Write Bash"6metadata:7 author: claude-mods8 related-skills: net-ops9---1011# ASUS Router Operations1213> Facts verified as of 2026-07.1415Authoritative guidance for configuring and hardening ASUS routers — stock **Asuswrt** and **Asuswrt-Merlin** firmware — via the web UI and SSH/nvram. Covers security hardening, encrypted DNS, VPN, network segmentation, AiMesh, AiProtection, and JFFS scripting.1617> **Safety first.** Changes here can lock you out or drop the network. Test during low-usage windows, document the before value, and know how to undo. Cite official docs, not folklore.1819---2021## Stock Asuswrt vs Asuswrt-Merlin2223| | Stock Asuswrt | Asuswrt-Merlin |24|---|---|---|25| Base | ASUS official | Community fork of ASUS source (same core, more control) |26| Scripting | Limited | **JFFS custom scripts**, cron, `services-start`, `firewall-start`, nat-start |27| DNS control | Basic | **DNS Director** (per-client/global DNS redirection, DoT) |28| VPN | OpenVPN/WireGuard server+client | + **VPN Director** (policy/split-tunnel routing) |29| Best for | Most users | Power users wanting scripts, fine-grained DNS/VPN routing |3031**Never mix stock and Merlin nodes in the same AiMesh network.** Keep the firmware family consistent across mesh nodes.3233---3435## Security hardening checklist3637Do these on every new router, in order:38391. **Change defaults immediately** — both the admin/login password *and* the WiFi password.402. **Disable WPS** — it's a brute-force surface.413. **Disable UPnP** unless an app genuinely needs it (it creates unpredictable port forwards).424. **Use explicit port forwarding, never DMZ** — DMZ exposes the entire device.435. **Disable remote WAN admin access** — use a VPN to manage remotely instead.446. **Enable AiProtection** (two-way IPS + malicious-site blocking) where available.457. **Set up a guest network** with intranet access disabled (proper isolation).468. **Enable firewall logging** for security monitoring; forward to syslog if you have a collector.479. **Apply ingress filtering** (BCP38/84 anti-spoofing) where supported.4810. **Keep firmware current** — security fixes land in point releases.4950See `references/hardening-and-network.md` for the full hardening rationale, VLAN/IoT51segmentation, AiMesh backhaul tuning, QoS, and dual-WAN.5253---5455## DNS privacy stack5657| Layer | What | Notes |58|-------|------|-------|59| **Transport** | DoT (DNS over TLS) or DoH (DNS over HTTPS) | Stops plaintext port-53 hijacking. Merlin DNS Director can enforce DoT |60| **Provider** | Cloudflare (1.1.1.1), NextDNS, ControlD, AdGuard | Choose for filtering/analytics needs |61| **Validation** | DNSSEC | Validates record authenticity |62| **Per-client policy** | DNS Director (Merlin) | Different DNS per device/profile; split-horizon |63| **Rebinding protection** | On by default | **Can break local services** (Plex, smart home) — whitelist specific domains rather than disabling wholesale |6465**Avoid plain DNS (port 53)** — unencrypted and hijackable. Move to DoT/DoH.6667---6869## VPN decision table7071| Need | Use |72|------|-----|73| Fast modern tunnel, low overhead | **WireGuard** server/client (preferred where supported) |74| Maximum compatibility / legacy clients | **OpenVPN** server/client |75| Route only *some* clients/traffic through VPN | **VPN Director** (Merlin) — policy-based split tunnel |76| Remote admin of the router | VPN in, then manage on LAN (never expose WAN admin) |7778Common clients: NordVPN, Surfshark, Mullvad via OpenVPN/WireGuard config import.7980---8182## Network segmentation8384| Goal | Approach |85|------|----------|86| Visitor isolation | Guest network with "Access Intranet" **off** |87| IoT containment | Dedicated guest/VLAN SSID; block lateral movement to main LAN |88| Consistent guest across mesh | Enable guest on AiMesh deliberately; mind "Access Intranet" per node |89| Smart-home discovery | mDNS/Bonjour may need controlled cross-VLAN allowances — scope narrowly |90| Segmented routing | VLAN segmentation + routing policies (capability varies by model) |9192---9394## Patterns to avoid9596| Anti-pattern | Why | Instead |97|--------------|-----|---------|98| DMZ mode | Exposes the whole device to the internet | Explicit per-port forwarding |99| UPnP globally on | Unpredictable auto port forwards | Enable only when required, understand the risk |100| Plain DNS (port 53) | Plaintext, hijackable | DoT/DoH |101| Mixing stock + Merlin in AiMesh | Inconsistent behavior | Keep firmware family uniform |102| Disabling DNS rebind protection wholesale | Reopens rebinding attacks | Whitelist the specific local domains that break |103| Wireless mesh backhaul on congested channels | Throughput collapse | Wired backhaul or dedicated DFS 5GHz channel |104| Default admin/WiFi credentials | Trivial compromise | Change both immediately |105| Remote WAN admin enabled | Major attack surface | Manage via VPN |106107---108109## Operating principles1101111. **Reversibility** — record the current value before changing; know the undo path.1122. **Testability** — change during low-usage windows; verify before walking away.1133. **Trade-offs** — note privacy-vs-functionality costs (rebind protection vs local services).1144. **Verification** — confirm via system log, client-side test (e.g. DNS leak test), or `nvram get`.1155. **Cite official docs** — avoid unverified tweaks.116117---118119## SSH / JFFS scripting (Merlin)120121Merlin runs user scripts from JFFS at lifecycle points. Enable **JFFS custom scripts and122configs** (Administration → System) first.123124| Script | Runs at | Use for |125|--------|---------|---------|126| `services-start` | After services start | Start custom daemons |127| `firewall-start` | After firewall (re)builds | Add custom iptables rules (survives firewall restarts) |128| `nat-start` | After NAT rules load | Custom NAT/port rules |129| `dnsmasq.postconf` | Before dnsmasq starts | Inject dnsmasq config |130131Inspect/set persistent config with `nvram get <key>` / `nvram set <key>=<val>` + `nvram commit`132(commit sparingly — it writes flash).133134The `assets/firewall-start.sh` template shows the canonical safe shape for custom firewall135rules. See `references/hardening-and-network.md` for placement and gotchas.136137---138139## Assets140141| File | Use |142|------|-----|143| `assets/firewall-start.sh` | Annotated Merlin `/jffs/scripts/firewall-start` template — idempotent custom iptables rules with safe-by-default examples |144145---146147## See also148149- `net-ops` — general networking: subnets, DNS, TLS, firewalls, packet inspection150151### Key external resources152153- [Asuswrt-Merlin project](https://www.asuswrt-merlin.net/) · [docs](https://www.asuswrt-merlin.net/docs) · [wiki](https://github.com/RMerl/asuswrt-merlin.ng/wiki)154- [Merlin features (DNS Director, VPN Director)](https://www.asuswrt-merlin.net/features)155- [ASUS router security hardening FAQ](https://www.asus.com/support/faq/1039292/)156- [ASUS firewall intro](https://www.asus.com/us/support/faq/1013630/) · [Network Services Filter](https://www.asus.com/support/faq/1013636/) · [IPv6 firewall](https://www.asus.com/support/faq/1013638/)157- [AiProtection overview](https://www.asus.com/au/content/aiprotection/) · [setup](https://www.asus.com/support/faq/1008719/)158- [Cloudflare DoH](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/) · [ControlD ASUS setup](https://docs.controld.com/docs/asus-router-setup)159- [SNBForums community](https://www.snbforums.com/)
0xDarkMatter