Options for my second AC68U?

F

fatryan

[H]ard|Gawd
Joined
Feb 19, 2004
Messages
1,402
I have two AC68Us, but I'm currently only using 1 on my home network. I flashed AsusWRT-Merlin on the router currently in use. I have ExpressVPN configured on it via OpenVPN. It connects to 2 separate servers, depending on client device. But the router itself and the default for all new devices is no-VPN. I also have remote access via the Asus Android app, though I'm not sure how secure this is.

So I have some ideas for how to use the other router:

1) Setup aimesh or access point: don't really need it as our house isn't that big, but the 5GHz network isn't quite as strong as 2.4GHz on the 3rd floor. So this might be a good option to keep devices on 5GHz by default. I just don't want to deal with any significant loss of speed or continuous switching back and forth between connections to router vs. AP/node.

2) Setup dedicated ExpressVPN router: ExpressVPN firmware which gets me one-click switching of servers (assuming I can connect remotely to second router). Also easy to connect new devices to VPN, and get dedicated SSID for VPN. Would still need to have VPN client configured on main router since ExpressVPN firmware can only connect to one server at a time.

3) Setup dedicated AsusWRT-Merlin VPN router: I would move all my OpenVPN configurations to this router, so I can setup remote access to main router using VPN server. Not easier to connect new devices to VPN than current config, but still get dedicated SSID for VPN.

I would say #3 is probably ideal, considering I'm concerned about the security of the Asus app remote access. Don't want everything locked up in the event of DDoS attacks or someone stealing my info.

So is my understanding of the items above correct? What else could I potentially use the second router for?
 
Might as well get the coverage?

More APs, up to a point, means more channels covered, and more 'local' traffic to each device as they'll be closer to the AP they're using.
 
IdiotInCharge said:
Might as well get the coverage?

More APs, up to a point, means more channels covered, and more 'local' traffic to each device as they'll be closer to the AP they're using.
Click to expand...
Are there concerns with too much switching between networks since my house isn't all that big?

What about the other options I listed for using the second router as a VPN router, do those work as I described?
 
fatryan said:
Are there concerns with too much switching between networks since my house isn't all that big?

What about the other options I listed for using the second router as a VPN router, do those work as I described?
Click to expand...

If you can do both, that would be ideal. Put your VPN traffic on a separate channel etc.
 
IdiotInCharge said:
If you can do both, that would be ideal. Put your VPN traffic on a separate channel etc.
Click to expand...
i don't really know what i can do, that's why I'm here. I don't know a whole lot about networking.

I also just realized that i don't think I'll be able to get remote access to my surveillance system without configuring VPN server on the main router. So if i cannot simultaneously configure Asus VPN server & ExpressVPN clients on a single router running Merlin, then I'll necessarily have to configure the ExpressVPN servers in a separate dedicated VPN router.
 
fatryan said:
i don't really know what i can do, that's why I'm here. I don't know a whole lot about networking.
Click to expand...

With respect to the access point and VPN endpoint roles, it's more a matter of what your hardware is capable of with the various firmware options available.

fatryan said:
I also just realized that i don't think I'll be able to get remote access to my surveillance system without configuring VPN server on the main router. So if i cannot simultaneously configure Asus VPN server & ExpressVPN clients on a single router running Merlin, then I'll necessarily have to configure the ExpressVPN servers in a separate dedicated VPN router.
Click to expand...

The VPN doesn't have to be on the edge device, if the edge router can forward that traffic back to the appropriate endpoint on your network. That's basic port forwarding, but you do need to know what ports the VPN traffic will use.
 
IdiotInCharge said:
With respect to the access point and VPN endpoint roles, it's more a matter of what your hardware is capable of with the various firmware options available.



The VPN doesn't have to be on the edge device, if the edge router can forward that traffic back to the appropriate endpoint on your network. That's basic port forwarding, but you do need to know what ports the VPN traffic will use.
Click to expand...
well i have two AC68Us, one a couple years old, one i bought last month. The newer is flashed with the latest Merlin firmware as of like a week ago. The older is currently flashed with ExpressVPN firmware, but it's not in use at the moment. I can flash whatever firmware into the older one. Not sure if that provides enough info to tell what i can do with them.

You kinda lost me on the second part. Are you talking about the VPN clients from expressVPN or the Asus VPN server? Is that method of opening ports as risky as regular port forwarding?
 
fatryan said:
You kinda lost me on the second part. Are you talking about the VPN clients from expressVPN or the Asus VPN server?
Click to expand...

Talking about forwarding the VPN traffic. It's IP traffic, thus there are ports involved and so on.

fatryan said:
Is that method of opening ports as risky as regular port forwarding?
Click to expand...

Generally yes. You typically want to put VPN endpoints on the edge device, such that those packets never get routed (and then switched) behind that first router.

This isn't as big of a problem with more configurable hardware, i.e. routers with addressable interfaces, as the traffic gets routed where it needs to go rather than being tagged with a MAC address for the switch to... switch.

fatryan said:
Not sure if that provides enough info to tell what i can do with them.
Click to expand...

I'm not knowledgeable at all with respect to firmware on consumer equipment. Once you start wanting to do more than a typical home use scenario calls for, having that baseline of flexibility really helps. Generally, you'd split up the functions three ways, with a separate router / firewall, switch, and access point. This is of course more expensive.

You'll have to dig in to the various available firmware options to determine whether the hardware you have is suitable.
 
Hello guys,

I see you recommend ExpressVPN but is it really that great ? It seems REALLY expensive from my point of view... Even though reviews online seem positive about it, like this one https://the-bestvpn.com/review-expressvpn/ I'm not convinced it's worth paying 7$ / month for it. Don't you have any other VPN you could recommend that I could use with router? Note that I'm technically SUPER limited so I need something easy to set up. That's maybe the reason why you recommend ExpressVPN? Happy to have some info about it :)
 
You must log in or register to reply here.
Back
Top