Options for my second AC68U?

Discussion in 'Networking & Security' started by fatryan, Jan 14, 2020.

  1. fatryan

    fatryan [H]ard|Gawd

    Messages:
    1,056
    Joined:
    Feb 19, 2004
    I have two AC68Us, but I'm currently only using 1 on my home network. I flashed AsusWRT-Merlin on the router currently in use. I have ExpressVPN configured on it via OpenVPN. It connects to 2 separate servers, depending on client device. But the router itself and the default for all new devices is no-VPN. I also have remote access via the Asus Android app, though I'm not sure how secure this is.

    So I have some ideas for how to use the other router:

    1) Setup aimesh or access point: don't really need it as our house isn't that big, but the 5GHz network isn't quite as strong as 2.4GHz on the 3rd floor. So this might be a good option to keep devices on 5GHz by default. I just don't want to deal with any significant loss of speed or continuous switching back and forth between connections to router vs. AP/node.

    2) Setup dedicated ExpressVPN router: ExpressVPN firmware which gets me one-click switching of servers (assuming I can connect remotely to second router). Also easy to connect new devices to VPN, and get dedicated SSID for VPN. Would still need to have VPN client configured on main router since ExpressVPN firmware can only connect to one server at a time.

    3) Setup dedicated AsusWRT-Merlin VPN router: I would move all my OpenVPN configurations to this router, so I can setup remote access to main router using VPN server. Not easier to connect new devices to VPN than current config, but still get dedicated SSID for VPN.

    I would say #3 is probably ideal, considering I'm concerned about the security of the Asus app remote access. Don't want everything locked up in the event of DDoS attacks or someone stealing my info.

    So is my understanding of the items above correct? What else could I potentially use the second router for?
     
  2. IdiotInCharge

    IdiotInCharge [H]ardForum Junkie

    Messages:
    13,056
    Joined:
    Jun 13, 2003
    Second access point, run Cat5 to another position in the house.
     
  3. fatryan

    fatryan [H]ard|Gawd

    Messages:
    1,056
    Joined:
    Feb 19, 2004
    can i ask why you suggest this? I did just buy 1000' of plenum cat6 for my surveillance system...
     
  4. IdiotInCharge

    IdiotInCharge [H]ardForum Junkie

    Messages:
    13,056
    Joined:
    Jun 13, 2003
    Might as well get the coverage?

    More APs, up to a point, means more channels covered, and more 'local' traffic to each device as they'll be closer to the AP they're using.
     
  5. fatryan

    fatryan [H]ard|Gawd

    Messages:
    1,056
    Joined:
    Feb 19, 2004
    Are there concerns with too much switching between networks since my house isn't all that big?

    What about the other options I listed for using the second router as a VPN router, do those work as I described?
     
  6. IdiotInCharge

    IdiotInCharge [H]ardForum Junkie

    Messages:
    13,056
    Joined:
    Jun 13, 2003
    If you can do both, that would be ideal. Put your VPN traffic on a separate channel etc.
     
  7. fatryan

    fatryan [H]ard|Gawd

    Messages:
    1,056
    Joined:
    Feb 19, 2004
    i don't really know what i can do, that's why I'm here. I don't know a whole lot about networking.

    I also just realized that i don't think I'll be able to get remote access to my surveillance system without configuring VPN server on the main router. So if i cannot simultaneously configure Asus VPN server & ExpressVPN clients on a single router running Merlin, then I'll necessarily have to configure the ExpressVPN servers in a separate dedicated VPN router.
     
  8. IdiotInCharge

    IdiotInCharge [H]ardForum Junkie

    Messages:
    13,056
    Joined:
    Jun 13, 2003
    With respect to the access point and VPN endpoint roles, it's more a matter of what your hardware is capable of with the various firmware options available.

    The VPN doesn't have to be on the edge device, if the edge router can forward that traffic back to the appropriate endpoint on your network. That's basic port forwarding, but you do need to know what ports the VPN traffic will use.
     
  9. fatryan

    fatryan [H]ard|Gawd

    Messages:
    1,056
    Joined:
    Feb 19, 2004
    well i have two AC68Us, one a couple years old, one i bought last month. The newer is flashed with the latest Merlin firmware as of like a week ago. The older is currently flashed with ExpressVPN firmware, but it's not in use at the moment. I can flash whatever firmware into the older one. Not sure if that provides enough info to tell what i can do with them.

    You kinda lost me on the second part. Are you talking about the VPN clients from expressVPN or the Asus VPN server? Is that method of opening ports as risky as regular port forwarding?
     
  10. IdiotInCharge

    IdiotInCharge [H]ardForum Junkie

    Messages:
    13,056
    Joined:
    Jun 13, 2003
    Talking about forwarding the VPN traffic. It's IP traffic, thus there are ports involved and so on.

    Generally yes. You typically want to put VPN endpoints on the edge device, such that those packets never get routed (and then switched) behind that first router.

    This isn't as big of a problem with more configurable hardware, i.e. routers with addressable interfaces, as the traffic gets routed where it needs to go rather than being tagged with a MAC address for the switch to... switch.

    I'm not knowledgeable at all with respect to firmware on consumer equipment. Once you start wanting to do more than a typical home use scenario calls for, having that baseline of flexibility really helps. Generally, you'd split up the functions three ways, with a separate router / firewall, switch, and access point. This is of course more expensive.

    You'll have to dig in to the various available firmware options to determine whether the hardware you have is suitable.
     
  11. ChilledC18

    ChilledC18 n00b

    Messages:
    9
    Joined:
    Oct 21, 2019
    Hello guys,

    I see you recommend ExpressVPN but is it really that great ? It seems REALLY expensive from my point of view... Even though reviews online seem positive about it, like this one https://the-bestvpn.com/review-expressvpn/ I'm not convinced it's worth paying 7$ / month for it. Don't you have any other VPN you could recommend that I could use with router? Note that I'm technically SUPER limited so I need something easy to set up. That's maybe the reason why you recommend ExpressVPN? Happy to have some info about it :)