Configuring WAN settings in Asuswrt-Merlin for TM UniFi

Below is my Internet Connection setting for TM UniFi:

• WAN Connection Type: PPPoE
• Enable WAN: Yes
• Enable NAT: Yes
• NAT Type: Symmetric
• Enable UPnP: No (for better security control)
• Get the WAN IP automatically: Yes
• Connect to DNS Server automatically: No (set as Yes to use the DNS servers of your ISP)
• DNS Server: you can use the DNS servers of your ISP, or any of the public DNS servers below:
• Cloudflare: 1.1.1.1, 1.0.0.1
• FreeDNS: 45.33.97.5, 37.235.1.177
• Google: 8.8.8.8, 8.8.4.4
• Level3: 209.244.0.3, 209.244.0.4
• OpenDNS: 208.67.222.222, 208.67.220.220
• Quad9: 9.9.9.9, 149.112.112.112
• UncensoredDNS: 91.239.100.100, 89.233.43.71
• Verisign: 64.6.64.6, 64.6.65.6
• PPP Username: your username given by the ISP
• Password: your password given by the ISP
• Disconnect after time of inactivity: 0 second (never disconnect)
• MTU: 1480
• MRU: 1480 (same value as MTU)
• Internet Detection: PPP Echo
• PPP Echo Interval: 30 seconds
• PPP Echo Max Failures: 5 times
• Enable VPN+DHCP Connection: Yes
• Spoof LAN TTL value: No

You can use the ping command to find out the maximum possible MTU value for your WAN connection. Just ping to any external server that accepts ICMP echo, with the parameters "-f -l xxxx" where xxxx is a number you try to get as large as possible, while the ping result will remain to have 0% packet loss without packet fragmentation. Any number greater than it will cause packet fragmentation.

Your MTU will be this xxxx number added by 28.

In the ping results shown above, the maximum number is 1452. Therefore, the MTU is 1452+28=1480.

Dual WAN: if you only have single Internet connection, set this to Off. If you have two Internet connections, set this to On. Your secondary WAN connection can be configured as fail over backup link which only active when the primary WAN is down, or as load balancing link which active together with the primary WAN and share the Internet traffic.

Port Trigger: Disabled. You can enable it if required.

Virtual Server / Port Forwarding: Disabled. You can enable it if required. Note that if you have enabled Parental Control function of the router, there will be some Port Forwarding rules automatically set here for the Parental Control function.

DMZ: Disabled.

Enable DDNS Client: Yes.

Method to retrieve WAN IP: Internal.

Server: just pick one of your favourite. Use Asus if you have no preference.

Host Name: pick a name for your router to be accessible from the Internet. As long as the name is not in used by other user in the DDNS server, it can be used.

HTTPS/SSL Certificate: Let's Encrypt (this is the easiest to use)

NAT Passthrough:

• PPTP Passthrough: Enable
• L2TP Passthrough: Enable
• IPSec Passthrough: Enable
• RTSP Passthrough: Enable + NAT helper
• H.323 Passthrough: Enable + NAT helper
• SIP Passthrough: Enable + NAT helper
• Enable PPPoE Relay: Disable

If you don't use any VPN client and VoIP in your LAN, you can configure the NAT passthrough to be Disabled.