Configuring AiCloud 2.0 in Asuswrt-Merlin

Asus AiCloud 2.0 is a "personal cloud" feature available in Asus wireless routers, enabling you to have easy access to your shared files either inside your home network or externally from the Internet.

External access to AiCloud is still unaffected even if you have disabled web access from WAN, i.e. remote access to your router's configuration web interface is disabled from the Internet (configured the Administration > System > Remote Access Config > Enable Web Access from WAN to "No", which is a good security measure to prevent unauthorized remote access to your router).

AiCloud is best to be used with a Cloud Disk USB storage device plugged in to your router's USB 3.0 port. It can be a USB thumb drive or a USB external harddisk. You can either format it with NTFS or EXT4 file system.

In my experience, AiCloud for Asus RT-AC86U router can work properly with the following combination of file systems:

• NTFS only, single partition
• EXT4 only, single partition
• NTFS + EXT4. The EXT4 is to be used by Entware or Optware
• NTFS + EXT4 + SWAP

Inside AiCloud 2.0 menu option, there are 3 settings. You need to turn on Cloud Disk in order to share the attached USB storage device to both your Intranet and the Internet.

I recommend to disable Smart Access, unless you want all your shared resources in your internal network to be remotely accessible from the Internet via AiCloud.

Smart Sync is said to be able to sync your attached USB storage to Asus Webstorage in the cloud, or AiCloud of another router in the Internet. In order to use Smart Sync, you need to enable both Cloud Disk and Smart Access. I found this function to be still buggy, and haven't found the way to make it work properly with Asus Storage yet. Therefore, I just keep it off.

In order to access your AiCloud from the Internet, particularly when you don't have a fixed IP address allocated by your ISP, you will need to have your DDNS service up and running. It is configured inside WAN > DDNS, and you have quite a wide variety of DDNS servers that you can choose to use.

You can access to your AiCloud using:

• Web browser connecting to your router's AiCloud Web Access Port, configured in AiCloud 2.0 > Settings > AiCloud Web Access Port. It is advisable for you to change this port number from the default to your own.

• AiCloud Android App

• AiCloud iOS App
• 3rd party mobile apps, such as File Manager +

Asus Download Master is a utility in the router that enable you to download Internet files using torrents to your attached USB storage device. It is not installed by default, and when you install it, the router will setup optware in your USB storage device and install the Download Master utility there. It can then be accessible using its web interface by browsing to its port in your router.

I think Internet files downloading is much better to be handled by proper software in your computer, rather than using the utility in your router. It will consume your router's CPU and memory resources, reduce its stability and reduce its security level.

Inside USB Application > Media Services and Servers, you can make use of the built-in media server functionality in your router (miniDLNA) to stream media stored in the attached USB storage device to computers, tablets, smartphones, smart TV, media player, etc. Supported media content includes video, music and pictures.

If you enable iTunes Server, you can stream the media content to iTunes app and Apple TV in your intranet. Disable this if you don't need it.

By using Manual Media Server Path, you can specific only media files resided in certain folders in the attached USB storage device be accessible with the media server. For each of the folders, you can further specify whether to share the audio, image or video in it.

For Samba network file sharing, the following settings are recommended:

• Allow guest login: Off
• Maximum number of concurrent connects: 5
• Samba protocol version: SMBv2
• Simpler share naming: Yes
• Force as Master Browser: Yes
• Set as WINS server: Yes, unless you already have a WINS server in your local network

SMBv2 is more secured against Windows malware attack. However, you might see the following log entries in your router, which is caused by one or more clients trying to access using the old SMBv1 (CIFS) protocol.

 

To eliminate these log entries, you can either set the Samba protocol version to "SMBv1 + SMBv2", which is not recommended due to malware security issue with SMBv1, or to turn off SMBv1 clients.

In Windows, you can turn off its SMBv1 client by going to Control Panel > Programs > Programs and Features > Turn Windows features on or off > SMB 1.0/CIFS File Sharing Support and uncheck the SMB 1.0/CIFS Client.

The settings for NFS exports and FTP Share is pretty straightforward. You can just disable them if not in used.

Configuring Adaptive QoS in Asuswrt-Merlin

When your Internet connection is congested (most or all of its allocated bandwidth is used up) either from time to time, or most of the time, Quality of Service (QoS) is a mechanism for you to prioritize bandwidth usage based on network tasks and applications.

However, if your Internet connection is not congested most of the time (allocated bandwidth is hardly used up), it is advisable for you to turn off QoS function. This is because QoS won't make your Internet connection become faster, as your Internet connection is limited by your ISP allocation of maximum upload and download bandwidth. In fact, enabling QoS will incur additional workload to your router and your local network.

QoS is essential for a congested network to ensure that certain network tasks and applications will not be severely affected by the congestion by giving priority to their network traffic, at the sacrifices of those with lower priority. Turn on QoS when your Internet is congested will give you a better Internet experience if you configure it properly.

Bear in mind that QoS normally won't work together with Hardware Acceleration. Enabling QoS will cause the router to automatically shut down partial or all of the Hardware Acceleration function.

In the Asuswrt and Asuswrt-Merlin Game Boost screen, there is a LAN Boost - One Click Game First mode. That is actually a short cut to an adaptive QoS setting that turn on adaptive QoS and set Online Gaming with the highest priority of all network traffic. If you want to give the highest priority to other tasks such as Media Streaming instead of Online Gaming, make sure you turn off this LAN Boost - One Click Game First mode.

When you click into the Adaptive QoS menu, you will be presented with the Bandwidth Monitor screen. This screen is functioning regardless QoS is switch on or off in your router. It is a very useful screen to tell you the real time bandwidth usage of your network between the router.

Upload Bandwidth and Download Bandwidth is visually shown in the form of a speedometer. From this display, you can immediately know whether your Internet link is congested or not.

The same information is also obtainable in the Asus Router mobile apps connected to the router.

Below it is a list of hosts connected to the router, and their real time upload and download bandwidth usage respectively.

If you turn on Apps analysis, you can click on the icon of any of the hosts, and the screen will show a breakdown of bandwidth usage by the applications running in the host.

If you would like to turn on QoS function, recommended settings are as below:

• QoS type: Adaptive QoS
• Bandwidth Setting: Automatic Setting
• Queue Discipline: fq_codel
• WAN packet overhead: select the correct preset according to your Internet connection type

Click here if you are interested to understand more on the technical among the 3 queue disciplines of Stochastic Fairness Queueing (SFQ), Controlled Delay (CoDel) and Fair Queueing Controlled Delay (fq_CoDel).

You can then determine which kind of applications are going to have the highest priority to access the Internet: Games, Media Streaming or Web Surfing.

If you choose Customize, you are given control to customize the priority among the following traffic types:

• Gaming
• Video and Audio Streaming
• VoIP and Instant Messaging
• Web Surfing
• File Transferring
• Others

You can mouse over to each of them for more description of the traffic type respectively.

If you have QoS enabled, you can view the QoS Statistics screen to have an idea of the bandwidth usage by each of the traffic types.

Web History records down a log on the websites visited by the hosts. I find it no harm to enable or disable it. Even if you disabled it, it seems that the logging still be ongoing behind the scene. I also noticed that this Web History does not display every single website visited by the hosts.

Configuring AiProtection in Asuswrt-Merlin and Asuswrt

One of the selling points for Asus wireless routers is their AiProtection feature, providing real-time network monitoring and protection with its Trend Micro Deep Packet Inspection engine. This is a kind of enterprise-level security made available in Asus home routers.

AiProtection is signature based, which you can update its signature in Administration > Firmware Upgrade > Signature Version > Check. This is of no rival to today's enterprise-level security that uses machine learning and/or deep learning technology, but it is much better than none.

Router Security Assessment check your router settings for security best practices. If you enabled something that has potential to decrease the security protection, it will warn you by flagging that setting as a risk. It will provide you a direct link to disable that particular setting.

However, if you are clear on your requirement to enable certain settings, such as port forwarding, you can just ignore the warning.

To get the best from AiProtection, you should enable all the features of Malicious Sites Blocking, Two-Way IPS and Infected Device Prevention and Blocking.

Malicious Sites Blocking will prevent any computer in your local network to access to known malicious websites that can bring harm to your computer, such as infecting your computer with trojans, viruses, malwares, ransomwares, etc. Your computers should be installed with antivirus and Internet security software that performs this job. However, you will be surprised that there might be still some sites not detected by your computer's Internet security software but eventually blocked by your Asus router. Enabling Malicious Sites Blocking will provide double-layer protection from malicious websites on top of your computer's Internet security software. If you have a firewall with similar function behind your router, then you will have triple-layer protection.

Two-Way IPS will detect and block exploitation of a known network vulnerability, either from the Internet into your local network, or from compromized computers or IoT devices in your network trying to attack other computers or IoT devices in the Internet. This will, to certain extend, help you to protect unpatched vulnerability of your computers or IoT devices from being exploited and hacked.

Infected Device Prevention and Blocking will try to block the communication between compromised computers or IoT devices in your network and the hacker's command and control server. In this way, the hacker will not be able to easily take remote control of your compromised computers or IoT devices.

If you click on the Alert Preference button and set your email (Gmail / AOL / QQ / 163) there, you will be able to receive email alerts from your router whenever AiProtection alert is triggered.

The firmware actually provide reports for these AiProtection features in their respective tab so that you can known what threats have been intercepted, and which hosts are affected.

Parental Controls consist of Web & Apps Filters and Time Scheduling.

Parental Controls are host based and block traffic based on the source MAC address of the host accessing to the Internet. It is automatically enabled if you set one or more family members in Asus Router mobile apps as below 18 years-old and assign one or more hosts under them. The mobile apps will block them from accessing to Adult websites.

Beside adult websites, Web & Apps Filters can also block a host from accessing to Instant Message and Communication, P2P and File Transfer, and Streaming and Entertainment in the Internet.

Note that you can expand each of the 4 categories for finer blocking settings. For example, Adult category consists of Pornography, Illegal and Violence and Gambling sub-categories.

Enabling Web & Apps Filters will consume some of your router's CPU and memory, and will make web browsing slightly slower.

If you are using Asuswrt-Merlin firmware, there is another alternative called DNS Filter to do the filtering at the DNS server.

Time Scheduling function allows you to set time blocks in each of the days in a week that a particular host is allowed to access Internet. Internet access will be blocked for that particular host when the time is outside the allowed timeframe. You can set multiple blocks within a day.

This is only useful if the host is dedicated to a person or some persons that need to obey to your time scheduling. If it is a shared computer used by the whole family, then every family member will need to obey to the time scheduling when using that computer. There will be no exception.

You will notice that if you have any of the Parental Controls settings enabled, there are additional Port Forwarding entries automatically defined in your router. Those Port Forwarding entries will disappear after you disabled the setting.

Parental Controls are nice features to have. For better router performance, you might want to disable them, unless necessary to use them to guard your children Internet access.