Configuring WAN settings in Asuswrt-Merlin for TM UniFi

Below is my Internet Connection setting for TM UniFi:

• WAN Connection Type: PPPoE
• Enable WAN: Yes
• Enable NAT: Yes
• NAT Type: Symmetric
• Enable UPnP: No (for better security control)
• Get the WAN IP automatically: Yes
• Connect to DNS Server automatically: No (set as Yes to use the DNS servers of your ISP)
• DNS Server: you can use the DNS servers of your ISP, or any of the public DNS servers below:
• Cloudflare: 1.1.1.1, 1.0.0.1
• FreeDNS: 45.33.97.5, 37.235.1.177
• Google: 8.8.8.8, 8.8.4.4
• Level3: 209.244.0.3, 209.244.0.4
• OpenDNS: 208.67.222.222, 208.67.220.220
• Quad9: 9.9.9.9, 149.112.112.112
• UncensoredDNS: 91.239.100.100, 89.233.43.71
• Verisign: 64.6.64.6, 64.6.65.6
• PPP Username: your username given by the ISP
• Password: your password given by the ISP
• Disconnect after time of inactivity: 0 second (never disconnect)
• MTU: 1480
• MRU: 1480 (same value as MTU)
• Internet Detection: PPP Echo
• PPP Echo Interval: 30 seconds
• PPP Echo Max Failures: 5 times
• Enable VPN+DHCP Connection: Yes
• Spoof LAN TTL value: No

You can use the ping command to find out the maximum possible MTU value for your WAN connection. Just ping to any external server that accepts ICMP echo, with the parameters "-f -l xxxx" where xxxx is a number you try to get as large as possible, while the ping result will remain to have 0% packet loss without packet fragmentation. Any number greater than it will cause packet fragmentation.

Your MTU will be this xxxx number added by 28.

In the ping results shown above, the maximum number is 1452. Therefore, the MTU is 1452+28=1480.

Dual WAN: if you only have single Internet connection, set this to Off. If you have two Internet connections, set this to On. Your secondary WAN connection can be configured as fail over backup link which only active when the primary WAN is down, or as load balancing link which active together with the primary WAN and share the Internet traffic.

Port Trigger: Disabled. You can enable it if required.

Virtual Server / Port Forwarding: Disabled. You can enable it if required. Note that if you have enabled Parental Control function of the router, there will be some Port Forwarding rules automatically set here for the Parental Control function.

DMZ: Disabled.

Enable DDNS Client: Yes.

Method to retrieve WAN IP: Internal.

Server: just pick one of your favourite. Use Asus if you have no preference.

Host Name: pick a name for your router to be accessible from the Internet. As long as the name is not in used by other user in the DDNS server, it can be used.

HTTPS/SSL Certificate: Let's Encrypt (this is the easiest to use)

NAT Passthrough:

• PPTP Passthrough: Enable
• L2TP Passthrough: Enable
• IPSec Passthrough: Enable
• RTSP Passthrough: Enable + NAT helper
• H.323 Passthrough: Enable + NAT helper
• SIP Passthrough: Enable + NAT helper
• Enable PPPoE Relay: Disable

If you don't use any VPN client and VoIP in your LAN, you can configure the NAT passthrough to be Disabled.

Configuring LAN settings in Asuswrt-Merlin

For LAN IP Address and the corresponding subnet mask, pick one from the following private IP address ranges:

• 192.168.0.1 to 192.168.255.254 (subnet mask 255.255.0.0 for fixed first 2 numbers 192.168 in the available LAN IP addresses; subnet mask 255.255.255.0 for fixed first 3 numbers in the available LAN IP addresses)
• 172.16.0.1 to 172.31.255.254 (subnet mask 255.240.0.0, or 255.255.0.0, or 255.255.255.0)
• 10.0.0.1 to 10.255.255.254 (subnet mask 255.0.0.0 or 255.255.0.0 or 255.255.255.0)

For home network, using a subnet mask of 255.255.255.0 with 254 allocable IP addresses is sufficient.

If you want to allocate less usable IP addresses, you can refer to the subnet masks below:

• 255.255.255.128 (126 allocable IP addresses)
• 255.255.255.192 (62 allocable IP addresses)
• 255.255.255.224 (30 allocable IP addresses)
• 255.255.255.240 (14 allocable IP addresses)

Below is my LAN configuration for your reference:

• Enable the DHCP Server: Yes
• Hide DHCP/RA queries: No
• IP Pool Starting and Ending Address: for easier management, it is advisable to allocate this dynamic IP range to be different from the IP range used in manual assignment. Make sure this IP range is within the allocable IP addresses as defined by the subnet mask.
• Lease time: 86400 seconds
• Default gateway: the internal IP address of the router
• DNS Server: you can use the DNS servers of your ISP, or any of the public DNS servers below:
• Cloudflare: 1.1.1.1, 1.0.0.1
• FreeDNS: 45.33.97.5, 37.235.1.177
• Google: 8.8.8.8, 8.8.4.4
• Level3: 209.244.0.3, 209.244.0.4
• OpenDNS: 208.67.222.222, 208.67.220.220
• Quad9: 9.9.9.9, 149.112.112.112
• UncensoredDNS: 91.239.100.100, 89.233.43.71
• Verisign: 64.6.64.6, 64.6.65.6
• Advertise router's IP in addition to user-specified DNS: Yes
• Forward local domain queries to upstream DNS: No
• Enable DNSSEC support: No (unless you are sure your ISP and your DNS servers support this feature)
• Enable DNS Rebind protection: No (unless you are sure your ISP and your DNS servers support this feature)
• WINS Server: the internal IP address of the router
• Enable Manual Assignment: Yes

Note: For the hosts configured in the manual IP assignment table, you can edit their name and change their icon by clicking on their icon.

• Enable static routes: No (normally you don't need this, unless you have a complex network with several routers)
• IPTV: select the correct ISP Profile to auto-configure the IPTV settings for the corresponding ISP
• Switch Control:
• Enable Jumbo Frame: Disable
• Spanning-Tree Protocol: Enable

Configuring WiFi settings in Asuswrt-Merlin

Smart Connect is a feature in Asus wireless routers to automatically steer the WiFi clients to the most appropriate band of 2.4GHz and 5GHz. If you make use of Smart Connect feature, you will need to have the same SSID and Pre-Shared Key (WiFi password) for all the bands available.

If you prefer to have more control on which band your WiFi clients should connect to, you can disable Smart Connect.

For 2.4GHz band:

• There are 3 wireless modes available. "Auto" allows 802.11b/g/n devices to connect to the WiFi network. In this mode, 802.11n devices can connect with optimum speed (up to 250Mbps per stream). "Legacy" mode also allows 802.11b/g/n devices to connect to the WiFi network, and the 802.11n devices can only connect with a maximum speed of 54Mbps (same as 802.11g). If all your wireless devices support 802.11n, you can select "N only" wireless mode for optimal performance. This mode does not allow 802.11b/g to connect.
• Tick the "optimized for Xbox" if your WiFi network has Xbox 360 connected, otherwise just leave it unticked.
• If your WiFi network has old 802.11b and/or 802.11g devices, tick the "b/g Protection". This will protect those devices from interferences which will also affecting the 802.11n devices.
• Set channel bandwidth to 20/40 MHz to allow 802.11n connections to combine 2 channels for faster transmission speed, provided there is minimal channel interference with your neighbours. The router will device whether to use 20 MHz (one channel) or 40 MHz (dual channel) based on actual situation.
• Try to use control channel 1, 6 or 11 if none of your neighbours is using it. These 3 channels are non-overlapping.

For 5GHz band:

• Try to use a different SSID from 2.4GHz to have more control on which band you want your device to connect to.
• There are 4 wireless modes available. "Auto" allows 802.11ac/n/a devices to connect to the WiFi network. "Legacy" only allows 802.11n/a devices to connect, and the 802.11n devices can only connect with a maximum speed of 54Mbps. "N only" will exclude all the 802.11 ac/a devices. For most of the users, you should choose "N/AC mixed" because only very old device will use the 802.11a connection on 5GHz band, you probably don't have such device at home.
• Tick the "optimized for Xbox" if your WiFi network has Xbox 360 connected, otherwise just leave it unticked.
• Set channel bandwidth to 20/40/80 MHz to allow the router to make use of either single channel, 2 channels or 3 channels, based on the actual situation.
• The best control channel for most Asus routers is channel 48. Channels 36/40/44/48 belong to the UNII-1 low band channels, with channel 48 having the best transmission power. Other channels above are belonging to the UNII-2 or UNII-3 channels, which availability for use is depending on the country's regulation. Those higher band channels are in the Dynamic Frequency Selection (DFS) spectrum, and the router will simply disable using them if any radar systems is detected using the same spectrum.

For both 2.4GHz and 5GHz bands:

• Extension channel is the second channel for 40 MHz bandwidth (and third channel for 80 MHz in 5GHz band), which you can specify it to be either above the control channel or below the control channel.
• For most home users, set your authentication method to "WPA2-Personal" and WPA encryption to AES. If you have a RADIUS server in your local network, you can use "WPA2-Enterprise" for better security.
• WPA pre-shared key is a passphrase, which you can use a short sentence of words instead of a single word.
• For most of the users, you can leave protected management frames to be disabled. You can enable it for better security, but wireless clients that don't support this feature might not be able to connect to your WiFi network.
• In WPA WiFi connections, the group key is a shared encryption keys among all the connected devices to secure multicast/broadcast traffic. It is more secured to change this group key at certain time interval, although for most home user, there is usually no harm for not to change it. For group key rotation interval, the figure is in seconds. You can set it to 0 to use the same key without any periodic change required. The interval can be from 1 second to 2,592,000 seconds. 3,600 seconds should be good enough for most users.

WPS (WiFi Protected Setup) provides an easy way to connect new device to the WiFi network. For most home user, you can just disable this function, as your wireless devices at home is pretty fixed.

WDS (Wireless Distribution System) is a kind of wireless bridging function to extend your WiFi coverage with additional access points (AP). If your home network only has one wireless router, you can ignore the settings here. Besides, Asus routers has a better way of interconnection called AiMesh.

If you discovered your neighbour is stealing your WiFi network, you can block their device with Wireless MAC Filter. It is very straightforward to configure.

RADIUS Setting is for WPA2-Enterprise network. Most home users can just leave it as it is.

Below is my configuration for Professional Wireless settings, for your reference.

For 2.4GHz:

• Enable Radio: Yes
• Enable wireless scheduler: No
• Set AP Isolated: No
• Roaming assistant: Disable (enable if you use Smart Connect function)
• Bluetooth Coexistence: Pre-emptive (if you use Bluetooth keyboard/mouse/speaker nearby your router)
• Enable IGMP Snooping: Disable
• Multicast Rate(Mbps): Auto
• Preamble Type: Long
• AMPDU RTS: Enable
• RTS Threshold: 2346
• DTIM Interval: 3
• Beacon Interval: 100
• Enable TX Bursting: Enable
• Enable WMM: Enable
• Enable WMM No-Acknowledgement: Disable
• Enable WMM APSD: Enable
• Optimize AMPDU aggregation: Disable
• Modulation Scheme: Up to MCS 11 (NitroQAM/1024-QAM)
• Airtime Fairness: Enable
• Multi-User MIMO: Enable
• Explicit Beamforming: Enable
• Universal Beamforming: Enable
• Region: make sure you select correctly

For 5GHz:

• Enable Radio: Yes
• Enable wireless scheduler: No
• Set AP Isolated: No
• Roaming assistant: Disable (enable if you use Smart Connect function)
• Enable IGMP Snooping: Disable
• Multicast Rate(Mbps): Auto
• AMPDU RTS: Enable
• RTS Threshold: 2346
• DTIM Interval: 3
• Beacon Interval: 100
• Enable TX Bursting: Enable
• Enable WMM: Enable
• Enable WMM No-Acknowledgement: Disable
• Enable WMM APSD: Enable
• Optimize AMPDU aggregation: Disable
• Modulation Scheme: Up to MCS 11 (NitroQAM/1024-QAM)
• Airtime Fairness: Enable
• Multi-User MIMO: Enable
• 802.11ac Beamforming: Enable
• Universal Beamforming: Enable
• Region: make sure you select correctly

WiFi Radar enables you to check for the WiFi channels usage and congestion state around your area, so that you can set your control channel to the least congested option. Before using it, you need to go to the Configure tap and click on the Start Data Collection button, wait for a few seconds, then click on the Stop Data Collection button.