Configuring IPv6 settings in Asuswrt-Merlin for TM UniFi

All the IPv4 blocks have already fully allocated, and IPv4 should be exhausted any time from now. Although the Internet transition from IPv4 to IPv6 has been prolonged, it is advisable to make use of IPv6 now in parallel with IPv4.

In fact, many websites are found to be faster when accessed using IPv6.

Below are my settings on IPv6 for TM UniFi for your reference:

• Connection type: Native
• Interface: PPP
• DHCP-PD: Enable
• Release prefix on exit: Enable
• Auto Configuration Setting: Stateless
• Connect to DNS Server automatically: Disable (you can choose Enable to use the DNS servers of TM UniFi)
• IPv6 DNS Server: you can choose to use any of the public DNS servers below:
• Google: 2001:4860:4860::8888, 2001:4860:4860::8844
• OpenDNS: 2620:0:ccc::2, 2620:0:ccd::2
• CloudFlare: 2606:4700:4700:0:0:0:0:1111, 2606:4700:4700:0:0:0:0:1001
• UncensoredDNS: 2001:67c:28a4::, 2a01:3a0:53:53::
• Enable Router Advertisement: Enable

If your IPv6 is working, you will be able to see your LAN IPv6 Address, LAN Prefix Length and LAN IPv6 Prefix shown on the screen. More information can be found in the System Log > IPv6 screen.

Configuring WAN settings in Asuswrt-Merlin for TM UniFi

Below is my Internet Connection setting for TM UniFi:

• WAN Connection Type: PPPoE
• Enable WAN: Yes
• Enable NAT: Yes
• NAT Type: Symmetric
• Enable UPnP: No (for better security control)
• Get the WAN IP automatically: Yes
• Connect to DNS Server automatically: No (set as Yes to use the DNS servers of your ISP)
• DNS Server: you can use the DNS servers of your ISP, or any of the public DNS servers below:
• Cloudflare: 1.1.1.1, 1.0.0.1
• FreeDNS: 45.33.97.5, 37.235.1.177
• Google: 8.8.8.8, 8.8.4.4
• Level3: 209.244.0.3, 209.244.0.4
• OpenDNS: 208.67.222.222, 208.67.220.220
• Quad9: 9.9.9.9, 149.112.112.112
• UncensoredDNS: 91.239.100.100, 89.233.43.71
• Verisign: 64.6.64.6, 64.6.65.6
• PPP Username: your username given by the ISP
• Password: your password given by the ISP
• Disconnect after time of inactivity: 0 second (never disconnect)
• MTU: 1480
• MRU: 1480 (same value as MTU)
• Internet Detection: PPP Echo
• PPP Echo Interval: 30 seconds
• PPP Echo Max Failures: 5 times
• Enable VPN+DHCP Connection: Yes
• Spoof LAN TTL value: No

You can use the ping command to find out the maximum possible MTU value for your WAN connection. Just ping to any external server that accepts ICMP echo, with the parameters "-f -l xxxx" where xxxx is a number you try to get as large as possible, while the ping result will remain to have 0% packet loss without packet fragmentation. Any number greater than it will cause packet fragmentation.

Your MTU will be this xxxx number added by 28.

In the ping results shown above, the maximum number is 1452. Therefore, the MTU is 1452+28=1480.

Dual WAN: if you only have single Internet connection, set this to Off. If you have two Internet connections, set this to On. Your secondary WAN connection can be configured as fail over backup link which only active when the primary WAN is down, or as load balancing link which active together with the primary WAN and share the Internet traffic.

Port Trigger: Disabled. You can enable it if required.

Virtual Server / Port Forwarding: Disabled. You can enable it if required. Note that if you have enabled Parental Control function of the router, there will be some Port Forwarding rules automatically set here for the Parental Control function.

DMZ: Disabled.

Enable DDNS Client: Yes.

Method to retrieve WAN IP: Internal.

Server: just pick one of your favourite. Use Asus if you have no preference.

Host Name: pick a name for your router to be accessible from the Internet. As long as the name is not in used by other user in the DDNS server, it can be used.

HTTPS/SSL Certificate: Let's Encrypt (this is the easiest to use)

NAT Passthrough:

• PPTP Passthrough: Enable
• L2TP Passthrough: Enable
• IPSec Passthrough: Enable
• RTSP Passthrough: Enable + NAT helper
• H.323 Passthrough: Enable + NAT helper
• SIP Passthrough: Enable + NAT helper
• Enable PPPoE Relay: Disable

If you don't use any VPN client and VoIP in your LAN, you can configure the NAT passthrough to be Disabled.

Configuring LAN settings in Asuswrt-Merlin

For LAN IP Address and the corresponding subnet mask, pick one from the following private IP address ranges:

• 192.168.0.1 to 192.168.255.254 (subnet mask 255.255.0.0 for fixed first 2 numbers 192.168 in the available LAN IP addresses; subnet mask 255.255.255.0 for fixed first 3 numbers in the available LAN IP addresses)
• 172.16.0.1 to 172.31.255.254 (subnet mask 255.240.0.0, or 255.255.0.0, or 255.255.255.0)
• 10.0.0.1 to 10.255.255.254 (subnet mask 255.0.0.0 or 255.255.0.0 or 255.255.255.0)

For home network, using a subnet mask of 255.255.255.0 with 254 allocable IP addresses is sufficient.

If you want to allocate less usable IP addresses, you can refer to the subnet masks below:

• 255.255.255.128 (126 allocable IP addresses)
• 255.255.255.192 (62 allocable IP addresses)
• 255.255.255.224 (30 allocable IP addresses)
• 255.255.255.240 (14 allocable IP addresses)

Below is my LAN configuration for your reference:

• Enable the DHCP Server: Yes
• Hide DHCP/RA queries: No
• IP Pool Starting and Ending Address: for easier management, it is advisable to allocate this dynamic IP range to be different from the IP range used in manual assignment. Make sure this IP range is within the allocable IP addresses as defined by the subnet mask.
• Lease time: 86400 seconds
• Default gateway: the internal IP address of the router
• DNS Server: you can use the DNS servers of your ISP, or any of the public DNS servers below:
• Cloudflare: 1.1.1.1, 1.0.0.1
• FreeDNS: 45.33.97.5, 37.235.1.177
• Google: 8.8.8.8, 8.8.4.4
• Level3: 209.244.0.3, 209.244.0.4
• OpenDNS: 208.67.222.222, 208.67.220.220
• Quad9: 9.9.9.9, 149.112.112.112
• UncensoredDNS: 91.239.100.100, 89.233.43.71
• Verisign: 64.6.64.6, 64.6.65.6
• Advertise router's IP in addition to user-specified DNS: Yes
• Forward local domain queries to upstream DNS: No
• Enable DNSSEC support: No (unless you are sure your ISP and your DNS servers support this feature)
• Enable DNS Rebind protection: No (unless you are sure your ISP and your DNS servers support this feature)
• WINS Server: the internal IP address of the router
• Enable Manual Assignment: Yes

Note: For the hosts configured in the manual IP assignment table, you can edit their name and change their icon by clicking on their icon.

• Enable static routes: No (normally you don't need this, unless you have a complex network with several routers)
• IPTV: select the correct ISP Profile to auto-configure the IPTV settings for the corresponding ISP
• Switch Control:
• Enable Jumbo Frame: Disable
• Spanning-Tree Protocol: Enable