Adam Networks - AsusWrt Merlin

[BadWolfe]

I'm confused about "Adam Network" tool. It claims to be built into the ASUS router but I can't find it.
Configuration: AX86U Pro, AsusWRT Merlin Firmware: 3004.388.8_4

Goal: Set up OpenVPN. Instructions say to log into Adam Networks and copy my "Dynamic DNS URL", then inside the client configuration file replace "remote IP address" with the dyndns name.

I created an Adam Network account but cannot find the "Box ID" of my Asus Router. This lead me down a path where they state that ADAM is built into ASUS routers, but I can't find anything about that inside of the Router UI.

Am I headed down the wrong path?
------------------------------------------------------------
Update:
SOLVED:
1. Adam Network instructions were a misleading path. These instructions appear to be for a proprietary product offering where they load thier software on Routers for you.
2. Client configuration file (client1.ovpn) had an incorrect external IP address. The generated file used the DDNS address of the Router which included the "@." characters preceding the DNS address.
Solution: edit the Client configuration file and delete the two preceding characters, "@."
3. Client was unable to use the recommended Security level. Legacy level worked fine though. (OpenVPN client: Settings: Advanced)
Solution: Reset the OpenVPN Server by selecting "Default", enable OpenVPN Server and select "RSA Encryption 2048", generate a new Client configuration file.

Many thanks to everyone that helped figure this out. Special thanks to ColinTaylor for all the work that went into figuring solutions 2 and 3!

 

[dave14305]

Never heard of this before, but this is the closest thing I could find. Requires USB installation. What are you reading?

Install adam:ONE (v4+) on Asus Routers via USB storage

ASUS routers can now run adam:ONE® on most of the stable build of Merlin Supported Models, plus a few additional models, specifically this list: RT-AC66U_B1 (same firmware as the RT-AC68U) RT-AC68U (including revisions C1 and E1) RT-AC68P (same firmware as RT-AC68U) RT-AC68UF (same...

support.adamnet.works

 

[BadWolfe]

Never heard of this before, but this is the closest thing I could find. Requires USB installation. What are you reading?

Install adam:ONE (v4+) on Asus Routers via USB storage

ASUS routers can now run adam:ONE® on most of the stable build of Merlin Supported Models, plus a few additional models, specifically this list: RT-AC66U_B1 (same firmware as the RT-AC68U) RT-AC68U (including revisions C1 and E1) RT-AC68P (same firmware as RT-AC68U) RT-AC68UF (same...

support.adamnet.works

Here are the instructions for setting up OpenVPN on an Asus Router.

ASUS Router OpenVPN Server

Scope of this article OpenVPN has the highest degree of flexibility of VPN server and clients, and is available on all modern platforms. Setting it up can range from easy-as-defaults, to super complicated. In this how-to, we are opting for simplicity and simple setup that relies on a username...

support.adamnet.works

Here is where I read that AdamOne comes pre-installed on ASUS routers. (due to your response, I am sure that I am misinterpreting it though).

"adam:ONETM comes pre-installed on ASUS® routers" Source: Page 5 of AdamOne Quick Start Guide

adamONE Quick Start Guide.pdf

drive.google.com

I will look into the USB installation process. Thank you!
Note: I am struggling to get OpenVPN set up and working.

 

[ColinTaylor]

Here are the instructions for setting up OpenVPN on an Asus Router.

ASUS Router OpenVPN Server

Scope of this article OpenVPN has the highest degree of flexibility of VPN server and clients, and is available on all modern platforms. Setting it up can range from easy-as-defaults, to super complicated. In this how-to, we are opting for simplicity and simple setup that relies on a username...

support.adamnet.works

Here is where I read that AdamOne comes pre-installed on ASUS routers. (due to your response, I am sure that I am misinterpreting it though).

"adam:ONETM comes pre-installed on ASUS® routers" Source: Page 5 of AdamOne Quick Start Guide

adamONE Quick Start Guide.pdf

drive.google.com

I will look into the USB installation process. Thank you!
Note: I am struggling to get OpenVPN set up and working.

Yeah, this is like what some other companies do. They're saying that if you buy an Asus router from them they will preinstall Merlin's firmware and their software on it for you. So this is their addition and not something that is endorsed by Asus/Merlin or part of the normal Asus/Merlin firmware.

Products

ADAMnetworks

shop.adamnet.works

So the question is, have you actually purchased some device or service from this company? If so, what exactly?

 

[Viktor Jaep]

What kind of a shady website is this Adam thing... jeez. Stay away.

 

[Tech9]

30-30-30 and forget about it...

 

[RMerlin]

30-30-30 and forget about it...

View attachment 64481

This must have been written by someone still running DD-WRT on an WRT54G or something...

 

[BadWolfe]

Yeah, this is like what some other companies do. They're saying that if you buy an Asus router from them they will preinstall Merlin's firmware and their software on it for you. So this is their addition and not something that is endorsed by Asus/Merlin or part of the normal Asus/Merlin firmware.

Products

ADAMnetworks

shop.adamnet.works

So the question is, have you actually purchased some device or service from this company? If so, what exactly?

Thank you for responding.

No, I purchased a stock AX86U Pro and installed Merlin's latest firmware, so I am good there.

I'm just trying to get OpenVPN working and searched for instructions. This ADAM Network was simply from a Post I found.

I have OpenVPN working as a Server, exported and down loaded the client created on the Router, installed it on the client side OpenVPN (on iPhone) will not connect. I know this should be easy but I'm missing something simple.

 

[bits]

Maybe your Asus router is behind cgnat.
Is the wan IP address on the Asus router a private IP address?

 

[BadWolfe]

Maybe your Asus router is behind cgnat.
Is the wan IP address on the Asus router a private IP address?

I have DDNS set up using my DNS Host address. I've tried multiple iterations but the client cannot reach my OpenVPN Server.

Looking into the Client config file I see that the IP address displays my DNS server address: xxxxxxx.org
Once it was:
@xxxxxxx.org

After disabling DDNS the exported Client config file was:
172.172.172.172@xxxxxxx.org (IP address and hostname are examples).
This front IP address was the correct current address from my ISP.

Does any of this make sense as to why my Client won't reach home?

 

[bits]

If your server is behind cgnat your client won't be able to reach it.
Is you wan IP in one of these ranges?
10.x.x.x
172.16.x.x - 172.31.x.x
192.168.x.x
100.64.x.x - 100.127.x.x

If your wan IP is in those ranges you almost certainly are behind cgnat and will need to either contact your provider to have that removed which they may charge for or not allow at all. Or change to a provider that doesn't use cgnat or will allow you to disable it.

Or you could open a server that will respond eg (microsip, qtorrent or something on your router), port forward to its port and then check a site such as canyouseeme.org for that port.
If you get a success you may need to wait a further 5-10 minutes and try again to prove the port remains open.
If the port is not open, you are likely behind cgnat and you will not be able to host something like a VPN server.

 

[BadWolfe]

If your server is behind cgnat your client won't be able to reach it.
Is you wan IP in one of these ranges?
10.x.x.x
172.16.x.x - 172.31.x.x
192.168.x.x
100.64.x.x - 100.127.x.x

If your wan IP is in those ranges you almost certainly are behind cgnat and will need to either contact your provider to have that removed which they may charge for or not allow at all. Or change to a provider that doesn't use cgnat or will allow you to disable it.

Or you could open a server that will respond eg (microsip, qtorrent or something on your router), port forward to its port and then check a site such as canyouseeme.org for that port.
If you get a success you may need to wait a further 5-10 minutes and try again to prove the port remains open.
If the port is not open, you are likely behind cgnat and you will not be able to host something like a VPN server.

Thank you for this information. I was completely lost on what was happening.

 

[jksmurf]

Thank you for this information. I was completely lost on what was happening.

Until I changed provider, I had CGNAT on a remote router I need access to.

@bits is absolutely correct, if your provider uses CGNAT (it saves them IP addresses apparently) you can’t get through it without one of a few options. I list two of them below, ones I am familiar with through personal experience.

You can pay for a static IP address or you can do what I did (still do), set up and use Tailscale.

If you already know about tailscale ignore what follows, if not then for this you can either:

• Set up and configure any device attached to your network and always on, as a subnet router. This device will ‘advertise’ itself outside CGNAT and you can then connect to your LAN, including your router e.g. you can use a Raspberry Pi (my first foray into Tailscale) or if it’s always on, an AppleTV HD or 4K (a very simple option, see pics attached) or literally any other device you can install tailscale on (and there are multiple OS platforms and literally hundreds of Device types to choose from).
• If you’re on RMerlin FW, set up Tailscale on the Router. A very easy way to do this is to install TAILMON, an amazing Addon from @Viktor Jaep, this is what I now use, as the router is always on and I don’t need a separate device, although I do keep my Apple TV as a backup subnet router, which I can just enable if I need to, although I never have.

 

[Martinski]

...
I have OpenVPN working as a Server, exported and down loaded the client created on the Router, installed it on the client side OpenVPN (on iPhone) will not connect. I know this should be easy but I'm missing something simple.

The root cause of the problem may also be on the OpenVPN client application being used, but since you have not provided details about which client app you have installed/used to connect, and not posted any logs from both the server *and* client sides indicating if any specific error messages are generated, it's impossible to tell what the actual problem is to be able to narrow down the real cause.

 

[BadWolfe]

The root cause of the problem may also be on the OpenVPN client application being used, but since you have not provided details about which client app you have installed/used to connect, and not posted any logs from both the server *and* client sides indicating if any specific error messages are generated, it's impossible to tell what the actual problem is to be able to narrow down the real cause.

I have spent the last few days (since being told to investigate CGNAT) trying to understand if my provider is in fact causing this because of CGNAT.

From everything I am reading, my provider (Xfinity) is not the issue. Others seem to be able to use OpenVPN.

Due to my constant experiments, I started having issues with my Router (AX86U Pro).
- I tried turning off my DDNS to see if that would help. It did not help.
- I tried modifying the client config file to have my current home IP address. It did not help.
- I tried creating brand new client config files before and after disabling DDNS. It did not help.

I finally had to go back and rebuild my router and restore the original configuration file and then reinstall the Mesh Nodes manually to get my home network back to working correctly again. All of this caused grief to the wife.

I just read your comment about needing to see logs that OpenVPN might have.
Please allow me some time to again set up OpenVPN, generate a client configuration and generate logs to upload here.

The client OpenVPN application that I am using is on the iPhone downloaded from the Apple store. (OpenVPN version 3.5.1 (6211))

I really would like to get OpenVPN working and both appreciate and need your help on this.

 

[BadWolfe]

Until I changed provider, I had CGNAT on a remote router I need access to.

@bits is absolutely correct, if your provider uses CGNAT (it saves them IP addresses apparently) you can’t get through it without one of a few options. I list two of them below, ones I am familiar with through personal experience.

You can pay for a static IP address or you can do what I did (still do), set up and use Tailscale.

If you already know about tailscale ignore what follows, if not then for this you can either:

• Set up and configure any device attached to your network and always on, as a subnet router. This device will ‘advertise’ itself outside CGNAT and you can then connect to your LAN, including your router e.g. you can use a Raspberry Pi (my first foray into Tailscale) or if it’s always on, an AppleTV HD or 4K (a very simple option, see pics attached) or literally any other device you can install tailscale on (and there are multiple OS platforms and literally hundreds of Device types to choose from).
• If you’re on RMerlin FW, set up Tailscale on the Router. A very easy way to do this is to install TAILMON, an amazing Addon from @Viktor Jaep, this is what I now use, as the router is always on and I don’t need a separate device, although I do keep my Apple TV as a backup subnet router, which I can just enable if I need to, although I never have.

Thank you for this. I did spend some time looking at tailscale. I am hoping to get OpenVPN working since my needs are so small and it is built into the Router / Merlin software. If I can't get it working, tailscale will probably be my next move.

 

[Martinski]

...
Please allow me some time to again set up OpenVPN, generate a client configuration and generate logs to upload here.

The client OpenVPN application that I am using is on the iPhone downloaded from the Apple store. (OpenVPN version 3.5.1 (6211))

I assume you're referring to the "OpenVPN Connect" (I have that app on my phone, version 3.5.1_6211). When setting up the OpenVPN server on the router (and before importing the client profiles into this app), you must consider which "Security Level" you want the VPN to have when using the phone app.

On the "OpenVPN Connect" client app on your phone, go to "Settings --> Advanced Settings" (toward the bottom of the screen), and select which setting you want for the "Security Level" option:

1) Preferred (Recommended)
This option is the most restrictive because it requires the server to be configured with a minimum 2048-bit RSA encryption key, SSL certificates must be signed with a minimum SHA256 signature, compression must be disabled, only newer, non-deprecated ciphers are allowed, etc.

2) Legacy
This one has more relaxed requirements and will work with almost all TUN configurations, but it's less secure.

3) Insecure (Not Recommended)
[self-explanatory]

Depending on the above setting and how the OpenVPN server on the router is configured, you may have connection issues on the client side that the log will show as errors.

HTH

 

[BadWolfe]

Ok, I have a clean install on the router and iPhone. Here are two log files of my current attempt.
(logs deleted since no longer needed)

 

[BadWolfe]

I assume you're referring to the "OpenVPN Connect" (I have that app on my phone, version 3.5.1_6211). When setting up the OpenVPN server on the router (and before importing the client profiles into this app), you must consider which "Security Level" you want the VPN to have when using the phone app.

On the "OpenVPN Connect" client app on your phone, go to "Settings --> Advanced Settings" (toward the bottom of the screen), and select which setting you want for the "Security Level" option:
View attachment 64601
View attachment 64603

1) Preferred (Recommended)
This option is the most restrictive because it requires the server to be configured with a minimum 2048-bit RSA encryption key, SSL certificates must be signed with a minimum SHA256 signature, compression must be disabled, only newer, non-deprecated ciphers are allowed, etc.

2) Legacy
This one has more relaxed requirements and will work with almost all TUN configurations, but it's less secure.

3) Insecure (Not Recommended)
[self-explanatory]

Depending on the above setting and how the OpenVPN server on the router is configured, you may have connection issues on the client side that the log will show as errors.

HTH

Thank you for this information. I deleted the client installed configuration on my iPhone, then went through the settings you recommended. I tried each of the three options repeating a clean install of the client. So far none have worked (even the insecure mode).

I am sure it is something so fundamentally simple in my configuration on the Router. Hopefully the Server and Client side logs I uploaded can shed light into the issue.

 

[ColinTaylor]

Your VPN client file contains and invalid remote line.

From what you've indicated before you're trying to put something in there which contains an @ character. That is invalid. It should be your router's public IP address (e.g. 123.44.55.66) or a valid DDNS name (e.g. myhostname.org).

The example you gave earlier, 172.172.172.172@xxxxxxx.org is not valid.