Need help learning how to protect home NAS and Security camera setup

[g725s]

Hello, I'm seeking advise on making sure a new NAS I will be installing and my soon to be home security camera and home network are secure.

I would like to be able to save items off my phone and laptop to my NAS remotely. Also I plan to setup a Blue Iris PC and security cameras, and want to view or control that remotely as well.

I bought an Asus RT-AC68U probably near 6 years ago and flashed it with Merlin(that I've not updated since). But it has been a rock solid device. I works great and I would think might have the security options I might need to protect myself. Maybe there are faster router these days, but initially I think I should still with this ASUS for starters. The Asuswrt-Merlin firmware on this router is 376.49_4

I'm not super savvy with all this Network stuff so seeking advice on what direction I might go.

 

[L&LD]

The router you have is from 2013, so 6 years ago and the firmware is from 2014 around the end of December, so 5 years ago.

The network behind that router isn't very secure right now, you should upgrade to 384.14 final released today. You may need to do at least on intermediary flash between your firmware and the latest available (as the internals were resized many versions ago).

Your use case requires a highspeed ISP connection for both up and down. What is your ISP currently providing?

The original RT-AC68U you have will not be good with fast OpenVPN connections and your intended use. The RT-AC86U is currently the best OpenVPN hardware RMerlin supports at the lowest cost. The RT-AX88U with 4 cores and OpenVPN hardware acceleration may be better suited for your use case, if you need simultaneous off-site connections to your NAS on a regular basis.

Note on post edit: it is the RT-AX88U with 4 cores, not the RT-AC86U as I originally wrote. Apologies!

 

[g725s]

The router you have is from 2013, so 6 years ago and the firmware is from 2014 around the end of December, so 5 years ago.

The network behind that router isn't very secure right now, you should upgrade to 384.14 final released today. You may need to do at least on intermediary flash between your firmware and the latest available (as the internals were resized many versions ago).

Your use case requires a highspeed ISP connection for both up and down. What is your ISP currently providing?

The original RT-AC68U you have will not be good with fast OpenVPN connections and your intended use. The RT-AC86U is currently the best OpenVPN hardware RMerlin supports at the lowest cost. The RT-AC86U with 4 cores and OpenVPN hardware acceleration may be better suited for your use case, if you need simultaneous off-site connections to your NAS on a regular basis.

Thank you. I will look into a RT-AC86U.
So is there anyway to find out exactly what version of the firmware I should use as an intermediary flash version?

My internet speed are 50-90 down and 10-12 up

And I get your saying that I would be best to flash a new RT-AC86U to RMerlin? Is that the best for an RT-AC86U? Stock ASUS firmware not good enough?

 

[ColinTaylor]

So is there anyway to find out exactly what version of the firmware I should use as an intermediary flash version?

https://github.com/RMerl/asuswrt-merlin/wiki/Installation

• Starting with Asus's 3.0.0.4.380_3000, a new firmware format is used. To flash Asuswrt-Merlin on one of these newer firmwares, you will need 380.61 or newer. Likewise, downgrading to an older version is not supported. (Try firmware recovery mode if you really need to downgrade.)
• The RT-AC68U and RT-AC56U need to be at least on firmware 378.55 (or the last 378.xxx version from Asus) before you can flash 380.xx, due to the partition size change.

So first flash 378.55 and reboot. Then flash 380.70 and reboot. Finally flash the current version, 384.14.

Perform a factory reset followed by manually configuring the router.

 

[g725s]

https://github.com/RMerl/asuswrt-merlin/wiki/Installation

So first flash 378.55 and reboot. Then flash 380.70 and reboot. Finally flash the current version, 384.14.

Perform a factory reset followed by manually configuring the router.

Thank you ColinTaylor

 

[g725s]

https://github.com/RMerl/asuswrt-merlin/wiki/Installation

So first flash 378.55 and reboot. Then flash 380.70 and reboot. Finally flash the current version, 384.14.

Perform a factory reset followed by manually configuring the router.

before I go off and mess things up. After a factory reset I will have to redo a user/pw and the Wifi again?

The computers I use are not wired to the router. I have cable modem to router and my PC is in the other room via the WiFi of course. Can I do the final factory reset if not wired directly to the router?

After the factory reset how do I get back into the router to reconfigure. I assume that my username and pw will change? And I will have to redo all my settings.

 

[ColinTaylor]

Will my password stay the same through this process? After a factory reset I will have to redo a user/pw and the Wifi again?

Your password and other settings will be lost after a factory reset. There is too big a change to the firmware from what you have now to the current one to try a preserve the settings. That is why you need to do the factory reset. After the reset, the first time you try to log into the router it will enter the Quick Setup procedure. So you really need a wired connection to the router.

 

[g725s]

Your password and other settings will be lost after a factory reset. There is too big a change to the firmware from what you have now to the current one to try a preserve the settings. That is why you need to do the factory reset. After the reset, the first time you try to log into the router it will enter the Quick Setup procedure.

Ok I can hook up my laptop
i have been able to do all the flashes(currently showing 384.14) but now I'm at the point of a factory reset.
i am still using the PC via WiFi in the other room. But a little hesitant to do the factory reset till I understand how to get back into the router and reconfigure it.
what is the default password/username after a factory reset? I will hook my laptop directly and what is the address/username/pw i put into the browser? do I still use http://router.asus.com/ and and what is the initial username/pw?
Also I probably won't be able to do this last step till maybe monday. I need to head off to a family event right now.

 

[ColinTaylor]

what is the default password/username after a factory reset?

There isn't a default username and password any more. AFAIK you must use a cable to do the setup.

 

[g725s]

There isn't a default username and password any more. AFAIK you must use a cable to do the setup.

what just hook up my laptop and go to http://router.asus.com/ in a browser and I'll be into the router?

 

[ColinTaylor]

what just hook up my laptop and go to http://router.asus.com/ in a browser and I'll be into the router?

Yes. When you connect your laptop you should be able to get to the router with http://router.asus.com or http://192.168.1.1 If memory serves it should immediately put you on the setup screen where the first thing it makes you do is set a username and password. (If for some reason it does need you to log in it would be admin/admin).

EDIT: Apparently my memory was wrong . According to the manual you do need to log in with admin/admin.

 

[g725s]

Yes. When you connect your laptop you should be able to get to the router with http://router.asus.com or http://192.168.1.1 If memory serves it should immediately put you on the setup screen where the first thing it makes you do is set a username and password. (If for some reason it does need you to log in it would be admin/admin).

Thank you for your help ColinTaylor. I will have to do this another time. I need to get going. I will check back and let you know how it went, probably this Monday. Thanks again!

 

[dosborne]

i have been able to do all the flashes(currently showing

As you were able to get this far without any issues, you are well on your way to success with the reset.
It wouldn't hurt to go into the router setup and print off (or otherwise record) some of the basic settings to use as reference for when you reconfigure. Your isp configuration, your SSID, your DHCP settings, etc

On the other hand, since you've done the FW upgrades and obviously at least the basics are still functioning, you *could* continue without the reset, although it would be a good idea.

Updating your FW is of course only the first step towards your end goal. Keep in mind that allowing any remote access opens the "security" door ever so slightly. As elluded to above, the best approach is likely to setup VPN access into your home network so you can do your desired tasks (NAS and camera access). Be sure to do any research into any apps that your NAS or cameras may have as they could try and open ports into your network.

I would definitely stick with your current router until you find that it isn't powerful enough. If your load isn't that high you may find the router is fast enough, just keep an eye on cpu utilization under load.

 

[L&LD]

Also, at least in the latest versions (sorry, I can't remember now how long ago this began) after a full reset to factory defaults in the GUI, you will see two new SSID's called Asus (something or other) which are an open network (no password needed). Connect to one of these SSID's and start your browser of choice and you will see the Quick Setup screen with prompts to which you follow along. No cable needed.

 

[g725s]

Thanks to all for your help. Did the factory reset by holding the reset button on back of router for 5 seconds. It took at least 3 minutes for the router to do its thing. “router.asus.com” brought up the first screen where I put in admin/admin. Next screen had me make new login name and p/w. Then 3rd screen setup the 2&5GHz network names and p/w’s.

That was it so far.

 

[g725s]

The router you have is from 2013, so 6 years ago and the firmware is from 2014 around the end of December, so 5 years ago.

The network behind that router isn't very secure right now, you should upgrade to 384.14 final released today. You may need to do at least on intermediary flash between your firmware and the latest available (as the internals were resized many versions ago).

Your use case requires a highspeed ISP connection for both up and down. What is your ISP currently providing?

The original RT-AC68U you have will not be good with fast OpenVPN connections and your intended use. The RT-AC86U is currently the best OpenVPN hardware RMerlin supports at the lowest cost. The RT-AX88U with 4 cores and OpenVPN hardware acceleration may be better suited for your use case, if you need simultaneous off-site connections to your NAS on a regular basis.

Note on post edit: it is the RT-AX88U with 4 cores, not the RT-AC86U as I originally wrote. Apologies!

What kind of internet speeds are you talking about. I think my current speed is about 100 down and 15 up. I'm cheap and am grandfathered into this speed. If I go up in speed so does my bill :-(
What am I looking at in difference between the 68 and the 88?

Also I'm kind of kin to ASUS, only because this 68 has been rock solid. Are the more recent ASUS models retaining the same reputation?

I also want to change the location of my router out to the garage, and I'm wondering if setting up a second with AiMesh would help the speeds at the back of the house(single story 1500sqft)

 

[ColinTaylor]

What kind of internet speeds are you talking about. I think my current speed is about 100 down and 15 up. I'm cheap and am grandfathered into this speed. If I go up in speed so does my bill :-(
What am I looking at in difference between the 68 and the 88?

The RT-AC68U will run out of steam for OpenVPN at about 30Mbps. I'd guess with the RT-AC86U it would be about 250Mbps.

So at the moment the bottleneck for using OpenVPN for all your remote access is your upload speed of 15Mbps. We don't know whether that is sufficient for your needs, bearing in mind the concurrent "normal" use of the internet in your household.

Whether you need to use your router's built-in VPN server at all will depend on the specifics of the NAS and security system you get. For example, some NAS's have their own VPN servers (which may be better or worse than the router's). Some security systems store or proxy their video in "the cloud".

 

[g725s]

The RT-AC68U will run out of steam for OpenVPN at about 30Mbps. I'd guess with the RT-AC86U it would be about 250Mbps.

So at the moment the bottleneck for using OpenVPN for all your remote access is your upload speed of 15Mbps. We don't know whether that is sufficient for your needs, bearing in mind the concurrent "normal" use of the internet in your household.

Whether you need to use your router's built-in VPN server at all will depend on the specifics of the NAS and security system you get. For example, some NAS's have their own VPN servers (which may be better or worse than the router's). Some security systems store or proxy their video in "the cloud".

I am replacing my old HP Microserver that was running WHS 2011, with a QNAP TS-453Be. I am not familiar with QNAP at all yet.

I Noticed over on Slickdeals that RT-AX88U the goes for around $250 when on sale. The QNAP ships out to me in a day or two.

Also, I’m confused as to what model router everyone is suggesting here the rtax88u or the rtac86u? Is the 30 limit both up and down for my current router with openvpn?

Also, again thanks for helping me get my old ac68u revamped, I feel a lot more secure with AiProtect going.

 

[g725s]

The RT-AC68U will run out of steam for OpenVPN at about 30Mbps. I'd guess with the RT-AC86U it would be about 250Mbps.

So at the moment the bottleneck for using OpenVPN for all your remote access is your upload speed of 15Mbps. We don't know whether that is sufficient for your needs, bearing in mind the concurrent "normal" use of the internet in your household.

Whether you need to use your router's built-in VPN server at all will depend on the specifics of the NAS and security system you get. For example, some NAS's have their own VPN servers (which may be better or worse than the router's). Some security systems store or proxy their video in "the cloud".

Also regarding WPS. I would like to use it to setup my printer. But I see in AiProtection that it suggests you turn it off. Can you turn it on temporarily to setup a device and then disable it for security?

 

[dosborne]

Can you turn it on temporarily to setup a device and then disable it for security?

Yes