2019 Performance & Security Guide Updated, with Added & Removed Sections such as Ai-Mesh, newer scripts, and updated security posture(Will be completed mid-late August 2019) I'm still working on it guy's =]
*Compiling from source using VM and Ubuntu 18.04/18.10 and Debian
VM memory 4GB at min
2 processors, 30gb of space
#################################
Script Courtesy of Fitz Mutch
### Install fresh Ubuntu 18.04 LTS (Bionic Beaver)
ubuntu-18.04.2-desktop-amd64.iso
### Apply OS updates and make bash the default shell (reboot required)
sudo apt-get update && sudo apt-get -y dist-upgrade && sudo rm -f /bin/sh && sudo ln -sf bash /bin/sh && sudo reboot
### Install Linux kernel headers and essential development tools
sudo apt-get update && sudo apt-get -y install git build-essential linux-headers-$(uname -r)
### Install dependencies for AsusWRT
sudo dpkg --add-architecture i386 && sudo apt-get update && sudo apt-get -y install libtool-bin cmake libproxy-dev uuid-dev liblzo2-dev autoconf automake bash bison bzip2 diffutils file flex m4 g++ gawk groff-base libncurses5-dev libtool libslang2 make patch perl pkg-config shtool subversion tar texinfo zlib1g zlib1g-dev git gettext libexpat1-dev libssl-dev cvs gperf unzip python libxml-parser-perl gcc-multilib gconf-editor libxml2-dev g++-multilib gitk libncurses5 mtd-utils libncurses5-dev libvorbis-dev git autopoint autogen sed build-essential intltool libelf1 libglib2.0-dev xutils-dev lib32z1-dev lib32stdc++6 xsltproc gtk-doc-tools libelf-dev:i386 libelf1:i386 libltdl-dev
### Install other programs
sudo apt-get -y install lzip patchelf
### Clone the toolchains
cd
if [ ! -d am-toolchains ]; then
git clone
https://github.com/RMerl/am-toolchains
fi
### Fix the toolchain symlinks
sudo mkdir -p /opt ; sudo rm -rf /opt/toolchains ; sudo ln -s ~/am-toolchains/brcm-arm-hnd /opt/toolchains ; sudo rm -f /opt/brcm-arm ; sudo ln -s ~/am-toolchains/brcm-arm-sdk/hndtools-arm-linux-2.6.36-uclibc-4.5.3 /opt/brcm-arm ; sudo rm -f /opt/brcm ; sudo ln -s ~/am-toolchains/brcm-mips-sdk/tools/brcm /opt/brcm
### Clone the repo
cd
if [ ! -d asuswrt-merlin.ng ]; then
git clone
https://github.com/RMerl/asuswrt-merlin.ng
cd asuswrt-merlin.ng
# git checkout master
git checkout mainline
else
cd asuswrt-merlin.ng
# git checkout master
git checkout mainline
git pull
fi
### Create a build tree from the repo and fix the symlinks
cd
rm -rf asuswrt-merlin.ng-build
#rsync -aq asuswrt-merlin.ng/ asuswrt-merlin.ng-build --exclude .git
cp -a asuswrt-merlin.ng/ asuswrt-merlin.ng-build
# fix symlinks for HND toolchain
rm -rf ~/asuswrt-merlin.ng-build/release/src-rt-5.02hnd/bcmdrivers/broadcom/net/wl/impl51/main/src/toolchains
ln -s ~/am-toolchains/brcm-arm-hnd ~/asuswrt-merlin.ng-build/release/src-rt-5.02hnd/bcmdrivers/broadcom/net/wl/impl51/main/src/toolchains
# fix symlinks for ARM toolchain
rm -rf ~/asuswrt-merlin.ng-build/release/src-rt-6.x.4708/toolchains
ln -s ~/am-toolchains/brcm-arm-sdk ~/asuswrt-merlin.ng-build/release/src-rt-6.x.4708/toolchains
### Build RT-AC86U firmware (HND)
export LD_LIBRARY_PATH=/opt/toolchains/crosstools-arm-gcc-5.3-linux-4.1-glibc-2.22-binutils-2.25/usr/lib
export TOOLCHAIN_BASE=/opt/toolchains
echo $PATH | grep -qF /opt/toolchains/crosstools-arm-gcc-5.3-linux-4.1-glibc-2.22-binutils-2.25/usr/bin || export PATH=$PATH:/opt/toolchains/crosstools-arm-gcc-5.3-linux-4.1-glibc-2.22-binutils-2.25/usr/bin
echo $PATH | grep -qF /opt/toolchains/crosstools-aarch64-gcc-5.3-linux-4.1-glibc-2.22-binutils-2.25/usr/bin || export PATH=$PATH:/opt/toolchains/crosstools-aarch64-gcc-5.3-linux-4.1-glibc-2.22-binutils-2.25/usr/bin
cd ~/asuswrt-merlin.ng-build/release/src-rt-5.02hnd
make rt-ac86u
### Build RT-AC56U firmware (ARM)
export LD_LIBRARY_PATH=
export TOOLCHAIN_BASE=
echo $PATH | grep -qF /opt/brcm-arm/bin || export PATH=$PATH:/opt/brcm-arm/bin
echo $PATH | grep -qF /opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin || export PATH=$PATH:/opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin
cd ~/asuswrt-merlin.ng-build/release/src-rt-6.x.4708
make rt-ac56u
### Build RT-AC68U firmware (ARM)
export LD_LIBRARY_PATH=
export TOOLCHAIN_BASE=
echo $PATH | grep -qF /opt/brcm-arm/bin || export PATH=$PATH:/opt/brcm-arm/bin
echo $PATH | grep -qF /opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin || export PATH=$PATH:/opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin
cd ~/asuswrt-merlin.ng-build/release/src-rt-6.x.4708
make rt-ac68u
### Build RT-AC87U firmware (ARM)
export LD_LIBRARY_PATH=
export TOOLCHAIN_BASE=
echo $PATH | grep -qF /opt/brcm-arm/bin || export PATH=$PATH:/opt/brcm-arm/bin
echo $PATH | grep -qF /opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin || export PATH=$PATH:/opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin
cd ~/asuswrt-merlin.ng-build/release/src-rt-6.x.4708
make rt-ac87u
### Build RT-AC88U firmware (ARM)
export LD_LIBRARY_PATH=
export TOOLCHAIN_BASE=
echo $PATH | grep -qF /opt/brcm-arm/bin || export PATH=$PATH:/opt/brcm-arm/bin
echo $PATH | grep -qF /opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin || export PATH=$PATH:/opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin
cd ~/asuswrt-merlin.ng-build/release/src-rt-7.14.114.x/src
make rt-ac88u
### Build RT-AC3100 firmware (ARM)
export LD_LIBRARY_PATH=
export TOOLCHAIN_BASE=
echo $PATH | grep -qF /opt/brcm-arm/bin || export PATH=$PATH:/opt/brcm-arm/bin
echo $PATH | grep -qF /opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin || export PATH=$PATH:/opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin
cd ~/asuswrt-merlin.ng-build/release/src-rt-7.14.114.x/src
make rt-ac3100
### Build RT-AC5300 firmware (ARM)
export LD_LIBRARY_PATH=
export TOOLCHAIN_BASE=
echo $PATH | grep -qF /opt/brcm-arm/bin || export PATH=$PATH:/opt/brcm-arm/bin
echo $PATH | grep -qF /opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin || export PATH=$PATH:/opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin
cd ~/asuswrt-merlin.ng-build/release/src-rt-7.14.114.x/src
make rt-ac5300
### Build RT-AC3200 firmware (ARM)
export LD_LIBRARY_PATH=
export TOOLCHAIN_BASE=
echo $PATH | grep -qF /opt/brcm-arm/bin || export PATH=$PATH:/opt/brcm-arm/bin
echo $PATH | grep -qF /opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin || export PATH=$PATH:/opt/brcm-arm/arm-brcm-linux-uclibcgnueabi/bin
cd ~/asuswrt-merlin.ng-build/release/src-rt-7.x.main/src
make rt-ac3200
###################
Scripts- scripts have evolved in the community, going from a handful to a set of scripts most people regularly use
AMTM - Should be the first script you download. It houses all the main script's and make installing the rest easier. It also comes with a reboot scheduler, disk check, swap file creation, and version numbers for other scripts.
Skynet - a very good reputational firewall, which is a nice addition to AiProtect IPS, and blocks IP's
Diversion - The spiritual successor to AB-Solutions, it blocks HTTP ad domains via host files. This also installs Entware and Pixelserv
Pixelserv-TLS this will enable a web server to block all HTTPS ad, which supplements Diversion nicely
Stubby-Installer - This is your DNS over TLS script, which will encrypt your DNS queries and SNI, *stubby installer script isn't need on firmware version 384.11 and beyond. native script is better
DNScrypt - this will also encrypt your DNS queries via DNScrypt or DOH(DNS over HTTPS)
YazFi - enhanced guest WiFi, which act as sort of a quasi VLAN. You can segment guest network's, with different subnet's, and can allow or disallow communicating locally. Or, simply just allow internet connectivity without touching the LAN
ntpMerlin - run a NTP server daemon, which will work a bit better than your default implementation. *May conflict with other scripts such as Stubby
Entware - is your repo which will allow you to enhance and customize your router to your own personal needs
scMerlin
connmon
spdMerlin
scribe
uidivstats
#################
OPENVPN 2.4.7 Server/Client set-up configuration (unfinished)
#########
TCP TX/RX Tuning (unfinished)
########
Security Patches (unfinished)
########
SSL Cert Placement (unfinished)
#######
SMB tweaking, for speed enhancement (unfinished)
#######
Script to check vpn and extend entware services (unfinished)
#####
Redirect all internet traffic vs strict policy mode (unfinished)
######
------------------------------------------------------------------------------------------
Sources
https://www.snbforums.com/threads/extend-service-to-entware-services.54979/
https://www.snbforums.com/threads/redirect-internet-traffic-all-vs-192-168-1-0-24.55770/
https://www.snbforums.com/threads/scripted-vpn-client-configuration.55203/
https://www.snbforums.com/threads/ac86u-smb-tweaking.44729/
https://www.snbforums.com/threads/release-asuswrt-merlin-384-10-is-now-available.55742/
https://www.snbforums.com/threads/merlinwrt-compile-instructions.47984/page-4
https://www.snbforums.com/threads/how-to-improve-shell-script-code-quality-and-readability.55794/
https://x3mtek.com/how-to-improve-shell-script-code-quality-and-readability/
https://atom.io/packages/linter-shellcheck
https://ftp.snbforums.com/threads/failed-to-compile-firmware-for-rt-ac68u.54760/