asuswrt-merlin.ng VS core

Any way to tell if these issues affect the community-developed, third-party "Merlin" firmwares?

1: https://www.asuswrt-merlin.net

I think you need VPN director from Asuswrt Merlin https://github.com/RMerl/asuswrt-merlin.ng/wiki/VPN-Director

Not an answer, but I have the AC5300 and like it. And if you're not aware, there's open source firmware for a lot of the Asus routers here. I use it and once again seems fine. Disclaimer, I'm not a power user, so probably can't answer anything more specific about VPN setup on the router itself, but from my understanding it is possible.

However, I am struggling with how to route the site-to-site client's WAN traffic through its own OVPN client connection. If I set up a rule routing all client subnet traffic through the OVPN connection, then the Wireguard rule never gets processed, because all OVPN rules are processed before any Wireguard rules.

Many (all?) of the ASUS routers supported by the Merlin firmware https://www.asuswrt-merlin.net/ have OpenVPN built-in. If you have an ISP-provide modem/router, you may be able to put it in transparent bridge mode.

However, it looks like only the older model is on sale. Go for the Asus and do research if you want Merlin or not.

Here's the official website. It has a list of supported routers: https://www.asuswrt-merlin.net/

If you are somewhat good with computers, get an Asus router with a broadcom chipset that can run Merlin WRT. They are rock solid and feature packed (you can even adjust the wireless power level, since you're having wifi issues). There's a list of supported routers here: https://github.com/RMerl/asuswrt-merlin.ng/wiki/Supported-Devices

OPNsense is an open source, feature rich firewall and routing platform used by home users, small businesses, and enterprises around the world. OPNsense features “GeoIP” support, which allows you to block or allow traffic from specific countries using a geolocation database.

>I'm currently upgrading my home network, trying various options, and one of the headaches is provenance of the equipment.

If you're concerned about provenance (or even if you're not), I suggest using a general purpose device and rolling your own ala pfSense[0]/OPNSense[1], etc, or just use one of the BSDs or Linux and use native tools or one of the many router/firewall distros[2]

[0] https://www.pfsense.org/

[1] https://opnsense.org/

[2] https://en.wikipedia.org/wiki/List_of_router_and_firewall_di...

Meanwhile, I've never tried building OPN but it looks well documented and can be added to a vanilla FreeBSD install. https://github.com/opnsense/core

dnsmasq can be used for wildcard domain aliases in OPNsense firewall, https://github.com/opnsense/core/issues/4145#issuecomment-12...

Firmware's like Asuswrt-Merlin or OpenWRT can support dynamic-dns, or you can do like I do and run something like OPNsense in an x86 VM with a NIC passed through, or buy an inexpensive firewall appliance (up to 500mbps/1gbps/10gbps).

The easiest solution is to buy your own router, set it up, disable the router functionality on the Fritzbox 7590 and plug your router into it. It'll be cheaper and easier than a Cisco Firewall, but if you want to go the dedicated firewall route then I would recommenced OPNsense

Much searching lead me to a possible patch Unbound.inc for how it was handling aliases for 23.7 -> https://github.com/opnsense/core/pull/5925