Claude Skill

asus-router-ops

ASUS router config and hardening: Asuswrt-Merlin, security hardening, encrypted DNS (DoT/DoH), VPN (WireGuard/OpenVPN), guest networks, VLAN/IoT isolation, AiMesh, AiProtection. Triggers on: asus router, asuswrt, merlin, wireguard router, AiProtection, AiMesh, nvram, jffs, IoT is

LLM Mart · 0 points · 0 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download 0xdarkmatter-claude-mods-skills_asus-router-ops-3dfaf0b.zip · 7 KB

0xdarkmatter/claude-mods 43 7 forks MIT Updated 11h ago

Part of 0xdarkmatter/claude-mods — 94 skills

Install

skills CLI npx skills add https://github.com/0xDarkMatter/claude-mods/tree/main/skills/asus-router-ops

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install 0xdarkmatter-claude-mods@llmmart

Git git clone https://github.com/0xDarkMatter/claude-mods.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole 0xdarkmatter/claude-mods collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

ASUS Router Operations

Facts verified as of 2026-07.

Authoritative guidance for configuring and hardening ASUS routers — stock Asuswrt and Asuswrt-Merlin firmware — via the web UI and SSH/nvram. Covers security hardening, encrypted DNS, VPN, network segmentation, AiMesh, AiProtection, and JFFS scripting.

Safety first. Changes here can lock you out or drop the network. Test during low-usage windows, document the before value, and know how to undo. Cite official docs, not folklore.

Stock Asuswrt vs Asuswrt-Merlin

	Stock Asuswrt	Asuswrt-Merlin
Base	ASUS official	Community fork of ASUS source (same core, more control)
Scripting	Limited	JFFS custom scripts, cron, `services-start`, `firewall-start`, nat-start
DNS control	Basic	DNS Director (per-client/global DNS redirection, DoT)
VPN	OpenVPN/WireGuard server+client	+ VPN Director (policy/split-tunnel routing)
Best for	Most users	Power users wanting scripts, fine-grained DNS/VPN routing

Never mix stock and Merlin nodes in the same AiMesh network. Keep the firmware family consistent across mesh nodes.

Security hardening checklist

Do these on every new router, in order:

Change defaults immediately — both the admin/login password and the WiFi password.
Disable WPS — it's a brute-force surface.
Disable UPnP unless an app genuinely needs it (it creates unpredictable port forwards).
Use explicit port forwarding, never DMZ — DMZ exposes the entire device.
Disable remote WAN admin access — use a VPN to manage remotely instead.
Enable AiProtection (two-way IPS + malicious-site blocking) where available.
Set up a guest network with intranet access disabled (proper isolation).
Enable firewall logging for security monitoring; forward to syslog if you have a collector.
Apply ingress filtering (BCP38/84 anti-spoofing) where supported.
Keep firmware current — security fixes land in point releases.

See references/hardening-and-network.md for the full hardening rationale, VLAN/IoT segmentation, AiMesh backhaul tuning, QoS, and dual-WAN.

DNS privacy stack

Layer	What	Notes
Transport	DoT (DNS over TLS) or DoH (DNS over HTTPS)	Stops plaintext port-53 hijacking. Merlin DNS Director can enforce DoT
Provider	Cloudflare (1.1.1.1), NextDNS, ControlD, AdGuard	Choose for filtering/analytics needs
Validation	DNSSEC	Validates record authenticity
Per-client policy	DNS Director (Merlin)	Different DNS per device/profile; split-horizon
Rebinding protection	On by default	Can break local services (Plex, smart home) — whitelist specific domains rather than disabling wholesale

Avoid plain DNS (port 53) — unencrypted and hijackable. Move to DoT/DoH.

VPN decision table

Need	Use
Fast modern tunnel, low overhead	WireGuard server/client (preferred where supported)
Maximum compatibility / legacy clients	OpenVPN server/client
Route only some clients/traffic through VPN	VPN Director (Merlin) — policy-based split tunnel
Remote admin of the router	VPN in, then manage on LAN (never expose WAN admin)

Common clients: NordVPN, Surfshark, Mullvad via OpenVPN/WireGuard config import.

Network segmentation

Goal	Approach
Visitor isolation	Guest network with "Access Intranet" off
IoT containment	Dedicated guest/VLAN SSID; block lateral movement to main LAN
Consistent guest across mesh	Enable guest on AiMesh deliberately; mind "Access Intranet" per node
Smart-home discovery	mDNS/Bonjour may need controlled cross-VLAN allowances — scope narrowly
Segmented routing	VLAN segmentation + routing policies (capability varies by model)

Patterns to avoid

Anti-pattern	Why	Instead
DMZ mode	Exposes the whole device to the internet	Explicit per-port forwarding
UPnP globally on	Unpredictable auto port forwards	Enable only when required, understand the risk
Plain DNS (port 53)	Plaintext, hijackable	DoT/DoH
Mixing stock + Merlin in AiMesh	Inconsistent behavior	Keep firmware family uniform
Disabling DNS rebind protection wholesale	Reopens rebinding attacks	Whitelist the specific local domains that break
Wireless mesh backhaul on congested channels	Throughput collapse	Wired backhaul or dedicated DFS 5GHz channel
Default admin/WiFi credentials	Trivial compromise	Change both immediately
Remote WAN admin enabled	Major attack surface	Manage via VPN

Operating principles

Reversibility — record the current value before changing; know the undo path.
Testability — change during low-usage windows; verify before walking away.
Trade-offs — note privacy-vs-functionality costs (rebind protection vs local services).
Verification — confirm via system log, client-side test (e.g. DNS leak test), or nvram get.
Cite official docs — avoid unverified tweaks.

SSH / JFFS scripting (Merlin)

Merlin runs user scripts from JFFS at lifecycle points. Enable JFFS custom scripts and configs (Administration → System) first.

Script	Runs at	Use for
`services-start`	After services start	Start custom daemons
`firewall-start`	After firewall (re)builds	Add custom iptables rules (survives firewall restarts)
`nat-start`	After NAT rules load	Custom NAT/port rules
`dnsmasq.postconf`	Before dnsmasq starts	Inject dnsmasq config

Inspect/set persistent config with nvram get <key> / nvram set <key>=<val> + nvram commit (commit sparingly — it writes flash).

The assets/firewall-start.sh template shows the canonical safe shape for custom firewall rules. See references/hardening-and-network.md for placement and gotchas.

Assets

File	Use
`assets/firewall-start.sh`	Annotated Merlin `/jffs/scripts/firewall-start` template — idempotent custom iptables rules with safe-by-default examples

#!/bin/sh
# Asuswrt-Merlin custom firewall rules — copy to /jffs/scripts/firewall-start
#
# This is an ASSET TEMPLATE for a router, not an agent-run script. It runs on the
# router every time Merlin (re)builds the firewall, so rules added here survive
# firewall restarts. Adapt the ADAPT: lines, then on the router:
#   chmod +x /jffs/scripts/firewall-start
# (Requires JFFS custom scripts enabled: Administration > System.)
#
# RULES MUST BE IDEMPOTENT: delete-then-insert so re-runs don't stack duplicates.
# Test with the router console open — a bad rule can drop your management session.

LOG_PREFIX="custom-fw"

# Helper: insert a rule only after removing any existing identical one.
# Usage: reinsert <table?> <chain> <rule...>
reinsert_filter() {
  chain="$1"; shift
  iptables -D "$chain" "$@" 2>/dev/null
  iptables -I "$chain" "$@"
}

# --- Example 1: drop + log inbound from a known-bad subnet (ADAPT or remove) ---
# reinsert_filter INPUT -s 203.0.113.0/24 -j DROP

# --- Example 2: isolate an IoT subnet from the main LAN (ADAPT subnets) ---
# Assumes IoT on 192.168.50.0/24, main LAN on 192.168.1.0/24.
# Block IoT -> LAN, but allow established replies LAN -> IoT.
# reinsert_filter FORWARD -i br0 -s 192.168.50.0/24 -d 192.168.1.0/24 \
#   -m state --state NEW -j DROP

# --- Example 3: allow a specific LAN host to reach an IoT device (exception) ---
# reinsert_filter FORWARD -s 192.168.1.10 -d 192.168.50.20 -j ACCEPT

# --- Example 4: rate-limit + log SSH brute force on the LAN admin port (ADAPT) ---
# reinsert_filter INPUT -p tcp --dport 22 -m state --state NEW \
#   -m recent --set --name SSHPROBE
# reinsert_filter INPUT -p tcp --dport 22 -m state --state NEW \
#   -m recent --update --seconds 60 --hitcount 5 --name SSHPROBE \
#   -j LOG --log-prefix "${LOG_PREFIX}-ssh-bruteforce: "
# reinsert_filter INPUT -p tcp --dport 22 -m state --state NEW \
#   -m recent --update --seconds 60 --hitcount 5 --name SSHPROBE -j DROP

# All examples are commented out by default — uncomment and ADAPT the ones you need.
exit 0

references

hardening-and-network.md 4.7 KB

# Hardening, Segmentation, AiMesh & QoS — deep dive

Load for the rationale behind the hardening checklist, network segmentation design, AiMesh
backhaul tuning, dual-WAN, and JFFS script placement gotchas.

## Hardening rationale (why each step)

| Step | Threat it closes |
|------|------------------|
| Change admin + WiFi password | Default-credential takeover (botnets scan for these) |
| Disable WPS | PIN brute force / Pixie Dust |
| Disable UPnP | Malware silently opening inbound ports |
| Explicit port forward, no DMZ | DMZ forwards *all* ports to one host — total exposure |
| No remote WAN admin | Internet-facing admin panel = credential-stuffing target |
| AiProtection two-way IPS | Inbound exploit + outbound C2 / data exfil detection |
| Guest isolation | Stops a compromised visitor device reaching the LAN |
| Firewall logging | Detection + forensics |
| BCP38/84 ingress filtering | Source-address spoofing / reflection-attack participation |

### DNS rebinding protection trade-off

Rebinding protection blocks responses that resolve to private/local IPs — defeating an
attacker who tricks the browser into talking to your LAN. But it also breaks legitimate
local services that resolve to RFC1918 addresses (Plex, Home Assistant, NAS web UIs).
**Whitelist the specific domains** that need to resolve locally rather than turning the
protection off entirely.

## Network segmentation design

| Tier | Placement | Cross-talk |
|------|-----------|------------|
| Main LAN | Trusted devices (laptops, phones) | Full intranet |
| IoT | Cameras, smart plugs, TVs | **No** access to main LAN; internet only |
| Guest | Visitors | No intranet; bandwidth-capped |
| Lab/DMZ-ish | Experimental hosts | Quarantined |

Implementation varies by model — higher-end ASUS routers expose VLAN/multiple isolated
SSIDs; others rely on guest-network isolation. The principle: an IoT device's compromise
must not reach your laptop.

**mDNS/Bonjour caveat:** smart-home discovery (Chromecast, AirPlay, HomeKit) uses mDNS,
which doesn't cross subnets/VLANs by default. If you segment IoT away from clients, you may
need a controlled mDNS reflector/repeater — scope it to the minimum needed, don't blanket-allow.

## AiMesh deployment

| Concern | Guidance |
|---------|----------|
| **Backhaul** | Wired backhaul is best. If wireless, use a dedicated/DFS 5GHz channel, not a congested one |
| **Node placement** | Within solid signal of the parent — too far hurts more than no node |
| **Channel/width** | Avoid congested channels; wider channels = more throughput but more interference |
| **Firmware** | Same family on all nodes (don't mix stock + Merlin) |
| **AiProtection/QoS across mesh** | Settings apply mesh-wide; verify they propagate to nodes |
| **Guest on mesh** | Enable deliberately; "Access Intranet" behavior must be consistent per node |

## QoS & traffic management

| Mode | Use for |
|------|---------|
| **Adaptive QoS** | General prioritization (gaming/streaming/WFH) with app categories |
| **Bandwidth limiter** | Hard per-device caps (guest, kids' devices) |
| **Game acceleration** | Latency-sensitive traffic prioritization |

QoS and AiProtection share the Trend Micro engine on many models — enabling one may affect
throughput on lower-end hardware.

## Dual-WAN

| Mode | Behavior |
|------|----------|
| Failover | Secondary WAN takes over when primary drops |
| Load balance | Distributes sessions across both WANs (ratio configurable) |

Define a failback policy and test by physically unplugging the primary during a low-usage window.

## JFFS script placement gotchas (Merlin)

- Enable **JFFS custom scripts and configs** before scripts will run.
- Scripts live in `/jffs/scripts/` and must be `chmod +x` with a `#!/bin/sh` shebang.
- **`firewall-start`** is the right place for custom iptables rules — it re-runs every time
  the firewall rebuilds (which happens on many config changes), so rules added here survive.
  Adding iptables rules elsewhere risks them being flushed.
- Make rules **idempotent** — check/delete before insert (`iptables -D ... 2>/dev/null;
  iptables -I ...`) so re-runs don't stack duplicates.
- `nvram commit` writes flash — commit only when persistence is needed, not in loops.
- Test rules with the router console open; a bad rule can drop your management session.

## Verification toolkit

| Check | How |
|-------|-----|
| DNS encryption working | DNS leak test site; confirm resolver = your DoT/DoH provider |
| Firewall rule active | `iptables -L -n -v` (Merlin SSH) |
| nvram value | `nvram get <key>` |
| Guest isolation | From guest SSID, attempt to reach a LAN host — should fail |
| Failover | Unplug primary WAN, watch system log for switch |
| VPN tunnel up | Check assigned IP / provider's "are you connected" page |

scripts
- .gitkeep 0 B · in bundle

SKILL.md 7.6 KB

---
name: asus-router-ops
description: "ASUS router config and hardening: Asuswrt-Merlin, security hardening, encrypted DNS (DoT/DoH), VPN (WireGuard/OpenVPN), guest networks, VLAN/IoT isolation, AiMesh, AiProtection. Triggers on: asus router, asuswrt, merlin, wireguard router, AiProtection, AiMesh, nvram, jffs, IoT isolation."
license: MIT
allowed-tools: "Read Write Bash"
metadata:
  author: claude-mods
  related-skills: net-ops
---

# ASUS Router Operations

> Facts verified as of 2026-07.

Authoritative guidance for configuring and hardening ASUS routers — stock **Asuswrt** and **Asuswrt-Merlin** firmware — via the web UI and SSH/nvram. Covers security hardening, encrypted DNS, VPN, network segmentation, AiMesh, AiProtection, and JFFS scripting.

> **Safety first.** Changes here can lock you out or drop the network. Test during low-usage windows, document the before value, and know how to undo. Cite official docs, not folklore.

---

## Stock Asuswrt vs Asuswrt-Merlin

| | Stock Asuswrt | Asuswrt-Merlin |
|---|---|---|
| Base | ASUS official | Community fork of ASUS source (same core, more control) |
| Scripting | Limited | **JFFS custom scripts**, cron, `services-start`, `firewall-start`, nat-start |
| DNS control | Basic | **DNS Director** (per-client/global DNS redirection, DoT) |
| VPN | OpenVPN/WireGuard server+client | + **VPN Director** (policy/split-tunnel routing) |
| Best for | Most users | Power users wanting scripts, fine-grained DNS/VPN routing |

**Never mix stock and Merlin nodes in the same AiMesh network.** Keep the firmware family consistent across mesh nodes.

---

## Security hardening checklist

Do these on every new router, in order:

1. **Change defaults immediately** — both the admin/login password *and* the WiFi password.
2. **Disable WPS** — it's a brute-force surface.
3. **Disable UPnP** unless an app genuinely needs it (it creates unpredictable port forwards).
4. **Use explicit port forwarding, never DMZ** — DMZ exposes the entire device.
5. **Disable remote WAN admin access** — use a VPN to manage remotely instead.
6. **Enable AiProtection** (two-way IPS + malicious-site blocking) where available.
7. **Set up a guest network** with intranet access disabled (proper isolation).
8. **Enable firewall logging** for security monitoring; forward to syslog if you have a collector.
9. **Apply ingress filtering** (BCP38/84 anti-spoofing) where supported.
10. **Keep firmware current** — security fixes land in point releases.

See `references/hardening-and-network.md` for the full hardening rationale, VLAN/IoT
segmentation, AiMesh backhaul tuning, QoS, and dual-WAN.

---

## DNS privacy stack

| Layer | What | Notes |
|-------|------|-------|
| **Transport** | DoT (DNS over TLS) or DoH (DNS over HTTPS) | Stops plaintext port-53 hijacking. Merlin DNS Director can enforce DoT |
| **Provider** | Cloudflare (1.1.1.1), NextDNS, ControlD, AdGuard | Choose for filtering/analytics needs |
| **Validation** | DNSSEC | Validates record authenticity |
| **Per-client policy** | DNS Director (Merlin) | Different DNS per device/profile; split-horizon |
| **Rebinding protection** | On by default | **Can break local services** (Plex, smart home) — whitelist specific domains rather than disabling wholesale |

**Avoid plain DNS (port 53)** — unencrypted and hijackable. Move to DoT/DoH.

---

## VPN decision table

| Need | Use |
|------|-----|
| Fast modern tunnel, low overhead | **WireGuard** server/client (preferred where supported) |
| Maximum compatibility / legacy clients | **OpenVPN** server/client |
| Route only *some* clients/traffic through VPN | **VPN Director** (Merlin) — policy-based split tunnel |
| Remote admin of the router | VPN in, then manage on LAN (never expose WAN admin) |

Common clients: NordVPN, Surfshark, Mullvad via OpenVPN/WireGuard config import.

---

## Network segmentation

| Goal | Approach |
|------|----------|
| Visitor isolation | Guest network with "Access Intranet" **off** |
| IoT containment | Dedicated guest/VLAN SSID; block lateral movement to main LAN |
| Consistent guest across mesh | Enable guest on AiMesh deliberately; mind "Access Intranet" per node |
| Smart-home discovery | mDNS/Bonjour may need controlled cross-VLAN allowances — scope narrowly |
| Segmented routing | VLAN segmentation + routing policies (capability varies by model) |

---

## Patterns to avoid

| Anti-pattern | Why | Instead |
|--------------|-----|---------|
| DMZ mode | Exposes the whole device to the internet | Explicit per-port forwarding |
| UPnP globally on | Unpredictable auto port forwards | Enable only when required, understand the risk |
| Plain DNS (port 53) | Plaintext, hijackable | DoT/DoH |
| Mixing stock + Merlin in AiMesh | Inconsistent behavior | Keep firmware family uniform |
| Disabling DNS rebind protection wholesale | Reopens rebinding attacks | Whitelist the specific local domains that break |
| Wireless mesh backhaul on congested channels | Throughput collapse | Wired backhaul or dedicated DFS 5GHz channel |
| Default admin/WiFi credentials | Trivial compromise | Change both immediately |
| Remote WAN admin enabled | Major attack surface | Manage via VPN |

---

## Operating principles

1. **Reversibility** — record the current value before changing; know the undo path.
2. **Testability** — change during low-usage windows; verify before walking away.
3. **Trade-offs** — note privacy-vs-functionality costs (rebind protection vs local services).
4. **Verification** — confirm via system log, client-side test (e.g. DNS leak test), or `nvram get`.
5. **Cite official docs** — avoid unverified tweaks.

---

## SSH / JFFS scripting (Merlin)

Merlin runs user scripts from JFFS at lifecycle points. Enable **JFFS custom scripts and
configs** (Administration → System) first.

| Script | Runs at | Use for |
|--------|---------|---------|
| `services-start` | After services start | Start custom daemons |
| `firewall-start` | After firewall (re)builds | Add custom iptables rules (survives firewall restarts) |
| `nat-start` | After NAT rules load | Custom NAT/port rules |
| `dnsmasq.postconf` | Before dnsmasq starts | Inject dnsmasq config |

Inspect/set persistent config with `nvram get <key>` / `nvram set <key>=<val>` + `nvram commit`
(commit sparingly — it writes flash).

The `assets/firewall-start.sh` template shows the canonical safe shape for custom firewall
rules. See `references/hardening-and-network.md` for placement and gotchas.

---

## Assets

| File | Use |
|------|-----|
| `assets/firewall-start.sh` | Annotated Merlin `/jffs/scripts/firewall-start` template — idempotent custom iptables rules with safe-by-default examples |

---

## See also

- `net-ops` — general networking: subnets, DNS, TLS, firewalls, packet inspection

### Key external resources

- [Asuswrt-Merlin project](https://www.asuswrt-merlin.net/) · [docs](https://www.asuswrt-merlin.net/docs) · [wiki](https://github.com/RMerl/asuswrt-merlin.ng/wiki)
- [Merlin features (DNS Director, VPN Director)](https://www.asuswrt-merlin.net/features)
- [ASUS router security hardening FAQ](https://www.asus.com/support/faq/1039292/)
- [ASUS firewall intro](https://www.asus.com/us/support/faq/1013630/) · [Network Services Filter](https://www.asus.com/support/faq/1013636/) · [IPv6 firewall](https://www.asus.com/support/faq/1013638/)
- [AiProtection overview](https://www.asus.com/au/content/aiprotection/) · [setup](https://www.asus.com/support/faq/1008719/)
- [Cloudflare DoH](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/) · [ControlD ASUS setup](https://docs.controld.com/docs/asus-router-setup)
- [SNBForums community](https://www.snbforums.com/)