0xDarkMatter/asus-router-ops
skills/asus-router-ops/SKILL.md
ASUS router config and hardening: Asuswrt-Merlin, security hardening, encrypted DNS (DoT/DoH), VPN (WireGuard/OpenVPN), guest networks, VLAN/IoT isolation, AiMesh, AiProtection. Triggers on: asus router, asuswrt, merlin, wireguard router, AiProtection, AiMesh, nvram, jffs, IoT isolation.
$ install --global
skillsauthnpx skillsauth add 0xDarkMatter/claude-mods asus-router-opsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 9, 2026, 2:36 AM200.8s3 files scanned
SKILL.md
- name:
- asus-router-ops
- description:
- ASUS router config and hardening: Asuswrt-Merlin, security hardening, encrypted DNS (DoT/DoH), VPN (WireGuard/OpenVPN), guest networks, VLAN/IoT isolation, AiMesh, AiProtection. Triggers on: asus router, asuswrt, merlin, wireguard router, AiProtection, AiMesh, nvram, jffs, IoT isolation.
- license:
- MIT
- allowed-tools:
- Read Write Bash
- author:
- claude-mods
- related-skills:
- net-ops
ASUS Router Operations
Facts verified as of 2026-07.
Authoritative guidance for configuring and hardening ASUS routers — stock Asuswrt and Asuswrt-Merlin firmware — via the web UI and SSH/nvram. Covers security hardening, encrypted DNS, VPN, network segmentation, AiMesh, AiProtection, and JFFS scripting.
Safety first. Changes here can lock you out or drop the network. Test during low-usage windows, document the before value, and know how to undo. Cite official docs, not folklore.
Stock Asuswrt vs Asuswrt-Merlin
| | Stock Asuswrt | Asuswrt-Merlin |
|---|---|---|
| Base | ASUS official | Community fork of ASUS source (same core, more control) |
| Scripting | Limited | JFFS custom scripts, cron, services-start, firewall-start, nat-start |
| DNS control | Basic | DNS Director (per-client/global DNS redirection, DoT) |
| VPN | OpenVPN/WireGuard server+client | + VPN Director (policy/split-tunnel routing) |
| Best for | Most users | Power users wanting scripts, fine-grained DNS/VPN routing |
Never mix stock and Merlin nodes in the same AiMesh network. Keep the firmware family consistent across mesh nodes.
Security hardening checklist
Do these on every new router, in order:
- Change defaults immediately — both the admin/login password and the WiFi password.
- Disable WPS — it's a brute-force surface.
- Disable UPnP unless an app genuinely needs it (it creates unpredictable port forwards).
- Use explicit port forwarding, never DMZ — DMZ exposes the entire device.
- Disable remote WAN admin access — use a VPN to manage remotely instead.
- Enable AiProtection (two-way IPS + malicious-site blocking) where available.
- Set up a guest network with intranet access disabled (proper isolation).
- Enable firewall logging for security monitoring; forward to syslog if you have a collector.
- Apply ingress filtering (BCP38/84 anti-spoofing) where supported.
- Keep firmware current — security fixes land in point releases.
See references/hardening-and-network.md for the full hardening rationale, VLAN/IoT
segmentation, AiMesh backhaul tuning, QoS, and dual-WAN.
DNS privacy stack
| Layer | What | Notes | |-------|------|-------| | Transport | DoT (DNS over TLS) or DoH (DNS over HTTPS) | Stops plaintext port-53 hijacking. Merlin DNS Director can enforce DoT | | Provider | Cloudflare (1.1.1.1), NextDNS, ControlD, AdGuard | Choose for filtering/analytics needs | | Validation | DNSSEC | Validates record authenticity | | Per-client policy | DNS Director (Merlin) | Different DNS per device/profile; split-horizon | | Rebinding protection | On by default | Can break local services (Plex, smart home) — whitelist specific domains rather than disabling wholesale |
Avoid plain DNS (port 53) — unencrypted and hijackable. Move to DoT/DoH.
VPN decision table
| Need | Use | |------|-----| | Fast modern tunnel, low overhead | WireGuard server/client (preferred where supported) | | Maximum compatibility / legacy clients | OpenVPN server/client | | Route only some clients/traffic through VPN | VPN Director (Merlin) — policy-based split tunnel | | Remote admin of the router | VPN in, then manage on LAN (never expose WAN admin) |
Common clients: NordVPN, Surfshark, Mullvad via OpenVPN/WireGuard config import.
Network segmentation
| Goal | Approach | |------|----------| | Visitor isolation | Guest network with "Access Intranet" off | | IoT containment | Dedicated guest/VLAN SSID; block lateral movement to main LAN | | Consistent guest across mesh | Enable guest on AiMesh deliberately; mind "Access Intranet" per node | | Smart-home discovery | mDNS/Bonjour may need controlled cross-VLAN allowances — scope narrowly | | Segmented routing | VLAN segmentation + routing policies (capability varies by model) |
Patterns to avoid
| Anti-pattern | Why | Instead | |--------------|-----|---------| | DMZ mode | Exposes the whole device to the internet | Explicit per-port forwarding | | UPnP globally on | Unpredictable auto port forwards | Enable only when required, understand the risk | | Plain DNS (port 53) | Plaintext, hijackable | DoT/DoH | | Mixing stock + Merlin in AiMesh | Inconsistent behavior | Keep firmware family uniform | | Disabling DNS rebind protection wholesale | Reopens rebinding attacks | Whitelist the specific local domains that break | | Wireless mesh backhaul on congested channels | Throughput collapse | Wired backhaul or dedicated DFS 5GHz channel | | Default admin/WiFi credentials | Trivial compromise | Change both immediately | | Remote WAN admin enabled | Major attack surface | Manage via VPN |
Operating principles
- Reversibility — record the current value before changing; know the undo path.
- Testability — change during low-usage windows; verify before walking away.
- Trade-offs — note privacy-vs-functionality costs (rebind protection vs local services).
- Verification — confirm via system log, client-side test (e.g. DNS leak test), or
nvram get. - Cite official docs — avoid unverified tweaks.
SSH / JFFS scripting (Merlin)
Merlin runs user scripts from JFFS at lifecycle points. Enable JFFS custom scripts and configs (Administration → System) first.
| Script | Runs at | Use for |
|--------|---------|---------|
| services-start | After services start | Start custom daemons |
| firewall-start | After firewall (re)builds | Add custom iptables rules (survives firewall restarts) |
| nat-start | After NAT rules load | Custom NAT/port rules |
| dnsmasq.postconf | Before dnsmasq starts | Inject dnsmasq config |
Inspect/set persistent config with nvram get <key> / nvram set <key>=<val> + nvram commit
(commit sparingly — it writes flash).
The assets/firewall-start.sh template shows the canonical safe shape for custom firewall
rules. See references/hardening-and-network.md for placement and gotchas.
Assets
| File | Use |
|------|-----|
| assets/firewall-start.sh | Annotated Merlin /jffs/scripts/firewall-start template — idempotent custom iptables rules with safe-by-default examples |
See also
net-ops— general networking: subnets, DNS, TLS, firewalls, packet inspection
Key external resources
- Asuswrt-Merlin project · docs · wiki
- Merlin features (DNS Director, VPN Director)
- ASUS router security hardening FAQ
- ASUS firewall intro · Network Services Filter · IPv6 firewall
- AiProtection overview · setup
- Cloudflare DoH · ControlD ASUS setup
- SNBForums community
Related Skills
0xDarkMatter/repo-doctor
testing
VerifiedTrustedCommunity
Audit any repo against the agentic-quality doctrine — score entry docs, structure, and enforcement gates, then map each finding to its fix. Triggers on: repo doctor, repo audit, agentic quality, is this repo agent-friendly, doc drift, stale AGENTS.md, monorepo structure, nested CLAUDE.md.
25SKILL.mdUpdated Jul 9, 2026
0xDarkMatter/parallel-ops
data-ai
VerifiedTrustedCommunity
Router for parallel or recurring agent work across six skills. Covers: parallel agents, fan out work, delegate to workers, run overnight, scheduled loop, land branches, mixed-model fleet, orchestrate workers, background agents at scale. Triggers on: which skill for parallel work, fan out agents, spawn workers, run this overnight, schedule a loop, land my branches, heterogeneous fleet, delegate to cheaper model, autonomous loop.
25SKILL.mdUpdated Jul 9, 2026
0xDarkMatter/fleetflow
tools
VerifiedTrustedCommunity
Heterogeneous cross-provider fleet - GLM (z.ai), Codex (OpenAI), Grok (xAI), Anthropic Sonnet/Opus/Haiku - from one session, porting the native Workflow tool's patterns (adversarial verify, judge panels, journal resume) to OS-process workers. Triggers: fleetflow, heterogeneous/mixed-model fleet, codex worker, grok worker, cross-provider fan-out, cross-model verify.
25SKILL.mdUpdated Jul 9, 2026
0xDarkMatter/threejs-ops
development
VerifiedTrustedCommunity
Application/game-scale three.js: ES modules, GLTF pipeline (DRACO/KTX2/meshopt), AnimationMixer, physics (rapier/cannon-es), react-three-fiber, and performance at scale (InstancedMesh, LOD, draw calls). Triggers on: three.js, GLTFLoader, r3f, game loop, WebGL memory leak, boids.
25SKILL.mdUpdated Jul 4, 2026