Changing DNS on ASUS Merlin Firmware - Complete Guide

Recommended DNS Providers

Basic DNS Configuration

Step 1: Access Router Interface

1. Open web browser and navigate to:
   • http://192.168.1.1 (default)
   • http://router.asus.com (alternative)
   • Or your custom router IP
2. Login with admin credentials

Step 2: Navigate to WAN Settings

1. Click Advanced Settings (left menu)
2. Select WAN
3. Choose Internet Connection tab

Step 3: Configure DNS Servers

Under WAN DNS Setting section:

1. Set Connect to DNS Server automatically to No
2. Enter your preferred DNS servers:
   • DNS Server 1: Primary DNS (e.g., 1.1.1.1)
   • DNS Server 2: Secondary DNS (e.g., 1.0.0.1)
3. Click Apply to save changes

Advanced DNS Features in Merlin

DNS over TLS (DoT)

Encrypt DNS queries for privacy:

1. Navigate to WAN > Internet Connection
2. Find DNS over TLS (DoT) section
3. Enable DNS over TLS
4. Select preset or configure custom:
   • Preset: Cloudflare, Quad9, etc.
   • Custom: Enter DoT server address

Popular DoT Servers

DNSSEC Validation

Enable DNSSEC for authenticity verification:

1. Go to Administration > System
2. Find DNSSEC support
3. Enable Enable DNSSEC support
4. Apply settings

Conditional DNS Forwarding

Route specific domains through different DNS servers:

1. SSH into router:

   ssh [email protected]

2. Create custom config:

   nano /jffs/configs/dnsmasq.conf.add

3. Add forwarding rules:

   # Forward work domains to corporate DNS
   server=/company.local/10.0.0.1
   server=/internal.corp/10.0.0.1
   
   # Forward streaming to fastest DNS
   server=/netflix.com/1.1.1.1
   server=/youtube.com/1.1.1.1

4. Restart dnsmasq:

   service restart_dnsmasq

DNS-Based Ad Blocking

Method 1: DNS Filtering Service

1. Use ad-blocking DNS providers:
   • AdGuard DNS: 94.140.14.14
   • Alternate DNS: 76.76.2.11
   • CleanBrowsing: 185.228.168.9

Method 2: Diversion Script

1. Install Diversion via amtm:

   amtm
   i (Install)
   Select Diversion

2. Configure blocking lists
3. Enable pixelserv-tls for HTTPS ads

IPv6 DNS Configuration

For IPv6 networks:

1. Navigate to IPv6 settings
2. Set Auto Configuration Setting to Stateless
3. Configure IPv6 DNS:
   • DNS Server 1: 2606:4700:4700::1111 (Cloudflare)
   • DNS Server 2: 2606:4700:4700::1001

DNS with VPN Enabled

Configure VPN DNS

1. Go to VPN > VPN Client
2. In client settings:
   • Accept DNS Configuration: Exclusive
   • Redirect Internet traffic: Yes
3. This ensures all DNS goes through VPN

DNS Leak Prevention

# Add to OpenVPN client config
dhcp-option DNS 10.8.0.1
block-outside-dns

DNS Performance Testing

Test Current DNS

# From router SSH
nslookup google.com
dig google.com @1.1.1.1

# Response time test
time nslookup google.com

Benchmark Multiple Servers

#!/bin/sh
# DNS benchmark script
for dns in 1.1.1.1 8.8.8.8 9.9.9.9; do
    echo "Testing $dns..."
    time dig @$dns google.com +noall +answer
done

Troubleshooting DNS Issues

DNS Not Changing

• Clear DNS cache:

  service restart_dnsmasq

• Reboot router: Some changes require full restart
• Check WAN status: Ensure internet connection is up

Slow DNS Resolution

• Try servers geographically closer
• Disable DNSSEC if causing delays
• Check router CPU usage during queries

DNS Leaks with VPN

• Verify "Accept DNS Configuration" is set to Exclusive
• Add custom DNS to VPN config
• Test at dnsleaktest.com

Advanced DNS Scripts

Auto-Switch DNS Based on VPN Status

#!/bin/sh
# /jffs/scripts/vpn-dns-switch.sh

if [ "$1" = "up" ]; then
    # VPN is up, use TorGuard DNS
    nvram set wan_dns1_x="10.8.0.1"
    nvram set wan_dns2_x="10.8.0.2"
else
    # VPN is down, use public DNS
    nvram set wan_dns1_x="1.1.1.1"
    nvram set wan_dns2_x="1.0.0.1"
fi
nvram commit
service restart_dnsmasq

DNS Query Logging

# Enable query logging
echo "log-queries" >> /jffs/configs/dnsmasq.conf.add
echo "log-facility=/opt/var/log/dnsmasq.log" >> /jffs/configs/dnsmasq.conf.add
service restart_dnsmasq

Security Best Practices

1. Use DNS over TLS: Encrypts queries from router to DNS server
2. Enable DNSSEC: Validates DNS responses
3. Avoid ISP DNS: They log and sometimes redirect queries
4. Test regularly: DNS servers can change policies
5. Multiple servers: Always configure primary and secondary

DNS Provider Comparison