Asus (Merlin firmware)

What Is Asus (Merlin firmware)?

You buy a capable ASUS router, then run into the usual VPN-router headaches: the stock firmware is “good enough” until you want policy-based routing, stable VPN client behavior, better logging, or the ability to run serious add-ons without turning the router into a science project. Merlin exists for people who want a VPN-capable router that still behaves like an ASUS router—same general UI and feature set—but with targeted fixes, extra knobs, and a cleaner path to advanced workflows.

Merlin’s defining trait is restraint. The project’s stated goal is to stay close to ASUS’ own firmware and focus on bug fixes, a handful of features, and practical tweaks—rather than a complete reimagining like DD-WRT or Tomato. That “first do no harm” approach is why it’s popular with users who want more reliability and control without taking a big performance or usability gamble. (smallnetbuilder.com)

For VPN use specifically, Merlin matters because it supports router-level VPN for both OpenVPN and WireGuard (per your verified specs). OpenVPN support (client and server) has been a long-running Merlin feature set, and WireGuard is integrated into the newer codebase with routing tied into Merlin’s policy system (VPN Director). (smallnetbuilder.com)

Asus (Merlin firmware) Features and Performance

Merlin’s VPN capability is about two things: (1) running VPN tunnels on the router (client and/or server) and (2) controlling which devices use which tunnel. Historically, Merlin added OpenVPN client and server functionality on supported routers, giving you a more modern VPN option compared with older PPTP-style setups. (smallnetbuilder.com) Your database protocols list (OpenVPN, WireGuard) matches what shows up in Merlin’s ecosystem and documentation references.

Policy-based routing (VPN Director) is a core differentiator

Merlin leans heavily on a built-in policy-routing concept commonly referred to as “VPN Director.” You can route selected clients/subnets through a chosen VPN tunnel instead of forcing everything through one VPN (or nothing). The Merlin changelog explicitly notes that WireGuard client routing is handled by VPN Director, and the source code includes VPN Director hooks for WireGuard routing rules. In practice, this is what makes Merlin workable for mixed households: you can keep gaming/streaming boxes on the normal WAN while pushing laptops or IoT segments through a VPN.

There’s also a separate “DNS Director” concept documented in Merlin’s wiki mirror, which is the other half of the privacy story: routing traffic through a VPN is one problem; avoiding DNS leaks or enforcing per-client DNS behavior is another. DNS Director is designed to apply DNS redirection rules per client, including bypass rules for specific devices. (Exactly which DNS modes you can use depends on the router model/firmware branch, so treat this as a capability framework, not a guarantee for every device.)

WireGuard and OpenVPN: real-world speed characteristics

On consumer routers, VPN throughput is typically CPU-limited—especially for OpenVPN. Even in user reports, the pattern is consistent: OpenVPN can peg router CPU depending on model/cipher/hardware acceleration, while WireGuard is usually lighter and faster on the same hardware. A long-running SmallNetBuilder review also frames Merlin’s ethos as adding VPN features without “putting performance at risk,” but that doesn’t mean VPN encryption is free. (smallnetbuilder.com)

For WireGuard specifically, Merlin is generally using ASUS’ underlying kernel-level WireGuard implementation on supported platforms; in community discussion around Merlin-derived builds, performance is described as roughly similar to stock ASUS firmware because the VPN stack itself is coming from ASUS’ codebase. Translation: Merlin can improve stability, visibility, and routing control, but it won’t magically turn a mid-range router into a gigabit-class VPN appliance.

Also note the trade-off that has bitten some users: certain routers/firmware versions have historically disabled hardware acceleration when enabling WireGuard, which can cut WAN throughput dramatically. A user report describes this behavior on an AX56U and claims later firmware restored acceleration. Treat that as “this has happened” rather than “this will happen,” but it’s a real class of issue you should watch for when VPN features interact with acceleration paths.

Add-ons, scripts, and the “Merlin ecosystem”

Merlin isn’t just the firmware image. A major reason people choose it is the add-on ecosystem and script hooks. The Merlin wiki includes “User scripts” hooks that run on VPN start/stop events (including WireGuard client/server), which is exactly what advanced users need for custom firewall rules, dynamic routing, or monitoring.

On top of that, Merlin supports Entware and a community tool called AMTM (Asuswrt-Merlin Terminal Menu) to install/manage popular add-ons. The AMTM wiki mirror describes it as a shell-based front end for managing popular scripts on Merlin routers, and the SNBForums add-on catalog highlights Entware/AMTM as a foundation for extensions. If your VPN router needs extras like ad blocking, enhanced DNS tooling, or additional services, this matters—but it also increases your maintenance burden.

Supported routers (this is not universal)

Merlin only runs on specific ASUS router models. The project maintains a supported devices list (for both the legacy branch and newer-generation branch), and it’s explicit that development for the legacy branch has been abandoned. (github.com) Before you treat “Merlin” as a router platform choice, verify your exact model is supported. “Close” models often aren’t close enough.

Pricing and Plans

Merlin firmware itself is distributed as downloadable firmware images (commonly mirrored via SourceForge), and the project points users to its GitHub repositories for source code. In other words, you’re not buying a subscription to Merlin.

So why does your database say pricing model: paid? Because the real cost is the router hardware (and potentially the VPN service you’ll use with it). Merlin is an enablement layer: it makes ASUS routers more capable as VPN routers, but it does not include a bundled VPN service.

What you can say confidently about “plans” is limited:

• No Merlin subscription tiers were found in the sources reviewed; Merlin is obtained by flashing supported ASUS hardware with the firmware builds hosted through its distribution channels.
• Your ongoing costs will typically be: (1) the ASUS router itself, and (2) whatever VPN provider you configure for OpenVPN/WireGuard (provider pricing/refunds depend on that provider, not Merlin).

If VPNSpotter requires a “paid/free” classification for this entry, the most honest interpretation is: Merlin is not “paid software,” but it is realistically a paid solution because it requires compatible ASUS hardware to run.

Privacy and Security Assessment

Merlin is firmware, not a VPN provider. That distinction matters for privacy claims. Merlin doesn’t give you “no-logs” guarantees because it’s not a service sitting between you and the internet as a third party. It’s your router OS. What it can do is:

• Reduce trust in third parties by letting you run your own VPN server (remote access back home) or by letting you route your network through a VPN provider you choose.
• Increase control and observability through logging, scripting hooks, and policy routing.

Open-source posture (partial, codebase realities)

Merlin publishes source code on GitHub for both the legacy and next-generation codebases, and the download page copy on SourceForge explicitly points to those repositories. That supports a meaningful transparency story: the project isn’t a closed binary blob with unknown changes.

However, Merlin is built on top of ASUS’ GPL releases and inherits the usual embedded-router reality: not every component involved in Wi-Fi and hardware acceleration is necessarily fully open in a way you can audit end-to-end. SmallNetBuilder’s review underscores that Merlin stays close to ASUS’ own firmware base rather than replacing everything. (smallnetbuilder.com) Practically, that’s good for stability and driver behavior, but it limits how far “open source auditability” can go versus a fully open router platform.

VPN routing and leak risk: depends on your configuration

Merlin’s policy-based routing is powerful, but power increases the ways you can misconfigure things. Merlin’s own documentation surface area around “DNS Director” and VPN Director implies the project is aware of DNS/routing pitfalls and provides mechanisms to manage them. But Merlin can’t guarantee you won’t leak—especially if you mix tunnels, allow bypass rules, or run complicated add-ons.

Also, be aware of subtle access-control details. For example, an SNBForums thread discussing WireGuard server behavior references Merlin’s WireGuard implementation file and points out that a UI “access intranet” switch may not restrict what some users expect. That’s not a scandal; it’s the normal gap between “toggle label” and actual firewall behavior, and it’s exactly the kind of detail you should validate in your own setup.

Jurisdiction, audits, and incident history

Jurisdiction questions apply more to VPN providers than to router firmware. Merlin doesn’t operate servers that handle your traffic by default, so there’s no “company logging your browsing” in the usual sense.

On audits: nothing in the sources reviewed indicates Merlin has undergone a formal third-party “no logs” audit (again, that concept doesn’t map cleanly to firmware), nor a full-scope security audit claim that can be stated as fact. Because those claims are easy to overstate, it’s better to keep it simple: Merlin has public source code and a long-standing community/user base, but you should not treat it as “audited” unless you verify a specific audit report.

Strengths and Limitations

Strengths

• Policy-based routing is first-class: VPN Director is baked into how Merlin handles VPN client routing, including WireGuard routing integration.
• Keeps the ASUS experience: Merlin’s stated direction is to stay close to OEM firmware while fixing bugs and adding selected features—less relearning, less random breakage. (smallnetbuilder.com)
• Add-on ecosystem via Entware/AMTM: For power users, AMTM + Entware is a practical way to extend the router, and it’s a widely referenced workflow in the Merlin community.
• Script hooks for VPN events: VPN start/stop script hooks (including WireGuard) make it possible to implement real “killswitch-ish” behaviors or custom routing checks—if you know what you’re doing.

Limitations

• Hardware support is limited: Merlin only supports specific ASUS models, with clear branch differences and an abandoned legacy branch. (github.com)
• VPN speed is router-dependent: OpenVPN can be CPU-bound; WireGuard is usually faster, but neither is guaranteed to hit line rate on consumer hardware.
• Advanced features raise complexity: Once you’re doing per-device routing and add-ons, you own the troubleshooting.
• Some behaviors are non-obvious: WireGuard server access controls and routing toggles may not behave how the UI label implies; you must test.

Who Should Use Asus (Merlin firmware)?

Good fit

1. You want per-device VPN routing on a home router: You need some devices on the VPN and others off it, and you don’t want to maintain a separate firewall appliance. Merlin’s VPN Director approach is built for this.
2. You want router-level WireGuard/OpenVPN without abandoning the ASUS UI: Merlin’s whole point is staying close to ASUS firmware while adding capabilities and fixes. (smallnetbuilder.com)
3. You’re comfortable with light ops work: SSH access, scripts, Entware, add-ons—Merlin supports this ecosystem, but you need the mindset to maintain it.

Not a good fit

1. You want a “set it and forget it” VPN appliance: Merlin can be stable, but the more you customize (routing rules, add-ons), the more you become the admin.
2. Your router isn’t explicitly supported: Merlin support is model-specific. If your model isn’t on the list, don’t assume it’ll work. (github.com)
3. You need guaranteed high VPN throughput: If you’re chasing near-gigabit encrypted routing, you may be better served by a dedicated x86 firewall/router platform; consumer routers vary widely under VPN load.