The Problem#

For a long time, my home network setup was “good enough”, but good enough doesn’t cut it when you want minimal latency, proper security, and zero ISP bloat. I run an ASUS RT-AX88U flashed with Asuswrt-Merlin, sitting behind a Jio-Fiber router (SRCMTF1_JCO4032_R2.59) acting as a gateway. It was a double-NAT architecture with the Jio router using the 192.168.0.0/64 IP range & the ASUS router using a 10.0.0.1/64 IP range.The Jio-Fiber router was being a real bottleneck for performance in front of my high performance ASUS router. You can’t get rid of the router either as it performs the authentication process with Jio’s servers. So, if we just connect the SC fiber terminal to a simple media converter and then connected ethernet from it to our main router, there will be now internet access.

Now the best solution to a situation like this is to put the Jio router into Bridge mode. That effectively makes it a dumb GPON modem and lets my ASUS router act as the main gateway. But thanks to Jio, it is impossible to put the Jio router into bridge mode even if you get root access to the router firmware using a method like this one.

So, the only workaround was to disable as much network related processing off of the Jio router as possible to reduce the double-NAT overhead as much as possible. This was also a perfect oppotunity to enable proper IPv6 support for my whole network as having public unique IPv6 addresses for each of my devices on my personal network will give significant boost to the overall performance due to the nature of IPv6 routing.

Alternative solution#

The much better alternative is to buy a unlocked third-party GPON/XPON terminals like this one & configure it to act as a dumb GPON modem. But that is a purchase I am not looking to make yet. I might delve into this route later but for now the simple workaround yelded much better results than the previous setup.

The Procedure#

This procedure starts with selectively disabling hardware & software functionalities & features on the Jio-Fiber router to make the path from my ASUS router to the Jio infrastructure as clear as possible.

Step 1: Dual-Stack Bypass#

First step to clear the Dual-Stack overhead was to get the NAT processing of the Jio router out of the equation.

  • I assigned the ASUS router a fixed IPv4 IP in the Jio router’s DHCP Reserved IP section. Then I Added the ASUS WAN IP to the Jio router’s IPv4 DMZ. This forwards all unhandled incoming IPv4 ports directly to the RT-AX88U, effectively eliminating Double NAT.

  • For IPv6, there was no need to add it to the DMZ. Because IPv6 will be set to Stateless / Passthrough, by which every device gets a globally unique public IPv6 address. With the ISP gateway firewall set to allow traffic through, the ASUS router’s active IPv6 firewall acts as the single inspection point. A secondary IPv6 DMZ is completely unnecessary.

Step 2: Disable Wireless#

This is another important step to ensure the Jio router is as absent as possible from the whole network. I disabled all Wireless access points on the Jio router. This was an extrmely tedious process as there are two seperate points in the Wireless Access Point section. First you need to disable the two access points and then you need to edit all the Profiles for the access points. Edit the profiles, Enable Hide SSID. Change password for all the profiles to different strong passwords.

Now that access points are out of equation that makes the Jio router consume a lot less power, lot less CPU load & makes the whole network a lot more secure by removing un-necessary & potentially much less secure access points.

Step 3: Disable Pass throughs, Filterings & Protections#

The Jio router with its measely Sercomm CPU, has a hard time filtering packets, headers & check for DDoS attacks and stuff. This causes higher than normal latency as the CPU struggles to process and transfer packets fast enough. As the much more robust firewall of my ASUS router with its Quad-Core CPU will handle all the Packet filtering and Protections itself, I disabled every form of filtering, passthroughs or protection settings I found on the Jio router’s WebUI.

Step 4: Configure IPv6#

Enabling full IPv6 support for the whole network was another target. This enables a lot of services too bypass any kind of NAT overhead by giving every device on the network its own unique public IP.

Because the JioFiber router cannot act as a true Layer 2 bridge for IPv4, it also fails to support DHCPv6 Prefix Delegation (DHCP-PD) downstream. This means if I set my ASUS router to “Native” IPv6 mode, it will fail to obtain a prefix block from the Jio box.

To bypass all IPv6 processing, firewall inspection, and routing overhead on the Jio router, you must configure your ASUS AX88U (Asuswrt-Merlin) in IPv6 Passthrough Mode. This turns the ASUS router into a transparent Layer 2 bridge exclusively for IPv6 traffic, allowing client devices to communicate directly with Jio’s upstream gateway to fetch individual, globally unique public IPv6 addresses.

  • You want to ensure Stateless mode and Prefix Delegation are active on the Jio router’s IPv6 config page. Stateless mode (SLAAC) forces the Jio router to simply broadcast the network prefix without maintaining a tracking table of individual device leases. This significantly reduces the Jio router’s CPU and RAM overhead.

  • Put your ASUS router on Passthrough mode from the IPv6 tab. Make sure to enable Release prefix on exit. This is standard housekeeping. It tells the router to properly release its IPv6 DHCP prefix when it reboots or disconnects from the WAN, ensuring the upstream ISP router doesn’t hold an old “stale” lease and refuse to issue a new one right away.

Because Passthrough mode grants local devices direct public IPv6 addresses, they are technically exposed to the wide-open internet if undefended. Fortunately, Asuswrt-Merlin retains control over its local firewall even in Passthrough mode.

Step 5: Disable Client Acces Control#

The Client Access Control setting on JioFiber routers is an aggressive internal firewall filter designed to restrict which local IP or MAC addresses are allowed to establish outbound or P2P (Peer-to-Peer) connections.

  • Leaving this enabled is notorious for silently blocking traffic that does not fit standard web browsing profiles. It frequently breaks remote access for homelab servers, security systems (like DVRs/NVRs), multiplayer gaming lobbies, and VPN tunnels.

  • Disabling it ensures the Jio hardware does not arbitrarily drop packets trying to leave or enter your ASUS router’s network boundary.

Step 6: Confgure DNS#

At last I made sure that everywhere on the Jio router, DNS were configured to my choice of DNS (Cloudflare, Quad9 & Control-D) instead of Jio’s DNS. Then I did the same on my ASUS router as well (as usual). This stops the Jio router to send DNS queries to the Jio servers where they surely will block or censor a majority of the queries if any device is not configured to use my choice of DNS.

  • BEWARE!! The Jio router will silently change the IPv6 DNS config to the default setting every time it reboots. They even warn you that many JIO SERVICES (the Jio STB & other services I think if you have TV service as well) will not work if you change the IPv6 DNS settings. Make sure you change them back after a reboot.

  • ALSO, I am not really sure that I trust the WebUI after I change the DNS configs. Who knows if they actually change anything under the hood.

Conclusion#

After all of this, now I feel little bit better about having the Jio box in my network. By taking it out of the equation as much as possible & enabling full IPv6 support, The loaded latency on the same speedtest server has come down to 6ms from 28ms. Now the Unloaded latency is around 2~3ms and Loaded around 6ms.

THAT BRINGS JOY :)

BUT, all of this time-wasting endavour could have been avoided if flipping the Bridge Mode toggle on the WebUI of the Jio router had actually enabled Bridge Mode.

THANKS JIO ! ! !

Thanks for reading. Feel free to contact me if you have any queries regarding this. Will be happy to help any way I can.