An OpenWrt Beginner's Guide

Preface

A first encounter with the OpenWrt Project might be overwhelming so I wanted to share some guidance to jumpstart newcomers. Note that a basic OpenWrt Journey is not a walk in the park and may consume countless hours of learning and setup while harvesting information - even when already tech experienced.

Planning

Determine how to setup your Network Topology depending on Home layout and needed wired connections and plan your Wi-Fi Access Point placement. Two examples:

  • Wifi Router - small area with <=4 wired connections
  • Core Router & Switch & Accesspoints - large area with >4 wired connections

Draw a network diagram ie. with draw.io with your desired Topology
2023.drawio

Buyer tips

When looking for new hardware you can check following popular devices

Core Router

10 Gbps - Fujitsu Futro S920/S940 or Lenovo M720q/M920q with dual 10GbE NIC
10 Gbps - Banana Pi BPI-R4 (see here)
2.5 Gbps - Banana Pi BPI-R3
2.5 Gbps - Banana Pi BPi-R3 mini
2.5 Gbps - Intel N100 with i226-V NIC
2.5 Gbps - NanoPi R6S (pending official support)
1.0 Gbps - GL.iNet GL-MT2500
1.0 Gbps - NanoPi R4S 4Gb
1.0 Gbps - Raspberry Pi CM4 + DFRobot Routerboard

Managed Switch 8-port PoE

2.5 Gbps/10G SFP - Ubiquiti Switch Enterprise 8 PoE
2.5 Gbps/10G SFP - TP-Link TL-SG3210XHP-M2
2.5 Gbps - Netgear MS108EUP
1.0 Gbps - Netgear GS308EP
1.0 Gbps - ZyXEL GS1915-8EP / GS1200-8HP

Access Point PoE

2.5 Gbps - Netgear WAX220
2.5 Gbps - ZyXEL NWA50AX Pro
1.0 Gbps - TP-Link EAP615 (older gen, 3x lan, see review)
1.0 Gbps - Ubiquiti UniFi U6+
Outdoor - ZyXEL NWA55AXE - Techdata

Wifi Router

Filogic 820 - ASUS RT-AX52 (pending official support)
Filogic 820 - Cudy WR3000
Filogic 830 - Asus TUF-AX4200 / Asus RT-AX59U
Filogic 830 - Banana Pi BPI-R3
Filogic 830 - Banana Pi BPi-R3 mini
Filogic 830 - GL.iNet GL-MT6000
Filogic 880 - Banana Pi BPI-R4 (see here)
MT7622 - Netgear WAX206 / Belkin RT3200 / Linksys E8450
ipq807x - Dynalink DL-WRX36

Travel Router with Travelmate

Filogic 820 - GL.inet GL-MT3000
MT7628AN - GL.iNet GL-MT300N V2

*budgettips: Ubiquiti EdgeRouter / Netgear GS308E / Zyxel WSM20
*Tri-band devices: here
*USB Wi-Fi adapter: here - see also this post
*USB ethernet adapter: Realtek RTL8153 or RTL8156
*Switch running OpenWrt: Netgear GS108T or GS310TP (allows metrics export into Grafana)
*Switch with Etherlighting: here

Installation

Lookup your OpenWrt device for instructions, read the Starter FAQ and Quick start guide

  • flash factory image
  • connect OpenWrt device lan-port with PC (wifi turned off) and goto 192.168.1.1 in your browser
    router: in Network > interfaces add wan with DHCP client on eth1; edit lan and set IPv4 to 192.168.0.1
    accesspoint: in Network > interfaces edit lan and set protocol to DHCP client; enable Wi-Fi network in Network > Wireless and set country code. When having multiple APs set different channel per AP, ie. ch1 on AP1 and ch11 on AP2 for 2.4 Ghz. See Dump Access Point
  • Save & Apply (keep settings) - when device does not come back after 5 minutes powercycle it

Upgrade

Upgrading is recommended when a new OpenWrt release is out (check release notes beforehand)

Packages

There is a huge Package Library (hit Update lists in System > Software). Favored for a Router are i.e.

  • advertisement blocking - adblock-fast or other options
  • malicious host blocking - luci-app-banip (select feeds like darklist, debl, feodo, firehol1, firehol2, greensnow, iblockspy, proxy, sslbl, threat, tor,cinscore, etcompromised, talos, bruteforce)
  • traffic shaping - luci-app-sqm; recommended settings for DOCSIS are here

Privacy/Security

To secure devices and guard privacy

  • to use a different DNS resolver than the one provided by your ISP - in Network > Interfaces > wan, uncheck 'Use DNS servers advertised by peer' and add DNS server 1.1.1.1 and 1.0.0.1
  • to encrypt DNS traffic use DoH or DNSCrypt - see comparison
  • to enforce Network isolation for wireless devices - see Guest WLAN (needs dnsmasq+firewall)
  • to enforce Network isolation for logical grouped devices - setup 802.1q VLAN to isolate guest, iot, home etc devices case1, case2. Tip: check also this wifi-vlan feature
  • to secure Internet connection and mask your IP address install Wireguard client
  • to secure remote access to your home network install Wireguard server
  • to perform a local vulnerability scan use Nessus Essentials
  • to perform a local portscan use nmap
  • to perform a remote portscan use port-scanner

Monitoring

An army of Monitoring options are available with collect-mod plugins

  • Accesspoint monitoring - luci-app-statistics collectd-mod-sensors
  • Router monitoring - luci-app-statistics collectd-mod-sensors collectd-mod-thermal collectd-mod-ping collectd-mod-sqm collectd-mod-irq
  • Router traffic monitoring - luci-app-nlbwmon (extra settings are needed)
  • Multi device Monitoring - export collectd output to a Grafana Server

Troubleshooting

  • keep it simple and stick to defaults where possible
  • look in Status > System Log
  • familiarize yourself with terminal commands (see Appendix)
  • in case of issues search the forum and/or create a topic with your config (see Appendix)

Appendix: Collect config

Connect to your OpenWrt device using ssh, copy output of below commands and post it in the relevant topic with preformatted text </> button (redact passwords, MAC addresses and public IP addresses)
image

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
Appendix: Terminal Commands

cpu memory: htop (press F2 and enable detailed cputime)
network: ifconfig, iftop, mtr -ezb4 --report 1.1.1.1, netstat, nslookup, route, traceroute
hardware: ethtool, iwinfo, iw phy0 info, iw list
text view/edit: cat, grep, logread, nano
ps: when a command is not available then install it in System > Software
ps2: see also
https://openwrt.org/docs/guide-user/base-system/user.beginner.cli
https://openwrt.org/docs/guide-user/network/wifi/wireless-tool/wireless.utilities

Appendix: Benchmark

Cloudflare speedtest
Ookia speedtest
Bufferfloat test

Appendix: External Resources

Embedded Hardware News https://www.cnx-software.com/
Linux (Kernel) News https://www.phoronix.com/
OpenWrt user Blog https://giuliomagnifico.blog/
Networking Fundamentals: https://book.systemsapproach.org/
Networking Fundamentals: https://www.geeksforgeeks.org/computer-network-tutorials/
OpenWisp https://openwisp.org/demo.html
OpenWrt Configurator https://github.com/jasrusable/openwrt-configurator
Recent commits https://git.openwrt.org/?p=openwrt/openwrt.git;a=summary or https://github.com/openwrt/openwrt/commits/openwrt-23.05
Wifi Survey https://github.com/jantman/python-wifi-survey-heatmap or https://www.netspotapp.com/gettrial.html or using a Robot Vacuum https://github.com/ccoors/Valeronoi
Wifi SNR https://interline.pl/Information-and-Tips/Minimum-802.11-SNR-Sensitivity
USB chargers https://lygte-info.dk/info/indexUSB%20UK.html and https://www.chargerlab.com/category/teardowns/teardowns-chargers-cables/

ps: support the OpenWrt Project by making a small donation

8 Likes

For a Wifi Router advice: are ipq807x and filogic the best performing devices for 2023/2024 ?
Do you have 2.5Gbps / 1.0Gbps device recommendations for these?

edit: I digged some time into topics and found following
ipq807x - Dynalink DL-WRX36 looks cool but currently lacks DSA support
filogic - contains a growing number of devices but many are not easily flashed.

I'm not sure why you added this question to your existing thread... but look at this section:

Read and search first, if you don't find answers to your questions, that is a good place to start a new thread regarding OpenWrt + hardware questions