How to determine if my OpenWrt has been hacked?

I am experiencing some unusual behaviour on my OpenWRT router and want to rule out any chance that it has been hacked.

One of the issues is that everything connected to it seems to have a perceived delay as if it is going via another site or route.

I tried changing my DNS on my phone to Cloudfare and OpenDNS to see if it improved things but it is still going via my OpenWRT router which can't be avoided as it is the underlying source of the connection to the Internet

If it has not been hacked then are there any things that need to be flushed (I imagine with a boot script which I could run at 04:00 for example with a reboot (if that can be done)?.

Any help or suggestions would be appreciated.

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export wireless; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
iptables-save -c; ip6tables-save -c; nft list ruleset; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ip -6 addr ; ip -6 ro li tab all ; ip -6 ru; \
ls -l  /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
2 Likes