What are the must‑have features for OpenWRT?

Rick13 · February 26, 2026, 9:29am

I already use AdBlock. I’m also considering using a VPN, such as WireGuard. My router is a Turris Omnia, which I’ve flashed to OpenWRT. What are some must‑have packages or good features to install on OpenWRT?”

egc · February 26, 2026, 10:05am

Secure DNS, I use https-dns-proxy

I also use WireGuard server to connect to my home and a WireGuard client to Mullvad for privacy

konus · February 26, 2026, 10:10am

luci-app-adblock to block ads
luci-app-sqm if your connection suffers from bufferbloat
luci-app-ddns + wireguard to be able to connect to your home network from your phone
luci-app-https-dns-proxy for more secure / private dns requests
luci-app-irqbalance to spread the load over multiple cores (if you have a multi core router)
luci-app-bcp38

sebastian_de · February 26, 2026, 9:39pm

Unbound as recursive DNS resolver.

github.com/openwrt/packages

net/unbound/files/README.md

master

# Unbound Recursive DNS Server with UCI
<!-- markdownlint-disable -->

## Unbound Description
[Unbound](https://www.unbound.net/) is a validating, recursive, and caching DNS resolver. The C implementation of Unbound is developed and maintained by [NLnet Labs](https://www.nlnetlabs.nl/). It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modular components, so that also DNSSEC (secure DNS) validation and stub-resolvers (that do not run as a server, but are linked into an application) are easily possible.

## Package Overview
OpenWrt default build uses [dnsmasq](http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html) for DNS forwarding and DHCP. With a forward only resolver, dependence on the upstream recursors may be cause for concern. They are often provided by the ISP, and some users have switched to public DNS providers. Either way may result in problems due to performance, "snoop-vertising", hijacking (MiM), and other causes. Running a recursive resolver or resolver capable of TLS may be a solution.

Unbound may be useful on consumer grade embedded hardware. It is fully DNSSEC and TLS capable. It is _intended_ to be a recursive resolver only. NLnet Labs [NSD](https://www.nlnetlabs.nl/projects/nsd/) is _intended_ for the authoritative task. This is different than [ISC Bind](https://www.isc.org/downloads/bind/) and its inclusive functions. Unbound configuration effort and memory consumption may be easier to control. A consumer could have their own recursive resolver with 8/64 MB router, and remove potential issues from forwarding resolvers outside of their control.

This package builds on Unbounds capabilities with OpenWrt UCI. Not every Unbound option is in UCI, but rather, UCI simplifies the combination of related options. Unbounds native options are bundled and balanced within a smaller set of choices. Options include resources, DNSSEC, access control, and some TTL tweaking. The UCI also provides an escape option and works at the raw `unbound.conf` level.

## HOW TO: Ad Blocking
The UCI scripts will work with [net/adblock](https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md) and/or [net/adblock-fast](https://github.com/openwrt/packages/blob/master/net/adblock-fast/files/README.md), if they are installed and enabled. It's all detected and integrated automatically. In brief, the [net/adblock](https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md) or [net/adblock-fast](https://github.com/openwrt/packages/blob/master/net/adblock-fast/files/README.md) create distinct local-zone files that are simply included in the unbound conf file during UCI generation. If you don't want this, then disable or reconfigure respective package to not send these files to Unbound.

With [net/adblock](https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md) package specifically, a few additional tweaks may be needed to enhance the realiability and effectiveness. Ad Block option for delay time may need to be set for upto one minute (adb_triggerdelay), because of boot up race conditions with interfaces calling Unbound restarts. Also many smart devices (TV, microwave, or refigerator) will also use public DNS servers either as a bypass or for certain connections in general. If you wish to force exclusive DNS to your router, then you will need a firewall rule for example:

**/etc/config/firewall**:
```

This file has been truncated. show original

Rick13 · March 3, 2026, 10:41am

thanks for the suggestions.
I will install WireGuard. I installed luci‑app‑irqbalance yesterday, but it wasn’t running. I think my Turris Omnia router (2 cores) doesn’t support it very well. I will take a look at the other tips. More tips or suggestions are welcome.

Stefan0 · March 3, 2026, 11:27am

For secure DNS, I prefere DoT with Dnsmasq and Stubby.

For fun and statistics:

luci-app-statistics
collectd-mod-thermal
luci-app-nlbwmon

For comfort:

nano
htop
curl
luci-app-attendedsysupgrade
ethtool
iperf3
diffutils

Rick13 · March 3, 2026, 11:51am

Thanks

plater · March 3, 2026, 4:09pm

nano

htop

tcpdump-mini

Whether it’s a router, switch, dumb AP, or all-in-one, these three packages will always be installed.

Rick13 · March 3, 2026, 9:05pm

Why use nano instead of vim?

tievolu · March 4, 2026, 2:11pm

Here are a few of packages I use that haven’t been mentioned yet:

luci-app-acme
luci-app-banip
luci-app-pbr
luci-app-upnp
luci-app-wol
dnsmasq-full
haproxy
logrotate
snmpd
vim-fuller
gnuplot
jq-full
lsof
perl
strace

timur.davletshin · March 4, 2026, 2:14pm

Now it is included in banip.

Rick13 · March 10, 2026, 1:18pm

Thanks
I will try..