WrtNova – browser config generator that builds pre-configured images via OpenWrt's ASU

Community Builds, Projects & Packages
1

What it is

A browser-based configuration front-end for OpenWrt. You select your device, fill in the settings you want (network, WiFi, VLANs, firewall zones, WireGuard, AdGuard Home, wifi mesh, multi-WAN, etc.), and it produces a single image you flash once. On first boot the router configures itself from those settings.

Relationship to the official OpenWrt project

It does NOT build or fork its own firmware. It uses the official Attended Sysupgrade (ASU) infrastructure — the same path as the firmware-selector. The image you download is stock OpenWrt compiled by OpenWrt's own build servers, with the requested packages included.

The only thing WrtNova generates is a uci-defaults first-boot script, which it submits to ASU as the defaults payload so it gets embedded in the image. So relative to the standard process, the firmware itself is identical to what you'd get from the firmware-selector with the same package set — the difference is the configuration layer, not the firmware.

What's different / what a user gets vs. the standard process

  • The standard firmware-selector lets you add a defaults script, but you write it yourself. WrtNova generates that script for you from a UI, covering things that are tedious to hand-write correctly:
    • Switch VLAN tagging with DSA-vs-swconfig handling per detected hardware
    • Guest / IoT zone isolation wired into the firewall
    • WireGuard client as a separate routed LAN segment with a routing-level kill switch (fails closed, doesn't leak to WAN) plus a reconnect watchdog
    • AdGuard Home, mesh (802.11s / batman-adv), mwan3 multi-WAN failover, DDNS
  • Single-node and multi-node/fleet configs (shared config with per-node overrides).
  • The generated first-boot script is left on the device at /rom/etc/uci-defaults/99-asu-defaults, so you can read exactly what was applied, and a factory reset re-applies your configuration rather than reverting to a bare image.

A note on secrets

Anything you put in the config (root/WiFi passwords, WireGuard keys, etc.) gets baked into the uci-defaults and submitted to the public ASU build server, where the build is retrievable by hash for ~30 minutes after it completes. Leave all password fields empty instead — the defaults are safe for first boot (no root password; Wi-Fi password is 12345678). Set real credentials after first boot via LuCI or SSH. [The UI will remind you of this.]

Transparency

The first-boot script (wrtnova.sh) and front-end are open source: https://github.com/LongQT-sea/wrtnova

You can read what it does before building, and inspect the embedded script on the device after flashing.

Tested on

  • Xiaomi CR6606, R3G, MiWiFi Mini
  • Haier HAR-20S2U1
  • D-Team Newifi D2
  • Linksys WHW03 V2

Best place for discussion

Please keep discussion in this thread for now; bug reports and feature requests are welcome as GitHub issues at the repo above.

Not affiliated with the OpenWrt project; it builds on top of it.

13 Likes
Extending the OpenWrt Sysupgrade Server with router configuration
2

You might want to note that any sensitive information in the resulting uci-defaults file will be stored on the ASU server, and will be publicly accessible for 7 days after a successful build.

4 Likes
3

Good point, thanks, that's worth being loud about. I'll add a warning in the
UI telling users to build with throwaway credentials and change them on first
login. Appreciate the heads-up.

2 Likes
4

Quick follow-up, I looked at the ASU source and saw build_defaults_ttl defaults to 30m for builds that include a defaults script. Does the production server use that default, or is it configured differently? Trying to give users accurate numbers in the UI warning.

5

Aha, you are correct, I believe the production server is running all defaults.. That indeed cuts down the window on how long your data is exposed...

6

It would be great if you could also add an option to select the 25.12-SNAPSHOT build version.

7

Can you check again, the SNAPSHOT version is already there in the list.

8

25.12-SNAPSHOT is not the same as SNAPSHOT; 25.12-SNAPSHOT belongs to the 25.12 branch, whereas SNAPSHOT is mainline.

1 Like
9

how to change the network to e.g. 192.168.33.xxx

whatever i try to input in the gui it results in 192.168.33.1.xxx

10

keep the IP prefix default, change the LAN VLAN ID to 33

11

Unless I misunderstood, they'll need to also remember this password if they reset the device to default.

12

Thank you, I'll change to "Leave passwords and sensitive fields empty. Defaults are safe for first boot: no root password, Wi-Fi password is 12345678. Anything you enter is sent to the ASU build server and baked into the firmware — set real credentials after first boot via LuCI"

13

The "official" firmware selector does not expose the release snapshots. For that, WrtNova would need to point to the alternate FS at https://openwrt.github.io/firmware-selector-openwrt-org/

14

I've just checked and it's just been added.

1 Like
15

Might be useful for some users.
I found that there's no field for custom uci-defaults configuration. The ice on the cake of ASU

16

wrtnova.sh is already 35KB without user config variables — adding a custom script field won't work unless upstream ASU raises its uci-defaults file size limit.

17

Great Project!

I have some questions
when you enable wireguard vpn client does it separately make this so we can still use the main network normally and can connect to the wireguard vpn through the wifi ssid I'm confused on this

I setup my device using wrtnova with pppoe in network so when It came up it had a software vlan created on br-lan with 20 number but I didn't set this in the advance options so is this like a thing to seperate the wan or something else because I'm confused normally on my RBR50V1 whenever I switch to pppoe it sets it to "switch port wan" option in the ports

18

Yes, connect to the VPN SSID and all your traffic will route through the WireGuard tunnel.

Most of the time when setting up a network for my clients, they usually want specific ports to carry VoIP or IPTV VLAN. Adding WAN ports into the same br-vlan makes it more convenient to convert any LAN port into an IPTV or VoIP port. Your WAN still works normally — just think of it like a managed switch.

1 Like
19

Thank you so much for the quick response as for the same principal I should follow for the credentials of wireguard and just add them later or should I just add the public information and leave like the private key aside and do this later

20

Yes, you can leave the private key empty and replace it after first boot.

1 Like