OpenWrt [1] is a remarkable Linux project focused on embedded devices. The OpenWrt project currently supports 2,951 devices [2]. Although OpenWrt uses the Linux kernel, it is not a typical Linux distribution. The userspace is quite different because embedded devices have much more limited resources, and the traditional Systemd boot manager with D-Bus for communicating between multiple processes is a poor choice. Additionally, most embedded devices lack a BIOS/UEFI, so supporting thousands of devices is challenging.

OpenWrt offers several benefits when setting up a typical WiFi router or switch, including:

• Device ownership – Many vendors or ISPs still partially control their devices after purchase through updates or remote management protocols. OpenWrt gives users full control of their devices.
• Security – Many vendors stop making firmware upgrades after two years from the time of the device release. This situation is very similar to the Android smartphone market. OpenWrt releases security upgrades for even very old devices and provides WPA3, a modern secure WiFi authentication protocol, for many of them. OpenWrt also ships with a modern Linux kernel, modern encryption standards, and a fine-grained firewall configuration for better network protection.
• Advanced features – OpenWrt provides advanced functionality that is either unavailable or only available in top router models: Features include SQM for video and audio conferences or game video streaming, encrypted DNS, a VPN, an ad blocker, P2P file sharing, disk partition backup, mesh networks, IPv6 tunnels, and others. The OpenWrt repository includes more than 3,000 packages.
• Support – OpenWrt developers use official forums, a mailing list, and IRC channels, so it's very easy to contact them. There are also many active community members on the official resources. The OpenWrt community has helped the author of this article multiple times. The official documentation [3] contains a Quick Start Guide, User Guide, and Developer Guide, which makes life easier for all categories of users, from first-timers to experienced Linux developers. The situation with general hardware vendors is different. There's often a contact form with an email address and an official forum, but getting an answer from an official employee can take a long time.
• Performance optimizations – OpenWrt ships with a modern Linux kernel and additional tools that reveal many options for performance tuning. Is the OpenWrt router connected to another router over a long distance? Do video conferences happen often and require lower latency? Is the CPU slow for the current traffic, and would it make sense to try software or hardware flow offloading [4]? OpenWrt provides many options to improve performance.

Because OpenWrt was not designed for network professionals, it is easier for a general user to configure and troubleshoot than a commercial router from Cisco or Juniper would be.

OpenWrt Project Details:

• Licenses: BSD-2-Clause, BSD-3-Clause, GPL-1.0, GPL-2.0, ISC, MIT
• Written in: C, Shell, Perl, Lua, ucode
• First release: 2004
• Top contributor: Gabor Juhos – 4,536 commits
• Activity: currently 52 commit per week

Choose the Right Device

OpenWrt supports many devices, so there's a good chance your current router is supported, too. If it is not, don't give up. Check the table of supported devices [2] and choose one you like. The price range is very wide, from a few dozen to several hundred US dollars. Some advice for newcomers: Pick a popular, well-known brand. If many people are using the same devices, there is a higher likelihood of fast bug detection and fixes. New devices and devices from unpopular brands have a smaller user base and are tested much less. The flash drive size (NOR or NAND) is critical for long-term OpenWrt usage. The Linux kernel size is constantly growing, so for long-term usage (without tricks involving an external USB drive), it is important not to buy devices with 8MB drives. 16MB is the minimum. 32MB, 64MB, or more is better for long-term usage. Regarding WiFi, devices with WiFi 6 or higher require plenty of RAM, so choosing a device with at least 512MB of RAM is optimal. Some devices that claim to support WiFi 7 do not support the 6GHz frequency. Be sure to avoid these devices because the 6GHz frequency is important for optimal performance over short distances without barriers.

OpenWrt Requirements:

• SoC (System on Chip) – officially supported by OpenWrt
• Memory: 8MB is the bare minimum; 16MB or more is a better choice.

If you want to share the VPN service with all local devices, you need a more powerful device to get good speed. In this case, a good processor is the top priority: Look for a CPU with two or more cores and a frequency of 1GHz or higher. Some devices don't have USB ports, but USB ports are important even if their need isn't obvious at the time of purchase. You can attach 4G or 5G modems and extra WiFi radios to the router later. A USB bootloader recovery is also useful if something goes wrong and can save a lot of time and prevent frustration. This feature is supported on a subset of OpenWrt-supported devices. One final detail about antennas is that dedicated long-range antennas are better than internal antennas in almost all cases. External antennas might not fit well with a room's decor, but they are useful.

A few words about cable switches: Their specs are much lower than those of a typical WiFi router, and that's intentional. WiFi is much more complex than a wired connection and requires more computing power. Currently, OpenWrt supports fewer switches than routers, but most of them work well. All you need to do is check that the switch has the right number of ports and is a popular brand, so testing and device support will be good to go. Fiber support is a good bonus, even if you don't need it right now – the situation could change later.

LuCI – The Web Interface

The way the average user communicates with OpenWrt is through LuCI [5]. The main LuCI interface is shown in Figure 1. LuCI is open source and can be completely removed if the device owner decides to use the console. In this regard, the LuCI interface is similar to a Linux server. Compared to the general router web interface of low- or mid-priced routers, LuCI is quite advanced and supports many features. The project is written in JavaScript, C, and Lua, and it supports a server-side Lua API and a client-side JavaScript API. The Lua API will be replaced with ucode, a special minimal scripting language similar to Lua, and rpcd. The ubus RPC daemon was created to simplify communication between OpenWrt components. The role that rpcd plays is similar to the role that dbus plays in desktop and server-side Linux. Both APIs come with good documentation, which allows developers to create new web interface extensions and backend applications.

Figure 1: The LuCI OpenWrt configuration interface. This interface is what a user sees after the first successful installation of OpenWrt.

Most of the LuCI navigation is done through the powerful navigation bar at the top of the web interface. Nav bar options include:

• Status – An overview (default front page), with options for Processes (Figure 2), Routing ( Figure 3), Firewall, System Log, Channel Analytics, and Realtime Graphs (Load, Bandwidth per interface, Wireless, Connections).

Figure 2: OpenWrt processes management tool.

Figure 3: OpenWrt routing configuration.

• System – another internal system sub-menu (included timezone and time synchronization menus), Language, and Style (dark or white theme setup).
• Network – Interfaces, Wireless, Switch, DHCP, DNS, Diagnostics, and Firewall.
• Logout – important for security: if you're a single user on the device, you can just close the tab with LuCI. If not, you need to click Logout to prevent other users from logging in and changing the router settings.

The OpenWrt web front page contains a lot of information. Many other web interfaces look very poor in comparison with OpenWrt. Of course, there are never-ending debates between the ascetic versus advanced approach, and many interfaces support one or another. In this case, a detailed approach is better because more information is always more helpful for understanding what's happening when something is going wrong. LuCI includes an excellent set of information: all LAN (Local Area Network) and WAN (Wide Area Network) port activity and traffic counters, advanced system load data – average and per process, real time wireless channels activity, firewall zones status and traffic, and much more. The OpenWrt web interface itself is the first step to giving a general router new features.

You can extend the LuCI web interface with extra OpenWrt packages if there is a need to avoid configuration in the console. The luci-app-advanced-reboot package provides an easy way to reboot the router into an alternative firmware partition for dual-partition devices or perform other advanced reboot operations. luci-app-adblock provides Adblock web configuration support. luci-app-attendedsysupgrade allows firmware upgrades of routers while keeping user-installed packages from Web UI. luci-app-transmission is a web interface for the Transmission BitTorrent client.

You'll find many more LuCI extensions at GitHub [6].

Firewall

Another important part of OpenWrt is the firewall application, Fw4, which makes the device and entire home network more secure. Fw4 (Figure 4) relies heavily on the Linux kernel and its Netfilter framework for firewalling, NAT, and packet filtering. Fw4 rules are defined in nftables, the successor of the well-known packet filter, iptables. After the firewall starts, these rules are handled and set to Linux Netfilter modules.

Figure 4: The OpenWrt firewall with graphical console and configuration file.

The Fw4 firewall hierarchy is similar to the firewall of Red Hat Enterprise Linux and its siblings, called firewalld. All network devices are split into zones, such as WAN, LAN, Public, and Work, and all packet movement between these zones is protected by firewall rules. You can configure the OpenWrt firewall from the web interface or the console using the file /etc/config/firewall. The configuration itself is not very complex and is user-friendly for newcomers. Fw4 provides a large set of rules for popular use cases. You can enable these additional rules with one click or by uncommenting a few lines in the console.

The WiFi configuration in OpenWrt (Figure 5) is much more advanced than the same configuration in generic router firmware. Basic settings, such as the access point name, encryption type (WPA2 or WPA3), the WiFi channel to use, and the maximum transmit power, are very similar to those of a general router in the mid-price range. Most advanced features are hidden in the Advanced Settings tab, allowing average users to complete the basic setup without issues (see the box entitled "Advanced Mode WiFi").

Figure 5: Wireless configuration in graphical and console mode.