Config Openwrt Complete Guide

Configuring OpenWRT can seem daunting, but it's actually quite straightforward once you know the basics.

First, you'll need to prepare your device by backing up any existing data and installing the OpenWRT firmware.

To do this, you'll need to download the OpenWRT image for your specific device model and flash it using a tool like LuCI or the command line.

This will erase all data on the device, so be sure to back up anything important first.

The OpenWRT firmware is designed to be highly customizable, with a vast array of packages available for installation.

One of the most important steps in configuring OpenWRT is setting up the network configuration, which includes configuring the WAN and LAN interfaces.

This can be done using the LuCI web interface or the command line, and it's essential to get it right in order to access the internet and connect to other devices on your network.

Readers also liked: Setup Openwrt Luci Https through Command Line

OpenWRT also provides a robust system for managing user accounts and access control, which is crucial for securing your network.

To set up user accounts, you'll need to create a new user and assign them to a group, which can then be given access to specific network resources.

Once you've completed these basic steps, you can start exploring the many advanced features and customizations available in OpenWRT.

If this caught your attention, see: Openwrt Ap

UCI is a command-line utility for getting, setting, or editing configuration, or you can edit files directly under /system/config.

You can use UCI to edit configuration files, and it's often provided as an example because you can easily cut and paste it into a shell.

UCI configuration can be edited in /etc/config files or using UCI commands.

Network configuration is contained in /etc/config/network.

Here are the basic configuration options for a single ENET interface:

To change the IP address of the lan network, you can use UCI to edit the configuration file.

LuCI is a web user interface for OpenWrt that can be enabled and compiled using the menuconfig in the OpenWrt directory.

To use LuCI, you need to select the luci package under the Collections submenu in the LuCI menu. LuCI is quite modular, allowing you to select additional modules if needed.

You can access LuCI by typing the IP address of the board (192.168.1.1 by default) in the URL bar of your browser after building and flashing the new image onto ESPRESSObin.

Readers also liked: Openwrt Luci

You can override the vid UCI option if needed. The OpenWrt UCI vid option of switch_vlan sections is automatically inferred from the vlan number.

It's also possible to disable the vid UCI option if you choose to. The OpenWrt backend automatically infers the vid option from the vlan number.

You can manually define the vid option if you need to. This can be useful if you're working with a specific configuration that requires a custom vid option.

Additional reading: Openwrt Uci

To configure your network in OpenWrt, you'll need to edit the /etc/config/network configuration file. This is where you define interface configuration, network routes, and switch VLANs.

You can do this by opening the file and appending a new section at the end. For a basic routing setup, you'll need to specify the interface protocol (dhcp), the physical interface associated with this section (wan), and a unique logical interface name ('wan').

Here's a quick rundown of the key parts of this section:

Once you've saved your changes, restart the network for the changes to take effect. Your 'wan' interface should now be up, and you can test it by pinging Google.

To configure your network client, start by connecting one end of an Ethernet cable to the WAN port on your device and the other end to your router or IP switch.

Connect to the console of your device as described in the Quick User Guide. The central network configuration in OpenWrt is configured in the /etc/config/network configuration file.

Here's what you need to append to the end of this file:

Save your changes and exit the editor. Then, restart the network for the changes to take effect. Your 'wan' interface should now be up.

Network Interfaces are the backbone of any network, and understanding how they work is crucial for setting up a reliable and efficient network configuration.

There are four main types of interfaces: network interfaces, wireless interfaces, bridge interfaces, and dialup interfaces. Network interfaces can be of type ethernet, virtual, loopback, or other.

Wireless interfaces, on the other hand, must be of type wireless, and are often used to bridge a wireless connection to a different network.

Bridge interfaces, which are used to connect multiple networks together, have a few specific options that are important to understand. These include the ability to set up VLANs (Virtual Local Area Networks) and configure the bridge's behavior.

Here's a list of some of the key options for bridge interfaces:

It's worth noting that VLANs are a powerful tool for network administrators, allowing them to segment networks and improve security.

DNS and Search Domains are crucial for any network configuration.

You can set DNS servers using the dns_servers option, while search domains can be set using dns_search.

These values will be automatically added to every interface with at least one static IP address.

Interfaces without any IP address configuration or using dynamic IP address configuration won't display the DNS option in the UCI output.

Check this out: Openwrt Dynamic Dns

You can use WPA2 Enterprise (802.1x) security on OpenWrt for networks like eduroam. This type of configuration is a typical wireless access point setup.

The eduroam network is a great example of a large-scale network that uses WPA2 Enterprise (802.1x) security.

VLAN 802.1Q/802.1AD interfaces have the same configuration settings, except for the type setting, which is either vlan_8021q or vlan_8021ad.

The type setting is a string that specifies the type of interface, and the default value is vlan_8021q.

To configure a VLAN 802.1Q interface, you need to specify the VLAN ID, which is an integer that defines the VLAN.

You might like: Openwrt Vlan

The VLAN ID can be set to any value, and the default value is empty.

VLAN 802.1Q interfaces also have options for ingress and egress QoS mapping, which define how VLAN header priority is mapped to Linux internal packet priority for incoming and outgoing frames, respectively.

Here's a summary of the key settings for VLAN 802.1Q interfaces:

Wireless Configuration is a crucial part of setting up your OpenWrt device. You can configure your wireless access point to ban specific MAC addresses from connecting, which is useful for securing your network.

To do this, you can use the macfilter option in the wireless section of your configuration dictionary. This is an example of how to ban two MAC addresses: "The OpenWrt backend supports a custom NetJSON extension for wireless access point interfaces: macfilter (read more about macfilter and maclist on the OpenWrt documentation for Wireless configuration)".

You can also configure your wireless access point to support roaming (802.11r) for seamless handovers between access points. This is achieved by setting the custom NetJSON extensions in your configuration dictionary.

To enable automatic channel selection, you need to set the channel to 0 and specify the band property. For example, you can set the band to "2g" for 2.4 GHz or "5g" for 5 GHz. Here's an example of how to set automatic channel selection for two radios:

The access point is a crucial part of wireless configuration, and it's essential to get it right. You can configure your wireless access point with a simple dictionary.

The network option of the wifi-iface directive can be filled in automatically, but you can override it if needed by setting the network option in the wireless section of the configuration dictionary. This is a common configuration.

A wireless access point can be configured with a custom NetJSON extension for macfilter ACL, which allows you to ban specific mac addresses from connecting. This is useful for security purposes.

You can also configure roaming options for a wireless access point using custom NetJSON extensions. This supports 802.11r in wireless access point interfaces.

Mesh (802.11s) is a type of wireless configuration that allows devices to connect to each other without a central access point.

Setting up 802.11s interfaces is fairly simple, you can bridge eth0 with mesh0, a layer2 802.11s wireless interface.

In 802.11s mesh mode, the ssid property is not required, which is a departure from other wireless configurations.

Mesh_id is a mandatory property in 802.11s mesh mode, meaning you'll need to specify it when setting up your mesh network.

Explore further: Openwrt Bridge Mode

A WDS repeater is a type of wireless network device that can extend the range of a wireless network by repeating the signal.

In the example of a WDS repeater, we can see that it involves configuring a WDS station to repeat the signal, as shown in the WDS repeater example.

A WDS repeater can be used to improve the coverage of a wireless network, especially in areas where the signal is weak or non-existent.

To configure a WDS repeater, you need to follow the steps outlined in the WDS repeater example, which involves setting up a WDS station to repeat the signal.

By using a WDS repeater, you can create a wireless network that covers a larger area, making it ideal for homes, offices, and public hotspots.

The radio settings in your wireless configuration are a crucial part of getting your network up and running smoothly.

To access the radio settings, you'll need to dive into the configuration dictionary and navigate to the radio key. This key must contain a list of NetJSON radio objects, which are specified in the NetJSON Radio object options.

The OpenWrt backend requires some additional settings for each radio in the list, including the driver and protocol options. Specifically, the driver can be set to one of the following: mac80211, atheros, ath5k, ath9k, or broadcom. The protocol, on the other hand, can be set to one of the following: 802.11a, 802.11b, 802.11g, 802.11n, 802.11ac, or 802.11ax.

Check this out: Openwrt One

Here's a quick rundown of the required options for each radio:

If you need to use the "automatic channel selection" feature of OpenWrt, you'll need to set the channel to 0 and specify the band property. For example, if you want to use 802.11n in the 2.4 GHz band, you would set the channel to 0 and the band to "2g".

To set up a bridged interface, you'll need to specify a unique logical interface name, such as 'lan'. This interface will contain the physical interfaces 'lan0' and 'lan1', which you'll assign to this section.

When creating a static route, you'll need to specify the static IP address and netmask to be used for this interface, along with a prefix size of 60. This is done by adding a 'static' section to your configuration file.

Optional settings for static route objects include specifying the type of route, such as unicast, local, or broadcast, as well as setting the MTU and routing table id. You can also enable the 'onlink' option to specify that the gateway is on link even if the gateway does not match any interface prefix.

Additional reading: Openwrt Interface

Here's a list of optional settings for static route objects:

Policy routing settings reside in the ip_rule key of the configuration dictionary, which allows for specifying rules with options such as 'in', 'out', 'src', 'tos', 'mark', 'invert', 'lookup', 'goto', and 'action'.

Dialup connections require specific settings to function properly. The OpenWrt backend NetJSON extensions provide a set of options for dialup interfaces.

One of the most important settings is the protocol, which can be set to one of the following options: 3g, 6in4, aiccu, l2tp, ncm, ppp, pppoa, pppoe, pptp, qmi, or wwan.

The default protocol is pppoe, but you can choose the one that best suits your needs. In my experience, pppoe is a good starting point, but you may need to experiment with other options to find the one that works best for you.

The password and username settings are also crucial for dialup connections. However, the default values for both settings are empty strings, indicating that you'll need to provide your own credentials.

Here's a summary of the dialup settings:

Policy routing allows you to define custom rules for routing traffic on your network. This is a powerful feature that can help you manage complex network setups.

The policy routing settings reside in the ip_rule key of the configuration dictionary. This key contains a list of rules, each with its own set of options.

Some of the options available for each rule include in, out, src, tos, mark, invert, lookup, goto, and action. These options allow you to specify the conditions under which a rule should be applied.

Here's a breakdown of the options available for each rule:

stringmarkstringinvertbooleanlookupstringgotointegeractionstring

Each of these options can be used to create a custom rule that meets your specific needs. By combining these options in different ways, you can create complex routing policies that help you manage your network traffic with ease.

Spanning Tree Protocol is a network protocol that prevents bridge loops and broadcast radiation in Ethernet networks.

By default, bridges are configured without STP, which can create a bridge loop if multiple ports are connected to a LAN.

STP is a must-have for redundancy purposes, allowing you to connect multiple ports in a bridge to a LAN without creating a loop.

To enable STP, edit /etc/config/network and add an option stp 1 to the interface.

This simple configuration change can prevent a lot of headaches down the line, trust me, I've seen it happen!

Explore further: Wake on Lan Openwrt

Configuring OpenWRT can be a bit overwhelming, but once you get the hang of it, you'll be able to unlock its full potential.

One of the most advanced features of OpenWRT is its support for multiple wireless networks, which can be configured using the "wireless" option in the Luci web interface.

You can also enable Quality of Service (QoS) to prioritize traffic on your network, which can be done by installing the "qos" package and configuring the "tc" commands in the "system" section.

To further customize your network, you can use the " firewall" option to create custom rules and filter traffic.

Expand your knowledge: Openwrt Qos 设置

The OpenWrt backend offers some really cool custom options that can be added to the default NetJSON General object. These options are specifically designed to work with the OpenWrt system.

One of these options is the timezone setting, which allows you to specify a particular time zone for your system. You can choose from a list of allowed timezone values.

Here's a breakdown of the timezone option: it's a string type, and you can select one of the allowed timezone values as its function.

Mesh (Adhoc) is a type of wireless networking that allows devices to connect directly to each other without the need for a central access point.

In an Adhoc network, devices can communicate with each other directly, forming a mesh-like structure. This is done through a process called peer-to-peer communication.

Each device in the network acts as a repeater, retransmitting data to other devices within range. This allows for a robust and reliable connection.

Explore further: Openwrt Mesh Network

A key benefit of Adhoc networks is their ability to adapt to changing environments and topologies. This makes them ideal for temporary or emergency situations.

In a typical Adhoc network, devices can move freely and still maintain connectivity. This is because each device acts as a gateway to the rest of the network.

Adhoc networks are often used in situations where a traditional infrastructure is not available, such as in disaster relief or outdoor events.

One of the standout features of this system is its ability to store all network config for all devices in a single UCI-like JSON config file.

This is a huge time-saver, as you can manage all your devices from a single location. The config file includes not just network settings, but also package information, firmware versions, and more.

The system also allows you to conditionally compose your JSON file to support multiple OpenWrt devices, different device models/types, and different roles.

Take a look at this: Openwrt Build System Setup

This means you can easily manage a variety of devices with different configurations. For example, you might have a router, a switch, and a dump-ap, each with its own unique settings.

The system has strict config syntax validation and logical error checking to prevent invalid configuration.

This ensures that your config file is always correct and up-to-date. The system also performs validation before returning output, so you can be confident in the accuracy of your config.

Here are some of the key features of the system:

Additionally, you can specify which packages you wanted installed or uninstalled on your devices, making it easy to manage software updates across all your devices.

To unlock the full potential of our system, you need to understand how it works. This involves specifying your UCI configuration in JSON.

The configuration can be applied conditionally using the .if and/or .overrides keys. This allows you to tailor your configuration to specific situations.

Here's a breakdown of the process:

By following these steps, you can ensure your configuration is tailored to your needs and works seamlessly with our system.

The parse method is a crucial feature in this backend, allowing you to convert native configurations into NetJSON configuration dictionaries.

This method is automatically called when initializing the backend with the native argument, making it a convenient way to get started.

The argument passed to native can be a string containing a dump obtained via uciexport, or a file object representing a configuration archive in tar.gz format, often used in OpenWrt.

Currently, only the hostname option is processed by this backend, so be aware of this limitation when using the parse method.

You can pass a string or a file object to the native argument, giving you flexibility in how you work with native configurations.

The programmable switch is a powerful feature that allows you to customize your network settings to your liking.

The programmable switch settings reside in the switch key of the configuration dictionary, a custom NetJSON extension. This key must contain a list of dictionaries, each with specific required keys.

The required keys for each dictionary in the list are name, reset, enable_vlan, and vlan. The vlan key itself is a list of dictionaries, each with device, reset, vlan, and ports as required keys.

Here's a breakdown of the required keys for the vlan list:

VXLAN is a powerful feature that allows you to set up layer 2 tunnels, making it ideal for connecting multiple networks together.

You can configure VXLAN settings to customize your tunnel's behavior. For example, you can specify the network name, which should be a unique string of 2 to 15 alphanumeric characters, dashes, and underscores.

The VXLAN tunnel endpoint is another important setting, which can be enabled or disabled. By default, it's set to False.

You can also configure the port for VXLAN connections, which is set to 4789 by default. This is a standard port for VXLAN connections.

Another key setting is the VXLAN Network Identifier, also known as VNI. You can set this to an integer or a string, and it's currently set to None by default.

If you want to bind the VXLAN tunnel to a specific interface, you can specify the interface name in the tunlink list.

To ensure data integrity, you can enable checksum validation in both the RX and TX directions. This is enabled by default in both directions.

Finally, you can adjust the MTU (Maximum Transmission Unit) for the route, which is currently set to 1280 by default. You can only enter numbers for this setting.

Here's a summary of the VXLAN settings:

When setting up OpenWRT, security and VPN options are crucial for protecting your network. The OpenVPN backend is a great option for secure connections.

You can configure OpenVPN on OpenWRT by using the OpenVPN backend schema, which includes all the necessary features. For more details on the schema, check out the OpenVPN backend schema page.

To ensure secure connections, it's essential to use a reliable VPN service.

Take a look at this: Openwrt Ovpn

OpenVPN is a robust backend solution that inherits its features from the original OpenVPN schema.

The OpenVPN schema includes a wide range of features, including those mentioned in the OpenVPN backend schema documentation.

For those who are new to VPNs, it's worth noting that the OpenVPN backend is a comprehensive solution that provides a solid foundation for secure network connectivity.

To learn more about the OpenVPN schema, you can refer to the OpenVPN backend schema documentation for a detailed explanation of its features and capabilities.

WireGuard is a reliable and efficient backend option for securing your online activities. It inherits its features from the WireGuard schema, which is a comprehensive framework for setting up WireGuard.

The OpenWrt backend adds a few properties to the WireGuard schema, making it even more versatile. You can specify a logical interface name, known as "network", which can be up to 15 alphanumeric characters, dashes, and underscores.

A unique feature of WireGuard is its ability to delegate IPv6 prefixes to other interfaces. You can list these prefixes using the "ip6prefix" property, which is an array of strings.

WireGuard also allows you to specify a list of unique IPv4 or IPv6 addresses using the "addresses" property. This is an array of strings that can be used to configure your tunnel endpoints.

Additional reading: Openwrt Disable Ipv6

Here are the properties that can be added to the WireGuard schema:

WireGuard Peers can also be specified using the "wireguard_peers" option. This allows you to configure a list of WireGuard peers, each with its own properties.

A different take: Wireguard Openwrt

In OpenWrt, you'll encounter some specific terminology that's essential to understand.

PHY stands for physical interface, which can be shown using the `iw list` command.

A VIF, or virtual interface, is presented in the system as a `wlan*` network interface, and there can be several VIFs for each PHY interface.

To set up OpenWrt, you'll need to log in to the device's web page using its IP address, which is usually `192.168.1.1`.

The default username is `root` and password is blank, so leave it empty.

To set up your device, you'll need to start by logging in to its web-page using its IP address, which is usually 192.168.1.1. The username is root and the password is blank, so just leave it empty.

You'll then need to navigate to the network interfaces page, where you can add a new outgoing network interface with the name wwan and set it up as a DHCP-client. Don't enable bridge on this interface, as it's not compatible with station vif.

Once you've created the interface, navigate to the firewall configuration page and add a new firewall zone. Set the input to accept and enable masquerading for outgoing traffic.

Here are the key steps to follow:

After setting up the firewall zone, navigate to the wireless configuration page and add a new station vif. You'll need to scan for available networks, select the correct channel, and set up WPA/WPA2 encryption.

In the world of network interfaces, there are two key terms you should know: PHY and VIF.

A PHY, or physical interface, is not shown in network interfaces but can be displayed using the "iw list" command, which provides detailed information about the interface.

There can be several VIFs, or virtual interfaces, for each PHY interface, which are presented in the system as "wlan*" network interfaces.