OpenWrt 24.10.0 – First Stable Release | Hacker News Reader

OpenWrt 24.10.0 – First Stable Release

openwrt.org

308 pointspm2222155 comments

OpenWRT is pretty great at offering features and security for consumer devices. Glad to see a release!

I used it for a while, but after I've had it for a few months, and want to improve/diagnose something, I can't easily tell which config I've changed from defaults, and so can't easily diagnose how I might have screwed it up, or predict how changes will impact the rest of the system.

I moved my router to NixOS, where I can now see the ~250 config that covers the custom setup needed for my ISP/LAN.

If asked, I'd still recommend OpenWRT for most techies, since it's easier to get started.

What hardware do you use for your router?

I use a https://www.pcengines.ch/apu2.htm with a separate wifi access point.

That's EOL now, so nowadays I'd look to ARM e.g. https://radxa.com/products/network-computer/e52c

I use ancient+cheap netgear SOHO routers (WNDR3700 v1 and v2 from ~2012) which can route 940Mbps on ethernet (with software flow offloading enabled).

For wireless AP i have an Mediatek MT7621 device, they are very well supported and provide proper wifi throuput

https://protectli.com/ Good quality devices. Real serial consoles to allow recovery when you make a networking configuration mistake ;-)

Same here. Alpine Linux on top of that + Unbound DNS, dnsmasq for DHCP, netfilter, chronyd for time. I've never been able to make them break a sweat.

Curious: how did you set up firewall (nftables?), IPv6 delegation both ULA and public prefix? Happy to read if you have a write-up somewhere.

I disabled IPv6 as my little ISP has not yet figured out how they want to bill for or assign/segment it out for static assignment. I have multiple static IPv4 addresses. I only use static IP's but that is a requirement specific to me. The firewall is very simple and just forwards packets and uses a simple IPv4 SNAT. The only time I've had it set up more complicated was when a guest was abusing P2P so I had to block it using string matches on the unencrypted commands.

My setup is honestly simple enough that a write-up would not benefit many. My Unbound setup to block many malicious sites is also fairly well documented by others. The null routing of commonly used DoH servers is straight forward. My Chrony setup would just annoy people as I only use stratum-1 servers and the options would just look like cargo-culting to some.

About the only thing not commonly discussed is the combination of thc_cake and some sysctl options to keep buffer bloat low but OpenWRT has their own take on that topic already.

Yeah, it's awkward that the usecase where I really want to be able to see (or really, commit) all my configuration like that is the place where I can't fit NixOS:( There was nixwrt, but that got discontinued. Actually it looks like Liminix is a thing now; I'll have to look at that.

There's hardware that has the form factor of a router, but is powerful enough to run an ordinary Linux machine. PC Engines, various ARM64 SBCs.

While this sounds good, you could just dump the contents of /etc into git and it would work about the same.

On most openwrt devices you can compare /rom/etc/config to /etc/config (though this will get you a bunch of automatic changes as well).

GP missed this basic fact and then moved to NixOS for a router target? What!?

I use NixOS, btw

Is nixos new arch?

For sure. I feel like the arch joke has played itself out.

I use arch, btw.

As an Arch user I've always been a bit confused by the joke. I have more shit go wrong on my Macbook. Sure, on Arch I might get a bad Nvidia driver update and either have to roll back the driver, kernel, or both[0] but these are at least easily fixable. You can easily determine the problem, fix it, and you've learned how to avoid it or resolve it in 5 minutes if it happens again (thanks Nvidia ;). Other than that, the only breaking things are when I'm fucking around, and well... that seems like my own damn fault lol. But several Macbooks I've had will go to sleep and if I try too fast to wake it up I'll have a black screen that can't be recovered until I reboot. And I could go on about how weird and infuriating some shit is and how I can't even implement a fix myself and I just give up because I don't want to waste time fighting Apple and play that cat and mouse game with no good documentation. I've just come to understand that "just works" means "not as buggy as Winblows".

[0] https://forum.endeavouros.com/t/only-black-screen-after-logi...

AFAIAA the joke comes from Arch's purported superiority (rolling release, close to upstream, bleeding edge, KISS) as compared to "bloated/slow" e.g. Ubuntu. It's kinda old now and existed even before the controversial switch to systemd from SysVinit/rc.conf.

Tbh I thought that it was because people are scared of the terminal, this even somehow includes people who have used Linux for a decade. That and that basically you're forced to use the terminal for Arch and read the instructions.

So kinda like how people joke about Ikea furniture being difficult to build. I mean... it's not, it's quite intuitive. But even if it wasn't then it's purely an exercise in ability to read instructions

Isn't arch just linux for people who can't install gentoo?

Gentoo is old arch.

Isn't Arch just Gentoo for people who think 90% of the time the provided build instructions are sufficient.

Does it run doom? Debian?

He was missing a config to compare to previous versions so it makes sense from that perspective.

Could always add a git repo to track changes to config files if you need the full history.

Tracking config via VCS is great, but the automatic changes is what then makes it tricky to understand what you've actually configured.

I had a look more into this. https://www.reddit.com/r/openwrt/comments/114kv0y/weeding_ou... has some people with the problem that I'm trying to avoid.

I see the fresh re-install suggestions probably work but that's tedious and risky.

That's not complete, though, is it? Ex. if I follow https://openwrt.org/docs/guide-user/network/wifi/wifiextende... most of the config is covered, but not the parts that disable daemons.

On virtual routers there is no content in /rom. What you can easily do is install another copy of the same image on another VM or container and run it through firstboot. Make a backup and compare it with a backup from your running system. Even better is to make a backup just after firstboot, then use the system and compare your current backup with the first one.

Do keep in mind that the OpenWRT backup does not contain information about which extra packages were installed after firstboot. I solved this adding a cron job which runs opkg list-installed > /etc/opkg_installed.txt and adding that last filepath to /etc/sysupgrade.conf so it gets added to backups.

If you have an overlay, you can do something like this to list user-installed packages only:

    ls /overlay/upper/usr/lib/opkg/info/*.list | sed -e 's/.*\///' | sed -e 's/\.list//'

There is no overlay on ext4-based virtual routers.

    # mount|grep ext4
    /dev/mapper/pve-vm--501--disk--0 on / type ext4 (rw,relatime,stripe=512)

The /overlay directory exists just like the /rom one does but they're empty:

    # ls -l /|grep -E 'overlay|rom' 
    drwxr-xr-x    2 root     root          1024 Jan 27 23:53 overlay
    drwxr-xr-x    2 root     root          1024 Jan 27 23:53 rom

These are empty directories (there is a note file in /rom with some info for those using squashfs which is not applicable to these installations).

Why not both? I also use NixOS as the main router/fw/nat, and OpenWRT in bridge mode as dumb APs.

All updates except semi-recent DSA changes were seamless.

Me too. My TP Link EAP605 is an AP running OpenWRT. Works well.

Are there well maintained nixos based router projects?

Not that I'm aware of.

systemd-networkd + kea + corerad is the software I use.

Will have to look at kea and corerad. What hardware do you use for the wireless links? Intel has been very hit or miss in my experience. And the misses suuuck, like after enough hosts connect, you get kernel panic on every new client connection, or all but the one device I needed a separate wlan for are compatible with the host. So, NixOS on a router that doesn’t have to be a wifi ap is extremely nice in my experience.

For wireless I started with the PC Engines miniPCI cards, but moved to a seperate AP for wifi6, and because hostapd was not fun.

https://openwrt.org/toh/tp-link/eap615-wall is the device I use as an AP, which runs OpenWRT.

I also have a separate AP with OpenWRT (UniFi with OpenWRT).

Running a router built with systemd-networkd and kea myself, and I quite like both, even though I have not integrated them with each other. Would you be willing to share some details on how you use these components? Especially corerad as I am not familiar with it and wonder on the why+how, considering networkd does NDP. Thanks

systemd-networkd sets up a LAN interface, which Kea then serves DHCP for.

CoreRAD is about the same thing, but for NDP instead of DHCP.

I could have used systemd-networkd for serving DHCP and NDP, but prefer to use separate modular privilege-separated deamons, especially if I get memory safety too.

Just saying, I'd be interested in a blog post if either of you did one.

> OpenWRT is pretty great at offering features and security for consumer devices

That's a misconception. Nobody actually cares about security for packages that are not in the default install. For example, the initscript for sstp-client disables certificate validation unconditionally, see https://github.com/openwrt/packages/issues/25212

Good job on raising that issue. TIL SSTP.

> Nobody actually cares about security for packages that are not in the default install.

Probably an exaggeration, but it's clear there are some packages that are insecure out-the-box.

It at least offers more security than the usual alternative on a consumer router of the manufacturer's OS (i.e. something updated once a decade running linux 2.6 with GPL-violating unreleased patches so you can't update it yourself, all written in C by the contractor that bid the lowest).

If others think this is in jest, there are recent TP-Link routers with 2.6 kernel and Broadcom.

   cd /etc
   git init
   git add .
   git commit -m 'default config'
   git remote add ...
   git push
   # modify your configs
   git diff HEAD
   git commit -m 'yay i changed stuff and i know what i did'
   git push

To see what was changed, I use the option to download a backup of the configuration, and compare it with an older copy I had downloaded earlier (it's a set of text files, it can be unpacked and compared with recursive diff).

How does the size of OpenWRT compare with the size of NixOS.

https://discourse.nixos.org/t/how-minimal-can-a-nixos-image-...

https://openwrt.org/supported_devices/432_warning

Size is a limiting factor for so.e hardware and architecture too.

NixOS works well for x86-64 and aarch64, but not so much armv7l, as so many consumer routers are.

The PC Engines happens to be x86-64 with decent storage expansion, but for sure if you want to target armv7l, NixOS is not a good choice.

Nice to hear PCEngines is still in business.

The website for the US distributor listed on PCEngines webssite is now selling "BoingFire" products instead of PCEngines.

https://manestate.com

OpenWrt is great. I recently got 10 Gbit internet at home and had to replace my Ubiquiti USG3, and running OpenWrt on a Lenovo Tiny PC is easy and efficient.

OpenWrt 24 adds support for configuring the ISP's IPIP6 tunnel I need to access IPv4 on my IPv6-native connection - for now I've been manually installing the newer package straight out of the 24 RCs into my OpenWrt 23 install but now I guess I can upgrade the whole install!

I also tried pfSense/opnSense but it seems like the FreeBSD kernel struggles with 10 Gbit network connections without picking very specific hardware, but Linux works perfectly (had a similar experience with TrueNAS CORE vs SCALE)

Excuse me but what do you need 10Gbps internet for? What is the use case? I get the cheapest thing that Comcast provides (50Mbps) and it seems to be enough for the 5 of us at home, everybody always streaming, gaming etc. I have an old asus router I got used in 2015 that I repaired with zip ties otherwise it powers off. At work we have 'infinite' internet (on a class A IP block) and I do not feel any difference in browsing or streaming (obviously I do if I need to transfer a file)

The use-case is because it's so cheap, why bother with anything less.

Currently, I can get 1Gbps Internet for $15, while the cheapest package is 200Mbps for $5. I expect they'll offer 10Gbps in my area in the next few years for the same cost as the 1Gbps now.

Still, at that speed, the router CPU can actually become the bottleneck, and OpenWRT currently has pretty poor support for hardware accelerated routing.

> at that speed, the router CPU can actually become the bottleneck

I was pretty worried about that, but the machine I got for my OpenWrt router is a Lenovo ThinkCentre Tiny with a Core i3-8100T CPU ($80 used with SSD/RAM etc included), and it's seems like it's way overkill, even at full bore the CPU usage appears to be negligible. Power usage is the same as the ISP router at about 17W idle, 24W routing 10 gbit, and that's with a 10 Gbase-T SFP+.

It helps that with a 10 Gbps pipe you don't need to run any kind of fancy QoS algorithms or anything...

With "modern" developing you send whole operation systems images back and forth (docker) or you download AI models, statistics, etc that are many hundred GB. It's nice only having to wait seconds rather then hours. A 10Gbe line usually does not mean dedicated 10Gbe internet exchange, it usually means many people are sharing the same 10Gbe line, so you do not always get the full bandwidth.

The price is the same as 1 Gbps ($30/mo) and I built the router out of $100 of parts, so it's kind of why not? It's nice when there are 10 GB updates to download, running off-site backups, and I can host whatever stuff I want out of my home instead of paying for a VPS on someone else's machine and worrying if it doesn't have enough RAM or something.

How do you connect your PC to the router?

For a desktop, 10 Gbps PCIe NICs are not expensive, especially if you go for used ones on eBay.

For a laptop, the Thunderbolt adapters are still expensive, but 2.5 Gbit adapters are very cheap if you can handle that limitation.

I pay 22€ per month for a 10Gbit, so I can definitely afford it. Plus very useful for self hosting

> IPIP6

Can this be used to replace NAT64?

Very specific hardware? An Intel NIC (x520 variant) is about it which can be had for cheap off eBay. If you’re trying to do line rate IPS, you’re going to need a modern cpu, but that’s the case regardless of OS.

Might have to do with the tunnel? If much of the traffic is going through a tunnel, that's probably all hashed to the same rx queue and could overwhelm a less capable cpu?

I've always had good experiences with the Intel x520/x540 10G nics on FreeBSD though, and given the eBay pricing, there's been no reason for me to explore any other offerings. Sadly, my recently installed fiber internet is 1G only, but maybe one day they'll update; but I can't really test if my system can do 10G without a proper upstream.

The NIC is an Intel x520. pfSense/opnSense both maxed out at routing about 5-7 Gbps with about 20% CPU usage (I'm assuming one core maxed) with the default config (so no IPS or QoS or anything configured, just basic NAT)

Tried a bunch of the random tunables people were posting on forums, tried turning on the hardware offload the manual says you shouldn't touch, it made no difference.

Modern OPNsense shouldn't be single threaded on routing. I guess without knowing the exact CPU it's tough to say, but a xeon-d will easily do 10Gbe routing which is ~1700 single core passmark, 11k for all cores.

https://www.cpubenchmark.net/cpu.php?cpu=Intel+Xeon+D-1541+%...

To me at least it looks like it's throttled on a single core https://kalleboo.com/linked/opnsense/vmstat.png

Vs Linux/OpenWrt which still has somewhat lop-sided CPU usage https://kalleboo.com/linked/opnsense/openwrt-htop.png

The CPU is a Core i3-8100T, which should handle it fine based on that CPU benchmark site

I always wanted to try OpenWRT but was put off by the necessity of doing hardware modifications to stock routers to gain root access. So naturally, once I found out that they were releasing some official hardware for OpenWRT (the OpenWRT One router), I ordered it as soon as possible. The router is excellent! It solved my bufferbloat issues and much more.

You must have had a bad luck/small sample size as majority of consumer routers can be flashed to OpenWRT by selecting the firmware file on the admin page and letting do its thing the exact same way as the original manufacturer update, or by using a TFTP recovery. From the top of my head, I recall only Xiaomi routers needing to be rooted/exploited.

Just get a

  Banana Pi BPI R4 or 
  NanoPi R6S

they have microSD slots and/or NVMe. Or just an x64 device (Intel N100 or N305) with multiple network ports.

I don't think the nanopi r6s has an NVMe slot, but the r6c definitely does

R5s has one :-)

Oh great - I don't need another nanopi and yet I'm now going to check out the spec/price for that one.

NVMe is great for adding swap and frequently updating containers.

Edit: just checked and it's only got 2 or 4gb ram so I'm less interested in it.

R5s has a garbage CPU that won't be able to handle QoS on probably >250mbps.

I'd avoid anything arm based that doesn't have a7x cores (ideally a76/a78 or newer, though I don't think there's any SBC socs using the a710/715/720 yet). A55 cores are old stupidly slow efficiency cores (area efficient, not power efficient).

Over the last few years I had several spare routers laying around. Never had I one that I could flash like you described. All had memory or RAM limitations. Maybe the spare routers I had are just too old.

OpenWrt One is based on Banana Pi anyway. And it comes already assembled, with the Luci GUI working out of the box, etc. In other words, it is a nice package for those who DON'T want to any screwdrivers to be involved just to get it actually running in your home.

Amazing you'd suggest an R4 given it's support is fundamentally broken.

Sinovoip's OEM build is an ancient 21.02 one. Whereas in the official one wifi is completely broken, working SFP is pure luck as "many" modules (all four fiber ones I've got here) on kernel 6.6 either don't show at all or just fail to come up. This was known to OpenWrt's mediatek maintainer who preferred to "spot and fix" it on the go:

https://github.com/openwrt/openwrt/commit/6257ea018a7d5b8d4b...

Meanwhile there are about two kernel devs working on mediatek in their free time who've only begun upstreaming R4 support, eg. Frank W.'s DTS parts… for kernel 6.14. (The other dev is Eric. W.)

To quote Frank W.: "The patches i posted are mainly patches adding basic support,only slightly changed to get accepted for mainline. There is no network part yet,also no sfp. Maybe i add sfps in next round,but without full network part (which is much work) it will not work." ( https://forum.banana-pi.org/t/bpi-r4-and-sfp/16945/330 )

Edit: The R4 also needs a soldering mod for certain SFP modules, and prior board revs have resistors that break SFP if NVMe is present (I'd say: sure to get 1.1, but Sinovoip originally shipped that rev broken as well, and didn't increment to 1.2 for the fixed ones).

Didn't know that. Thanks for posting this and taking the time.

just go to the wiki and get the most expensive and recent device marked as fully supported.

then install is as easy as flashing a file via the stock ui.

i dont get people going with the free alternative (wich is great for a lot of people on a budget) and then crying its harder then the thousand dollars alternative.

> I always wanted to try OpenWRT but was put off by the necessity of doing hardware modifications to stock routers to gain root access.

This is almost never required. They have a long list of supported devices, so unless you're trying to put OpenWRT on a device you already have that requires hardware mods, you should be able to easily find a compatible device that doesn't require this step.

All routers should use OpenWRT as a base

I am sure TPLink already use OpenWRT as base for many routers

Lots of them seem to in fact do, even if they don't advertise it :)

UniFi access points run OpenWRT. The latest beta releases for the U7 series for example is on OpenWRT 23.05.

Lots of them do, with their own crappy webui that conceals all the useful functionality.

I recently found out I do not need the main Wi-Fi anymore at home so I do not really need my main OpenWrt physical router anymore (I still need a the secondary AP running OpenWrt for IoT devices).

So I am going to now run my OpenWrt router as a VM on one of my home server just to get rid of some cables and clutter.

I really love OpenWrt but was tempted to try something new like pfSense or OPNsense, mainly because I now find PF way less confusing.

I also saw some people just love to build routers with OpenBSD and there are some great guides out there [0]

Any opinion or alternative I should consider?

- [0] https://openbsdrouterguide.net/

The next time I build a main router, I'm planning on using a Banana Pi R4. It is supposed to be able to run OpenWRT with no issues.

Upside is the ability to have 10G

Hopefully this is a simple question. I have a busted (seemingly) EdgeRouter from Ubiquiti that needs replacing.

I am currently on an old ASUS that was from the before times and it's "fine" but not updated any longer (even with the 3rd party firmware). So I'm in the market to get something new.

What's a nice all in one unit for OpenWRT? I have a very small 1000sqft house so generally speaking I have zero issues with range and everything is wireless anyway. I just want reliability and set it and forget it, generally speaking.

Check out teklager, I suspect they have the best option for you but my research on this was done about 2 years ago so you might want to have a look around. There's cheaper options that come from China but I am paranoid about back doors.

https://teklager.se/en/knowledge-base/which-router-should-i-...

I recommend a Dynalink AX3600. Really fast CPU, tons of RAM, great WiFi, and works perfectly with OpenWrt. $59 on Amazon.

I've been running an old Netgear R7800, as an all-in-one plastic OpenWrt router+switch+WiFi.

It's been so solid, that I haven't bothered to move to the Netgear RAX120v2 that I bought as an OpenWrt upgrade. (It tested fine with OpenWrt 24-rc, then I put it in storage for a more pressing occasion to upgrade.)

I also got a Netgear WAX220 WiFi AP, which I put OpenWrt 24-rc on, and tested with an OPNsense box (since OPNsense isn't good for WiFi). I decided I preferred OpenWrt for my simple needs for the router, but it's a nice enough OpenWRT WiFi AP that I expect to need it again someday, maybe to hang off a beefy OpenWrt PC-based router that's running IDS/IPS or something.

I went searching the OpenWRT forums and wiki for recommendations and ended up with the GL.iNet MT-6000. The stock firmware is a gui around a modern OpenWRT and they don’t try to lock it down at all so flashing is easy.

Seconded. The MT-6000 is basically the gold standard for OpenWRT at this point in time.

Thanks, I ended up going with this one. Looks like there's a new Flint 3 coming, but rumors seem to be indicating it is going to be more expensive and is possibly not OpenWRT compatible due to chipset. So, Flint 2 it is for now.

Take a look at OpenWRT One.

I'm happy with OpenWRT on a NanoPi R4S, but that doesn't have wifi built in.

Probably won't apply to you but for rackmount I have a Gigabyte GA-IMB410TN + Pentium Gold G6405, in a 1U Logic Case SC-1280, with a quad-port 2.5 GbE Realtek PCIe NIC (r8125) to supplement the motherboard's dual 1 GbE Intel NICs (igb & e1000e).

The motherboard can run off of 12-19V DC input via 5.5mm barrel jack (e.g. any old unused high-power laptop charger), or 12V via a 4-pin CPU EPS power connector (they are commoned together). Since the case comes with a 250W 1U Flex ATX power supply, I'm doing the latter.

This lets me take the PSU's 12V rail out via the barrel jack (edit: with 18 AWG cable, I know) to power the modem and a couple of TP-Link 2.5 GbE network switches which all run on 12V, saving 3 wall warts. Both switches are velcroed to the top lid with 20cm patch cords for 2.5 GbE ports 1 and 4. I have 5 LANs at home, so the 6x wired ethernet ports this gives me are perfect.

OpenWRT runs pretty great on amd64 and I've been running the v24.10 branch (pre-release) for several months on it without issue.

I'm disillusioned by OpenWrt. For a few years I did pull requests adding packages, fixing stuff, improvements. Only the minimal 1-2 lines PRs were accepted and merged, while big important changes that I worked on, tested and keep updated for years were never merged. Most were simply ignored with no feedback.

Instead they seem to focus on getting GPUs and Doom working... and now they even do hardware dev. And it's not even decent hardware, it's crippleware ewaste hardware.

APK will have to wait till 25.

For those who didn't immediately get it, it looks like openwrt is trying to move to the package manager from Alpine Linux: https://openwrt.org/docs/guide-user/additional-software/opkg...

Btw what's the go-to device / vendor for OpenWrt these days? Seems like tplink is lagging behind with my last Archer C7..

It depends on the features you want. My approach is to search in their supported devices, and sort by ram.

I just get a small x86 box and then buy stand alone POE access points for wifi.

Same. NixOS with some cheap 2.5G ethernet cards and a ubiquiti AP.

Power draw is pretty low and I don't have to deal with yet another ecosystem.

Don't misunderstand me, I've used OpenWRT on many things including an original WRTgl, but I'd rather something boring these days.

GL-Inet Flint2, maybe?

Just got 2 of these a few days ago and am super happy with them. The firmware it comes with is essentially OpenWRT with a fancier UI so that means that you can use an OpenWRT sysupgrade image to flash it to OpenWRT with no issues. WiFi6 and Hardware Flow Offloading (HFO) are super nice features of this particular router. Downside is that it has 4 1G LAN ports and 2 2.5G (1 WAN, 1 WAN/LAN) ports, so you're kind of stuck with gigabit.

I use a flint2 as the router for my 2Gbs internet connection, a Wireguard VPN server and to provide network connectivity for devices in my garage which is where the router lives.

I use the 2.5Gbs WAN/LAN port to uplink it to a switch in my basement where all my cabling terminates and a small rack lives. This switch then provides a mixture of 2.5, 5 and 10Gbs ports.

The point being that the flint2 doesn’t limit me to 1Gbs.

I replaced my Archers with glinet Flint 2 devices.

It should be noted that GL-Inet does not support or is affiliated with OpenWRT in any way. More on that: https://news.ycombinator.com/item?id=42285923

For those that may not be aware if you are interested in the Flint 2 but havent purchased yet Glinet is releasing the Flint 3 soonish (they have a product page up saying coming soon). Not much is known about it other than it will be wifi 7 compatible

https://www.gl-inet.com/products/gl-be9300/

It's using Qualcomm IPQ53xx, so will take a while before it's supported by Linux/OpenWrt. I don't think even IPQ50xx has been merged yet.

Edit: http://download.gl-inet.com/releases/qsdk_v12.5/kmod-4.7/be9...

There is also the router made in partnership with OpenWRT, the OpenWRT One. I’m using one right now and it has been very stable just on the RC builds for this release for a few weeks now. This is the first actual release supporting this device. The device itself is pretty nice with a JTAG header on the board so it's pretty clear that it is a hacker-friendly device. Haven’t needed to use that yet though…

As others have mentioned, the OpenWrt One is great. 2.5Gbps WAN port makes it future proof, currently using it as the gateway for the residential 1Gbps fiber.

Next hurdle is to make ISP upgrade their ONU to have a 2.5Gbps port so I can get ACTUAL 1Gbps out of it, but it will likely also mean they need to upgrade the entire string of GPON equipment, so likely have to wait for a bit.

Also have success with OpenWRT on the ultra low cost Mi AX3600, while hardware acceleration is not supported, it is nice to not have to run out of date Chinese firmware.

I needed to answer that question a month ago. The One felt too untested. Most people recommend the Flint2, but it felt expensive. So I landed on the asus RT AX53U

For routing, x86 is going to have the best perf for CPU intensive tasks like QoS. For wireless, mediatek is well supported upstream. WiFi is wifi 6 only though. Wifi 6E and 7 are in the works but will take a while to stabilize. My set up is an old lenovo thinkcentre nano IoT box as the router and netgear wax220 as AP, both running openwrt.

WiFi 6E works fine on OpenWrt, it's just that there are only two routers supported in ToH SmartRG SDG-8733 and SDG-8734. It works out of the box (I tried just as a test) on my MT7922 (RZ616) card in my PC.

Who sells them? I don’t see any in stores.

For Wifi, things with the ath9k was the gold standard for a while, though then Qualcomm bought Atheros, but supposedly the followup ath10k/11k/12k drivers are decent too.

Mediatek MT76xx/79xx (mt76 driver) are also considered very good.

See https://github.com/morrownr/USB-WiFi/blob/main/home/USB_WiFi... (yes this is specifically about USB adapters, but usually the same driver is used for built-in WIFI in access points as well)

https://wireless.docs.kernel.org/en/latest/en/users/drivers....

This release also supports the latest Realtek RTL8169 drivers, popular with inexpensive mini PCs. Great job, OpenWrt Team!

Asus RT-AX89X works pretty well with OpenWRT now (make sure it's revision B, avoid any A revisions).

But if you want 10 Gbps for wired connection with upstream support, you need something else (like DEC750 which has no wifi).

GL.inet makes routers with a fork of OpenWRT. The actual OpenWRT is only a flash away (you can flash the upgrade directly from the stock firmware). Their products are very solid and I will probably buy routers exclusively from them going forward.

I would suggest checking out their Table of Hardware [0]. You can filter it by various fairly detailed criteria.

From my experience, given the local availability constraints, I often only get a handful of practical options to choose from.

For something like a successor to TP-Link Archer C7 with WiFi 6 support, I have chosen TP-Link Archer AX23 [1] and it seems okay to me so far as a cheap wired-to-wireless edge device.

[0] https://openwrt.org/toh/views/start

[1] https://openwrt.org/toh/tp-link/archer_ax23_v1

As previous owner of Archer C7, Archer AX23 barely upgrade if you want to install additional packages as it have same 16/128 flash/memory configuration just like C7.

Personally I upgraded to xiaomi Router AX3200 with 128/256 flash memory configuration and 4:4 MIMO, though it lacks USB and have WAN+3LAN ports compare to usual WAN+4LAN.

Really looking forward to that one.

I'm a SRE and love to work with infrastructure, tweak things, etc, and have my own home lab. For years (decades?), I have gone the DIY route with networking gear and it's been painful to tell family "oh, just another 15min or maybe 4h and this will work great?" after I was updating things or messing around.

This year I decided to replace all networking equipment with Ubiquiti (gateway, APs, switches). It's really expensive and it makes me feel like a sell out but I have had zero issues (it's been 6 months now).

I'm really happy that OpenWrt has a stable release and others continue to make progress. I'll probably be deploying some _spare_ devices that won't break my main network, try patches, submit bugreports, etc. But I'm enjoying the peace of mind now.

Not contributing much to the discussion about OpenWrt, sorry.

My experience has been the opposite. I've had OpenWRT gear running rock solid for more than a decade, and a box full of Ubiquiti gear that no longer gets updates, doesn't work with recent management software, and some that's even been resuscitated back to usefulness by flashing with OpenWRT.

It's not selling out when you're running a critical production system for a small number of users (the people in your house). You made the right choice.

I looked into Amplifi based on your comment and it looks like they haven’t updated the line since 2022 and people are speculating they may exit the home market. Did you worry about this?

Actually ubiquiti doesn’t have any more to sell and the product is being bid up past 2x on Amazon. I guess we’ll find out if the line has a future soon.

I didn't know that, thanks. However, I didn't buy anything from the Amplifi line. I'm using the UCG-Ultra gateway, U7/U6+ access points and their standard switches.

Thanks for the details! Interesting.

Just upgraded. All customization were automatically applied with no issues so far. Amazing work OpenWrt team.

I've generally had success with openwrt upgrades, however when reading the release notes it seems my target has now converted from swconfig to DSA which means all configuration has to be done from scratch. Oh well, I didn't have that extensive configuration anyway.

Is there a recommended hardware and step by step guide for those new to this? Can you do mesh networks?

> Is there a recommended hardware and step by step guide for those new to this?

What exactly are you planning to do? OpenWrt is quite flexible. There's this https://openwrt.org/toh/buyerguide.

> Can you do mesh networks?

Yes. Note also https://openwisp.org/ if you want to do a whole fleet of OpenWrt routers.

I've always found openwisp to be tailored to massive fleets of OpenWrt routers (100+). Not really for a home setup where you have a handful of devices (5-10). Alternatives are welcome since I haven't found anything yet.

this non-official version (uses upstream TOH data though) is much more responsive and has better filters: https://soif.github.io/OpenWrtTOH/

Wiki has you covered for beginners guide

This is a great resource. Should part of the official project.

https://forum.openwrt.org/t/better-and-faster-table-of-hardw...

The OpenWRT One is a good starting point, if it covers your needs.

It sounds great, but is there any way to receive those from a retailer based in the U.S. rather than shipped from China?

Where do you think the US retailers get them from?

Based on reddit [1] and other some other recommendations I got an asus ax4200 and put openwrt on it. I'm fairly happy, but some people have run into connection dropping (possibly due to ISP power saving resulting in link dropping down to 10 mbs, and something then goes wrong.) With forum help [2] I found a workaround: either turn off auto negotiation (works) or using a lan port as a wan port (have not tried).

https://www.reddit.com/r/openwrt/comments/1cr1lvp/is_the_asu...

https://github.com/openwrt/openwrt/issues/14192#issuecomment...

Been using OpenWRT on a Ubiquity EdgeRouter X for years and it runs great, using adblock directly on it as well, granted there are no nice statistics for adblock like on PiHole but the important thing is that it does the job. Have a separate dumb AP also running OpenWRT which needs upgrading and the next router must support OpenWRT it has practically become a required feature

I’ve had quite a hard time compared to setting up my router with opnsense, but I do get how challenging it is to offer something that lets you configure everything on just about any device.

It would be quite hard getting sane defaults for all sorts of configs, e.g. multi AP setup as in my case.

i went with a mini pc, passive cooling & opnsense. It's been a great for the last few years. Stable as a rock.

OPNsense running on a mini PC with OpenWRT access points is where it's at.

Anyone know if this supports the nanopi range?

Edit: they've got sysupgrade packages for the r6c at least so the answer is yes

I'm happily running a rc of this on a nanopi r3s

I've got an r5c running friendlywrt 23 and am looking to migrate it onto an r6c that I've got (the addition of an nvme drive makes it a lot more powerful for running containers). I'm glad I waited for this release.

Go there https://openwrt.org/toh/start and enter NanoPi in the search field?

Gives 17 entries…

Yeah I should have checked there before asking. I'd just looked at the release notes

I use 24.10 with a NanoPI R5S and it works as expected.

Wifi via NVMe Adapter needed some tinkering, but Mediatek ftw.

Most time wasted for the custom 3d printed case cover to fit the Adapter + wifi antennas

Should I update my router over SSH while I'm at work, or should I just wait until I get home?

Go for it! What's the worst that could happen?

Do you have people or services at home who would be upset with an interruption until you get home? Plan for the worst reasonable case: upgrading will fail and knock your router offline until you can fix it or replace it.

I use the Merlin firmware for my Asus router. I've long heard of OpenWRT but do not know how they compare.

I used Merlin on my TM-AC1900 APs for some time. It's more or less a slightly customized build of the AsusWrt firmware, with a bit easier time for fiddling, like adding packages and shell access. The webui is the Asus ui, with some tweaks. Merlin only runs on asus devices.

OpenWrt is distribution that works more or less the same on all of the supported hardware. IMHO, the Asus firmware is reasonable, so it's not a bad place to start, but some manufacturers have pretty minimalistic firmware and IMHO, something like OpenWRT that provides fairly consistent capabilities across a range of hardware is really handy (when OpenWRT supports your hardware anyway).

I run OpenWRT on an LTE gateway, and on my new APs, although I'm running off a fork right now because the ath11k drivers in 24.10 didn't work well for me in the rc builds; hopefully after this release settles down, snapshot builds will move to the newer linux kernel and I can switch to that.

I have used merlin for quite a while, mostly happy (except for some security holes...) However, once asus drops support for older devices (e.g. rt-ac68u and rt-ac86u), merlin might also drop it. For now rt-ac68u is dropped by merlin, but ac86u is fine for now (at least until the end of the year.)

Upshot: if you care about very long term support, openwrt is nice.

Reply on news.ycombinator.com