[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: DSCP Classify - Service for applying DSCP class to connections [22.03-24.10.x]

This thread is a centralised place for discussing my nftables 'dscpclassify' service for applying DSCP class to connections.
I will update this post with up to date information as the service is enhanced and welcome ideas and people's inputs.
What is DSCP Classify?
DSCP Classify is an nftables based service for applying DSCP classifications to connections, compatible with OpenWrt's firewall4 for dynamically setting DSCP packet marks (this only works in OpenWrt 22.03 and above).
This should be used in conjunction with layer-cake SQM queue with ctinfo configured to restore DSCP on the device ingress.
The dscpclassify service uses the last 8 bits of the conntrack mark (0x000000ff).
Latest release
OpenWrt 22.03-24.10.x
Release notes
Please raise issues/suggestions for improvement
https://github.com/jeverley/dscpclassify/issues
If available please include the debug file /tmp/dscpclassify.debug as this will help with troubleshooting.
Classification modes
The service uses three methods for classifying and DSCP marking connections outlined below.
1. User rules
The service will first attempt to classify new connections using rules specified by the user in the config file.
These follow a similar syntax to the OpenWrt firewall config and can match upon source/destination ports and IPs, firewall zones etc.
The rules support the use of nft sets, which could be dynamically updated from external sources such as dnsmasq.
2. Client DSCP hinting
The service can be configured to apply the DSCP mark supplied by a non WAN originating client.
This function ignores CS6 and CS7 classes to avoid abuse from inappropriately configed LAN clients such as IoT devices.
3. Dynamic classification
Connections that do not match a user rule or client hint will be dynamically classified by the service to reduce their priority.
Multi-connection client port detection for detecting P2P traffic
These connections are classified as Low Effort (LE) by default and therefore prioritised below Best Effort traffic when using the layer-cake qdisc.
Multi-threaded service detection for identifying high-throughput downloads from services such as Steam
These connections are classified as High-Throughput (AF13) by default and therefore prioritised as follows by cake:
diffserv3/4: prioritised equal to Best Effort (CS0) traffic
diffserv8: prioritised below Best Effort (CS0) traffic, but above Low Effort (LE) traffic
Service installation
To install the main dscpclassify service via command line you can use the following commands
repo="https://raw.githubusercontent.com/jeverley/dscpclassify/main"
mkdir -p "/etc/dscpclassify.d"
if [ ! -f "/etc/config/dscpclassify" ]; then
    wget "$repo/etc/config/dscpclassify" -O "/etc/config/dscpclassify"
else
    wget "$repo/etc/config/dscpclassify" -O "/etc/config/dscpclassify_git"
fi
wget "$repo/etc/dscpclassify.d/main.nft" -O "/etc/dscpclassify.d/main.nft"
wget "$repo/etc/dscpclassify.d/maps.nft" -O "/etc/dscpclassify.d/maps.nft"
wget "$repo/etc/dscpclassify.d/verdicts.nft" -O "/etc/dscpclassify.d/verdicts.nft"
wget "$repo/etc/hotplug.d/iface/21-dscpclassify" -O "/etc/hotplug.d/iface/21-dscpclassify"
wget "$repo/etc/init.d/dscpclassify" -O "/etc/init.d/dscpclassify"
chmod +x "/etc/init.d/dscpclassify"
/etc/init.d/dscpclassify enable
/etc/init.d/dscpclassify start
Ingress DSCP marking requires the SQM queue setup script 'layer_cake_ct.qos' and the package 'kmod-sched-ctinfo'.
To install the SQM setup script via command line you can use the following commands:
repo="https://raw.githubusercontent.com/jeverley/dscpclassify/main"
opkg update
opkg install kmod-sched-ctinfo
wget "$repo/usr/lib/sqm/layer_cake_ct.qos" -O "/usr/lib/sqm/layer_cake_ct.qos"
wget "$repo/usr/lib/sqm/layer_cake_ct.qos.help" -O "/usr/lib/sqm/layer_cake_ct.qos.help"
Service configuration
The user rules in '/etc/config/dscpclassify' use the same syntax as OpenWrt's firewall config, the 'class' option is used to specified the desired DSCP.
A working default configuration is provided with the service which should work for most users.
The service supports the following configuration options
Config option Description Type Default
class_bulk The class applied to threaded bulk clients string le
class_high_throughput The class applied to threaded high-throughput services string af13
client_hints Adopt the DSCP class supplied by a non-WAN client (this exludes CS6 and CS7 classes to avoid abuse) boolean 1
threaded_client_min_bytes The total bytes before a threaded client port (i.e. P2P) is classified as bulk uint 10000
threaded_client_min_connections The number of established connections for a client port to be considered threaded uint 10
threaded_service_min_bytes The total bytes before a threaded service's connection is classed as high-throughput uint 1000000
threaded_service_min_connections The number of established connections for a service to be considered threaded uint 3
lan_device Manually specify devices that the service should treat as LAN list: string
lan_zone Manually specify firewall zones that the service should treat as LAN list: string lan
wan_device Manually specify devices that the service should treat as WAN list: string
wan_zone Manually specify firewall zones that the service should treat as WAN list: string wan
wmm When enabled the service will mark LAN bound packets with DSCP values respective of WMM (RFC-8325) boolean 0
Example user rule
config rule
 option name 'DNS'
 list proto 'tcp'
 list proto 'udp'
 list dest_port '53'
 list dest_port '853'
 list dest_port '5353'
 option class 'cs5'
 option counter '0'
The counter option can be enabled to count the number of matched connections for a rule.
The OpenWrt firewall syntax is outlined here.
SQM configuration
The 'layer_cake_ct.qos' queue setup script must be selected for your wan device in SQM setup,
It is important that Ignore DSCP on ingress is Allow in SQM setup otherwise cake will ignore the service's DSCP classes.
Below is validated working SQM config for use with the service
Config parameter Value
qdisc_advanced 1
squash_dscp 0, to ensure cake does not remove ingress packet DSCP values
squash_ingress 0, to ensure cake looks at packet marks on ingress
qdisc_really_really_advanced 1
iqdisc_opts nat dual-dsthost ingress diffserv4
eqdisc_opts nat dual-srchost ack-filter diffserv4
script layer_cake_ct.qos

Associated discussions
DSCPCLASSIFY in Main repo?
CAKE QoS Script (OpenWrt)
Acknowledgements
I'd like to thank
@ldir
and
@amteza
for their great suggestions and contributions!

4 Replies
16

[Assistant]
Great work!
Question: you have a WMM node in which you seem to over-write DSCPs so that intent maps to the the right (we can argue about that *) AC for each DSCP. I would argue that instead of re-writing DSCPs over and over again, we might be better of using qos_map_set to configure the desired DSCP to AC mapping for the AP and all stations instead?
*) Neither AC_VI and especially not AC_VO are without considerable side-effects on "normal" traffic in AC_BE (both by taking weighted priority in air access as well as reducing the total WiFi segment capacity by limiting aggregation duration for AC_VO), so it is arguable whether one should actually move all that much traffic to the higher classes. I know that https://www.rfc-editor.org/rfc/rfc8325 seems to endorse such usage of ACs, but I note that rfc8325 is pretty thin on studies actually showing the consequences of doing so... so IMHO rfc8325 is decent information how to map different PHBs to WiFi but one first should figure out whether one wants to give a specific PHB special treatment over WiFi in the first place.

1

moeller0:
Question: you have a WMM node in which you seem to over-write DSCPs so that intent maps to the the right (we can argue about that *) AC for each DSCP. I would argue that instead of re-writing DSCPs over and over again, we might be better of using qos_map_set to configure the desired DSCP to AC mapping for the AP and all stations instead?
Fair points, I know we've discussed before too I make use of it in my setup as my mesh APs are running stock firmware.
What I can do is make this off by default and then it's down to the user to decide whether they want to use it with their setup (which feels like a good compromise given the RFC's draft status).

2 Replies
3

yelreve:
Fair points, I know we've discussed before too I make use of it in my setup as my mesh APs are running stock firmware.
Good argument! I had only considered the full OpenWrt APs case here and forgot about non-qos-map configurable APs at all.
yelreve:
What I can do is make this off by default and then it's down to the user to decide whether they want to use it with their setup (which feels like a good compromise given the RFC's draft status).
That would be a safer default IMHO that still allows users to opt in (I am a big fan of opt-in, but also of sane defaults and here the best path is unclear to me).


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Simple-adblock: fast, lean and fully uci/luci configurable AdBlocking

THIS HAS BEEN REPLACED BY adblock-fast, PLEASE USE THE NEW PACKAGE!
Here's the story -- I was impressed by the elegance and simplicity of bole5's (from OpenWrt forum) single-file adblocking script and started tinkering with it a long time ago. I kept working on it and now turned it into simple-adblock and luci-app-simple-adblock (with some help/suggestions from
@hnyman
and
@dibdot
).
There are a few things which differentiate this from another excellent adblocking solution by
@dibdot
:
It's very fast.
It understands hosts files and domains lists only (to keep it lean and fast).
Everything is configurable from Web UI and uci commands.
You can add your own domains to whitelist or blacklist.
You can add URLs to your own blocked hosts or domains lists to block/whitelist.
Requires no configuration for the download utility wherever you want to use wget/libopenssl or uclient-fetch/libustream-mbedtls.
Installs dependencies automatically (DD/LEDE-default uclient-fetch libustream-mbedtls).
Just like
@dibdot
's solution:
It uses dnsmasq to return "domain not found" (thanks
@dibdot
for the suggestion!) for blocked domains/hosts with no memory footprint for its own code .
It defaults to DNS-hijacking, so if you have local devices on your network with hardcoded DNS servers, simple-adblock will force them to use your router DNS server (both IPv4 and IPv6) instead.
The actual speed will depend on your router model and connection speed, but because it uses simple sed substitutions to process the whole list in one go and because it backgrounds processing of already downloaded data while the next list is being downloaded, it's pretty quick.
Check out the README for more information/instructions.
Both packages are available from my repo: https://docs.openwrt.melmac.net/#on-your-router
I welcome any feedback!

23

[Assistant]
In 1.5.5 I've added an option to assign one of the router LEDs to indicate adblocking status (on/off).
Can be set in config file/uci command or Web UI.

3

Thanks for simple-adblock! I'm really impressed with how lean it is, while still being very functional!

1

Now in official repo for trunk/snapshot images. For everything else -- there's my own repository.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: [facinstall] Package for easy installation factory images

I made a convenient tool for installing factory images or for revert to stock firmware.
This package facinstall_all.ipk can be installed on any version of OpenWrt (but not lower than v21).
Supported routers
Source code: https://github.com/openwrt-xiaomi/facinstall/tree/main/files
Screenshot after check Xiaomi stock image:

19

[Assistant]
NIce work. Hope to be able to test it soon on a tuf-ax4200.
Thx

I can confirm it worked without any problems on ASUS TUF-AX6000.
Since I had issues with a snapshot, nothing else was working (other than the serial port). And this tool helped me restore my the stock firmware.
Thank you for your hard work!
@remittor
Just make sure to mention on which devices will this thing work on.

1 Reply
2

Nice work! I can confirm that the package works without any problems on the Redmi AX6000 router.
Thanks!

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Help translating OpenWrt’s web interface

Hi all,
I added an instance of weblate which helps to conveniently translate the OpenWrt web interface. There are currently 27 languages to translate, if you speak more than one language, please join in and help translating!
Hosted Weblate
OpenWrt
OpenWrt is translated into 47 languages using Weblate. Join the translation or start translating your own project.

19

[Assistant]
Will / are these translations officially used by the openwrt project?

2

I see that when translating an App (e.g. DDNS), a string that I modify is "Enabled" and is also modified in all apps with that word to translate. I mean, in one App it means one thing and in another it means something else even if it is the same word in English. I don't know if it can be deactivated or dodged.

1

castillofrancodamian:
I mean, in one App it means one thing and in another it means something else even if it is the same word in English.
Do you have one or more examples for this?


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Qualcomm Fast Path For LEDE

Repository based on openwrt snapshot is here
gwlim/openwrt-optimized-builds: optimized openwrt builds on github
Images are built by github runners with all kmod included by default on a schedule
If you want an image for your specific router you can request and I can add a workflow build profile

26

[Assistant]
On a TL-WR1043NDv1 mips24kc Router running at 430MHZ
This is the performance
Client connecting to 10.1.1.2, TCP port 5001
TCP window size: 0.22 MByte (default)
[ 5] local 192.168.1.103 port 49910 connected with 10.1.1.2 port 5001
[ ID] Interval Transfer Bandwidth
[ 5] 0.0- 1.0 sec 81.5 MBytes 684 Mbits/sec
[ 5] 1.0- 2.0 sec 78.4 MBytes 657 Mbits/sec
[ 5] 2.0- 3.0 sec 74.5 MBytes 625 Mbits/sec
[ 5] 3.0- 4.0 sec 78.1 MBytes 655 Mbits/sec
[ 5] 4.0- 5.0 sec 71.9 MBytes 603 Mbits/sec
[ 5] 5.0- 6.0 sec 77.4 MBytes 649 Mbits/sec
[ 5] 6.0- 7.0 sec 74.4 MBytes 624 Mbits/sec
[ 5] 7.0- 8.0 sec 76.8 MBytes 644 Mbits/sec
[ 5] 8.0- 9.0 sec 72.6 MBytes 609 Mbits/sec
[ 5] 9.0-10.0 sec 78.6 MBytes 660 Mbits/sec
[ 5] 0.0-10.0 sec 764 MBytes 640 Mbits/sec
[ 5] MSS size 1448 bytes (MTU 1500 bytes, ethernet)
On Wireless due to lower cpu consumption by fast path
Wireless Throughput on this mips24kc machine also improved
Iperf thread stopped [CAUSE=Stream closed]
iperf -c 10.1.1.2 -P 1 -i 1 -p 5001 -f m -t 10 -T 1
Client connecting to 10.1.1.2, TCP port 5001
TCP window size: 0.08 MByte (default)
[ 3] local 192.168.1.130 port 55582 connected with 10.1.1.2 port 5001
[ ID] Interval Transfer Bandwidth
[ 3] 0.0- 1.0 sec 13.6 MBytes 114 Mbits/sec
[ 3] 1.0- 2.0 sec 16.9 MBytes 142 Mbits/sec
[ 3] 2.0- 3.0 sec 18.0 MBytes 151 Mbits/sec
[ 3] 3.0- 4.0 sec 18.9 MBytes 158 Mbits/sec
[ 3] 4.0- 5.0 sec 17.4 MBytes 146 Mbits/sec
[ 3] 5.0- 6.0 sec 19.2 MBytes 161 Mbits/sec
[ 3] 6.0- 7.0 sec 19.1 MBytes 160 Mbits/sec
[ 3] 7.0- 8.0 sec 19.0 MBytes 159 Mbits/sec
[ 3] 8.0- 9.0 sec 19.2 MBytes 161 Mbits/sec
[ 3] 9.0-10.0 sec 13.9 MBytes 116 Mbits/sec
[ 3] 0.0-10.0 sec 175 MBytes 147 Mbits/sec
Done.

3 Replies
3

Is the patch dependent on mips24k(c)? https://lede-project.org/docs/instructionset/mips_24kc

1

No Fast Path is optimizing Linux Routing Network Stack.
Totally Architecture independent
I have it working on WDR4900v1 (mpc8548), WDR4300 (mip74kc) and WR1043ND (mips24kc)

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Optimized build for the D-Link DIR-860L

I have been building custom builds for my DIR-860L for a while now and now I hope that by sharing them they will make other people happy as well. All my releases are tested on my router before they are released. Ofcourse, these builds cater to my needs but I am open to criticism/suggestions/tips.
I am not responsible for bricked devices, thermonuclear war, you getting in a fight because you destroyed the internet, etc! By flashing this custom, custom firmware you take full responsibility of your actions. That includes knowing what to do when s**t hits the fan! There be dragons here!
What's inside?
LuCI (luci-ssl-openssl-nginx) with OpenWRT2020 theme
Apps: adblock, banIP, BCP38, SQM QoS, statistics and WireGuard
Utilities and others: ethtool, iperf3, irqbalance, nano, msmtp and wget (with ssl support)
Tweaks: built with GCC 9 and binutils 2.35.1. CPU overclocked to 1 GHz.
Changelog:
r2919: Initial release to the public
r3128: Dropped the compiler optimization flags (-Os -pipe -mno-branch-likely -mips32r2 -mtune=1004kc -mmt -mdsp) because they caused the build to fail, removed HZ = 1000 since I noticed no real benefit. Removed curl.
r3194: Added iptables-mod-tee iptables extension.
r3636: Removed luci-app-watchcat, added irqbalance and compiled with new compiler optimization flags(-Os -pipe -mno-branch-likely -mips32r2 -march=1004kc -mdsp).
r4245: Removed irqbalance and iptables-mod-tee
r4414: Upstream updates
r4426: Upstream updates (this commit should improve WiFi performance)
r4498: Upstream updates + this commit by blogic which should fix cpu core calibration!
r4577: Upstream changes (most notably newer kernel version (4.9.37) and latest mt76 driver), added BBR TCP congestion control algorithm and the fq packet scheduler (defaults are cubic and fq_codel).
r4633: Upstream changes. Most notably the latest version of the mt76 driver and a patch for the rcu_sched stalls!
r4651+1: Upstream changes and added Qualcomm shortcut-fe (thanks to
@dissent1
). Due to a derp untested!
r4714+1: Upstream changes and an updated Qualcomm shortcut-fe which should work with SQM QoS.
r4767+3: Upstream changes, most notably this commit.
r4949: Upstream changes, most notably a backport concerning the ethernet driver and an updated version of mt76. Removed addrwatch because it caused the build to fail. Removed Qualcomm shortcut-fe because it doens't play nice with SQM QoS.
r5017: Upstream changes
r5099: Upstream changes, most notably update to mt76 nand driver and KRaCK patches. Compiled with GCC 7.2.0.
r5394: Openssl optimized for speed and upstream changes most notably an updated mt76 driver which should increase throughput.
r5442: Added WireGuard and support for USB storage (untested! FAT32 and ext4 filesystems should work.) Also, as usual, upstream changes. Most notably an updated mt76 driver and an updated cake qdisc.
r5448: Upstream changes, most notably an update to the latest MT76. Instead of using the -Os compiler optimization flag, -O2 is used to fix dropbear bugging out.
r5578: Switched back to GCC 6. Upstream changes most notably an updated mt76 driver and the latest bake of cake with a brand new ack-filter which mostly should improve throughput on asymmetrical connections. Happy holidays!
r5645: Upstream changes, most notably an update to cake.
r5762: Added support for LUKS encryption. Upstream changes most notably a few bugfixes to cake.
r6009: Upstream changes most notably an updated mt76 driver and these two commits (should slightly improve rx performance).
r6150: Replaced SSMTP with msmtp. Upstream changes, most notably an updated mt76 driver and commits which fix the VLAN functionality of the switch.
r6302: Version 4.14 of the linux kernel with the modules required for Flow Offload. Upstream changes, most notably an updated mt76 driver and a couple of mac80211 commits
r6502: Upstream changes, enabled MIPS FPU emulation
r6640: Upstream changes, most notably switch to linux kernel 4.14 and support for HW NAT, huge thanks to
@nbd
and
@blogic
!
r6646: Upstream changes, added luci-app-ddns, added support for the exFAT file system
r6653: Upstream changes, most notably an updated mt76 driver
r6690: Upstream changes, most notably an updated mt76 driver.
r6705: Upstream changes, most notably an updated mt76 driver + other assorted fixes for the ramips platform.
r6795: Upstream changes, most notably an updated kernel and a fix for possible data corruption on multicore systems.
r6953: Upstream changes, most notably an updated kernel, an updated mt76 driver, WireGuard MIPS optimatization and fixes for the mt7621 ethernet driver.
r7161: Upstream changes, lots of important ones but due to my laptop dying no listed notable changes from my part.
r7188: Upstream changes, most notably fixes for flow offload.
r7274: Upstream changes, most notably an updated mt76 driver, a fixed full routed GRO->TSO offload and a fix for jumbo frames (mtu > 1500). Switched from uhttpd to nginx for LuCI, which is asynchronous so should be more responsive.
r7301: Upstream changes, most notably an updated mt76 driver.
r7493: Upstream changes, added ebtables, added new compiler optimization flag (-ftree-vectorize).
r7540: Upstream changes, compiled with GCC8, added back filesystem modules (thanks
@TPLinkUser
!) and cake now supports tc classes (aka more to mess around with).
r7682: Upstream changes
r8089: Upstream changes most notably an updated mt76 driver, updates to WireGuard and re-enabled MIPS vDSO.
r8196: Upstream changes, most notably an updated mt76 driver and commits for mac80211, most notably this one.
r8216: Upstream changes, most notably an update MT76 driver and fixes for the CAKE SQM QoS algorithm.
r8289: Upstream changes, most notably gcc-optimized inlining and enabled memory compaction
r8340: Upstream changes, most notably an updated mt76 driver and a refreshed mt7621 kernel config.
r8349: Upstream changes, most notably an updated mt76 driver (mostly cleanups).
r8467: Lots of upstream changes, most notably updated mt76 driver and wireguard. Also, banIP is now included. It creates an ipset of known bad IP addresses which is kinda neat. Should provide a bit more security at the cost of some ram.
r9239: (A lot of) upstream changes most notably an updated mt76 driver and a patch which moves irq affinity for wireless of the main core.
r9559: Upstream changes, most notably an updated mt76 driver.
r10127: Upstream changes
r11146: Upstream changes, most notably an updated mt76 driver which enables Airtime Fairness.
r11189: Upstream changes, most notably an updated mt76 driver and a mac80211 patch which should both increase performance (+/- 10%).
r11890: Upstream changes, most notably an updated mt76 driver
r12147: Upstream changes, most notably a significant fix for hostapd and a commit which fixes an issue with flow offloading. Also, flow control is disabled in this build which fixes a bug with it.
r12194: Upstream changes, most notably an updated mt76 driver. Also, flow control should really be disabled in this build and there is a full version of dnsmasq which supports stuff like DNSSEC
r12215: Upstream changes and the cosmetic fix is now properly applied
r12255]: Upstream changes, most notably an updated mt76 driver. It also containts this commit which should fix the rcu timeout issue
14905: Upstream changes, most notably patches for mac80211, changed compiler flag from Os to O2.
r15619: Upstream changes, most notably fixes for DNSpooq. CPU overclocked with 120 MHz to 1 GHz (~10% WAN -> LAN performance boost)
Downloads:
r2919
r3128
r3194
r3636
r4245
r4413 (untested build!)
r4426
r4498
r4577
r4633
r4651+1 (untested!)
r4714+1
r4767+3
r4949
r5017
r5099
r5394
r5442
r5448
r5578
r5645
r5762
r6009
r6150
r6302
r6502
r6640
r6646
r6653
r6690
r6705
r6795
r6953
r7161
r7188
r7274
r7301
r7493
r7540
r7682
r8089
r8196
r8216
r8289
r8340
r8349
r8467
r9239
r9559
r10127
r11146
r11189
r11890
r12147
r12194
r12215
r12255
r14905
r15619

8

[Assistant]
Wondering if you'll keep building off master or will switch to the 17.01 branch (or maybe provide both)?

The plan was to switch over to the stable branch with some experimental bleeding edge builds along the way.

I might be interested in buying this router, since the mediatek wifi drivers are the most opensourced ac drivers, but I am wondering whether the CPU in this router is good enough for my needs. I am using a 200/40 Mbit internet connection and I would like to be able to use the piece of cake shaper. Is the CPU in this router able to route and shape 200 Mbit of incoming traffic? Or should I look at beefier routers (probably ipq806x based routers, although I hate the Ath10k driver). Thank you very much in advance!


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Qualcommax NSS Build

This topic is to discuss community builds (not supported by Openwrt) for target Qualcommax that include the QCA QSDK software - https://git.codelinaro.org/clo/qsdk + Openwrt.
If you want to know more about NSS, how to build, configure a build or just download a pre-build image for your device please head to (please note that the README is being updated at the moment)
github.com
qosmio/openwrt-ipq/blob/qualcommax-6.x-nss-wifi/README.md
![OpenWrt logo](include/logo.png)

OpenWrt Project is a Linux operating system targeting embedded devices. Instead
of trying to create a single, static firmware, OpenWrt provides a fully
writable filesystem with package management. This frees you from the
application selection and configuration provided by the vendor and allows you
to customize the device through the use of packages to suit any application.
For developers, OpenWrt is the framework to build an application without having
to build a complete firmware around it; for users this means the ability for
full customization, to use the device in ways never envisioned.

Sunshine!

## Download

Built firmware images are available for many architectures and come with a
package selection to be used as WiFi home router. To quickly find a factory
image usable to migrate from a vendor stock firmware to OpenWrt, try the
*Firmware Selector*.
This file has been truncated. show original

5

[Assistant]
The current build is on
@bitthief
repo - https://github.com/bitthief/openwrt latest branch ipq807x-5.15-pr-final
other people have their own repo perhaps can add their own experiences - for my own use case I have seen marginal improvements - I have ECM compiled for macvlan support and I haven't seen ECM been used ... ecm_dumpsh shows no accel being used! the major pro I feel is the use of nss-drv...
From a crypto perspective - nss-crypto-cfi is outstanding however nss-crypto compiles
others can jump in and provide their own comments
note - I took some patches from
@qosmio
nss-packages and
@ACwifidude
repo in order to be able to compile with macvlan support (there is another community build for IPQ806x that is useful to follow)

6

There are any install files for testing or need to create a clone in my OpenWrt repo and try to compile?

Hi
@ccost1974
you need to build your own image. Note that
@bitthief
repo is now using the main branch


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Adblock-lean: set up adblock using dnsmasq blocklist

@Wizballs
,
@antonk
and myself maintain a new and ultra simple and lightweight adblocking solution for OpenWrt: adblock-lean.
The Hagezi DNS blocklists lists are fully supported by adblock-lean and strongly endorsed, and Hagezi himself recommends adblock-lean:
Features of adblock-lean include inter alia:
ultra light on resources - minimal CPU and RAM usage, facilitating massive blocklist use on low-spec routers or and even larger blocklists (one million lines plus) on mid to higher-spec routers;
implemented as a service script - no package dependencies;
no bloatware and (hopefully) minimal bugs or glitches;
daily updates of blocklists;
leverage compression during blocklist processing and optional compression for generated blocklist;
volatile memory used for all processing - no flash wear;
feature rich with many safeguards such as:
rigorous checking through downloaded blocklist lines and generated blocklist file;
protections against malicious or temporarily broken remote blocklists; and
verifying certain test DNS lookups succeed upon restarting DNSmasq; and
set once and forget.
adblock-lean is available here:
github.com
GitHub - lynxthecat/adblock-lean: Lean and powerful adblocking solution for OpenWrt
Lean and powerful adblocking solution for OpenWrt
adblock-lean is a super simple and lightweight adblocking solution that leverages the major rewrite of the DNS server and domain handling code associated with dnsmasq 2.86 that drastically improves performance and reduces memory foot-print, facilitating the use of very large blocklists for even older, low performance devices.
adblock-lean was designed primarily for use with the dnsmasq variant of the oisd blocklist used by major adblockers and which is intended to block ads without interfering with normal use.
adblock-lean is written as a service and 'service adblock-lean start' will download and setup dnsmasq with a new blocklist file. Various checks are performed and, in dependence upon the outcome of those checks, the script will either: accept the new blocklist file; fallback to a previous blocklist file if available; or restart dnsmasq with no blocklist file.
History of development can be traced in this thread.
And there is a thread concerning the perpetual optimisation of adblok-lean here.
Test your adblock efficacy here:
d3ward.github.io
Test Ad Block - Toolz
Looking for an easy way to check the efficiency of your ad blocker?Toolz offers a simple and beautiful design test that allows you to quickly and easily test the performance of current ad/content blocker solution. Intuitive interface makes it easy to...
Whilst there are already a few users (including myself of course), adblock-lean will benefit from testing and feedback from more users.

1 Reply
17

[Assistant]
Cool, not a bad idea to start a separate/clean topic for adblock-lean. Can focus on more specific development here vs the general discussion in the other thread.

3

Have been running the latest adblock-lean for a few days with 22.03.4 release, all is good. PS laughed at thundering herd name

2

No sure if this is the right thread, but I've been testing the adblock lean project and so far I'm happy, although I modded the script a bit just to use another lists. The (HaGeZi) ones.
The updates and cron working great. Would be possible to add more than 2 links to the list?
One thing I'm having some extra thoughts is the adblocking is working really great and I'm using with DNS https proxy in that way I hijack all the dns DoH/DoT from my network and forced to pass it to my dns with the adblock lean and works great.
But I need sometimes a device without the blocking because need to check something with GA/Marketing. I think maybe in the future would be nice to have a LUCI UI, to add extra list or add more functionalities. I'm replacing NextDNS with adblock-lean and I'm really impressed, thank you.
quick question regarding adding a second list? I know that i could modify the file size and obviously my device will be affected by the ram consumed.
blocklist_url="https://big.oisd.nl/dnsmasq2"
but would be possible to add a second list?
blocklist_url="https://big.oisd.nl/dnsmasq2, link2"

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Policy-Based-Routing (pbr) package discussion

The old vpn-policy-routing thread grew too big and contains a lot of outdated information, now that pbr is available, so I've decided to start a new thread.
pbr is a next generation service supporting split-tunneling for multiple types of VPN tunnels (Openconnect, OpenVPN, PPTP and Wireguard), allowing you to create policies to use a designated VPN tunnel or WAN as a gateway. More information (requirements, full features list, etc.) on the service is available in the README.

Differences between pbr and vpn-policy-routing
Check the README Differences section.

Status of pbr on OpenWrt 23.05
Check the README OpenWrt 23.05-related section.

Status of pbr on OpenWrt 22.03
Check the README OpenWrt 22.03-related section.

How to install
Check README How To Install section.

Getting help
Check the README Getting Help section for details on what kind of information you need to provide to report bugs and/or request help troubleshooting setup.

The old thread which grew too long and has too much of the no longer relevant information is kept here.

17

[Assistant]
With update to version pbr 0.9.9-1, the new luci-app-pbr 0.9.9-1 is required!

If you're using pbr on an x86_64 system, you can install the dnsmasq 2.87 from this post and test the pbr in the nft mode.

1

The WebUI app (luci-app-pbr) version 0.9.9-3 has been converted to javascript.
Here's the current list of TODOs for the new luci app, so don't report these issues:
Gateways are not shown at the top.
If there were any errors during pbr last run, they are not shown at the top.
Same goes for any warnings.
The option to select resolver set support for domains is missing descriptions for options which are unavailable on the platform.

4


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: A new Luci theme for LEDE/OpenWrt

Hi all，
I made a new luci theme for openwrt.
GitHub
jerrykuku/luci-theme-argon
A new Luci theme for LEDE/OpenWRT. Contribute to jerrykuku/luci-theme-argon development by creating an account on GitHub.

Features:
New login theme, Request background imge from bing.com, Auto change everyday.
blur effect for login form
Auto adapt to dark mode

1 Reply
14

[Assistant]
Great theme. How can I enable the dark mode?
I am using luci-theme-argon_2.2.1

It is activated, but still no dark mode. Tested also on android 10 with universal dark mode on, on pc using edge and brave browser.
Is there a way I could force dark mode through ssh?
Thanks for the beautiful theme.

Dark mode is working fine for me. Beautiful theme, thanks you so much.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: [HowTo] Running Adguard Home on OpenWrt

Hello everybody,
this is a small guide for Adguard Home, an equivalent alternative to Pi-Hole.
To use Adguard Home on an OpenWrt router you need at least 20 MB free storage and about 100 MB free RAM (it can be started from a USB stick; the more RAM, the better). I‘m running Adguard Home on a Netgear R7800.
Ads/trackers/malware etc. are blocked by DNS. The DNS lists can be copied 1:1 from Pi-Hole or equivalent sources. Regex is also supported.
The big advantage over Pi-Hole is that Adguard Home does not need any dependencies and can be started from a single binary file.
Adguard Home comes with its own web interface, which can be accessed on a self-selected port.
The DNS server can be operated in parallel to dnsmasq.
DNS over TLS and HTTPS are supported by default.
Adguard Home can be started automatically via /etc/rc.local by simply executing the binary
Since it is programmed in Go, many architectures are already supported:
https://github.com/AdguardTeam/AdGuardHome/releases
1. Installation
The installation is relatively simple. The corresponding release must be downloaded and unpacked.
The application starts via ./AdguardHome and all necessary settings can be made via the web interface.
ssh root@192.168.1.1
opkg update && opkg install wget
mkdir /opt/ && cd /opt
wget -c https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.101.0/AdGuardHome_linux_armv5.tar.gz
tar xfvz AdGuardHome_linux_armv5.tar.gz
rm AdGuardHome_linux_armv5.tar.gz
Either just run it:
/opt/AdGuardHome/AdGuardHome

or install it directly with:
/opt/AdGuardHome/AdGuardHome -s install

It is also possible to run it in the background (manually started):
opkg update && opkg install coreutils-nohup
nohup /mnt/usb/AdGuardHome/AdGuardHome > /dev/null 2>&1&
1.1. Attention
!!!! It is possible to install AdguardHome under /opt/, but this directory can grow. Old binaries are moved as backup after an update. blocklists can become relatively large. it is better to move AdGuardHome to a USB stick. So it will survive future OpenWRT updates !!!!
2. Configuration
After AdguardHome is started on the router, open the browser and start the AdGuard Home web interface
2.1 DNS Port
I have the Adguard Home DNS server running at 192.168.1.1:5353
2.1 HTTP Port
web interface at 192.168.1.1:8080.
2.2 /etc/conf/dhcp
Accordingly, the /etc/conf/dhcp config must be adjusted and the new DNS server must be defined:
config dnsmasq
       option domainneeded '1'
       option localise_queries '1'
       option rebind_protection '1'
       option rebind_localhost '1'
       option local '/lan/'
       option domain 'lan'
       option expandhosts '1'
       option authoritative '1'
       option readethers '1'
       option leasefile '/tmp/dhcp.leases'
       option localservice '1'
       list server '192.168.1.1#5353'
2.3 /etc/firewall.user
Prevent DNS leaks and force all connected devices to use the new DNS port:
iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j DNAT --to 192.168.1.1:5353
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 53 -j DNAT --to 192.168.1.1:5353
3. Blocklists and tuning
Good Blocklists:
You may want to add those lists to your http://192.168.1.1:8080/#filters lists.
https://firebog.net/
https://dbl.oisd.nl/
Adguard Home Regex:
Those are really good regex rules which already block 50% of all ads/trackers/bots etc.
You have to add the to http://192.168.1.1:8080/#custom_rules
https://github.com/mmotti/adguard-home-filters/blob/master/regex.txt
DNS over TLS Upstream Server:
AdGuardHome supports TLS DNS for more privacy. Dhe dns requests are much slower though. some dns servers are sometimes down and somehow it is still a bit buggy. sometimes AdGuardHome crashes if you do the upstream test more often.
https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers#DNSPrivacyTestServers-DoTservers
DNS Leak Test:
https://www.dnsleaktest.com/results.html
Recommended modifications:
DNS over TLS
Good no-logging-policy DNS Server:
tls://fdns1.dismail.de
tls://dns.neutopia.org
tls://dns.digitale-gesellschaft.ch
Make sure that the upstream servers are working. This is also a good resource: https://kb.adguard.com/en/general/dns-providers
For me it is a super easy alternative to Pi-Hole, without installation effort and many dependencies.
Have fun with it!

7 Replies
24

[Assistant]
Thank you for this guide. I had been curious about Adguard Home for quite some time now but had no idea that it could run on OpenWrt. This is great. Excellent tutorial too.
What exact package did you download for your Netgear R7800?
Also, which package would I download for my Linksys WRT3200ACM?
Thank you for sharing this info. Cheers!

2 Replies

Or just install https-dns-proxy with the Web UI app and configure it to use AdGuard DNS server. That's it, no downloading/unpacking needed.

1 Reply
5

Thanks for your reply! The R7800 and the WRT3200ACM are using both an ARM-CPU. You will probably need this package:
https://github.com/AdguardTeam/AdGuardHome/releases/download/v0.100.8/AdGuardHome_linux_arm.tar.gz

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Build for Linksys EA9500

OpenWrt for Linksys EA9500 v1.0/v1.1
First time Installation
US Model:
Linksys secure-signs the firmware for this router, hence it is not possible to install using Factory UI.
So, this router requires a serial cable connected to the router. On boot, interrupt the boot by Ctrl+C and enter CFE prompt. Make sure tftp server is running. Download tftpd sever from here. Detailed instructions here. Disassembly instructions here
From CFE prompt execute following. Where 192.168.1.10 is where your tftp server is running.
 flash -noheader 192.168.1.10:/openwrt.trx nflash0.trx
Also you may want to reset partial boots and boot partition using
 nvram set bootpartition=0 && nvram set partialboots=0 && nvram commit
NOTE: This router has two copies of firmware. The router switches between one or the other after three consecutive partial boots. You can force a partial boot by turning off router 10 seconds after booting.
Once you have installed Lede on one partition, leave the second partition on Factory firmware. this way you can dual boot into Openwrt or Factory.
Non-US EA9500 Model First Flash This
2020-12-19 Flash from Linksys UI. Once in OpenWrt, flash to both partitions using these instructions. If it boots into Linksys, use 2020-11-23 alternate instead.
Full Builds
2021-10-10 ALFHA BUILD! Works on my router, report back issues. DSA driver, Kernel v5.10.72.
2021-08-09 Kernel v5.4.137
2021-02-15 Kernel v5.4.98. Perform factory reset if possible.
2020-11-23 Kernel v5.4, swconfig driver instead of DSA. Please factory reset after installing.
2020-01-02 Supersedes Dec 31st build. Kernel v 4.19.91, Read wifi instructions below
2019-06-19 Kernel v4.19.52
2019-03-15 Kernel v4.19.25, hardware tagging, Congestion Control
Revert to Factory EA9500_Factory.trx
Flash from CFE:
flash -noheader 192.168.1.10:/EA9500_Factory.trx nflash0.trx
flash -noheader 192.168.1.10:/EA9500_Factory.trx nflash0.trx2
Flash factory from ssh
mtd write /tmp/EA9500_Factory.trx firmware
mtd write /tmp/EA9500_Factory.trx failsafe
Wifi Instructions:
Make sure to set country code: United States: US, World: EU
5Ghz Radios:
radio0 and radio2 - stick to 40Mhz bandwidth
radio0 stick to lower bands (36, 40, 44, 48, 52, 56, 60, 64)
radio2 stick to higher bands (136,140,144,153,157,161,165)
Source
Patch for kernel v4.19
Config Seed
Package list based on
https://github.com/infinitnet/lede-ar71xx-optimized-archer-c7-v2

2 Replies
7

[Assistant]
Do you have any suggestion how to upload the firmware via TFTP? Been trying for two days now and still no luck. What is the perfect timing for pressing upload button?

Unplug the router and adapter and keep it for 15 mins. And plug your wire into port 8. Make sure to use Linux and set static ip/mask/gateway = 192.168.1.2/24/192.168.1.1 in network config file. Use ifconfig eno1 up/down to enable disable ethernet port. Disable any network manager that may interfere with this steup.
I use tftp one line command from the openwrt link above. Make sure the trx path you provide exsist. Also, the right time to hit enter is after you see all the lights flash.
As a test, make sure you can ping 192.168.1.1 after lights flash.
Edit
I tried it myself but can't get thru myself now - it worked earlier. Will try to do this over the weekend.

I have to admit unfortunately, tftp client method does not work. I opened my router again and hooked up the serial port. Clearly the router has been disabled to load any trx from tftp client:
CFE log from ea9500
Device eth0:  hwaddr 60-38-E0-XX-XX-XX, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Loader:raw, invalid tftp target filename (:)!
Could not load :: Invalid parameter
Normally the log should look like this (from EA6500):
 Device eth0:  hwaddr C8-D7-19-XX-XX-XX, ipaddr 192.168.1.1, mask 255.255.255.0
            gateway not set, nameserver not set
 Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
 Loading: Failed.
 Could not load :: Timeout occured
You can see CFE is crippled by removing the tftp and eth0 params.
I may have uploaded using serial port and not the tftp client. And mixed up later when I was making a note about it.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Adblock support thread

Hi,
in OpenWrt stable & snapshot package repo you'll find the adblock package (plus LuCI companion/configuration package):
latest snapshot version: adblock 4.4.2-3 plus luci companion package
stable OpenWrt version 24.10.x.: adblock 4.4.2-3 plus luci companion package
Link to the latest adblock documentation
Link to the latest adblock changelog
Feel free to test, ask questions or make suggestions.
Have fun!
Dirk

4 Replies
37

[Assistant]
logread -e "adblock" gives the following output:
Mon Dec 12 09:53:36 2016 daemon.err adblock.sh[944]: udhcpc: started, v1.25.1
Mon Dec 12 09:53:36 2016 daemon.err adblock.sh[944]: udhcpc: sending discover
Mon Dec 12 09:53:39 2016 daemon.err adblock.sh[944]: udhcpc: no lease, failing
Mon Dec 12 09:53:39 2016 daemon.err adblock.sh[944]: udhcpc: started, v1.25.1
Mon Dec 12 09:53:39 2016 daemon.err adblock.sh[944]: udhcpc: sending discover
Mon Dec 12 09:53:42 2016 daemon.err adblock.sh[944]: udhcpc: no lease, failing
Mon Dec 12 09:53:42 2016 user.notice adblock-[1.9.99-pre0] info: block lists with overall 132369 domains loaded (1.9.99-pre0, LEDE Reboot CURRENT r2437-854459a)
I removed the previous package and luci addon with luci.

htmt:
daemon.err adblock.sh[944]: udhcpc: sending discover
udhcpc is the DHCP client fetching a WAN address from your ISP for your WAN interface. Nothing to do with adblock (or DNS) by itself.
Does your router get WAN address when adblock is disabled?
But you seem to have a lot of blocklists loaded. You might test first with only a few lists. And you might reboot the router one more time so that there are surely no leftovers in dnsmasq tmp from the previous ablock version.

My router gets a WAN address also when adblock is enabled.
As far as I can see adblock2 is working without a problem. I just don't understand the errormessages in the log.
My router has plenty of ram (512 MB), so I thought is is not a problem to enable almost every list.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWISP 22.05 release

PS: demo site available!
I am extremely proud to announce the release of OpenWISP 22.05!
In the last 18 months we have done a terrific job at making the system more stable, fixing bugs, adding important features that are essential to manage production networks and improving documentation.
This release comes after many iterations and testing on real world production systems.
Highlights
Added support for remotely executing shell commands on devices
Added automatic provisioning of Subnets and IPs
Added support for WireGuard and VXLAN tunnels
Added required templates
Most modules have a fully featured REST API
The web UI theme has been modernized with the aim to improve user experience
OpenWISP Monitoring has been added to ansible-openwisp2 and docker-openwisp
OpenWISP RADIUS has been added to ansible-openwisp2 and docker-openwisp
OpenWISP WIFi Login Pages 1.0.0 has been released and a dedicated ansible role has been created to allow deploying it
There have been significant advancements and improvements in Docker OpenWISP
As usual, if you are using the official ansible role you can upgrade by following its upgrade instructions,
PLEASE MAKE SURE TO BACK UP YOUR CURRENT INSTANCE BEFORE UPGRADING.
Complete list of changes
For the exhaustive list of changes, please refer to the change log of the modules you're interested in:
Ansible OpenWISP 2
OpenWISP Controller
openwisp-config OpenWrt package
OpenWISP IPAM
OpenWISP Monitoring
openwisp-monitoring OpenWrt package
OpenWISP Firmware Upgrader
OpenWISP Network Topology
OpenWISP RADIUS
OpenWISP WiFi Login Pages
Ansible Wireguard OpenWISP
Ansible OpenWISP WiFi Login Pages
Many thanks to all the contributors and OpenWrt users who made this possible!
PS: demo site available!

1 Reply
18

[Assistant]
I read a few of the getting started and and the quickstart page but I did not see any info on the minimum requirements for the openwrt device.
I am guessing that my tplink 4300 will not have enough space or memory to run this.

1 Reply

nemesis:
Added support for WireGuard and VXLAN tunnels
If I am reading this correctly that can be used for layer 3 roaming like ruckus has with there dataplane box. IE AP makes a tunnel back to central server and the wifi client's mac address would always show up as coming from server and not a AP allowing the client to roam and not re arp at every new AP.

Looks interesting, but what is this and what does it have to do with OpenWrt?

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: How is this big Open Source project managed? Can it do these several things?

How is this big Open Source project managed? Can it do these several things?
I want Server side build service, where I can build for any device.
I want correct minimalism and modularity, to not ship unused features onto the device, most devices only do minimal IPv4 functions that can fit in 1MB.
I want client-side GUI not device-side GUI.
I want loading function binaries over IP, into RAM. No need to store on device flash.
I want modern CPU optimization technologies like AlphaDev did with the sorting algorithm and some games.
I don't want a full system onto the device, I want to change the tightly optimized binaries on every configuration and feature change.
I want to understand the project bottlenecks and why decisions have been made the way they have.
Tight integration source code <-> WiKi/forums/docs for factual correctness and semantical hierarchy.
Actually this will be easier, if the project has a "dedicated" (contextually) AI which can do most of this, isn't it?
Help me understand how low-level developers who have a more intelligent view of the CPU systems, get motivated to do things, with the organization and hierarchy that produces this system, and why is it not more optimized? Because in the past, it was a big fame to do low level optimizations, and now? The software gets bloated. What are the code change statistics, that show, how the system is optimized compared to how the system is bloated with features?
Thank you.

2 Replies

[Assistant]
@infr-automation

Sure ... everything is possible
Are you a real human being or a Bot account?

1 Reply
3

Hey you get defensive? I am just accusing you of not doing it correctly. Why so defensive? Just answer the questions truthfully.

3 Replies

infr-automation:
Help me understand how low-level developers who have a more intelligent view of the CPU systems, get motivated to do things, with the organization and hierarchy that produces this system, and why is it not more optimized? Because in the past, it was a big fame to do low level optimizations, and now?
Even I can answer this
Sure back in the day, and I'm talking mid 1970's here, I was about 13 years old and the education department wanted to know if children that age could understand concepts such as Mnemonic assembly language and BASIC. They chose our school and a professor from the local uiversity came and explained how 8 bit machines worked and how to program using these two languages, one high level, the other low level. I understood it and excelled in it. I got a job in computers when I was 16 and that corp sent me to university, but by the time we reached 32 bit machines my programming days were over. These days programmers have the luxury of huge amounts of memory and storage capacity. It's like asking "why arent you guys still programming in a way my 8 bit machine understands and can deal with, and the answer is " Because we dont have to, grandpa"

1 Reply
3


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Support 80+80 MHz channels for 802.11ac and 802.11ax

Some 802.11ac chipsets support 80+80 MHz channel operation in addition to 160 MHz channel operation, e.g. QCA9886, QCA9888.
OpenWrt currently only let users choose a contiguous 160 MHz channel.
By setting hostapd parameters like vht_oper_chwidth, he_oper_chwidth, vht_oper_centr_freq_seg1_idx, he_oper_centr_freq_seg1_idx, it should be possible to achieve 80+80 MHz channel operation.
https://www.qnap.com/en/how-to/faq/article/how-are-the-160-mhz-and-80-mhz80mhz-channels-different-from-ieee802-11ac-or-wi-fi-5 has more information on 80+80 MHz, including why one may want to use 80+80 MHz.

1

[Assistant]
Search the forum for “VHT80P80” for relevant patches you can apply yourself.
I’ve not submitted these to the project (maybe I will…) but they work fine.

3 Replies
2

lantis1008:
VHT80P80
Please create a PR with the necessary changes

3

Is it AC-specific or does it work for AX and above as well?

3 Replies


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: NPT6 as a core feature

The official mwan3 documentation says:
Using mwan3 with IPv6 requires additional configuration such as IPv6 masquerading through methods like NETMAP or NAT6. This is currently not implemented in mwan3 directly and requires additional configuration. ... This is something that needs to be configured outside of mwan3 itself.
Currently, what's expressible using the core firewall features is NAT6, where all LAN hosts are masqueraded behind the router IPv6 address, just like it is done with IPv4. This is suboptimal. That's why the feature request to make network prefix translation for IPv6 a core feature, configurable through Luci without the need to write any scripts.
Just for the reference, here is what I do, and what I want to be fully achievable without custom scripts:
#!/bin/sh

source /lib/functions/network.sh

# IPv6 NAT (horrible)
ip6tables -t nat -F PREROUTING
ip6tables -t nat -F POSTROUTING
ULA=$(uci get network.globals.ula_prefix)
for IFACE in $(uci show mwan3 | sed -n '/=interface/s/^mwan3\.\(.*\)=interface/\1/ p') ; do
  network_get_device DEVICE $IFACE || continue
  network_get_prefix6 PREFIX $IFACE || continue
  BITS=${PREFIX##*/}
  if [ "$BITS" -le 48 ] ; then BITS=48 ; fi
  ULA_PART=${ULA%%/*}/$BITS
  FIRST_IP=${PREFIX%%:/*}:1
  echo "Mapping $ULA_PART <-> $PREFIX for $IFACE (on $DEVICE)"
  ip6tables -t nat -A PREROUTING -d $FIRST_IP -j REDIRECT
  ip6tables -t nat -A PREROUTING -d $PREFIX -j NETMAP --to $ULA_PART
  ip6tables -t nat -A POSTROUTING -s $ULA_PART -m conntrack --ctorigdst $PREFIX -j NETMAP --to $PREFIX
  ip6tables -t nat -A POSTROUTING -s $ULA_PART -o $DEVICE -j NETMAP --to $PREFIX
  ip6tables -t nat -A POSTROUTING -s $ULA -o $DEVICE -j MASQUERADE
done
This tries to use NETMAP where possible, and resorts to MASQUERADE only if the upstream prefix is too small. Example: if the ISP only offers a /64, then the LAN would go through NETMAP, and the gguest WiFi (if I create one), or whatever delegated prefixes my hypervsor hosts obtain through DHCPv6, will still get IPv6 connectivity, in a masqueraded form.

1

[Assistant]
Given native connectivity is the standard - would this break IPv6 for those who get native connectivity?

The proposal is to make sure that NETMAP is available through Luci, optional and default off.
Actually, if the LAN is bigger than what the ISP supports, I think that by default it should use native connectivity where possible and MASQUERADE those parts of the LAN which don't fit.

1

Does this concept actually work? I thought that endpoints which were issued a ULA are not supposed to use it to originate traffic to a GUA, i.e. an Internet site. Because unless they get translated somewhere in the LAN, ULAs will not route through the Internet.
So to have a fixed prefix on the LAN which can be NPTd to the ISP prefix that keeps changing, you have to make up a fake GUA prefix which you usually don't really own and thus you don't know if it is going to conflict with something on the Internet making it unreachable.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: InitramFS version without firewall

Hi
Would it be possible to get version or images of initramfs kernel without firewall ?
If the AP is located in remote place (high pole, ceiling in warehouse - 10+meters,..) then it's hard to get hands on LAN port and mgmt IP 192.168.1.1 after "upgrade" to OpenWRT . Also Wlan radio is off.
I just need this for installation of OWRT, afterwards i roll my own packages etc via firmware-selector.openwrt.org, but i would rather have fwall disabled then to climb ladders.

Solved by lleachii in post #16
All, to be clear, I realized the OP never actually stated this - it's only been implied: the firewall needs to be off because the WAN port will be used to re setup the OpenWrt (or initially install it) whatever state the device is in, the OP has reset it (or it's in a new state - i.e. WiFi off by …

[Assistant]
Do a custom build where you do the basic configuration as described here.

2 Replies
1

(just in case it is not obvious) the user has not to build from source but can just use the image-builder. Also the user does not have to even provide a custom UCI config, the image-builder can be told to disable certain services, like in this case the firewall. So the default rule set would be present but not active till it gets enabled.

For the firewall, yes. But for enabling WiFi by default?

2 Replies


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Identity PSK, or Multi PSK to a single SSID

Hi there, I was looking at a byo AP solution using openwrt, but not really finding answers if this is possible or supported so presuming not. That being ability to assign multiple different PSK's for different users or devices to a single SSID. This is specifically NOT using WPA-Enterprise, but still Personal, just managing use of list of many PSK's to auth endpoints differently transparently as a "feature".
I mostly play in the enterprise world, but looking for a home solution to emulate what I do for customers of mine using these features. Cisco calls it "Identity PSK or iPSK", Arista uses Roles each with a different PSK (which I use today at my house), Extreme/Aeorhive, Aruba, most all offer like these days as some "feature" of theirs, and has nothing but benefits to avoid the one psk to rule them all that gets written on the bathroom walls for a good time. These usually come with vlan or firewall assignments ala dot1x, but I'd be happy with just multiple psk's I can add and delete if/when people/things come/go.
Since it's all the same chip vendors underneath, I presume it's just a software limit, but is this something possible at all with openwrt, or something to request on a roadmap? I've seen others ask the same, but it's usually dismissed as "use wpa-enterprise for that" or it just doesn't work sort of answers, however if the mega-vendors can do so, I don't see why there can't be a solution for open source software too.
Thanks in advance!

3 Replies
4

[Assistant]
mikebutash:
ability to assign multiple different PSK's for different users or devices to a single SSID.
This is not possible with WPA Personal.
mikebutash:
I've seen others ask the same, but it's usually dismissed as "use wpa-enterprise for that" or it just doesn't work sort of answers,
Are those other vendors actually setting up one SSID with multiple passwords using WPA personal?
The 802.11 standard is not really intended to do what you're asking, but if the answer to my above question is "yes", I can posit two possibilities:
They may create multiple SSIDs with the same name, and then assign each a different password. I have no idea if this would actually work, but you could try doing the same thing (it would probably cause major problems for devices that have just one of the passwords).
They could be employing 'tricks' that are chipset specific and require custom closed source firmware that is developed in partnership with the chipset manufacturers. If this is the case, such firmware/code would not be available to OpenWrt.
But the other thing to ask is "to what end" would you use this? If you want to setup different 'permissions levels' for each of these unique passwords, you would be better off with unique SSIDs that map to different subnets, and thus you can use different passwords... that works with no issue. Otherwise, I can't quite understand what value comes from multiple different passwords that all end up joining the same network.

1

psherman:
Are those other vendors actually setting up one SSID with multiple passwords using WPA personal?
No.
mikebutash:
Cisco calls it "Identity PSK or iPSK"
IPSK can be configured on any AAA serer that supports Cisco av-pair.
From: https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-5/b_Identity_PSK_Feature_Deployment_Guide.html
mikebutash:
Extreme/Aeorhive
https://www.aerohive.com/wp-content/uploads/Aerohive_Datasheet_ID_Manager.pdf
mikebutash:
(which I use today at my house)
So, why did you fail to mention that there's other services, etc. required for this setup?
Your post implies moreso just adding a list of additional PSKs to a config - yet these directions from other vendors are describing a more complex setup, require additional servers, etc.

1 Reply

Yes this is possible but not exposed in uci iirc.
Google for wpa_psk_file. The MAC address 00:00:00:00:00:00 can be used as wildcard to specify device agnostic PSKs.

3


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Use background_radar by default

Bring good devices from last 3-5 years to the coolness level of OpenWrt One.
Likely dozen devices with broken feature flag (cf AX23) need the feature masked via DTS.
wifi script revolution seemingly excludes current stable in the meantime.

1 Reply
3

[Assistant]
How can I check if my devices support this feature?

add to 5ghz radio
option background_radar 1
set channel to one known hit by radar (logread-e RADAR)
Then set permitted channels
option channels '36 52 100 116 132 149 165'
to cover only dfs channels
wait a day see channel switches instantly

2

I think channel 165 is unnecessary if you have selected a channel width greater than 20 MHz.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Clear WAN or Internet health indicator on the status overview page

Have you ever had a problem with your internet
Loaded up router.lan, and not immediately known whether internet was up or down ?
For now the way to determine if internet is working or not is to scroll down to the IPv4 Upstream section
Look at the address field and, if there is an address IP assigned then you internet might be working
I think there should be at the top of the page, a clear color-coded indicator of internet status, quality and current transfer speed.
It should say something unamibguous like "Internet connection working correctly", in green and "Internet connection is not working correctly" in red. That should be the minimum viable version of this.
After this, it would be nice to display, current latency 5 minute min/avg/max and current transfer speed 5 minute min/avg/max, maybe a ICMP error message counter and/or TCP retransmission rate and/or dropped packets. And if feeling fancy, a nice little histograph of the last hour with a line for latency and a line for bandwidth usage.
There is software called pingplotter that does this.
For just 60$USD it will traceroute up to two addresses every second, display on screen the latency of each hop in a candle chart and the total network latency in an histograph
Here is what it looks like for inspiration

1 Reply

[Assistant]
shodanx:
It should say something unamibguous like "Internet connection working correctly", in green and "Internet connection is not working correctly" in red.
How is this determined, without phoning home to some 3rd server?
What if the 3rd server id down/unreachable
How about those who have to setup their connection first?
shodanx:
Have you ever had a problem with your internet
Loaded up router.lan, and not immediately known whether internet was up or down ?
For now the way to determine if internet is working or not is to scroll down to the IPv4 Upstream section
That's not very a very effective way to determine. In fact, there's no need to login to your router.
shodanx:
There is software called pingplotter that does this.
For just 60$USD it will traceroute up to two addresses every second, display on screen the latency of each hop in a candle chart and the total network latency in an histograph
Wow, $60!
OpenWrt can do it for free. Fancy candle charts are on you.
Cool idea!
(But it really seems like some gimmick the OEMs put into their firmware to facilitate phoning home.)

To me it also seems like a feature which is hard to implement and unsuitable to be enabled by default.
You would need an active ping or HTTP probing background process which 99% of the time is just producing traffic for nothing since nobody is looking at the router ui when it is working. We also can’t probe a 3rd party server due to privacy and ToS implications. We can’t probe openwrt.org due to privacy concerns and prohibitive infrastructure costs for a rather fringe feature.
Thousands of OpenWrt installations continuously sending dummy traffic to a specific host would essentially amount to a DDoS.

2

Would your suggestion here be a compromise that could be used for the purpose of what this feature request asks for?
That thread asks for failover to another WAN connection when the link is down. Seems like two similar problems?


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Bypassing the HH3K up to 2.5Gbps using a BCM57810S NIC

Due to the widespread use of the ONU stick, which typically employs a 2.5G interface, I am hoping to add the 2.5G driver for the 57810 network card. I have found some relevant information and would like to package the 2.5G driver within the bnx2x driver to make it more convenient for us to use, rather than having to compile the files from scratch for every version. I hope to receive everyone's support in this endeavor.
DSL Reports
Re: [Internet] Bypassing the HH3K up to 2.5Gbps using a BCM57810S NIC - Bell...
[Internet] Bypassing the HH3K up to 2.5Gbps using a BCM57810S NIC - Bell Canada | DSLReports Forums

1 Reply
2

[Assistant]
The driver is already exposed in the OpenWrt buildroot:
$ git grep -i Package\/bnx2x
package/firmware/linux-firmware/broadcom.mk:Package/bnx2x-firmware = $(call Package/firmware-default,=QLogic 5771x/578xx firmware)
package/firmware/linux-firmware/broadcom.mk:define Package/bnx2x-firmware/install
package/kernel/linux/modules/netdevices.mk:define KernelPackage/bnx2x
package/kernel/linux/modules/netdevices.mk:define KernelPackage/bnx2x/description
The driver is compiled by default even, see the kmod list for 22.03. You can use the image generator to have it included in your image.

1

Does not seem to support 2.5g, only supports 10g and 1g

1 Reply
1

OK. So you need to make sure that patch for 2,5G applies more or less cleanly, then recompile. For something that requires patching, there's no other solution unfortunately.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Add support Mercusys mr70x v2 and Tp-link ax53/55

Hardware
Qualcomm IPQ0509 (0518)
SoC IPQ0518 (this is a special version of the IPQ5018 chip)
also such a processor in the ax72 model
https://static.tp-link.com/upload/gpl-code/2023/202301/20230113/GPL_AX72v1.tar.gz
Qualcomm QCN6102
REALTEK RTL8367S
https://www.mercusys.com/uk/download/mr70x https://static.mercusys.com/gpl/GPL_MR70Xv2.tar20230105025301.gz 2) https://www.mercusys.com/uk/download/mr80x/v1#GPLCode https://static.mercusys.com/gpl/GPL_MR80Xv1.tar20230105025217.gz 3) https://www.tp-link.com/en/support/download/archer-ax53/#GPL-Code https://static.tp-link.com/upload/gpl-code/2023/202302/20230206/GPL_AX53v1.tar.gz 4) https://static.tp-link.com/upload/gpl-code/2022/202208/20220829/GPL_AX55v1.tar.gz
all these models are on this board

[Assistant]
As you possess the hardware and would be doing [most of] the work, can you provide more information?
Serial output?
What does each link entail?
Are you going to provide any details, information, etc.?
What have you done thus far?

links to models and source code gpl
sorts that are similar in characteristics

1 Reply

As you should have read in Add support for TP-LINK AX55 V1 - #2 by slh, there's no SOC support for this target in OpenWrt, so it would be up to you to start from (almost) zero.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: LED control for GL-MT1300

Night LED timer for wifi router for OpenWrt
Installing and Using OpenWrt
My feature request is same as the issue raised by a guy here , so can someone help :
I did not find a solution in that thread. Maybe it is not possible due to hw limitations?
Maybe it is not sw controlled? I would like some feedback from owners of this device
Running: OpenWrt 23.05.2, r23630-842932a63d
TY

Solved by h8red in post #7
The only way to disable led is with i2c controls for this router: i2cset -f -y 0 0x30 0x04 0x00 Adding this line to rc.local disables leds on startup. Lets mark this topic as solved for now
1

[Assistant]
please post output this commands:
find /sys/class/leds/*/
uci show | grep system | grep led

1 Reply

ncompact:
uci show | grep system | grep led
system.@led[0]=led
system.@led[0].name='off'
system.@led[0].sysfs='mt76-phy1'
system.@led[0].trigger='none'
system.@led[0].default='1'
system.@led[1]=led
system.@led[1].name='off'
system.@led[1].sysfs='white:system'
system.@led[1].trigger='none'
system.@led[1].default='1'
system.@led[2]=led
system.@led[2].name='off'
system.@led[2].sysfs='blue:run'
system.@led[2].trigger='none'
system.@led[2].default='1'
system.@led[3]=led
system.@led[3].name='off'
system.@led[3].sysfs='mt76-phy0'
system.@led[3].trigger='none'
system.@led[3].default='1'
ucitrack.
@system
[0].init='led'
ucitrack-opkg.
@system
[0].init='led'
/sys/class/leds/blue:run/
/sys/class/leds/blue:run/device
/sys/class/leds/blue:run/subsystem
/sys/class/leds/blue:run/max_brightness
/sys/class/leds/blue:run/brightness
/sys/class/leds/blue:run/trigger
/sys/class/leds/blue:run/uevent
/sys/class/leds/mt76-phy0/
/sys/class/leds/mt76-phy0/device
/sys/class/leds/mt76-phy0/subsystem
/sys/class/leds/mt76-phy0/max_brightness
/sys/class/leds/mt76-phy0/brightness
/sys/class/leds/mt76-phy0/trigger
/sys/class/leds/mt76-phy0/uevent
/sys/class/leds/mt76-phy1/
/sys/class/leds/mt76-phy1/device
/sys/class/leds/mt76-phy1/subsystem
/sys/class/leds/mt76-phy1/max_brightness
/sys/class/leds/mt76-phy1/brightness
/sys/class/leds/mt76-phy1/trigger
/sys/class/leds/mt76-phy1/uevent
/sys/class/leds/white:system/
/sys/class/leds/white:system/device
/sys/class/leds/white:system/subsystem
/sys/class/leds/white:system/max_brightness
/sys/class/leds/white:system/brightness
/sys/class/leds/white:system/trigger
/sys/class/leds/white:system/uevent

1

test this script (and post output):
the first part deactivates all the LEDs, the second reactivates them all
echo "0" > /sys/class/leds/white:system/brightness
echo "0" > /sys/class/leds/mt76-phy0/brightness
echo "0" > /sys/class/leds/mt76-phy1/brightness
echo "0" > /sys/class/leds/blue:run/brightness
cat /sys/class/leds/white:system/brightness
cat /sys/class/leds/mt76-phy0/brightness
cat /sys/class/leds/mt76-phy1/brightness
cat /sys/class/leds/blue:run/brightness

echo "1" > /sys/class/leds/white:system/brightness
echo "1" > /sys/class/leds/mt76-phy0/brightness
echo "1" > /sys/class/leds/mt76-phy1/brightness
echo "1" > /sys/class/leds/blue:run/brightness
cat /sys/class/leds/white:system/brightness
cat /sys/class/leds/mt76-phy0/brightness
cat /sys/class/leds/mt76-phy1/brightness
cat /sys/class/leds/blue:run/brightness
ps: I assume they will only be useful:
/sys/class/leds/blue:run/brightness
/sys/class/leds/white:system/brightness
as the specifications show 2 LEDs
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=d89a7f0120db42d4fae1656e1860ef49523acabb
OpenWrt Wiki – 23 Dec 21
GL.iNet GL-MT1300 (Beryl) v1
GL.iNet GL-MT1300 (Beryl) v1 Under Construction! This page is currently under construction. You can edit the article to help completing it. The GL.iNet GL-MT1300 v1 is a small, lightweight router intended for travel use, first released in 2021. It...

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Support 4G/5G automatic reconnection using ModemManager

Right now on an ISP-triggered 4G/5G disconnection, ModemManager will not automatically reconnect. It merely reports the disconnection to netifd and that's it. Work is needed to be done to the netifd protocol to tie things up to react to the reported disconnection and reconnect.
Back in November 2022, I raised this issue here:
github.com/openwrt/packages
ModemManager: broken in 22.03/23.05 and netifd reconnect issue
opened
Nov 3, 2022
lynxthecat
**Firstly**, ModemManager is broken in 22.03 because modem disconnect does not r…
And
@aleksander0m
wrote:
The way to solve this, after briefly talking with
@jow
- about this in IRC would be to have the netifd protocol handler launch a "watcher" process which brings up the connection, and is kept alive and running for as long as the network interface is assumed connected. If MM detects a network-initiated disconnection, the dispatcher script called by MM should kill that watcher process. At that point, netifd (if configured to autoconnect) will then kill the netdev, restart that process and await proto updates.
Anyone up to the task of writing this logic in the netfid modemmanager protocol handler?
And most recently:
Might anyone be willing to carry the torch and progress this matter for the 4G/5G modem users out there?

Solved by Lynx in post #75
I can mark this feature request as solved as a variant of my script has recently just been merged into the OpenWrt 'master' branch: So automatic reconnection in ModemManager should be the norm now.
3

[Assistant]
I consider this approach bloated, far too complicated. Simple script, pinging a well known target, i.g. 8.8.8.8, can do the job for a qmi-interface.

1 Reply

I just ran into this with my LTE Backup connection - I was surprised that OpenWrt does not try to keep the connection alive.

1 Reply
1

A temporary workaround hack is:
root@OpenWrt:~# cat /usr/lib/ModemManager/connection.d/10-report-down-and-reconnect
#!/bin/sh

# Automatically report to netifd that the underlying modem
# is really disconnected and reconnect if interface was up

# require program name and at least 4 arguments
[ $# -lt 4 ] && exit 1

MODEM_PATH="$1"
BEARER_PATH="$2"
INTERFACE="$3"
STATE="$4"

[ "${STATE}" = "disconnected" ] || exit 0

. /usr/share/ModemManager/modemmanager.common
. /lib/netifd/netifd-proto.sh
INCLUDE_ONLY=1 . /lib/netifd/proto/modemmanager.sh

MODEM_STATUS=$(mmcli --modem="${MODEM_PATH}" --output-keyvalue)
[ -n "${MODEM_STATUS}" ] || exit 1

MODEM_DEVICE=$(modemmanager_get_field "${MODEM_STATUS}" "modem.generic.device")
[ -n "${MODEM_DEVICE}" ] || exit 2

CFG=$(mm_get_modem_config "${MODEM_DEVICE}")
[ -n "${CFG}" ] || exit 3

IFUP=$(ifstatus ${CFG} | jsonfilter -e '@.up')

logger -t "modemmanager" "interface ${CFG} (network device ${INTERFACE}) ${STATE}"
proto_init_update $INTERFACE 0
proto_send_update $CFG

[ "${IFUP}" = "true" ] && ifup ${CFG}

exit 0
But
@aleksander0m
laid out a proposal on what needs to be done to address this properly.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Missing important feature: ECO MODE / Power Saving

OpenWRT is so great however it still missing one important feature,
Could you please release new firmware update that support ECO MODE / Power Saving feature.
That feature will help reduce the energy consumption of the device which is beneficial for both the environment and utility bills. I think that's important nowadays.
Thank you so much

[Assistant]
How much energy does your router use?
Genuine question - not a flippant response.
I ask because you can only use less energy if you make your device less performant, which might not be what you want or need.

4

My two cents:
Not all devices have power sources that will reduce power consumption reduce their power usage. In many cases, this feature will have no effect at all.
OpenWrt (and Linux in general) already try to consume as little CPU (one of the big power users) as possible. I do not think there is much to do here. Besides, many CPUs cannot reduce their frequency.
You could also reduce power consumption if you reduce the wifi usage or power (another big power user). You can already do that, but it has consequences on the usability of the device.
In conclusion, if you have a real problem (like "my device is using X watts of power in this situation, but it could use only Y watts if we do this or that"), then let's talk about it. But these broad requests do not go too far, usually.

8

According to this link:
EnergySage
How Many Watts does a Wifi Router Use?
Wifi routers are an essential part of keeping your home connected. Read more to find out how much electricity they use.
Ten watts is a safe average electricity consumption to assume for modern Wi-Fi routers from top manufacturers. (For which I'm guessing Wifi would contribute at worse 1W). That would mean 7.2kW per month (720 hours at 10Watts/h)
So if in December i consumed 720kW in total for a cost of 72$, the router should have counted for 0.72$, if i'm not wrong. Not even en espresso shot basically. Sure, adding more such devices it starts to add up, but for a single home-router it's acceptable, there are other much bigger offenders in the house (keeping hot water, cooking, fridge etc)

2 Replies


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Automatic LAN subnet reassignment upon conflict with WAN

I'll use this new subsection to formally request a new feature that would automatically reassign the LAN subnet if a conflict is detected on the WAN. I think that this would make setup easier for those who are new to OpenWrt and attempt to set it up behind another router that is already using the current OpenWrt default of 192.168.1.0/24.
A while back, I wrote an RFC and it seemed to get a bit of traction. But, it was too late to make it into 22.03. So, maybe this can be included in 23.xx??
Here is the original RFC with high level implementation details:
RFC: Automatic LAN subnet reassignment upon conflict with WAN
For Developers
Continuing a conversation from here as an RFC for implementation (per
@richb-hanover-priv
in this comment). Abstract: Method of automatic LAN network reassignment upon conflict with WAN Purpose: Prevent a conflict where the LAN and WAN occupy the same or overlapping subnets. This issue will cause routing to fail. Most often impacts novice/new OpenWrt users when they connect an OpenWrt device to an existing network using the common 192.168.1.0/24 subnet. Can also impact road-warrior type us…

3

[Assistant]
I would propose to at least set different metrics by default for wan and lan. This will not fix broken internet connectivity but ensures that lan remains reachable even if the wan side conflicts.
We could add detection for the conflict to LuCI then and guide the user through the renumbering

1

jow:
at least set different metrics by default for wan and lan
I'm not sure why this would be necessary. The lan is not an upstream gateway (and never is in the default configuration state), and therefore doesn't need a different metric.
jow:
ensures that lan remains reachable even if the wan side conflicts.
The OpenWrt lan should always be reachable, even if the wan conflicts.
I just tested it to be sure:
I set an OpenWrt LAN IP the be the same as my main router
Connected the OpenWrt WAN to my upstream LAN
Plugged a computer to the OpenWrt LAN.
OpenWrt remained accessible with no issues via the IP address and https://openwrt.lan even though there was a conflict on the WAN. Routing, of course, doesn't work.
jow:
We could add detection for the conflict to LuCI then and guide the user through the renumbering
I think that I personally prefer the idea of automatically fixing the scenario, but guiding the user would be an interesting option. Maybe when the user logs into the OpenWrt interface, it would present a message saying that this issue was detected... maybe t could then give three options:
Fix it for me (automatic, aside from a click to initiate it)
Guide me through fixing it (guided but manual)
Ignore (dismiss the error, don't change anything).

2 Replies

psherman:
OpenWrt remained accessible with no issues via the IP address and https://openwrt.lan even though there was a conflict on the WAN. Routing, of course, doesn't work.
I think it is a coincidence, based entirely on interface indices. We should not rely on this.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: DHCP Leases: Button to Remove

Hello,
I would like to request a new button on the "Active DHCP Leases" list next to the "Set Static" called "Remove" that would remove an existing lease.
Removing a lease is useful and it is mostly just about deleting the line from /tmp/dhcp.leases and by restarting dnsmasq afterwards. Other firmwares like DD-WRT to it and it seems to work.
Thank you.

1 Reply
3

[Assistant]
TCB13:
Removing a lease is useful
Please excuse my obvious ignorance: for what exactly? The device in question would neither lose its lease nor receive a different IP upon renewal.

2 Replies
2

It is useful when you're testing a ton of devices, containers or VMs and you need to cleanup your DHCP leases. You may run out of space or you simply want to see if the device is able to properly request a new clean lease and everything works properly.
There are other more annoying cases, for instance if you plan to assign a static lease to a device and it already has an IP, then it will keep the old address until the lease expires. The static leases UI also doesn't deal very well with this scenario.
The device in question would neither lose its lease nor receive a different IP upon renewal.
Yes that may happen under a bunch of cases, however not having a way to remove it is way worse. Besides dnsmasq will most likely eventually support FORCERENEW that will fix that problem.
IETF Datatracker
RFC 3203: DHCP reconfigure extension
This document defines extensions to DHCP (Dynamic Host Configuration Protocol) to allow dynamic reconfiguration of a single host triggered by the DHCP server (e.g., a new IP address and/or local configuration parameters). [STANDARDS-TRACK]
I'm not saying a "Remove" button will make everything perfect and fix everything. I'm just saying it can be there and if you search there are lot of people looking for ways to remove leases as well.

1

TCB13:
It is useful when you're testing a ton of devices, containers or VMs and you need to cleanup your DHCP leases. You may run out of space
Is such a fringe case realistically remedied by a "remove this one single lease" button? How many hundreds (or thousands?) of leases are we talking about, and is it practical to click the "remove" button and restart dnsmasq equally a hundred times?
want to see if the device is able to properly request a new clean lease
LuCI conveniently orders DHCP leases by age, the most recent on top.
if you plan to assign a static lease to a device and it already has an IP, then it will keep the old address until the lease expires
Removing a lease from the leases file will not change anything about that. The device reconnecting or the lease on the device expiring will, and the button cannot do that for you.
I'm not trying to be confrontational, but unless and until dnsmasq gains FORCERENEW functionality I'm not convinced a "remove" button solves much of anything except very superficial cosmetic issues, bought with the wrong impression that it actually did something.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Resurrect knockd?

Would it be possible to resurrect the knockd package?
The suggested replacement of fwknop lacks an iOS app store client.
Pretty please? If desired I can take a stab at the code and submit a pull request.
Ty.

1 Reply
2

[Assistant]
Johnny5IsAlive:
If desired I can take a stab at the code and submit a pull request.
You don't need permission. Just go for it.

@krazeh
are you a maintainer? i just want to know that the code would get merged prior to doing the work. thanks.

Johnny5IsAlive:
i just want to know that the code would get merged prior to doing the work
I'm not a maintainer, but I doubt anyone would be able to tell you what you're wanting to know. Without seeing what the changes are it's unlikely anyone would commit to saying it'd get merged. On the other hand, it's equally unlikely anyone else is going to make the changes. If they were it would've been done already. So you're kinda stuck at do the work and hope it gets merged, or don't do it and nothing will get changed.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Variable in Block MAC Address

To block Specific OUI
use wildcard character for Mac Address allow list ?
Example - Allow all except - F8:10:93:::**
for example A3:2X:BC where X can be anything
A3:Y4:E2 where Y can be e,2,A,c

1 Reply

[Assistant]
Neither iptables or nftables (firewall), nor hostapd (wireless mac lists) support wildcard matching, which makes this feature request unimplementable.

1 Reply
1

Did you try with arptables? Or the idea is to have it in the web interface?
This is from the man page:
-z, --source-hw [!] hwaddr[mask]
Specify the source hardware (MAC) address of the packet. hwaddr (and mask, if specified) must consist of one or more 8-bit hexidecimal numbers, separated by ':' characters. If the mask is not specified, it defaults to a number of 0xff octets equal to the length of the hwaddr specified, then 0s. The flags --source-mac , --src-hw , and --src-mac are aliases for this option.
The same is applicable to arptables-nft as well.

nvladimirov's reply above looks very promising.
Since you specifically mentioned blocking by OUI though, are you are looking for a NAC type solution such as what Cisco / ISE offers? ( ability to profile based on OUI and categorize as "Nortel Device, etc. ). If you are looking actually looking for a NAC-type solution PacketFence is a free / open source option you could integrate on a separate system.
If all you want do is block a a few OUI ranges though, maybe another option would be to request this as an enhancement to the existing BanIP package. BanIP (maintained by
@dibdot
) is already designed to block ranges of IPs and has ability to block a manual list of specific MAC addresses. Perhaps it could be modified to use MAC ranges also.
For more info:
github.com
openwrt/packages/blob/master/net/banip/files/README.md
<!-- markdownlint-disable -->

# banIP - ban incoming and outgoing IP addresses/subnets via Sets in nftables

## Description
IP address blocking is commonly used to protect against brute force attacks, prevent disruptive or unauthorized address(es) from access or it can be used to restrict access to or from a particular geographic area — for example. Further more banIP scans the log file via logread and bans IPs that make too many password failures, e.g. via ssh.

## Main Features
* banIP supports the following fully pre-configured domain blocklist feeds (free for private usage, for commercial use please check their individual licenses).
  **Please note:** By default every feed blocks all supported chains. The columns "WAN-INP", "WAN-FWD" and "LAN-FWD" show for which chains the feeds are suitable in common scenarios, e.g. the first entry should be limited to the LAN forward chain - see the config options 'ban\_blockpolicy', 'ban\_blockinput', 'ban\_blockforwardwan' and 'ban\_blockforwardlan' below.

| Feed                | Focus                          | WAN-INP | WAN-FWD | LAN-FWD | Information                                                   |
| :------------------ | :----------------------------- | :-----: | :-----: | :-----: | :-----------------------------------------------------------  |
| adaway              | adaway IPs                     |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
| adguard             | adguard IPs                    |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
| adguardtrackers     | adguardtracker IPs             |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
| antipopads          | antipopads IPs                 |         |         |    x    | [Link](https://github.com/dibdot/banIP-IP-blocklists)         |
| asn                 | ASN IPs                        |         |         |    x    | [Link](https://asn.ipinfo.app)                                |
| backscatterer       | backscatterer IPs              |    x    |    x    |         | [Link](https://www.uceprotect.net/en/index.php)               |
| bogon               | bogon prefixes                 |    x    |    x    |         | [Link](https://team-cymru.com)                                |
This file has been truncated. show original

2 Replies
1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Luci-app-wireguard + QR generation

Am I right that QR code generation is somewhat broken in current stable release (all updated installed so far)? Allowed IPs are missing in generated QR, like those IPs from simplest config bellow (192.168.10.128/32 and fd00:10::128/128). In order to finish client configuration in official Android client I have to fill in those manually.
config interface 'vpn'
 option proto 'wireguard'
 option listen_port '51820'
 option private_key 'longkeygoeshere='
 list addresses '192.168.10.1/24'
 list addresses 'fd00:10::1/64'

config wireguard_vpn 'wgclient'
 option preshared_key 'longkeygoeshere='
 option private_key 'longkeygoeshere='
 option public_key 'longkeygoeshere='
 list allowed_ips '192.168.10.128/32'
 list allowed_ips 'fd00:10::128/128'
Any chance to fix it?

Solved by timur.davletshin in post #113
Forget it. I have deleted luci-app-wireguard and qrencode from my test router. None of it will run in production. My users will stay without buggy QR codes.
3 Replies

[Assistant]
There's a long discussion on this:
[?] luci-app-wireguard QR Code shows Private Key
Network and Wireless Configuration
In the past weeks since the QR Code function of luci-app-wireguard was added, I've seen different interpretations of what the QR function should be used for. Some think they should be able to scan and get a config for a new peer (although this would be odd, since at least mobile apps, they generate a keypair themselves in the same way the wg command would work on OpenWrt) Others think they should be able to scan for the Public Key of the OpenWrt interface, for easy pasting into e.g. a mobile…

1 Reply

timur.davletshin:
Allowed IPs are missing in generated QR
Do you mean they're not being added to the peer (i.e. on the android device) as addresses? They shouldn't be allowed IPs on both end of the tunnel.

1

The Allowed IPs on the "server" side are different from the allowed IPs on the "client".
On the "server" side they are e.g. 192.168.10.128/32 while on the client side they are e.g.: 0.0.0.0/0 , ::/0
You can argue that the QR code should contain the default Allowed IPs: 0.0.0.0/0 , ::/0 or perhaps the LAN subnet of the router?

2 Replies
1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Wifi Feature Request: Random Mac Address for AP

Hi, I want to suggest a feature for AP with OpenWRT Firmware. The Feature that I want to suggest is the
Random Mac (Toggle On or Off).
This said feature is to prevent some Wifi Deather Jammer. that can sabotage some Deployed AP.
Every time the AP reboots. the wifi mac will be changed so that the information of the wifi will be changed and the jammed wifi will be free again.

Solved by frank92735 in post #12
Random MAC is a great idea. I also must say I like your multi AP idea as the 8266 can only deauth one AP at a time. Building on the multiple AP idea: in theory you could go with 10 AP's. Reboot each one once per hour staggered in 6 minute intervals using luci-app-netcat (or cron job uci network r…
1 Reply
1

[Assistant]
You should be able to script it, then add it to rc.local ?

1 Reply
2

reydeyes:
Wifi Deather Jammer
That's "deauther", as in "de-authentication", nothing to do with "death". And deauthing is not jamming.
Nitpicking aside, out of sheer curiosity, do you suffer from such malicious actors?

1 Reply
5

When you set a new mac address, do you:
have to reboot
restart network
set down/up interface
something else
?

1