[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: [THEME] Argon (main thread)

I have decided to start this thread as a way to keep together all the information regarding this excellent theme for OpenWrt along with a conversation about its issues and how to fix them. The original developer
@jerryk
maintains the official repo of this theme, a set of two packages that are not yet available in the OpenWrt package database
The theme is really pleasant to the eye, as you can see here:
It has been carefully curated to look great both on PC:
And on mobile browsers:
But the installation process is tricky and still needs some work. While it is fixed by the developer, I will try to summarize in this OP the important issues and how to overcome them in order to have a beautiful Argon theme up and running.
There are two main issues:
The config package for Argon is not fully updated to the new opkg, and the library required to maintain backward compatibility is not included in the dependencies in the config package.
The buggy CSSTidy module in the default Luci breaks some portions of the CSS files of this theme, causing undesired visual artifacts when the Argon packages are baked into the firmware. The CSSTidy module simplifies and reduces the size of the CSS files of any theme or additional page. In Argon, CSSTidy reduces these files from 158 KB to 82 KB. However, CSSTidy is buggy and, more often than not, breaks some pages.
And there are three solutions to them:
The straightforward solution would be to work the code to fix these issues, the same way other packages like bootstrap had to be modified to be compatible with CSSTidy. But that is nothing that you as a user can do, unless you can handle lua, CSS, HTML... code and are willing to contribute to the project.
Apply workarounds to an existing installation without updating the firmware. Easy patch but not good for devices with reduced resources.
Build a new image — using imagebuilder, or from sources— removing the problems by including all the patches in the firmware image.
INSTALLATION IN A ROUTER
Ensure your router has internet access. Log into its command line interface (CLI) using this command in your PC (replace the IP address if your router has another IP address):
ssh root@192.168.1.1
Once you are logged into your router's CLI type this:
opkg update
opkg install luci-compat
opkg install luci-lib-ipkg
mkdir -p /tmp/okibcn
cd /tmp/okibcn
URL=$(wget -q https://api.github.com/repos/jerrykuku/luci-theme-argon/releases/latest -O - | awk -F \" -v RS="," '/browser_download_url/ && /-argon/ {print $(NF-1)}')
wget $URL -O $(basename $URL)
opkg install $(basename $URL)
rm  -rf /tmp/okibcn/*
URL=$(wget -q https://api.github.com/repos/jerrykuku/luci-app-argon-config/releases/latest -O - | awk -F \" -v RS="," '/browser_download_url/ && /-config/ {print $(NF-1)}')
wget $URL -O $(basename $URL)
opkg install $(basename $URL)
cd
rm -rf /tmp/okibcn
You are all set. If you have a session open in your browser, just logout using the LuCI interface. Then log in again to your router using the web interface and go to System > System >  Language and Style and select Argon in the Design field. Now click on save & apply button and logout.
If you want to configure the accent color, the light/dark mode and other settings, go to System > Argon config in the web interface.
This method will not survive a firmware upgrade and you will have to repeat it every time you upgrade your firmware image. To avoid that you can integrate Argon in the images you build. The next two messages in this thread will illustrate how to do it using the OpenWrt imagebuilder, and building the firmware directly from source.

2 Replies
12

[Assistant]
INTEGRATE ARGON IN THE FIRMWARE USING IMAGEBUILDER:
To build the image you need a Linux system, Windows Subsystem for Linux (WSL) works fine too. Ensure your Linux OS has all the required tools to compile the image: p7zip-full build-essential libncurses5-dev libncursesw5-dev zlib1g-dev gawk git gettext libssl-dev xsltproc rsync wget unzip python. This is the sequence of commands for Ubuntu that ensures your system is ready to use the imagebuilder:
sudo rm -rf /etc/apt/sources.list.d/* /usr/share/dotnet /usr/local/lib/android /opt/ghc
sudo -E apt-get -qq update
sudo -E apt-get -qq upgrade -y
sudo -E apt-get -qq install p7zip-full build-essential libncurses5-dev libncursesw5-dev zlib1g-dev gawk git gettext libssl-dev xsltproc rsync wget unzip python
sudo -E apt-get -qq autoremove --purge
sudo -E apt-get -qq clean
Now your Linux is ready to build the image. Let's do it:
PROFILE="netgear_r7800"          # REPLACE THE PROFILE OF YOUR DEVICE
RELEASE="snapshots"              # "21.02.2" or "21.02.1" FOR OLDER RELEASES
TARGET="ipq806x"                 # USE THE TARGET ARCHITECTURE FOR YOUR DEVICE
ARCH="generic"                   # USE THE SUBTARGET ARCHITECTURE FOR YOUR DEVICE

DIFF_PACKAGES="luci luci-compat luci-lib-ipkg luci-theme-argon luci-app-argon-config"

mkdir -p openwrt.imagebuilder
cd openwrt.imagebuilder
if [ "$RELEASE" = "snapshots" ]; then
    wget https://downloads.openwrt.org/$RELEASE/targets/$TARGET/$ARCH/openwrt-imagebuilder-$TARGET-$ARCH.Linux-x86_64.tar.xz -O - | tar xJf - --strip-components=1;
else
    wget https://downloads.openwrt.org/releases/$RELEASE/targets/$TARGET/$ARCH/openwrt-imagebuilder-$RELEASE-$TARGET-$ARCH.Linux-x86_64.tar.xz -O - | tar xJf - --strip-components=1;
fi
! grep -q "src imagebuilder file:packages" repositories.conf && echo "src imagebuilder file:packages" >> repositories.conf
mkdir -p packages
URL=$(wget -q https://api.github.com/repos/jerrykuku/luci-theme-argon/releases/latest -O - | awk -F \" -v RS="," '/browser_download_url/ && /-argon/ {print $(NF-1)}')
wget $URL -O packages/$(basename "$URL")
URL=$(wget -q https://api.github.com/repos/jerrykuku/luci-app-argon-config/releases/latest -O - | awk -F \" -v RS="," '/browser_download_url/ && /-config/ {print $(NF-1)}')
wget $URL -O packages/$(basename "$URL")
SAFEPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PATH=$SAFEPATH make -j$(nproc) image PROFILE=$PROFILE PACKAGES="$DIFF_PACKAGES" FILES=files/ EXTRA_IMAGE_NAME="$(date +"%Y.%m.%d-%H%M")"
After less than 5 minutes your image will be baked. Your hot new image is ready, you can see it by typing:
cd  bin/targets/*/*/
ls
If everything went fine, your argon-ready sysupgrade image should be there.
If you are using WSL, just type explorer.exe . to open a file browser in that location so you can easily upload the image from Windows.
Adding Argon makes the image 440 KB larger.

3

FULL BUILD FROM SOURCES WITH ARGON
:
To build the image you need a Linux system, including the Linux Subsystem for Windows. Ensure your Linux OS has all the required set of tools to compile the image: diff find flex gawk gcc-6+ getopt grep libc-dev libz-dev make4.1+ perl. This is the sequence of commands for Ubuntu:
sudo rm -rf /etc/apt/sources.list.d/* /usr/share/dotnet /usr/local/lib/android /opt/ghc
sudo -E apt-get -qq update
sudo -E apt-get -qq upgrade -y
sudo -E apt-get -qq install -y git bzip2 diff find flex gawk gcc-6+ getopt grep libc-dev libz-dev make4.1+ perl python3.6+ rsync subversion unzip which
sudo -E apt-get -qq autoremove --purge
sudo -E apt-get -qq clean
Now your Linux is ready to build the image from source. Let's do it:
git clone -b master https://github.com/openwrt/openwrt.git openwrt
cd openwrt
SAFEPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PATH=$SAFEPATH ./scripts/feeds update -a
PATH=$SAFEPATH ./scripts/feeds install -a
git clone -b master https://github.com/jerrykuku/luci-theme-argon package/luci-theme-argon
git clone -b master https://github.com/jerrykuku/luci-app-argon-config package/luci-app-argon-config
echo "CONFIG_PACKAGE_luci=y" >> .config
echo "CONFIG_PACKAGE_luci-compat=y" >> .config
echo "CONFIG_PACKAGE_luci-lib-ipkg=y" >> .config
echo "# CONFIG_LUCI_CSSTIDY is not set" >> .config
echo "CONFIG_PACKAGE_luci-theme-argon=y" >> .config
echo "CONFIG_PACKAGE_luci-app-argon-config=y" >> .config
make menuconfig
Select your device, otherwise it will build for all devices. The device selection requires only the first three lines, selecting target architecture, subtarget and then the specific device model. Don't touch anything else below that unless you know what you are doing.
Now you are ready to build your image, just type:
PATH=$SAFEPATH make defconfig
PATH=$SAFEPATH make -j$(nproc)
After more than 1 hour your image will be baked. Your hot new image is ready, you can see it by typing:
cd  bin/targets/*/*/
ls
If everything went fine, your argon-ready sysupgrade image should be there.
If you are using WSL, just type explorer.exe . to open a file browser in that location so you can easily upload the image from Windows.

3

okibcn:
to keep all the information regarding this excellent theme for OpeWrt.
We have a wiki for documentation. If you want to keep information, the wiki would be the place to go.

1 Reply


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Online ImageBuilder and Upgrade Server

Hi, for the last year I've been working on a server which allows two things:
Devices check online for new versions or package upgrades
Easily create custom images without setting up a build environment.
This is done by a back-end which automatically sets up ImageBuilders and parses available packages and profiles. Once initialized, an API allows to perform upgrade checks and build requests.
Without giving to many details here, the created images are cached to allow faster responses.
While initially only planned for upgrade checks, the API is usable to offer an online ImageBuilder which allows firmware creation even from mobile devices.
There have been some major refactoring lately, so some stuff does not fully work, but as I have currently some spare time I'll try to fix all the issues within the next weeks.
I'd be happy for some feedback & feature requests, the project is intended to be generically usable so communities can setup their own servers.

1 Reply
31

[Assistant]
The online interface has an advanced mode to allow customization of pre-installed packages:

7

Looks great!
Would be even better if you've allowed further customization by letting users paste their own uci-defaults script in the text area.

Good idea, I've planed created something similar to allow allow all kinds of files, but reducing it to UCI appears much easier to implement. My only concern is on how to add SSH keys...


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Ipq806x NSS build (Netgear R7800 / TP-Link C2600 / Linksys EA8500)

Have Master, 23.05, and 22.03 builds for ipq806x devices with hardware offloading using the two NSS cores. All Master and 23.05 R7800 builds are tested before positing (router boots + wifi works). I don't own a C2600, EA7500v1, EA8500, G10, NBG6817, R7500v1, R7500v2, or d7800 (builds for these are untested - make sure you known how to tftp if you get in trouble)
Build Goals:
Maximum ipq806x performance for Gigabit WAN connections.
Simple and compatible with master (able to flash back and forth if you like testing different builds)
Optimize support for 802.11 v/k
Simple set of packages focused on statistics / graphs / monitoring
Features:
NSS drivers for NAT offloading & SQM offloading (NSS Fq_codel)
USB / LEDs / Drive mounting works
Longer wait for failsafe button
Wpad-OpenSSL
OpenSSL Luci + Luci stats
PPPoE
Ath10k-ct or ath10k drivers builds. The builds with the “ath10k” in the name are running mainline firmware and drivers. The builds with no additional description are running the OpenWRT default ath10k-ct firmware and drivers.
Extras: IPv6 support, adblock, ddns, htop, openvpn-openssl, and wireguard.
Known Issues:
Luci SQM and normal SQM config doesn’t work. Have to use custom config.
Ground rules:
Appreciate feedback and improvements relative to the goals of the build
Appreciate config recommendations to optimize performance and 802.11 v/k
Appreciate developer support to fix bugs and maximize the potential of ipq806x with NSS hardware offloading support.
Master + NSS Hardware Offloading Download: (sysupgrade and factory image in bin folder)
Ipq806x Targets (most devices):
github.com
//github.com/ACwifidude/openwrt/tree/kernel5.15-nss-qsdk11/bin/targets/ipq806x/generic
Chromium Targets:
github.com
//github.com/ACwifidude/openwrt/tree/kernel5.15-nss-qsdk11/bin/targets/ipq806x/chromium
OpenWrt 23.05 (Stable) + NSS Hardware Offloading Download: (sysupgrade and factory image in bin folder)
Ipq806x Targets (most devices):
github.com
//github.com/ACwifidude/openwrt/tree/openwrt-23.05-nss-qsdk11/bin/targets/ipq806x/generic
Chromium Targets:
github.com
//github.com/ACwifidude/openwrt/tree/openwrt-23.05-nss-qsdk11/bin/targets/ipq806x/chromium
OpenWrt 22.03 (Stable) + NSS Hardware Offloading Download: (sysupgrade and factory image in bin folder)
github.com
//github.com/ACwifidude/openwrt/tree/openwrt-22.03-nss-qsdk10.0/bin/targets/ipq806x/generic
Wireless Performance: (with the below settings on a R7800 using an iphone 2x2 client)
ath10k-ct, 5.10 Kernel with NSS Hardware Offloading
[SUM]   0.00-30.01  sec  2.30 GBytes   659 Mbits/sec                  receiver
[SUM]   0.00-30.01  sec  1.99 GBytes   569 Mbits/sec  189             sender

ath10k (OpenWrt with no offloading)
[SUM]   0.00-30.01  sec  1.60 GBytes   459 Mbits/sec                  receiver
[SUM]   0.00-30.01  sec  1.14 GBytes   326 Mbits/sec  699             sender

ath10k-ct (OpenWrt with no offloading)
[SUM]   0.00-30.01  sec  1.53 GBytes   437 Mbits/sec                  receiver
[SUM]   0.00-30.01  sec  1.21 GBytes   347 Mbits/sec  763             sender
Wired Performance: (No NSS SQM, using build default settings)

4 Replies
46

[Assistant]
Replicating my build from scratch:
Master:
git clone -b kernel5.15-nss-qsdk11 https://github.com/ACwifidude/openwrt.git
Openwrt 23.05:
git clone -b openwrt-23.05-nss-qsdk11 https://github.com/ACwifidude/openwrt.git
Openwrt 22.03:
git clone -b openwrt-22.03-nss-qsdk10.0 https://github.com/ACwifidude/openwrt.git
If you are building for one type of router you can change the first section of the diffconfig on github to just one device if you are building for a particular model (delete all the routers you don’t want to build for, follow the instructions below after the # sign):
# delete the “multi profile” line
# delete the line ending in ""
CONFIG_TARGET_MULTI_PROFILE=y
CONFIG_TARGET_DEVICE_PACKAGES_ipq806x_generic_DEVICE_netgear_r7800=""
My diffconfig file is set up for ath10k-ct driver/firmware. If you want to use ath10k driver/firmware instead - use the diffconfig-ath10k file.
When your diffconfig is to your liking - this is how to prep and build (I have a 4 CPU system, change the last line to the number of CPUs in your system):
./scripts/feeds update -a && ./scripts/feeds install -a && cp diffconfig .config && make defconfig && ./scripts/getver.sh

make -j5
Rebasing with Master, OpenWrt 23.05, or OpenWrt 22.03 (make sure you are in the openwrt folder, rebase with the latest updates - then you can build as per above)
#Remove “rebase” commit (this gives you a clean build environment - it deletes the final bin content and diffconfig files, I’d copy the diffconfig to a separate folder before running this command)
git reset --hard HEAD~1

git remote add upstream https://git.openwrt.org/openwrt/openwrt.git

#Master Rebase:
git fetch upstream && git rebase upstream/master

#OpenWrt 23.05 Rebase:
git fetch upstream && git rebase upstream/openwrt-23.05

#OpenWrt 22.03 Rebase:
git fetch upstream && git rebase upstream/openwrt-22.03
If you need further help the OpenWrt wiki is well written and has further build system usage instructions:
OpenWrt Wiki – 10 Dec 16
Build system usage
Build system usage * Do everything as an unprivileged user, not root, without sudo. * Make sure there are no spaces in the full path to the build directory. There is an issue affecting the current OpenWrt source tree (from at least 21.02...
Recommended configuration (build is the master defaults (CPU has been further optimized as per below), you’ll have to do all the rest yourself):
Firewall Software & Hardware offloading disabled
Use the default performance CPU governor (this is the build default)
Optionally you can use on demand settings (some report less stability):
    echo ondemand > /sys/devices/system/cpu/cpufreq/policy0/scaling_governor
    echo ondemand > /sys/devices/system/cpu/cpufreq/policy1/scaling_governor
    echo 600000 > /sys/devices/system/cpu/cpu0/cpufreq/scaling_min_freq
 echo 600000 > /sys/devices/system/cpu/cpu1/cpufreq/scaling_min_freq
 echo 25 > /sys/devices/system/cpu/cpufreq/ondemand/up_threshold
 echo 10 > /sys/devices/system/cpu/cpufreq/ondemand/sampling_down_factor
This is how to switch back to the build defaults:
echo performance > /sys/devices/system/cpu/cpufreq/policy0/scaling_governor; echo performance > /sys/devices/system/cpu/cpufreq/policy1/scaling_governor
Irqbalance disabled, packet steering disabled
uci set irqbalance.irqbalance.enabled=0; uci set network.globals.packet_steering=0; uci commit
Custom NSS fq_codel startup script if SQM is desired (below is set to 900/900). Recommend setting to 5% below your ISP provided speed and then adjusting from there as per your testing. Maximum is ~900Mbit.
modprobe nss-ifb

ip link set up nssifb

# Shape ingress traffic to 900 Mbit with chained NSSFQ_CODEL
tc qdisc add dev nssifb root handle 1: nsstbl rate 900Mbit burst 1Mb
tc qdisc add dev nssifb parent 1: handle 10: nssfq_codel limit 10240 flows 1024 quantum 1514 target 5ms interval 100ms set_default

# Shape egress traffic to 900 Mbit with chained NSSFQ_CODEL
tc qdisc add dev eth0 root handle 1: nsstbl rate 900Mbit burst 1Mb
tc qdisc add dev eth0 parent 1: handle 10: nssfq_codel limit 10240 flows 1024 quantum 1514 target 5ms interval 100ms set_default
802.11v,k enabled on 5ghz radio for setups with multiple APs (change to your timezone)
wireless settings
uci set wireless.default_radio0.ieee80211v=1; uci set wireless.default_radio0.ieee80211k=1; uci set wireless.default_radio0.bss_transition=1; uci set wireless.default_radio0.wnm_sleep_mode=1; uci set wireless.default_radio0.time_advertisement=2; uci set wireless.default_radio0.time_zone=CST6CDT,M3.2.0,M11.1.0; uci commit
Make custom DNS internal sites work (if you have custom sites):
ifconfig br-lan promisc
turn custom internal sites off:
ifconfig br-lan -promisc
kmods don’t install like normal on this build. If you want a custom set of kmods the best solution is to build from scratch (see above). Here is the full listing of packages that are built when I build:
MasterNSS builds:
https://github.com/ACwifidude/openwrt/tree/kernel5.15-nss-qsdk11bin/targets/ipq806x/generic/packages-MasterNSS
MasterNSS-ath10k builds:
github.com
openwrt/bin/targets/ipq806x/generic/packages-MasterNSS-ath10k at...
kernel5.15-nss-qsdk11/bin/targets/ipq806x/generic/packages-MasterNSS-ath10k
This repository is a mirror of https://git.openwrt.org/openwrt/openwrt.git It is for reference only and is not active for check-ins or for reporting issues. We will continue to accept Pull Request...
Example install of a package (doesn't always work)-
opkg install https://github.com/ACwifidude/openwrt/raw/kernel5.15-nss-qsdk11bin/targets/ipq806x/generic/packages-MasterNSS/kmod-bluetooth_5.10.107-1_arm_cortex-a15_neon-vfpv4.ipk
Want Ath10k instead of Ath10k-ct?
Load the ath10k version to get both the driver and firmware. If you want to just change the firmware you can switch like this:
opkg update && opkg remove ath10k-firmware-qca9984-ct && opkg install ath10k-firmware-qca9984
Looking for more of a minimalist / no frills build with the minimum active services running?
Add this script to your startup script on your router to disable “extra” services:
# these services do not run on the router
for i in adblock openvpn sqm; do
  if /etc/init.d/"$i" enabled; then
    /etc/init.d/"$i" disable
    /etc/init.d/"$i" stop
  fi
done

17 Replies
15

ACwifidude:
Performance Governor
I read some people suspect this is needed for stability but in my case, the R7800 is perfectly stable running the schedutil governor with the NSS patches enabled.

2 Replies
1

I haven’t had any stability problems either. I’ve found all the governors work fine. I’ve been rocking the performance governor recently and it is going well.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: LuCI APP: luci-app-sms-tool (SMS / USSD Codes / AT Commands)

Hi, I created next small LuCI app.
Luci-app-sms-tool is a mini gui for handling messages via sms_tool application/project https://eko.one.pl/?p=openwrt-sms_tool Works with mPCI-E and USB 3G/LTE modems. Don't work with HiLink/RNDIS modems. I'm making it available and maybe it'll come in handy.
Preview and quick configuration (version 1.9.5 & modem Quectel EM160R-GL)

Enlarge the page to see the movie with better quality. (CTRL +)

Application version (1.9.5-20221207):
https://github.com/4IceG/luci-app-sms-tool
Language Packages:
luci-i18n-sms-tool-pl_unknown_all.ipk
luci-i18n-sms-tool-ru_unknown_all.ipk
Luci-app-sms-tool_1.9.3-20211205:
Cosmetic change to the SMS icon on a neutral light and dark theme.

New sms-tool_2021-12-03-d38898f4 from Cezary:
Fix: DCS for ussd.
sms-tool_2021-12-03-d38898f4-1_arm_cortex-a15_neon-vfpv4.ipk
sms-tool_2021-12-03-d38898f4-1_arm_cortex-a7_neon-vfpv4.ipk
sms-tool_2021-12-03-d38898f4-1_arm_cortex-a9_vfpv3-d16.ipk
sms-tool_2021-12-03-d38898f4-1_arm_xscale.ipk
sms-tool_2021-12-03-d38898f4-1_mipsel_24kc.ipk
sms-tool_2021-12-03-d38898f4-1_mips_24kc.ipk
sms-tool_2021-12-03-d38898f4-1_x86_64.ipk
The latest version always on
OpenWrt =< 19.07
https://github.com/4IceG/luci-app-sms-tool
OpenWrt >= 21.02
https://github.com/4IceG/luci-app-sms-tool-js
https://github.com/obsy/sms_tool
Other useful packages for mobile internet:
GitHub
GitHub - 4IceG/luci-app-3ginfo: Graphic visualization of the mPCI-E and USB...
Graphic visualization of the mPCI-E and USB 3G/LTE modem connection status. - 4IceG/luci-app-3ginfo
Preview
GitHub
GitHub - 4IceG/luci-app-atinout-mod: Web UI AT-commands using atinout for...
Web UI AT-commands using atinout for OpenWrt. Contribute to 4IceG/luci-app-atinout-mod development by creating an account on GitHub.
Preview

18

[Assistant]
That's a very useful feature! Thanks for your great work

1

Thank you
@Zuzia
. No big deal, everyone would write such an application if they needed it .

Nice, dude!
I used to text from my router to my phone in the old days...
At the time, I just used an email utility built into DD-WRT (sendmail I think it was) and my service providers SMTP server. I'd email phone#@tmomail.net and it'd show up on my phone as an MMS. Maybe you could build this into it? I think there may be a sendmail version supporting SSL/TLS (think Hotmail, GMail, etc...) but it's pretty bloated size wise. Just an idea.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: OpenWrt 21.02.x ath79 tiny LuCI

This is a package of OpenWRT 21.02.3 stable builds for targets ath79.
Modifications against default tiny packages:
removed PPP support
removed OPKG
removed SSL support
removed signature checking, etc.
removed swapoff and long options support from busybox
stripped to bare bones
added LuCI
flashing from LuCI switched off (it causes devices to freeze)
This way the builds could fit into squashfs (factory/sysupgrade) compatible builds. Relayd or wpad-basic could not fit in anymore.
Please note there is still upgrading incompatibility against deprecated target ar71xx (OpenWRT version 18.06 or older), please see https://openwrt.org/docs/guide-user/installation/ar71xx.to.ath79 for more info.
Backup your configuration via webserver, but flash new upgrades using SSH. Webserver most likely doesn't have enough memory to handle file upload as all my tests resulted in the need to reboot the device entirely.
  ssh root@192.168.1.1 #or use PuTTY
  grep machine /proc/cpuinfo #check device identification
  cd /tmp
  wget HTTP-URL #copy URL from browser, HTTPS won't work
  sysupgrade -u -v openwrt- #use TAB to autocomplete filename
If you are unable to log into LuCI, you probably have old /etc/config/uhttpd file present and there are attempts to redirect you to HTTPS protocol. Remove it (use rm /etc/config/uhttpd) and re-flash using the guide above.
Builds have not been tested for all devices, but compiling resulted in no errors.
https://ashus.ashus.net/thread-192.html

15

[Assistant]
I created an account just to say thank you. I am using your 21.02 for wa901nd v5 as guest network originally from 18.06. It is working great. Better controls for Openwrt and security. The only drawback is the slow loading of the interface which is understandable because of the 4/32 nature of the device. And whenever I enter the Connections tab under Realtime graphs it only shows the device ip and ip address of the visited websites unlike 18.06 where the device/site names were identified. Otherwise, It's amazing how it resurrected such a legacy device. Thanks!

2

Yes, the devices are old and slow. DNS lookups on that page were slowing the list down dramatically, it was changed in OpenWRT to not resolve the names by default.
Although I came here today to publish 21.02.1, I have sad news. We are running out of space rapidly. While 19.07.x were straightforward to build, 21.02.0 and now 21.02.1 need more and more space, so now I had to begin cutting pieces from the system utils. If this goes on, I will have to cut IPv6 or these may be the last builds for 4MB devices with LuCI.

1 Reply
3

Thank you for taking the time to create an updated build for these devices that have long been forgotten by it's manufacturer albeit with modifications to allow them to work perfectly on 4/32 devices. I thought it was the end for my device at 18.06 and then you came along. You make the internet a safer place by securing old devices across the globe with Openwrt.
I have installed the new update 21.02.1 thru Luci and it restarted with the new black theme. Awesome! And all my settings are still intact. I also think Luci is snappier. From my setup I disabled from startup IPv6 since my ISP does not use it, Dropbear since I dont SSH hoping to improve the memory usage for the device. I also used Software flow offloading in firewall and that made a difference. I used the Write DNS queries in Syslog instead of the Realtime graphs since that is a better way to track activity for port 53. And so many other things I could'nt do in 18.06.
Being able to use this build is Godsend. Thank you once again.

2


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Adblock-fast: ad-blocking service for dnsmasq, smartdns and unbound

This is a replacement/new version for the simple-adblock package, which couldn't have been taken further while keeping the existing config file structure, hence the new package/name.
Migration script from simple-adblock is included and ran after the installation. It should carry over the lists/domains you've been allowing/blocking with simple-adblock and also stop and disable simple-adblock, so if you're migrating, it should be a smooth and easy process.
This new package auto-detects supported list formats:
AdBlockPlus format
domains list format
hosts file format
dnsmasq config file (with both server= and local= statements) format
So pretty much any list which doesn't require the complex processing you can throw at adblock-fast and it should figure it out on the fly.
The README is available at https://docs.openwrt.melmac.net/adblock-fast/.
I'll add more information later, for now I needed the URL to the thread to add to the README.

11

[Assistant]
Unless anyone has experienced issues with adblock-fast (and the luci app) over the last week of testing, my plan is to merge the update into snapshots and 23.05.0-rc tomorrow.
PS. Many thanks to
@jow
and
@stokito
for polishing up the luci app code.

3

Hi mate could we have a quick breakdown of the difference between addblock and adblock-fast? Pros and cons:

4

Thanks for releasing this - I like its simplicity. I'm struggling with the "dnsmasq_instance" option, though. I run 3 dnsmasq instances and want to ad-block #0 and #1, so I've set "option dnsmasq_instance '0 1'" in the config file. Running "/etc/init.d/adblock-fast restart" gives "/etc/rc.common: eval: line 606: 1: not found" and the dnsmasq configs don't contain the adblock servers line. Setting it to a single number or '*' works as expected. This is what your doc says about the option:
String of space-separated DNSMASQ instance numbers (or ‘*’ for all) to be affected by the service.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: QoSmate: (Yet Another) Quality of Service Tool for OpenWrt

I'm excited to announce the release of QoSmate, a new QoS solution for OpenWrt. QoSmate aims to simplify the process of setting up QoS on your router while offering customization options for those who need them.
Key features:
Support for both HFSC and CAKE queueing disciplines
Easy-to-use LuCI interface (luci-app-qosmate)
Flexible traffic classification with nftables
Automatic package installation and setup
ingress shaping via ifb + ctinfo
QoSmate builds upon the excellent work of
@dlakelan
and his SimpleHFSCgamerscript. It extends the original concept with additional features and a user-friendly interface.
You can find QoSmate on GitHub:
github.com
GitHub - hudra0/qosmate
Contribute to hudra0/qosmate development by creating an account on GitHub.
Installation:
QoSmate is not yet an official OpenWrt package, but it's designed for easy installation. You can set it up with just two commands. Detailed installation instructions are available in the README file on the GitHub repository.
Please note that the README is still a work in progress. I am continuously updating it to provide helpful information. If you encounter any unclear instructions or have suggestions for improvement, please let me know.
While QoSmate isn't currently in the official OpenWrt package repository, if there's sufficient interest and demand from the community, I'll consider submitting a request for its inclusion in future OpenWrt releases.
Getting Started:
Follow the installation instructions in the GitHub README
Access QoSmate through the LuCI web interface under Network > QoSmate
Configure your WAN interface and speeds in the Settings tab (or use the Auto Setup function)
Choose between HFSC and CAKE in the Advanced tab
Set up custom rules in the Rules tab if needed
Apply the changes
Special thanks to
@choppyc
for extensive testing and invaluable feedback throughout the development process.
I welcome any feedback, suggestions, or contributions from the community.
Screenshots:
To give you a better idea of what QoSmate looks like in action, I've included some screenshots below:
Note: Officially, only OpenWrt is supported. Forks may introduce fundamental changes or adjustments that could impact compatibility or functionality.
Reporting Issues
If you're experiencing issues with QoSmate, please use the [Issue Report Template]
to provide all necessary information. This helps identify and resolve problems more quickly.
Note: Before reporting an issue, please:
Check if your issue is already addressed in this thread
Run a bufferbloat test with and without QoSmate
Ensure you're using the latest version)
to provide all necessary information. This helps us identify and resolve problems more quickly.

30

[Assistant]
Interesting contribution Hudra. This weekend I'm going to try it, see how it works for me. Thank you!

1

Will this work if my wan is wifi (wwan)
My only choice for internet is using wifi.
Not sure if it matters but my router is a TP-Link TL-WDR4300 running 23.05.3

Currently, QoSmate is primarily designed for wired WAN connections with relatively stable bandwidth. Using it with a WWAN connection might not be optimal due to the potentially variable nature of wifi connections.
However, if your wifi connection provides relatively stable and consistent bandwidth, you could give it a try. The key is to set the shaper rate to a bandwidth value that you will have available at all times. This ensures that the QoS rules remain effective even during periods of lower bandwidth.
I was considering the implementation of CAKE w/ Adaptive Bandwidth in some way. This could potentially make QoSmate more effective for variable bandwidth connections like WiFi or mobile internet.

5


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Davidc502- wrt1200ac wrt1900acx wrt3200acm wrt32x builds

This thread is dedicated thread for davidc502 builds. Please ask questions related to the builds here. However, keep in mind, if your question is not answered to your satisfaction in this thread, feel free to post your question in the "Installing and Using Lead" forum as there is usually a much larger audience of experts who can help.
Current images built and distributed.
WRT1200ac Version 1 and 2
WRT1900ac Version 1 and 2
WRT1900acs Version 1 and 2
WRT3200acm Version 1
WRT32X Version 1
Website: https://dc502wrt.org
I feel the focus of these builds are for beginners to intermediate users as they provide some of the more popular applications found without being too bogged down. If you have an idea of an improvement, let me know as your thoughts are always welcome.
If you have a question, but don't want to post it in this thread, send me a private message, and I'll respond as soon as I can.
Best Regards,
David

22

[Assistant]
There is an outstanding issue with Darkmatter LuCi theme not working properly.
Builds affected are 7093 and 7210.
The source packages for DarkMatter have not been touched in 6 months (as of this date). It is unknown if or when the package maintainers will address the problem.
GitHub
apollo-ng/luci-theme-darkmatter
luci-theme-darkmatter - Alternative Luci theme for LEDE/OpenWRT

2 Replies
1

Thanks for creating this thread
@davidc502
! I feel at home again and not a forum wonderer anymore

1

Please consider enabling hardware crypto support in OpenSSL:
CONFIG_OPENSSL_ENGINE_CRYPTO=y
CONFIG_OPENSSL_HARDWARE_SUPPORT=y
Note: Do not enable hardware digest support, since it breaks some of TLS handshakes.

3 Replies
1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: [How-To-Updated 2021] Installing AdGuardHome on OpenWrt [Manual and opkg method]

Introduction:
This thread mostly covers the manual installation of AdGuard Home's edge/beta version. OpenWrt's opkg version is the stable release. The edge version installs to /opt/AdGuardHome , the opkg version to /etc/adguardhome for the config files and /tmp for filters, logs etc thus you WILL loose them when your router reboots.
AGH - https://github.com/AdguardTeam/AdGuardHome
A few points first of all.
The ports chosen are either well known alternate ports or reasonable compromises. You are free to edit the scripts to use your own ports but you should check with https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers for reserved ports.
OpenWrt has a AGH package in opkg. Instructions are here https://openwrt.org/docs/guide-user/services/dns/adguard-home
NextDNS - It is recommended to use AGH as a better client for NextDNS : [How-To-Updated 2021] Installing AdGuardHome on OpenWrt [Manual and opkg method] - #6 by mercygroundabyss
For limited space routers you can mount a USB drive and use that to host AGH. Mounting it as /opt/AdGuardHome will ensure you do not run out space on smaller routers. Currently AGH is 35mb. Add in filters, DNS queries, Stats, (and a 2nd copy of AGH binary when it updates and backs up) and your space rapidly vanishes. With careful setting of options you can keep the requirements low but having an entire USB drive to use will avoid issues.
Another interesting option is what
@Cheddoleum
uses. He kindly wrote up about using a pi zero off the USB port router piggy backing on OpenWrt. Raspberry Pi Zero as a router-attached ethernet gadget This gives AGH a separate cpu to run on if your router is older and lacks space and power.
My installation uses 192.168.1.1 as default IP. Please ensure you edit any scripts to match your config or this will break things in bad ways.
https://github.com/AdguardTeam/AdGuardHome/wiki/Encryption - AGH supports encrypted DNS internally and it is just a matter of choice as to which method you use and what servers you put in.
I do NOT use SSL for AGH's web frontend. Luci (OpenWrt's web interface) runs on port 80 and port 443 for SSL. I run AGH on port 8080. If you wish to use SSL for AGH you will need to move Luci or run AGH on non standard ports. AGH does use SSL for encrypted DNS but that is separate to the web interface. You can also use nginx to proxy AGH. See https://openwrt.org/docs/guide-user/services/dns/adguard-home#nginx_reverse_proxy_through_luci for more details.
Installation:
I use Putty for SSH shell access and WinSCP for remote file access to my router. This means I can edit files directly and also create the scripts required for install. It also avoids windows to unix file issues that can occur with editing of files. (unix uses Line Feed for new line, windows uses Carriage Return / Line Feed. This will cause unexpected errors in unix.)
Ok. Having had some free time today I have updated my backup router to OpenWrt 21.02.1.
Completely clean install and reset to defaults. OpenWrt uses 192.168.1.1 thus all my scripts assume and follow that convention.
I updated opkg and pulled new updates. (listed below if you are curious.)
opkg results
With that done I now use the following script to install packages required for AGH install and a few test tools.
The most important is sudo. This is required for setting up AGH service.
ca-certificates ca-bundle - These are the certificates required for SSL.
curl wget tar unzip - System tools for downloading AGH and unzipping updates etc.
Bind-tools is all the DNS tools. This package is for testing DNS queries and ensuring DNSSec is on and proper resolution of DNS queries.
The script then pulls the AGH installer script and installs the Edge version. This is the most up to date and is generally best version to use.
Now the fun bit. With AGH installed, we now switch OpenWrts DNSMasq to the background so we can pull client info from it and resolve the OpenWrt clients. Rebind protection is removed. DHCP options are added so AGH will take over from DNSMasq. Unless DNSMasq is moved from port 53 to port 54 then AGH cannot take over and be primary DNS. Luci's web interface lives on port 80 so we just tell AGH when we set it up to use port 8080 for its web interface instead.

(The reason you setup OpenWrt to use a different unencrypted upstream is so when it brings up your connection it can do NTP and updates as AGH will still be loading. Without NTP setting your router time / date correctly, SSL will fail and thus no encrypted DNS.)

See https://openwrt.org/docs/guide-user/services/dns/adguard-home#bypassing_encrypted_dns_for_ntp for more details.
I have split my install script into two. The first swaps the routers upstream DNS for Cloudflare DNS. As some may want to keep their existing DNS settings I've moved this to a separate script that you can run or ignore and continue to the installation script instead.
routerDNS.sh
#!/bin/sh
# Reconfigure router DNS provider to cloudflare upstream

# Disable peer ISP DNS
uci set network.wan.peerdns="0"
uci set network.wan6.peerdns="0"

# Reconfigure router IPv4 DNS provider to cloudflare upstream
uci -q delete network.wan.dns
uci add_list network.wan.dns="1.1.1.1"
uci add_list network.wan.dns="1.0.0.1"

# Reconfigure router IPv6 DNS provider to cloudflare upstream
uci -q delete network.wan6.dns
uci add_list network.wan6.dns="2606:4700:4700::1111"
uci add_list network.wan6.dns="2606:4700:4700::1001"

# Save changes
uci commit network

# Restart network service to reflect changes
/etc/init.d/network restart
installAGH.sh The install script looks up the first ipv4 and v6 addresses to use for installing. It uses the br-lan interface for this. If you have a different interface you will need to change the script.
#!/bin/sh
# Switch to Adguard setup
# Grab packages for AGH and updates.
opkg update
opkg install sudo ca-certificates ca-bundle curl wget wget-ssl tar unzip bind-tools

#grab and install AGH
curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -c edge

# 1. Enable dnsmasq to do PTR requests.
# 2. Reduce dnsmasq cache size as it will only provide PTR/rDNS info.
# 3. Disable rebind protection. Filtered DNS service responses from blocked domains are 0.0.0.0 which causes dnsmasq to fill the system log with possible DNS-rebind attack detected messages.
# 4. Move dnsmasq to port 54.
# 5. Set Ipv4 DNS advertised by option 6 DHCP
# 6. Set Ipv6 DNS advertised by DHCP
# 7. Set 24hr DHCP Leases
# Get the first IPv4 and IPv6 Address of router and store them in following variables for use during the script.
NET_ADDR=$(/sbin/ip -o -4 addr list br-lan | awk 'NR==1{ split($4, ip_addr, "/"); print ip_addr[1] }')
NET_ADDR6=$(/sbin/ip -o -6 addr list br-lan scope global | awk 'NR==1{ split($4, ip_addr, "/"); print ip_addr[1] }')

echo "Router IPv4 : ""${NET_ADDR}"
echo "Router IPv6 : ""${NET_ADDR6}"

uci set dhcp.@dnsmasq[0].noresolv='0'
uci set dhcp.@dnsmasq[0].cachesize='1000'
uci set dhcp.@dnsmasq[0].rebind_protection='0'
uci set dhcp.@dnsmasq[0].port='54'
uci -q delete dhcp.@dnsmasq[0].server
uci add_list dhcp.@dnsmasq[0].server="${NET_ADDR}"
uci set dhcp.lan.leasetime='24h'

#Delete existing config ready to install new options.
uci -q delete dhcp.lan.dhcp_option
uci -q delete dhcp.lan.dns

# DHCP option 6: which DNS (Domain Name Server) to include in the IP configuration for name resolution
uci add_list dhcp.lan.dhcp_option='6,'"${NET_ADDR}"

#DHCP option 3: default router or last resort gateway for this interface
uci add_list dhcp.lan.dhcp_option='3,'"${NET_ADDR}"

#Set IPv6 Announced DNS
for OUTPUT in $(ip -o -6 addr list br-lan scope global | awk '{ split($4, ip_addr, "/"); print ip_addr[1] }')
do
 echo "Adding $OUTPUT to IPV6 DNS"
 uci add_list dhcp.lan.dns=$OUTPUT
done

# Save changes
uci commit dhcp

# Restart dnsmasq service to reflect changes
/etc/init.d/dnsmasq restart

echo 'Goto http://'"${NET_ADDR}"':3000 and configure AdGuardHome.'
Output from the install.
With that complete now we login http://192.168.1.1:3000 and configure AGH.
AGH should see port 53 for DNS is clear so that option is fine.
However Luci runs on port 80 so AGH detects this and will not let you proceed.
Change the web interface port to 8080 and continue the install.
Setup your user and password and then you should be at the main web interface.
At this point you can just follow AGH's wiki to guide you into setting up AGH. But for completeness I have documented the process below.
GitHub
Configuration · AdguardTeam/AdGuardHome Wiki
Network-wide ads & trackers blocking DNS server. Contribute to AdguardTeam/AdGuardHome development by creating an account on GitHub.
There are a few needed tweaks depending on if you selected listen on all interfaces during setup. To fix this some manual editing is required of the yaml file. By default AGH in its setup asks you what interfaces to bind to. It either lets you select a single interface or ALL interfaces. (That means if your WAN interface is up you will have DNS listening there. There is an issue in for that to be selectable so you can deselect WAN interfaces. Its currently filed as an improvement for the 108 version I believe)
Open the /opt/AdGuardhome.yaml file and find the following:
dns:
  bind_hosts:
  - 127.0.0.1
  - ::1
  - 192.168.1.1
  - fd1a:c860:7174::1
  port: 53
That config serves DNS on localhost ipv4, ::1 localhost ipv6, 192.168.1.1 and ipv6 fd1a:c860:7174
DNS Settings:
On your AGH web interface open the DNS settings page http://192.168.1.1:8080/#dns and then configure your provider as you want.
I use Cloudflare but other providers are listed here.
https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration#upstreams - Configure upstreams
(edit - Added example DNS picture as guide. You do not need to use any other programs like Unbound or DNS-Over-Https. AGH does it internally. All you have to do is pick your provider and method of encrypted DNS.)
Domain interception :
If you have the default OpenWrt DHCP then adding :
[/lan/]127.0.0.1:54
[//]127.0.0.1:54
to the upstream list that will intercept lan and domainless requests and pass those requests back to openwrt. "lan" is OpenWrt's default domain. (127.0.0.1) local loopback is used here to enable statistics tracking but you may also use your router ip (192.168.1.1) here too. Domain Interception is necessary for multi ip networks. For simple IP networks rDNS should cover this.
Bootstrap Servers
Then I setup the bootstrap servers. These are known ip addresses to allow AGH to find DNS resolvers.
https://kb.adguard.com/en/general/dns-providers#cloudflare-dns - Cloudflare DNS info.
(edit - List of providers here - https://kb.adguard.com/en/general/dns-providers)
Reverse DNS (rDNS)
To enable rDNS so AGH picks up your DHCP assignments from OpenWrt.
From the AdGuard Home web interface Settings → DNS settings
Scroll to “Private reverse DNS servers”
Add 192.168.1.1:54
Tick both “Use private reverse DNS resolvers” and “Enable reverse resolving of clients' IP addresses” boxes and click apply.
https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration#rdns-clients - Configuring rdns.
yaml settings for this:
  resolve_clients: true
  use_private_ptr_resolvers: true
  local_ptr_upstreams:
  - 192.168.1.1:54
Filters:
AGH comes with built in filters. Add as you see fit. There are more filter lists available on the internet but be aware as you add more filters, you use more memory and space. Limited space/mem routers will need to be monitored to ensure you do not run out of memory with huge lists.
Filter Sites:
https://firebog.net/
https://oisd.nl/ For AdGuardHome you must use abp.oisd.nl
I have updated info about filter lists here : [How-To-Updated 2021] Installing AdGuardHome on OpenWrt [Manual and opkg method] - #401 by mercygroundabyss
Interface:
You will notice that the interface shows "0 malware/phishing sites blocked".
You will only see Blocked lists showing for your results from your filter lists.
It is their DNS which gives those definitions so you will have to use AGH DNS as upstream if you wish to use those counters.

It is explained in their blog here :
AdGuard Blog
Introducing AdGuard Home
As many of you probably know, AdGuard provides a lot of ways to block ads in form of various apps and browser extensions. Some even heard about AdGuard DNS, a way to block ads without installing anything on your device. And today we are announcing...
Limited space routers:
Due to space limitations and AGH silently failing to update from the web interface I created a manual script to update AGH from SSH. It will not backup AGH like the web interface does. It just downloads and then overwrites the binary.
(Issue filed - https://github.com/AdguardTeam/AdGuardHome/issues/3801)
(more explanation here - [HowTo] Running Adguard Home on OpenWrt - #442 by mercygroundabyss) Please refer to the AGH wiki for manual updating.
https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#manual-update - Manual Update documented here.
Data Files:
The /opt/AdGuardHome/data folder contains the following.
root@OpenWrt:/opt/AdGuardHome/data# ll -h
drwxr-xr-x    3 root     root         512 Oct 29 09:42 ./
drwxrwxrwx    4 root     root         736 Oct 30 09:06 ../
drwxr-xr-x    2 root     root         800 Nov  2 09:52 filters/
-rw-r--r--    1 root     root       45.4M Nov  2 20:42 querylog.json
-rw-r--r--    1 root     root        8.9M Oct 29 09:00 querylog.json.1
-rw-r--r--    1 root     root       32.0K Oct 30 05:28 sessions.db
-rw-r--r--    1 root     root        4.0M Nov  2 21:00 stats.db
querylog files : These are your DNS queries. Can be removed.
sessions.db : active logins to AGH currently. This can be deleted but you will need to relog back in.
stats.db : Your statistics database. can purge but you will lose your statistics data.
filters folder contains all your filter downloads. Purge if it is full but it will re-download your filters. If your filters are too large for your diskspace you will have to disable large filters and restrict their usage.
Future Updates:
For those wondering what's coming next in AGH - https://github.com/AdguardTeam/AdGuardHome/milestone/37 )
https://github.com/AdguardTeam/AdGuardHome/issues/2830 is potentially the bit we have been waiting for to have AGH take over DHCP from OpenWrt.
Space:
One of the reasons I use the lists I do is down to memory. While big lists have their place, we have to bear in mind that what we are doing here is adding AGH to OpenWrt routers. This usually means limitations on disk space and memory, especially for older routers. OpenWrt already has depreciated 4 and 8mb routers. I tested with a 128mb BT Hub 5. I can get about 140k of filter rules before I run into memory issues. The bigger problem is the disk space and AGH binary being 35mb alone. Its why I created my script to do updates and filed an issue on AGH's hub. https://github.com/AdguardTeam/AdGuardHome/issues/3801
DNS Lockdown:
If you want to lock things down? https://openwrt.org/docs/guide-user/services/dns/adguard-home#dns_interception
Firewall rules to enforce your Adguard DNS to be the only DNS and to block other outgoing attempts.
Just make sure you have an exclusion for your router and Adguard or you will find yourself DNSless.
Uninstalling:
This script uninstalls AGH and resets your router to Google DNS as your upstream. This is a known good default and should always work.
uninstallAGH.sh
#!/bin/sh
curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v -u

# 1. Reverts AdGuard Home configuration and resets settings to default.
# 2. Enable rebind protection.
# 3. Remove DHCP options for IPv4 and IPv6
uci -q delete dhcp.@dnsmasq[0].noresolv
uci -q delete dhcp.@dnsmasq[0].cachesize
uci set dhcp.@dnsmasq[0].rebind_protection='1'
uci -q delete dhcp.@dnsmasq[0].server
uci -q delete dhcp.@dnsmasq[0].port
uci -q delete dhcp.lan.dhcp_option
uci -q delete dhcp.lan.dns

# Network Configuration
# Disable peer/ISP DNS
uci set network.wan.peerdns="0"
uci set network.wan6.peerdns="0"

# Configure DNS provider to Google DNS
uci -q delete network.wan.dns
uci add_list network.wan.dns="8.8.8.8"
uci add_list network.wan.dns="8.8.4.4"

# Configure IPv6 DNS provider to Google DNS
uci -q delete network.wan6.dns
uci add_list network.wan6.dns="2001:4860:4860::8888"
uci add_list network.wan6.dns="2001:4860:4860::8844"

# Save and apply
uci commit dhcp
uci commit network
/etc/init.d/network restart
/etc/init.d/dnsmasq restart
/etc/init.d/odhcpd restart
Changelog:
Tidied up a few sentances and improved layout.
Added more info about encrypted DNS and no need for external modules/programs.
Added screen shots for configuring upstreams.
Added post about using NextDNS. (see here)
December 7, 2021 (London)
Tweaked script to do IPv6 DNS
December 9, 2021 (London)
Removed my filter list. AGH has updated theirs.
December 15, 2021 (London)
Added local domain interception. Thanks to
@Cheddoleum
-
December 16, 2021 (London)
opkg version update.
December 25, 2021 (London)
Uninstall instructions.
January 14, 2022 (London)
Minor editing and readability tweaks.
January 19, 2022 (London)
IPV6 DNS Fix and Script updates
January 29, 2022 (London)
apparently jq for json parsing isnt default installed.
January 31, 2022 (London)
Added AGH Manual Update FAQ
February 1, 2022 (London)
IPV6 - removed json/jq replaced with awk
February 4, 2022 (London)
Added introduction, changed title, linked to opkg version, warning on unix/windows file issues, nginx proxy info added.
April 4, 2022 (London)
NTP Warning enhanced. Replaced PTR picture. NFT tables added/DNS Interception.
June 25, 2022 (London)
dnsmasq port replaced from 5353 to 54 due to clash with mDNS service.
June 26, 2022 (London)
Fixed router PTR lookups to dnsmasq.
June 29, 2022 (London)
Removed manual update and left link to AGH wiki.
October 7, 2022 (London)
Revisiting filter lists.
November 19, 2022 (London)

8 Replies
24

[Assistant]
Thank you for the beautiful write up. I will give a try this on my APU2 (probably this weekend).
Custom firewall rules to prevent any DNS leaks
iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j DNAT --to 192.168.1.1:5353
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 53 -j DNAT --to 192.168.1.1:5353
I'm not sure if this is really necessary. But I would like to leave it here as an addendum. Hope you don't mind!
ulpian

1 Reply
2

Thank you for this write up. I have reinstalled AGH on my router three (3) times and have yet to see the update button despite having 15GB free on my OpenWRT using extroot from OpenWRT wiki.

1 Reply
1

This will forward requests to dnsmasq and not AdGuard. In the OP's writeup, he's trying to eliminate dnsmasq and only use it for local lookups (hostname of clients)

2


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Rpi4 < $(community_build)

Seems there is some demand... so... let's get the ball rolling
This build is a combination of tweaks and setup that suit my purpose... and accommodations to try to make it flexible enough to be used by most...
CONS
it's messy
extroot-overlay is not supported on this build ( use usb-mount and point service data there if needed ) IF YOU WILL BE USING NON VOLATILE LARGE DATA - GITGUIDE
traditional backup / restore is different more involved on this build
a little effort and an open mind are prerequisites to using this build
verbage
new users, would be advised to start with an Official build (21.02)... master the basics / troubleshoot / ask questions on the general forum and opt to try this build once the requisite skills are acquired...
VARIANTS
'extra(full)': has most packages without going super overboard
std-halffull
DOWNLOAD: https://github.com/wulfy23/rpi4/tree/master/builds/
NOTE: downloads exceeded images at separate webhost
INSTALLATION:
non-community sysupgrade notes
ext4 (report back re: no squashfs)
note: slow sdcards can take a good 6-7 minutes+ quick ones are closer to 3 and a half...
SAMPLE INSTALL COMMANDS
@stargeizer
windows instructions with wan setup tips gpuyy@reddit(note:kmod-is-included) related-forum-topic-index
@aporetic
more beginner setup tips for wan interface
wan.isp-vlans
@cricalix
AUTOMATED UPGRADES (only use once confident with your backup / sysupgrade.conf / wrt.ini settings )
update-notice-frequency
use regular sysupgrade methods (dl from git, luci/ssh) whilst the 'update unavailable' message is active? (edit: added an experimental 'gitnewest' parameter use --help)
#> /bin/rpi-sysup-online.sh check
#> /bin/rpi-sysup-online.sh  -R  current
GENERAL NOTES:
NON DEFAULT SERVICES ARE DISABLED
Unlike a regular build... most additional services installed into this build are default disabled. So you need to enable what you use each install...
cmdl: /etc/init.d/SERVICE enable; /etc/init.d/SERVICE start'
luci: LUCI > SYSTEM > Startup > Click [DISABLED+START]
The custom settings file /root/wrt.ini (system>startup>local startup) has a parameter ENABLEDSERVICES that can be used to automate this each install... it is explained in the post below.
USE COMMON SENSE / ESTABLISHED BASICS / GUIDES
manually backup your stuff or use a second sdcard etc. for the first build or three
SAFETY / SECURITY
disclaimers and assurances
Every time you boot a freshly installed image or sysupgrade... the device takes 2-3mins to initialize... please allow 3 minutes for this initialisation to take place (20210210 the led now provides useful feedback about this process)... I highly advise you to get a good quality SDCARD (samsung EVO plus)
OPKG NOTES:
(base|core|luci) are git customfeeds ( report back on things )

(sadly due to space constraint seems i've excluded 'i18n' language packages from the luci mirror: apologies to everyone and ask on the thread if you have questions about this)

rolling official packages may require
opkg install --force-checksum #or opkg update frequently
ADDITIONS:
Users are encouraged to add customisations so, if you have any scripts / mods / ideas or (regulars) want commit access to the sources by all means!

13 Replies
18

[Assistant]
PACKAGELIST: see git > builds > ABC > packages.txt
out-of-tree: ARGON THEME git
CUSTOM FEATURES(optional):
The file /root/wrt.ini is intended to be used to enable/disable built in script functionality.
add this to your /etc/sysupgrade.conf (automatic)
when you re-flash check the newer one in /etc/custom/wrt.ini
or manually add desired options from the list below
perftweaks and packetsteering notes 2.9.17-30+ 21st/April disabled due to lack of input
available options
(note: 1.15.17-45+ you can edit in banip>advanced>wrt.ini builds later than 2.7.33 in system>startup )
/etc/packagesremove.txt ( in your sysupgrade.conf )
Package names to be auto uninstalled
/etc/packagesinstall.txt ( in your sysupgrade.conf )
Package names to be auto installed ( 2.3.11-29+ )
HOW SHOULD I UPGRADE?
add any extra services you enable to ENABLEDSERVICES="service1 service2" in /root/wrt.ini (system>startup>local startup)
add any special data files and folders to /etc/sysupgrade.conf
use the command line: 'rpi-sysup-online.sh -R current' or uploading into LUCI you also have to enable AUTORESTOREAPPLY=1 in wrt.ini ( if you do not wish to re-install packages... the remove the '-R' or disable AUTORESTOREAPPLY=1 )
note: the 'one-click-flash' within luci is equivalent to 'rpi-sysup-online.sh -R stable'
(or whatever your have UPGRADEsFLAVOUR set to)
always make separate manual backups: you can use the updatecheck bar to dump 'clean' post-install restorable tar.gz
if you do not wish to use rpi-sysup-online.sh... regular 'sysupgrade -R /tmp/sysupgrade.img.gz' is also fine ( -k is automatic ) and the autorestore.sh script is still generated without -R ... just not applied
rpi4.qos: ldir hisham2630 dlakelan (and others)
@SyntaxTerror
UTILITY SCRIPTS (beta):
expand
PINOUT

source: community.octoprint.org

8 Replies
1

For my builds I add:
Acme
DDNS
Collectd
nlbwmon
USB drivers for storage and network adapters (RTL-8152/3)
6in4 support
Wireguard
FAT32, NTFS, and Ext4 support
Luci (including any relevant luci apps for above packages)
banip
irqbalance
SQM
nano

1 Reply
2

anon50098793:
anyone who is interested, post a list of common default packages you select to install...
mwan3
vpn-policy-routing
openvpn
wireguard
banip
bind-dig
bind-host
e2fsprogs
fdisk
ip-full
iptraf-ng
irqbalance
nmap
tcpdump
sqm
watchcat
+3G/LTE modules and luci protocols
+USBtoETH modules

1 Reply
2


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: banIP support thread

Hi,
in OpenWrt snapshot package repo you'll find the banIP package:
latest snapshot version: banIP 1.5.6-5 plus luci companion package
stable OpenWrt version 24.10.x.: banIP 1.5.6-5 plus luci companion package
Link to the latest banIP documentation
Link to the latest banIP changelog
Feel free to test, ask questions or make suggestions.
Have fun!
Dirk

4 Replies
48

[Assistant]
a new LuCI frontend is currently under construction ...

1 Reply
7

dibdot:
intended for current snapshot release level
Can you precise that "current"? Will this be true even in 2 years time from now?
I'm coming from the OpenWrt wiki, where many "current" or "currently" are heavily outdated, years after they have been added and never got removed again...

1

tmomas:
Can you precise that "current"?
Notably the LuCI frontend part requires the latest changes in master, which are not in 17.x or 18.x branch.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Divested-WRT: No-nonsense hardened builds for Linksys WRT series

Hello!
Here are my simple, no-nonsense, UNOFFICIAL builds of OpenWrt for the Marvell-based Linksys WRT devices.
I've maintained these between 2015-2016 and again since mid-2020.
Configs and patches are obviously included.
Builds are here
Changelog is here
Git repo is here or here
GPG key used to sign the sha256sums is here
A simple build guide is here
The build guide in video form is here
mamba and venom builds have their kernel partition resized to 4MB and 6MB respectively.
There is more infomation in this thread.
A simple content blocking script is included that adds our blocklist config to dnsmasq from here.
This is a much more efficient approach than downloading & processing the lists on device and has the benefit of supporting wildcards for greater efficiency and increased blocking.
This blocker can be permanently disabled via /etc/init.d/divblock disable if you don't want it or want another blocker package.
You can exclude a domain by adding it to /etc/config/divblock-exclusions as so:
/www\.example\.com/
Then restart: /etc/init.d/divblock restart
Please report any wrongly blocked domains in this thread or here:
https://github.com/divestedcg/dnsrm
https://gitlab.com/divested/dnsrm
All reasonable questions are welcome in this thread, however:
Please read the README at the builds page, and the special instructions for resized builds!
Please also read/search through this thread to see if your questions have already been answered!
You can also search other parts of this forum and the wiki for answers to your questions.
Have fun!

14

[Assistant]
great builds - you got through the dsa - wifi-lan disconnect issues with a patch.
thank you

1

still some issues with reconnect to wifi after roaming - it takes many minutes to re-establish wifi connection.
see Pre-compiled updated mwlwifi drivers for stable releases

1 Reply

@linbox
, OT here, but there too... if you have the time to try a different tack.
See PR4307 for some possible DSA setup info using netifd. I'm not suggesting you use the actual GUI change from the PR(but can if you want), but to get some syntax for the config files involved. You will also need to read recent commit comments in the netifd log. This did not work for me the last time I tried (mamba), but apparently worked from comments in PR thread. There have been a considerable number of commits since I last tried, some appearing to be related to getting WLAN integrated into the DSA change, as well as syntax changes. This is where things will land when complete (i.e. WIP), so it is the road forward. There also looks to be some related WIP in jow staging tree.

1 Reply


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Speedtest: new package to measure network performance

I'd been thinking about making a network speed testing package since first posting about the currently available options, and over the last few months have developed, tested, and packaged the speedtest-netperf.sh script.
While a PR has since been submitted and merged into the openwrt/packages repo, user feedback and testing exposure, especially on multi-core systems, continues to be welcome.
There is a README.md online, and from the package commit a brief description:
The speedtest-netperf.sh script measures the network throughput while
monitoring latency under load and capturing key CPU usage and frequency
statistics. The script can emulate a web-based speed test by downloading
and then uploading from an internet server, or perform simultaneous
download and upload to mimic the stress of the FLENT test program.

It simplifies tasks such as validating ISP provisioned speeds or setting
up and fine-tuning SQM, directly on the router. The CPU usage details
can also help determine if the demands of SQM, routing and other tasks
such as the test itself are exhausting the device's CPUs.

This script leverages earlier scripts from the CeroWrt project used for
bufferbloat mitigation, betterspeedtest.sh and netperfrunner.sh. They are
used with the permission of the author, Rich Brown.

The package can be installed directly from the openwrt/packages repo, and should work on LEDE 17.01 onwards:
# uclient-fetch https://downloads.openwrt.org/snapshots/packages/mips_24kc/packages/speedtest-netperf_1.0.0-1_all.ipk
# opkg install speedtest-netperf_1.0.0-1_all.ipk
It is also possible to install and run the speedtest-netperf.sh script on a Linux server connected to your router's LAN interface. This can be useful if running the script on your router consumes too much CPU or fails to meet your speed and latency targets. For example, on Ubuntu:
$ sudo apt-get install netperf wget
$ cd /tmp
$ wget https://raw.githubusercontent.com/openwrt/packages/master/net/speedtest-netperf/files/speedtest-netperf.sh

The script output includes network throughput, packet loss, a latency distribution, per-core processor usage and frequency, and CPU consumption of the test program (mainly netperf) itself.
Sample output on an old DIR-835 router (560 MHz single-core MIPS) showing the standard sequential test followed by the more stressful concurrent test:
# speedtest-netperf.sh -H netperf-west.bufferbloat.net -p 1.1.1.1 --sequential
[Date/Time] Starting speedtest for 60 seconds per transfer session.
Measure speed to netperf-west.bufferbloat.net (IPv4) while pinging 1.1.1.1.
Download and upload sessions are sequential, each with 5 simultaneous streams.
..............................................................
 Download:  33.30 Mbps
  Latency: [in msec, 64 pings, 0.00% packet loss]
      Min:   9.551
    10pct:  11.281
   Median:  14.480
      Avg:  14.550
    90pct:  17.327
      Max:  21.308
 CPU Load: [in % busy (avg +/- std dev), 57 samples]
     cpu0:  86.7 +/-  6.5
 Overhead: [in % used of total CPU available]
  netperf: 60.2
.............................................................
   Upload:   5.13 Mbps
  Latency: [in msec, 61 pings, 0.00% packet loss]
      Min:   8.615
    10pct:   9.792
   Median:  14.152
      Avg:  14.303
    90pct:  17.317
      Max:  19.934
 CPU Load: [in % busy (avg +/- std dev), 58 samples]
     cpu0:  19.7 +/-  5.7
 Overhead: [in % used of total CPU available]
  netperf:  1.4

# speedtest-netperf.sh -H netperf-west.bufferbloat.net -p 1.1.1.1 --concurrent
[Date/Time] Starting speedtest for 60 seconds per transfer session.
Measure speed to netperf-west.bufferbloat.net (IPv4) while pinging 1.1.1.1.
Download and upload sessions are concurrent, each with 5 simultaneous streams.
..............................................................
 Download:  31.86 Mbps
   Upload:   4.53 Mbps
  Latency: [in msec, 63 pings, 0.00% packet loss]
      Min:   8.871
    10pct:  13.792
   Median:  17.480
      Avg:  18.427
    90pct:  22.292
      Max:  57.617
 CPU Load: [in % busy (avg +/- std dev), 59 samples]
     cpu0:  90.0 +/-  9.7
 Overhead: [in % used of total CPU available]
  netperf: 46.6

In the examples above, my target upload/download speeds are achieved with good latencies. Although the CPU load is high, much of that is due to the netperf test program itself, so during normal operation there should be more CPU "headroom" available.

For your own testing, please note the script Usage parameters below from the README, and try to run both a sequential and concurrent test, using a netperf server geographically close to you.
speedtest-netperf.sh [-4 | -6] [-H netperf-server] [-t duration] [-p host-to-ping] [-n simultaneous-streams ] [-s | -c]

Options, if present, are:

-4 | -6:           Enable ipv4 or ipv6 testing (default - ipv4)
-H | --host:       DNS or Address of a netperf server (default - netperf.bufferbloat.net)
                   Alternate servers are netperf-east (US, east coast),
                   netperf-west (US, California), and netperf-eu (Denmark).
-t | --time:       Duration for how long each direction's test should run - (default - 60 seconds)
-p | --ping:       Host to ping to measure latency (default - gstatic.com)
-n | --number:     Number of simultaneous sessions (default - 5 sessions)
-s | --sequential: Sequential download/upload (default - sequential)
-c | --concurrent: Concurrent download/upload

Appreciate any usage feedback. Thanks to all!

Recent Changes

1 Reply
12

[Assistant]
Run fine:
Measure speed to netperf-west.bufferbloat.net (IPv4) while pinging 1.1.1.1.
Download and upload sessions are concurrent, each with 5 simultaneous streams.
.............................................................
 Download:  40.93 Mbps
   Upload:  46.47 Mbps
  Latency: (in msec, 61 pings, 0.00% packet loss)
      Min: 2.945
    10pct: 4.991
   Median: 10.796
      Avg: 14.775
    90pct: 25.821
      Max: 105.775
Processor: (in % busy, avg +/- stddev, 58 samples)
     cpu0: 43 +/-  5
     cpu1: 22 +/-  4
     cpu2: 20 +/-  5
     cpu3: 22 +/-  5
 Overhead: (in % total CPU used)
  netperf: 15

Nice! I wonder whether it would be possible to report the CPU usage like the ping results, or at least with say a 95 and 99 percentile? The average will somewhat hide short excursions to idle0% that still might lead to reduced network throughout. But that is just a minor potential feature request....

davidc502:
Run htop whilst running the speed test.
This is great advice in general but will not help with the reason to run a concurrent CPU load-meter together with a speedtest IMHO. The issue is that transient CPU overloads can and will affect both measured latency and achieved throughput negatively, so adding the load information to the summary output is great. I am only trying to argue even more information like maximum CPU load and say 99-percentile as these will give a better feeling whether the speedtest is reliable. This is especially important with this test, as
@guidosarducci
notes, as running netperf will put additional load on the router's CPU(s).


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Build for Netgear R7800

I have built a nice build for Netgear R7800 that offers the basic router functionality plus some useful add-ons, but does not contain too much additional fancy stuff like multimedia.
The build is based on the bleeding-edge development main/master branch and the stable 24.10 branch. ("master" has been renamed as "main" in OpenWrt)
Current version:
Branch Version (branch-revision-commithash-date)
main/master (development branch) main-r30100-143cfd6113-20250616
stable openwrt-24.10 owrt2410-r28724-976b09707e-20250616 (DSA)
stable openwrt-23.05 owrt2305-r24217-ae5488a5cc-20250616 (swconfig, no DSA)
All builds are with the default ath10k-ct wifi driver. The mainline ath10k wifi driver is being offered as a downloadable .ipk in the download directory of each build.
R7800 firmware downloads are available in Dropbox:
Download site: https://www.dropbox.com/sh/ew0gap0crn30wyk/AADQLCBF5All8wc8RXmxisqAa
I only upload the versions after successfully flashing my own router, so the build has at least that much quality assurance process.
Full configuration and source code diffs are included in the download directory, in case somebody wants to utilize info in own builds. There is also a script to automatically re-create my build environment with all the sources patched with my patches. (advice in the next message)
Features included:
LuCI with HTTPS SSL support
LuCI statistics include CPU frequency scaling graph and CPU temp graph
Luci theme "openwrt-2020" included in addition to the default "bootstrap"
USB storage automounting
Support for various file systems to enable most drives.
ext2/3/4, FAT, HFS+, CIFS/SMB, NTFS, EFI/GUID partitions
WiFi, WPS and reset buttons work
console tools: Nano text editor, htop, patch, ccrypt for file encryption/decryption
failsafe entrance trigger time window increased to 5 sec (from 2 s)
irqbalance for balancing irq load between CPU cores. Initially disabled in config.
see "cat /proc/interrupts" for summary of irq usage of CPU cores
Network tools
SQM-scripts for QoS traffic control. The package is initially disabled, as max speed needs to be adjusted to WAN connection speed
Adblock package (initially disabled)
IPv6: tunnel support for 6in4, 6to4, 6rd, IPv6 NAT support
unetd - new OpenWrt specific small VPN (in master)
wireguard VPN support (in master, 22.03)
kmod-tun, enables opkg install of OpenVPN (openvpn-openssl variant)
DDNS support
miniupnpd settings: leave upnp off by default in /etc/config/upnp
IEFT BCP38 support
wget, curl
iptables-mod-ipsec and kmod-ipt-ipsec
Noteworthy recent changes:
February 2020: wireguard added
March 2021: CPU frequency scaling settings configurable via /etc/init.d/cpufreq, applied at boot
Jan 2022: ramoops pstore support added.
See /sys/fs/pstore/dmesg-ramoops-* files for a crash log after a reboot.
Sep 2022: unetd - new OpenWrt specific small VPN
Dec 2022: NTFS support in master from kmod-fs-ntfs3 in Linux 5.15
Dec 2022: Add openssh-sftp server, so that newest scp works without -O option
Note: As I build with standard kernel options, the release and snapshot packages should be compatible with my builds, in case somebody wishes to add packages to my build. That goes for "userspace" packages. Installing kernel package is more difficult and risky.

8 Replies
59

[Assistant]
Instructions for re-creating my build environment
My firmware release contains also a script to re-create my full build environment in a few minutes. I use Ubuntu as my buildhost, so the prerequisites etc. are tailored for that.
The creation script runs pretty automatically. The needed few steps are:
Create the base directory (I use /Openwrt) and make it writable by your normal user account (non-root)
Download from my newest firmware the newBuildroot.sh file and the three/four *.patch files to /Openwrt
Run newBuildroot.sh. It creates the complete build environment and applies the patches
Build firmware with hnscripts/updateNmake.sh
Detailed explanation of the steps in the build environment creation process :
Create the base directory (like e.g. /Openwrt) to your buildhost. chown/chmod that directory to be writable by your normal user account (chmod 755). Buildroot will be created in that directory, e.g./Openwrt/master or /Openwrt/owrt2305
Download the "newBuildroot.sh" file from my newest firmware build package to /Openwrt and chmod "newBuildroot.sh" to be executable
Download the firmware's three/four patch files: -main.patch (or -openwrt.patch), -packages.patch, -luci.patch (and -routing.patch) to /Openwrt. Note that the master build environment needs the master patches, and correspondingly the openwrt-23.05 environment needs the openwrt-23.05 patches.
Verify that "newBuildroot.sh" references the correct patches: Check that the FILESTAMP variable definition matches the timestamp in actual patch names.
Run "newBuildroot.sh". It installs the needed prerequisite packages to Ubuntu, creates trunk or chaos git repository and downloads the feeds' sources, patches them and also adds the new files to version control as well as chmods the known script files to be executable.
If patch names are correctly set in"newBuildroot.sh", all sources will get patched by the script. Main source needs to be patched first, as that patch possibly contains changes to feeds.conf.defaults. Then it updates the feeds (packages, luci, routing), patches the feed files and finally installs the packages from feeds with "scripts/feeds install -a".
Check the attributes of the possible script files added by the patches and chmod them executable, if needed. e.g. /etc/reinstall-packages.sh and other scripts in /etc
Note: With the current button hotplug procd functionality also the button scripts in /etc/rc.button need to be executable. (E.g. files/etc/rc.button/BTN_2)
Verify that the build script files located in /hnscripts are executable and have been added to git version control.
Verify that the new files have been added to git tracking. The script has commands for the "files" directory & ".config.init", but you should check if there are other unknown files added by the patches. The script tries to automatically include the noticed new files created by the patches.
Copy possibly needed additional files and prepare the build system:
Download and extract llvm toolchain tar.gz for qosify building
Copy extra custom files to /files . E.g. your personal settings to be the included in the firmware.
Copy build keys to if you want to maintain the same build key in the new environment
Possibly also create a file share for transferring files. For example, I need /media/windows-share to easily move files from Virtualbox to PC.
Additionally, I need to set git options (username etc.) and to set minor OS options like gedit not producing backup files etc.
Steps 1-5 should be done automatically by the script, but verify the results
After this you should have an identical build environment as I have. I have actually recreated my current build environment several times with this process.
Note: The -main.patch also contains the device profile recipe ".config.init" with all the needed package selections and all build scripts used in my build environment.
Steps in the actual firmware build process in /Openwrt/master:
cd into /Openwrt/master
Copy .config.init as the new .config to initialize the build profile:
cp .config.init .config
("make defconfig" will expand the recipe to a full .config . You can run that command also manually.)
Do the actual make: hnscripts/updateNmake.sh
transfer files from bin/target/ipq806x to wherever you need them. I use a script: hnscripts/mountNcopy.sh
Explanation of the scripts in /hnscripts:
updateNmake.sh is the main build script that updates sources and builds the firmware
mountNcopy.sh is the script that I use to copy firmware files to my PC
newBuildroot.sh is the build environment creation script
Other scripts (timestampVersion, parallelcompile, singlecompile, kernelcompile, copypackages2tmp) are just helpers. createbuildinfo.sh creates the firmware release package with docs & patches and is automatically called at the end of a build. (Usually there is no need to call that manually.)

8 Replies
9

Did you try HZ=1000 instead of the default? When do you actually need to use nathelper-rtsp nowdays?

2 Replies
1

diizzy:
Did you try HZ=1000 instead of the default? When do you actually need to use nathelper-rtsp nowdays?
I tried HZ=250 and did not see any difference compared to the default 100. But I did not test 1000 Hz, as I don't quite see how the timer interrupts would affect packet-driven QoS. As discussed in the SQM development forum, it looks the culprit is HTB qdisc which seems to dislike the dual-core with arm-cortex.
I am not using nathelper-rtsp myself, but I was asked to add that to my WNDR3700 build earlier and I have kept it in the recipe. It is so difficult to add kmods afterwards to private builds, so I have just kept it along in case somebody needs it.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: VPN Policy-Based Routing + Web UI - ARCHIVE #1

THIS THREAD IS KEPT AS AN ARCHIVE, BUT IS NOW LOCKED. REFER TO THIS NEW THREAD: VPN Policy-Based Routing + Web UI -- Discussion

As the VPNBypass package was well received but was lacking ability to explicitly route specific traffic via OpenVPN tunnel instead of bypassing it, I've written a policy-based routing service.
Make sure to go over README or at least its Known Issues section.
Both vpn-policy-routing and luci-app-vpn-policy-routing are available from my repo: https://stangri.github.io/openwrt-repo/. After adding this custom repo to your router, you can install and upgrade both vpn-policy-routing and luci-app-vpn-policy-routing from the command line or Web UI like any other package.
If you have any problems, be sure to include the config file, as well as output of the service when it's being started/reloaded and the output of /etc/init.d/vpn-policy-routing support.
I'd welcome any feedback!

11

[Assistant]
Thanks to feedback from
@hnyman
I've managed to re-organize both luci app and how the service works internally. I've also added a screenshot to the README so you can see what you're getting yourselves into.

3

Looking forward to giving this a whirl this coming weekend.

From version 3.0 supports multiple OpenVPN tunnels (with device names tun* or tap*).


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: VPN Bypass (split tunneling) Service + Luci UI

This was created out of necessity -- my internet traffic is routed thru VPN tunnel (my router is VPN client) and I needed split tunneling to route some traffic outside of the VPN tunnel.
Started with connections to local Plex Media Server then I wanted to access some domains and IP ranges outside of the VPN tunnel and then I wanted some local network IPs/ranges to access internet outside of VPN tunnel. All of that is supported in the service.
Make sure to check out the README for detailed information and instructions.
Both packages can be installed from my repo: https://stangri.github.io/openwrt-repo/.
NOTES:
At least for now, domains have to be defined in dhcp config, not in the vpnbypass config.
Any feedback on functionality or the code or any suggestions are always welcome.

8

[Assistant]
Super cool, will be taking a peek at this. Would be really nice to integrate this. I already added a long list of pia "recipes" into my build, and will be doing some ipvanish ones as well. Would be cool to integrate it into all one package.
Any thought into making a luci page for it?

cybrnook:
Any thought into making a luci page for it?
Yeah, making a luci page won't be much too much work, however I have close to zero experience with Makefiles, so making an ipk is an issue for me.

Woohoo, thanks to
@diizzy
I've made a proper package for vpnbypass.

1


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: CAKE w/ Adaptive Bandwidth [August 2022 to March 2024]

The "CAKE w/ Adaptive Bandwitdh" project builds on nearly a year of effort by many experts on this forum. For details concerning its early development, see this archived thread: CAKE w/ Adaptive Bandwidth [Historic]
This topic can serve as a place to continue the discussion for all projects:
bash script
lua code
perl code
We are happy to post links to other implementations.
Prior discussion: CAKE w/ Adaptive Bandwidth [Historic: October 2021 to September 2022]

10

[Assistant]
We are pleased to announce an initial release of cake-autorate, a script that controls the latency for links with varying speeds, such as LTE, cable modems, and Starlink connections where the capacity varies by time of day, or even from second to second.
The cake-autorate script continually monitors receive and transmit load and the latency to known hosts in order to automatically adjust the CAKE algorithm's parameters to maximize bandwidth while keeping latency low.
For convenience, an installer script is available (cake-autorate-setup.sh) that installs all the packages and files required for cake-autorate. For more details about cake-autorate, or to find the installer script, visit the Github repository at: https://github.com/lynxthecat/cake-autorate/tree/main
Update: CAKE-autorate 1.1.0 - 28Sep2022 available
Implemented several new features such as:
Switch default pinger binary to fping - it was identified that using concurrent instances of iputils-ping resulted in drift between ICMP requests, and fping solves this because it offers round robin pinging to multiple reflectors with tightly controlled timing between requests
Generalised pinger functions to support wrappers for different ping binaries - fping and iputils-ping now specifically supported and handled, and new ping binaries can easily be added by including appropriate wrapper functions.
Generalised code to work with one way delays (OWDs) from RTTs in preparation to use ICMP type 13 requests
Only use capacity estimate on bufferbloat detection where the adjusted shaper rate based thereon would exceed the minimum configured shaper rate (avoiding the situation where e.g. idle load on download during upload-related bufferbloat would cause download shaper rate to get punished all the way down to the minimum)
Stall detection and handling
Much better log file handling including defaulting to logging, supporting logging even when running from console, log file rotation on configured time elapsed or configured bytes written to
https://github.com/lynxthecat/cake-autorate/releases/tag/v.1.1.0

1 Reply
8

Damn! i search for that since a long time and today you release that script. I'm glad and impress i can look for videos without to manually select minimum resolution. I have a A+ all the time now on waveforme bufferbloat test page, BUT i realize that my isp is shaping my 4g connection to 2,5mbps. Without you script my bandwith can go to 50000 mbps with lots of bufferbloat
My config is on movistar chile with an quectel ec25 modem.
Low 1000kbps
Base 25000kbps
Hight 50000kbps
With that script result, can i make denunciation for a excessive shaping ?
I have a directional 12dbi antenna to the only tower like at 5 km far. The at+csq returns me 28,99.
I apply the ttl=65 to make sure that they are not detect me as computer
All datas i can send to you
Thankyou

2 Replies

I have experienced Vodafone UK selectively throttling 4G in dependence upon port number, but this can be circumvented with the use of a VPN.
Have you tried the script yet? It is pretty easy to set up and may need some configuring to optimize it for your connection. You can indeed control how aggressively it adapts the rate up or down in dependence on the monitored load and latency.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Optimized build for the TP-Link C2600 / Netgear R7x00 / Linksys EA8500 / Zyxel Armor Z2

Some of you may know me as arokh from the old OpenWrt community. Anyways, got a new router and decided to get up to date with latest master As always, my goal is to offer a useful set of features that works out of the box.
Features
Based on latest git
LuCI web interface with rosy theme
Pre-configured wireless with SSID OpenWrt and password "changemenow" (root pw is the same)
Built with GCC 8.3 and -O2 optimization
Unlocked 00 (world) domain all channels available
https-dns-proxy (not used by default)
UPnP, DDNS, SQM, luci-app-statistics
OpenVPN and IPsec IKEv2 (strongSwan) pre-configured and ready to go (instructions below)
UPnP / DLNA working over OpenVPN/IPsec through the use of multicast routing with smcroute
Isolated guest network that gets routed through Tor network (SSID OpenWrt Tor)
USB auto mounting and F2FS, exFAT, NTFS and EXT filesystem support
NFS kernel server with V4 support
OpenSSH
Full wpad
Cloudflare's 1.1.1.1 is used by default. If you'd like to use your ISP's DNS servers instead execute this command:
# uci set dhcp.@dnsmasq[0].noresolv='0' && set network.wan.peerdns='1' && uci commit
Instructions for VPN
At first boot, a CA is created under /etc/CA, then certificates for "phone", "laptop" and "workstation" are generated for you.
OpenVPN is configured to access your external IP address at udp port 1194 and fallback tcp 1194. Ready to go .ovpn files are found under /www/vpn which can be accessed like this:
https://openwrt/vpn/phone.ovpn
To use IKEv2 on iOS, import the following:
https://openwrt/vpn/phone.p12 (certificate and key) <- password to import is "openwrt"
https://openwrt/vpn/CA.pem (CA certificate)
Then set up an IKEv2 VPN, use your external IP address as server/remoteid and "phone" as localid. Then choose certificate and select the one you imported already.
The script /usr/sbin/vpn.sh can be used to create new certificates or re-generate the CA if you so wish.
PS: If there is no WAN connection at first boot, the VPN certificates won't be generated and will have to be done manually with the mentioned script.
Download
Builds can be found here: https://drive.google.com/open?id=1zUJ4HHPEYh1ecIhF7vlwAb9V3vs9nvDE
My github: https://github.com/escalade/LEDE/tree/escalade
My builds are provided as is. They should be flashed cleanly (sysupgrade -n or use factory image with tftp).
You can clone my repo and build yourself using the profiles/ipq806x file as a config template. If you are targetting a different device you will also need to change TARGET_OPTIMIZATION in the config.

1 Reply
10

[Assistant]
Thanks for all your hard work! I've been using arokh builds with my c5/c7 before. Wifi was flaky in the past on c2600 with 17.x releases and latest git builds, I saw this commit but didn't have the time to check. So Wifi should work proper now or have you made some additional tweaks besides unlocking all channels?
Also have you heard about quad9.net (DNS 9.9.9.9, unfiltered 9.9.9.10).

Works great here getting very good speeds even without the antennas. I live in a relatively small apartment though. No I haven't heard about quad9. Sounds exactly like Cisco OpenDNS which I already use in this build.

1 Reply

Welcome back arokh/escalade!
Nice to see the VPN-updates, I was struggling to get your old stuff to work.
It still works on my phone but not on my Windows 10 laptop.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: Web UI to reboot to another partition (for Linksys/ZyXEL dual-partition routers) and to power off/power down

I've created a small package which adds an Advanced Reboot page under System which displays currently booted partition and provides buttons to reboot to current or alternative partitions as well as to power off your router.
This is just a WebUI wrapper for the already existing dual-booting functionality in OpenWrt. If your router is currently lacking ability to boot from either partition with the OpenWrt tools, this package cannot be made compatible with your router.
List of supported routers, installation instructions and additional information is available in the README.
This package is now in the official OpenWrt repo from version 17.01.x and up (thank you
@hnyman
)!

1 Reply
12

[Assistant]
Looking quickly to the source code in the .ipk, I failed to immediately find out how your code evaluates that it is running in a wrt1x00acx series (or otherwise compatible) device, so that the "nandboot" command and "boot_part" things are valid and it makes sense to display the button to the user.
A separate Luci app (and a new item in the System menu after Reboot) for the functionality would be more logical than trying to cram it into the existing flash/reset page.
That approach would more easily enable adding that package only to the compatible routers.
There should also be a confirmation query about the boot switch before the setting is toggled. It is much too large change to be done with a single button press / menu item selection.

stangri
I check for existence of /usr/sbin/fw_printenv and /usr/sbin/fw_setenv.
I have those in my R7800 / ipq806x device... They are just generic u-boot env reading/writing tools. They prove nothing. (my device does not have dual partitions.)
stangri
What would you suggest?
You will likely need to look into the proper board info files that are populated during the boot:
root@LEDE:~# cat /tmp/sysinfo/board_name
r7800
root@LEDE:~# cat /tmp/sysinfo/model
Netgear Nighthawk X4S R7800
root@LEDE:~# head -n 5 /etc/board.json
{
        "model": {
                "id": "r7800",
                "name": "Netgear Nighthawk X4S R7800"
        },
(I don't have my WRT3200ACM on right now, so I can't verify how the files look there.)

I see the boot partition switch functionality as a so serious action, that user should not be able to select it by just an accident. There needs to be at least a confirmation.
And as the boot commands and partition names will vary from device to device, you need to make sure that you are on a compatible device before making changes there.
From long-term maintenance perspective, it is more sensible to have this a separate add-on app that can be selected and installed to compatible devices, than a default Luci functionality in all devices.


[System] You are an OpenWrt support assistant; use the following forum posts as background but remember they may be incomplete or outdated—if you’re unsure, flag the uncertainty and point the user to the official OpenWrt documentation.

[User]
Title: A modern web interface for OpenWrt implemented in vue.js and element-ui

Home: https://github.com/zhaojh329/oui
Features:
Fast: Use static pages; access any kind of system data via ubus
Multi User: Support for multi-user and access management
Vue + Element-UI: Enjoy the dev experience of Vue + Element-UI

(upload://ptbEim6xZqtN9cFkJsqbcg80jTK.png)

14

[Assistant]
Looks interesting, might have a dabble with this on my WRT32X.

Looks nice but the sidebar might be a little too bland. I have yet to find a theme that really lures me away from bootstrap.

2 Replies
5

Router:
I have yet to find a theme that really lures me away from bootstrap.
darkreader

1 Reply
1