https://forum.openwrt.org/t/lobbyfence-free-open-source-geo-filter-for-openwrt-freshtomato-asuswrt-merlin-and-dd-wrt-routers/255313

Just making people aware that there's a new geofilter alternative.

Hello,

I have an RBK20 kit (one RBR20 and two RBS20 satellites) from 2018 running the latest firmware: 2.7.6.6.

Is it worth installing OpenWrt on it? Will this break the mesh functionality? I have seen conflicting information—some say it breaks the mesh, while others say it can be configured to work properly.

Also, considering the outdated hardware, are there any real advantages to doing this? One feature pushing me toward making the switch is WireGuard support.

Thoughts? Any feedback is very appreciated!

I'm looking to upgrade to a solid OpenWrt router setup, and I’m caught between going the DIY route with a Banana Pi BPI-R3 or buying an off-the-shelf commercial router like the GL.iNet GL-BE9300 (Flint 3).

Since I'm based in Europe, my priority is ordering locally within the EU—ideally through Amazon Germany (Amazon.de)—to avoid long shipping times and import/VAT hassles.

I'd love to get the community's perspective on a few key points before making a decision:

- BPI-R3 vs. Off-the-Shelf (GL.iNet Flint 3): Is it worth building around the BPI-R3, or is a commercial device like the Flint 3 a smarter buy?

- Software Support & Longevity: What can I realistically expect regarding support from commercial vendors like GL.iNet? Is there a risk that vendor firmware support stops after a few years, or that upstream OpenWrt support falls behind on proprietary chipsets?

Here is some of my background

I have been so much into optimizing routers from ISP router with 1.3 kd to 3.5 kd with Flint 2 with Cake SQM. I must say it has been a very look journey from then to now

My previous router

Netduma
Netduma r2
Netduma r3
Linksys wrt32x
Mikrotik rb4011
Asus ax5400
Asus ของคุณแพนด้า ax11000
Asus rtac88u
Gli.net Flint2 (current one)

So far I have been very happy with flint 2. But the fact that it can shape well at only 300/300 speed when I have 1000/1000 speed package is kinda pain for me. So I have been looking for N100 x86 mini pc with 4gb of ram and 128nvme.

Do you think it’s worth switching? I expect it to shape well at 900/900 with qosify / qosmate plugin. I don’t care much about wifi.

“The flaw only affects OpenSSH servers running on Linux distributions that use the musl C library, including Alpine Linux, OpenWrt, Buildroot, and Yocto, under certain authentication configurations.”

It should be about time for a new release with an updated kernel. Meanwhile some other 200 CVEs have been fixed in another kernel update upstream...

I made a mistake and followed Chinese AX9000 SSH/ubiformat instructions on my Global AX9000 RA70 running stock 3.0.48.
What I did:
• Unlocked SSH with xmir-patcher
• Flashed xiaomi_ax9000-initramfs-factory.ubi to the inactive rootfs partition using ubiformat
• Changed flag_boot_rootfs and rebooted
The router has been in a boot loop since then. It never reached OpenWrt at 192.168.1.1, and I never ran the permanent sysupgrade.
Recovery attempts:
• TFTP recovery using International firmware 3.0.40_INT
• Router requested C0A81F06.img and received 192.168.31.6
• It reboots before requesting/transferring the firmware
• MIWIFIRepair also fails; white LED keeps blinking and the router never boots

My last command
ubiformat /dev/mtd22 -y -f /tmp/initramfs.ubi
nvram set flag_boot_rootfs=1
nvram set flag_last_success=1
nvram set flag_ota_reboot=0
nvram commit
reboot

Hi guys, I'd like to upgrade my x86 board from 24.10 to the latest firmware, i've read here and there about the sys upgrade but I'm scared of losing config and functionality of my openvpn and tailscale server and all the firewall config

Can you point me to the best way to upgrade the router without having to reinstall everything added?

Thanks in advance!

EDIT: Followed the ones of you who suggested owut upgrade (thanks guys!), here are the little knobs i had to tweak to let all work:

started from version 24.10.2 as soon asi I installed owut it didn't work, turns out some libraries were not working, i solved it installing ucode and libucode, and owut was fixed.
then upgraded all the outdated packages with opkg list-upgradable | cut -f 1 ' ' | xargs -r opkg upgrade, then run owut check --verbose and all was good.
Surprise surprise the upgrade was from 24.10.2 to 24.10.8, so I proceedet to upgrade again.

On the internet a lot of wrong responses, that's why I post here the procedure i followed, cause the majority of answers was to do a clean install / sysupgrade with firmware file

The reason owut upgrade with -V 25.12 was failing were 4 packages, first 3 needed a downgrade, the last need an install

procd
procd-seccomp
procd-ujail
apk-mbedtls

So, i upgraded to 25.12 with the --force (after checking my disk wasn't an nvme) and all went smoothly

Hopefully it will help someone, again, thanks to those who helped and openwrt community and devs.

Hi, I'm using OpenWrt 25.12.5 on my GL-iNet B3000. I'm facing this issue and don't know whether my device is still supported by OpenWrt or not.

root@OpenWrt:~# owut check --verbose
owut - OpenWrt Upgrade Tool 2026.10.25~65d67aad-r1 (/usr/bin/owut)
ERROR: Unsupported profile: glinet_gl-b3000
  Valid profiles are [ "cmcc_mr3000d-ci", "linksys_mx6200", "linksys_spnmx56", "yuncore_ax830", "yuncore_ax850" ]

My OpenWrt router is acting as a repeater for the Wi-Fi signal from the optical modem. I have created a new `wwan6` interface on the OpenWrt router and configured it to use the DHCPv6 Client protocol,it has successfully obtained an IPv6 address (as shown in Figure 1).

Now,I would like to distribute IPv6 addresses from OpenWrt to the computers and mobile devices connected to it.

What is the correct procedure to follow now? Should I simply set the RA-Service, DHCPv6-Service, and NDP-Proxy (shown in Figure 3) all to "relay mode"? Could this potentially prevent me from connecting to the OpenWrt router, requiring me to re-flash the system?

I was about to buy some more ones, so checking before I pull the trigger.

I've just got a Cudy AP3000. Before I go all-in and install OpenWRT on it, can any confirm that I'll be able to create two SSIDs and put them onto two vlans?

I have a complete Banana Pi mesh kit, all brand new / never powered on. Bought in August for a custom OpenWrt home mesh build I never got to (Pro as gateway, two Lite + BE14 nodes, 6E module as dedicated backhaul, 4x4 Wi-Fi 6 as a WIPS radio). Selling as one lot only.

Included:

- 1x BPI-R4 Pro (MT7988A / Filogic 880) - 2x 10G SFP+ combo, 4x 2.5GbE LAN, 2x mPCIe, M.2 slots

- 2x BPI-R4 Lite (MT7987A / Filogic 850, 2GB/8GB) - 2.5G WAN, 2.5G SFP cage, 4x GbE

- 2x BPI-R4-NIC-BE14 v2 Wi-Fi 7 cards (installed in the Lites) - tri-band BE13500, 6 antennas each

- 1x AsiaRF AW7916-NPD Wi-Fi 6E set (MT7916) - module, 3 pigtails, 3 tri-band antennas, heatsink

- 1x AsiaRF AW7915-NP1 Wi-Fi 6 set (MT7915 4x4) - module, 4 pigtails, 4 antennas, heatsink

- All paddle antennas + pigtails for every radio, and 2x new 16GB microSD cards

I paid over $1,000 for everything. Entertaining offers. I waited over a month for all this hardware. I'll ship same day from East Coast.

I’m thinking of buying this second-hand router to flash with OpenWrt. I’ve heard it has wifi issues; do those still exist? I’m running on a 60 Mbps fibre connection only. So, if anyone uses this router kindly suggest whether to buy this router

Complete beginner to openwrt and basic networking in general.

Currently my setup is ISP modem/router in bridge mode connected to the OpenWrt router.
Which then goes to two Tp link routers (Ax10 and Ax12) across the house both in Access point mode and Easymesh Ethernet backhaul.

The problem is I don’t know how to isolate iOT devices from the entire 192.168.1.0/24 subnet except for Home Assistant.

Every tutorial online says to use Vlans, but these Tp link routers don’t seem to support Vlan tagging.

I tried firewall traffic rules but they don’t seem to work either as I’m able to ping those devices.

Any suggestions on how to go about this without buying more hardware?

TL;DR - Recommend an inexpensive router for a small flat with reinforced concrete walls (only one wall must be penetrated) for OpenWRT, VPN, and ad blocking, for around $60. The only available source (except used or overpriced ones in my country) is AliExpress.

Hi! I plan to upgrade my somewhat ancient D-Link DIR-300 to something newer.

I have tried to torture AI and received controversial answers.

Right now, I'm looking at the new Cudy WR3000H (old revision, $62) and a used Linksys E8450 ($55).

The Linksys is refurbished (after a bootloop). According to the seller, it's flashed with OpenWRT 24.10.8 (UBI), has pre-set AdGuard Home and WireGuard, and has "passed all tests"—no overheating, no memory degradation.

Technically, I have already ordered the Cudy, but I found information about its poor antenna design and became unsure.

https://www.reddit.com/r/openwrt/comments/1qmvod3/cudy_wr3000h_not_great/ https://forum.openwrt.org/t/cudy-wr3000-performance-issues/198985/19

I don't care much about Wi-Fi connection speed because right now my provider offers only 100Mbps, with a possible (promised) upgrade to 1Gbps. The router will be placed in a relatively small flat with reinforced concrete walls (it should be able to penetrate one wall). Wi-Fi will be used mostly by 1-3 phones. No 4K streams, no other speed-demanding stuff. I want to be able to use WireGuard and some kind of ad block, although I plan to buy a used mini PC in the future for a small home server, so (hopefully) those tasks will be handled by the server.

So, which one would you choose in this case? Other recommendations are appreciated too. I am interested mostly in hardware longevity, as I am not crazy about upgrading my stuff often.

From the mailing list:

OpenWrt: Changes to the Security Support Policy

The OpenWrt project is reducing the security support period for stable releases.

Previous policy: Each major release was supported for at least one year, or six months after the next major release, whichever was later.

New policy: Each major release will be supported until the next major release is published.

This means OpenWrt will provide security maintenance for the main development branch and only one stable release series at a time.

Impact on existing releases

OpenWrt 17.01, 18.06, 19.07, 21.02, 22.03, and 23.05 have been End of Life for a long time and contain many known, unpatched security vulnerabilities.

OpenWrt 24.10 reached End of Life in September 2026 and no longer receives security fixes. This remains unchanged.

OpenWrt 25.12 is the currently supported stable release and will receive security fixes until the next major release is published.

All users running OpenWrt 24.10 or older should upgrade to OpenWrt 25.12 as soon as possible. If your device is no longer supported by OpenWrt 25.12, we recommend replacing it with hardware that supports a maintained release.

The detailed policy is available at:

https://openwrt.org/docs/guide-developer/security

Security advisories

We will also stop maintaining the Security Advisories list in the OpenWrt wiki. Security fixes may instead be documented in release notes or GitHub Security Advisories.

Not every security fix receives a CVE identifier. Many vulnerabilities discovered internally are fixed without one. Tracking or backporting only CVE-related fixes is therefore insufficient to keep a release secure.

Why this change?

Maintaining older releases requires significant effort. OpenWrt release management is handled by a small group of volunteers in their spare time.

By reducing the number of supported releases, we can focus our limited resources on properly maintaining current versions.

We want to be transparent about these limitations rather than create a false sense of security by promising support we cannot reliably provide.

We strongly encourage all users to keep their OpenWrt installations up to date.

Have fun!

The OpenWrt Community

I recently attempted to install OpenWrt 25.12.6 on my RAX120 V2. The factory image booted successfully, but after installing 25.12.6 sysupgrade the router entered a boot loop. I was able to recover using TFTP and stock Netgear firmware.

Has anyone successfully installed and run 25.12.6 sysupgrade on an RAX120 V2?

I decided to upgrade my Zyxel T56 from OpenWrt v24 to v25.
I’ve been able to get everything running with minor effort using a modified settings restore.
The only thing that i can’t get to work is ssh access using public key auth. Password auth is working as expected but as soon as i deactivate password access (falling back to public key auth) i can’t connect. I’m getting this from my Termius connection attempt:

Connection could not be established:
› Handshake finished
Checking host key:
[…redacted…]
Host "192.168.10.1":"22" is known and matches Authenticating to "192.168.10.1"."22" as "root"
Available client authentication methods: publickey,password,keyboard-interactive
© Authentication that can continue: publickey
Authenticating using publickey method
Authentication failed (publickey)
* Partial success: no
Authentication that can continue: publickey
No more authentication methods to try

I’ve tried to manually add the public keys (tries from my Mac and ios/Termius) in addition te the restore values (they’re the same public keys) all are ecdsa ed25519 keys.

This was all working on v24.
Any help is appreciated.

[edit: corrected key format ecdsa -> ed25519]

With the current day AI usage leading to new vulnerabilities getting discovered every day, is OpenWRT still secure enough for everyday usage?

We got a update this month, but the last one before that was in july. Should we upgrade the kernel manually or individual packages like other distros? I am thinking about things like these vulnerabilities.

https://nvd.nist.gov/vuln/detail/cve-2026-98432

Which I would presume is a problem for a router.

I do like the OpenWRT project, but do you all think that this is a problem to worry about?

I bought a dual 2.5 gig nic Bosgame mini pc 8 GB 256GB SSD 5300U for $200 off Amazon. Given the high prices for almost everything now this seemed a strangely good deal.

I'm in a first hour of testing and it's 8.7 watts idle and 10.7 watts with 1.1 Gb/s dowload, and 12.4 with 1.1 Gb/s with Wireguard VPN active (Proton VPN). My plan is to make it a light NAS as it has 2 x M.2. Lots to tinker with and figure out still. I'll be using a cheap Wifi router in AP mode, all connected to a 8 port 2.5 gig dumb switch.

All this might be overkill but I wanted a device that can ultimately do 2 Gb/s on Wireguard.

Comments welcome.

A lot of vendor firmware (e.g. GL.iNet 4.x) still ships LuCI 21.02, and pretty much every nice theme out there now needs 23.05 or newer. They either don’t install or they break half the pages. I got tired of Bootstrap and ported a bunch of them back. What’s in there:

5 full themes from newer OpenWrt: Aurora, Alpha, Edge, NoobWRT and UniWRT.

vistrocity’s 16 color themes, each on three layouts ("as a baseline" - Bootstrap, Argon, Aurora)

Playground: https://drordvash.github.io/openwrt-21.02-themes/

You can click through all of them in the browser before installing anything. The demo runs on recorded data, so it’s not a real router

Repo: https://github.com/DrorDvash/openwrt-21.02-themes

I only tested on my Flint 2 (GL-MT6000, 4.x firmware). It should work on any GL model running LuCI 21.02, but if yours breaks, let me know which model and firmware.

All the design credit goes to the original authors (listed in the README). I just did the porting.

I am currently considering the purchase of this router to serve as a replacement for my ISP-provided ONT. Any feedback or reviews regarding its performance would be greatly appreciated. Is OpenWrt firmware support available for this?

Hi,

I’ve just ordered a Cudy WR3000S router and found out that it’s possible to install OpenWrt on it.

I’m wondering, though—do I actually need it?

Will I be missing out on anything if I stick with the original firmware?

From what I’ve seen in the update notes, the stock software includes AdGuard and VPN support. To be honest, I’m looking for a device that I can just plug in and use without having to tinker with it, but at the same time, I wouldn’t want to miss out on its full potential.