1. Post-installation

Upgrade all packages

  • SSH to the router.

Check if ca-certificates is installed

  • Try opkg update first, if errors code 4 occurs, then:
opkg update --no-check-certificate \
opkg install ca-certificates --no-check-certificate
  • Else, continue to the next step.

Upgrade all packages

opkg list-upgradable | cut -f 1 -d ' ' | xargs -r opkg upgrade

Add a password

  • Open luci web interface.
  • System πŸ‘‰ Administration πŸ‘‰ Router Password πŸ‘‰ Set password πŸ‘‰ Save.

2. Personalization

Rename the router

  • Open luci web interface.
  • System πŸ‘‰ System πŸ‘‰ Hostname πŸ‘‰ Save & Apply.

Change NTP server

  • Open luci web interface.
  • System πŸ‘‰ System πŸ‘‰ Time Syncronization πŸ‘‰ modify NTP server candidate πŸ‘‰ Save & Apply.
  • Some NTP servers I prefer over the default one:
    • time.cloudflare.com
    • time.google.com
    • time.windows.com

3. Optimization

Enable hardware flow offloading

  • What is hardware offloading?.
  • TL;DR: offload some tasks from CPU to specialized hardware ▢️ increase performance ▢️ increase network bandwidth (e.g. from WAN to LAN).

Create crontab for automatic updates all packages

  • Luci web interface πŸ‘‰ System πŸ‘‰ Scheduled Tasks
  • Paste this into the input box:
0 0 * * * opkg update && opkg list-upgradable | cut -f 1 -d ' ' | xargs -r opkg upgrade
  • Save.

This will update all packages at 00:00 every day. Use the below table to customize the schedule or use crontab.guru to generate the crontab.

PositionMeaningValue
1Minute0-59
2Hour0-23
3Day of month1-31
4Month1-12
5Day of week0-6 (0 = Sunday)
  • Example:
    • Every 5 minutes: */5 * * * *
    • Each hour at minute 30th: 30 * * * *
    • Every Saturday at 11:30 PM: 30 23 * * 6
    • Twice a month at 1:30 AM on the 1st and 15th: 30 1 1,15 * *

4. Wifi, mesh, VLAN, fast roaming…

FAQ

  • What’s wifi mesh?
    • Backhaul: connect multiple routers to each other.
    • Wired backhaul: connect multiple router(s)/AP(s) to each other via ethernet cable.
    • Wireless backhaul: connect multiple router(s)/AP(s) to each other via wifi a.k.a. wifi mesh.
  • So it’s not related to combining multiple wifi SSIDs into one?
    • Nope, that’s the job of the client (e.g. your phone).
  • What’s VLAN?
    • Virtual local area network. Imagine a big apartment complex where all the residents share the same network. A VLAN would be like creating separate apartments within the complex, so that each “apartment” has its own network and can’t see or access the other networks. This helps to keep different groups of people or devices separate and more secure.
  • Fast roaming?
    • Roaming: when a device disconnects from one access point and connects to another.
      • Disconnect AP1 πŸ‘‰ authenticate with AP2 πŸ‘‰ connect to AP2.
    • Fast roaming: change how the device roams, so it feels like you never disconnect from the network.
      • Authenticate with AP2 πŸ‘‰ connect to AP2 πŸ‘‰ disconnect AP1.

OneMarkFifty’s playlist

I’d highly recommend this playlist from OneMarkFifty.


You don’t have to watch all of them, just these:

  1. How to configure OpenWrt as Firewall for your home network and Guest Wifi and IPTables explained
  2. extend a guest wifi on second access point with OpenWrt using VLANs
  3. DIY WI-FI MESH with OpenWrt
  4. VLAN in OpenWrt 21
  5. CHEAP WI-FI MESH ALTERNATIVE with fast roaming OpenWrt Wi-Fi Access points
  6. Guest Wi-Fi over Mesh with VLAN tunneling

My tutorial

Main router

Firewall

Luci web interface πŸ‘‰ Network πŸ‘‰ Firewall πŸ‘‰ Zones section.

  • Create a new zone:

    FieldValue
    NameGuestZone
    InputREJECT
    OutputACCEPT
    ForwardREJECT
    Allow forward to destination zoneswan
    Allow forward from source zoneslan or leave blank if you don’t want lan to access GuestZone
  • If Allow forward from source zones of GuestZone is set to lan, you’ll also need to edit the lan zone:

    • Allow forward to destination zones: add GuestZone
  • Since GuestZone is blocked from accessing the router (Input rule), we need to whitelist port 53, 67 and 68 for the router to assign DHCP and provide DNS for the guest client.

    • Luci web interface πŸ‘‰ Network πŸ‘‰ Firewall πŸ‘‰ Traffic Rules tab.
    • Add a new rule, only modify these fields:
      FieldValue
      NameAllow DNS and DHCP
      Protocoltcp and udp
      Source zoneGuestZone
      Destination zoneDevice (input)
      Destination port53 67 68
      Actionaccept
    • Save & apply.

Devices

Luci web interface πŸ‘‰ Network πŸ‘‰ Interfaces πŸ‘‰ Devices tab

  • Have 2 bridge devices: br-lan and br-guest. Create them if they don’t exist.

    General device options tabLAN bridgeGuest bridge
    Device typeBridge deviceBridge device
    Device namebr-lanbr-guest
    Bridge portsAll physical LAN ports of the routerLeave blank for the moment
    Bring up empty bridgecheckedchecked
  • Save. (NOT SAVE & APPLY)

  • Back to configure the br-lan device: hit Configure... button.

  • Navigate to the Bridge VLAN filtering tab.

    • Enable VLAN filtering: checked
    • Add 2 new VLAN ID: one for guest, one for local network.
    • I’ll use 3 for the guest network and 10 for the local network. Avoid using 1 as it’s the default VLAN ID, and the routers are also using this for other tasks so it’s better to avoid other clients having access to it.
    • For LAN ports that are using to connect to
      • Other routers, select egress tagged for ALL the VLANs: network packages will have the VLAN tag (tagged) when they leave (egress) the router to VLAN-aware devices, your PC or laptop won’t be able to use these ports as they don’t know what to do with the VLAN tag.
      • Other clients, select egress untagged and Primary VLAN ID for ONE VLAN that you want to use for that port: network packages meant to go to that port will not have the VLAN tag (untagged) when they leave (egress) the router to VLAN-unaware devices, and for network packages don’t have the VLAN tag, the router will send them to the port with the Primary VLAN ID checked.
    • Tick the local box of all the VLANs. This will make the VLAN visible for local use, such as assigning VLAN zones to interfaces.
  • Save (NOT SAVE & APPLY)

  • Go back to Configure... the br-guest device: add Software VLAN: "br-lan.3" to the Bridge ports field.

  • WARNING: DO NOT HIT SAVE & APPLY YET! IF YOU ACCIDENTALLY DO SO, WAIT 90s FOR THE LUCI TO ROLLBACK THE CHANGES.


Interfaces

Luci web interface πŸ‘‰ Network πŸ‘‰ Interfaces πŸ‘‰ Interfaces tab

  • Have 2 interfaces: lan and guest. Create them if they don’t exist:

    FieldLAN interfaceGuest interface
    NameLANGUEST
    ProtocolStatic addressStatic address
    Devicebr-lan.4br-guest
  • Create interface

  • Edit if the interface already exists.

    • General Settings tab:

      FieldLAN interfaceGuest interface
      ProtocolStatic addressStatic address
      Devicebr-lan.4br-guest
      Bring up on bootcheckedchecked

      For IPv4 address and netmask, you can use any IP in one of the below classes. The router will use the IP to assign DHCP to the clients in the same class.

      ClassRangeAllowed netmask
      A10.0.0.0 to 10.255.255.255255.0.0.0, 255.255.0.0, 255.255.255.0
      B172.16.0.0 to 172.31.255.255255.255.0.0, 255.255.255.0
      C192.168.0.0 to 192.168.255.255255.255.0.0, 255.255.255.0
    • Advanced Settings tab:

      FieldLAN interfaceGuest interface
      Force linkcheckedchecked
      Use default gatewayuncheckedunchecked
    • Firewall Settings tab:

      FieldLAN interfaceGuest interface
      Create/Assign firewall-zoneLANGuestZone
  • Navigate to DHCP Server tab and hit Set up DHCP Server if it exist

    DHCP Server
    else just make sure the Ignore interface unchecked.
    DHCP Server


Configure mesh backhaul

Skip this if you’re not planning to create a mesh backhaul.

  • Install requried packages: luci web interface πŸ‘‰ System πŸ‘‰ Software πŸ‘‰ Update lists

    • Update lists button
    • Search luci-proto-gre, wpad-mesh-wolfssl
    • Tick Overwrite files from other package(s) before hit Install.
    • Reboot the router(s)/AP(s).
  • Add interface for the other router(s)/AP(s) to connect to:

    • General Settings tab:

      FieldValue
      NameAP1
      ProtocolGRETAP tunnel over IPv4
      Bring up on bootchecked
      Remote IPv4 address or FQDNIPv4 address of the other router/AP
      Local IPv4 addressIPv4 address of the current router
    • Advanced Settings tab:

      FieldValue
      Force linkchecked
      Bind interfacelan
      Don’t Fragmentunchecked
      Use default gatewayunchecked
  • Assign the interface to the bridge(s):

    • br-lan: add @AP1.10 to the Bridge ports field.
    • br-guest: add @AP1.3 to the Bridge ports field.
  • Repeat the above steps as many times as the number of routers/APs you want to connect to.

  • Create a mesh wifi backhaul: luci web interface πŸ‘‰ Network πŸ‘‰ Wireless

    • Add a new wifi SSID. Some APs made specifically for mesh backhaul may have a dedicated wifi module for this purpose, I’d recommend using one just for mesh, another one for dumb AP.

    • Device Configuration: this will apply on the entire wifi module’s settings, skip this section when adding another SSID of the same wifi module.

      • General Setup: Operating frequency
        FieldValue
        ModeAC or N depending on your wifi module, AX not recommended
        ChannelChoose one not occupied in your area
        WidthThe higher the better IF the channel is not busy
    • Interface configuration:

      • General Setup:
        FieldValue
        Mode802.11s
        Mesh Idmy-mesh-network
        Networklan
      • Wireless Security:
        FieldValue
        EncryptionWP3-SAE (string security)
        Passwordsuper-secret-password
    • Save.

  • Save & apply.


Dumb AP

Connect WAN of this AP to the LAN of the main router. Connect your devices to the LAN of this AP.

Turn off unnecessary services

  • Luci web interface πŸ‘‰ System πŸ‘‰ Startup πŸ‘‰ Initscripts tab
  • Disable firewall, dnsmasq and odhcpd.

Firewall

  • Skip this one, the main router will handle this.

Wired backhaul

Create 2 devices and 2 interfaces exactly the same as the main router if you’re using wired backhaul, except:

  • Devices:
    • Add *ALL ports of the router to the Bridge ports field of br-lan.
    • Change the Device of the LAN and GUEST interfaces to br-lan.10 and br-guest BEFORE hit Save & apply.
  • Interfaces:
    • No need to define the firewall.
    • Protocol of the 2 interfaces is DHCP Client
    • The DHCP Server tab should still have a button Set up DHCP Server, else just check the Ignore interface in the General Setup of the DHCP Server tab.

Wireless backhaul

  • Install luci-proto-gre, wpad-mesh-wolfssl packages. Create a GRETAP tunnel over IPv4 interface like the main router (let’s call ROUTER), but this time:
  • Remote IPv4 address or FQDN: the IPv4 address of the main router.
  • Local IPv4 address: the IPv4 address of this AP. Create 2 devices and 2 interfaces exactly the same as the main router if you’re using wired backhaul, except:
  • Devices: same as the main router, except:
    • Ignore the Firewall and Bridge VLAN filtering section.
    • Beside the physical LAN ports, add @ROUTER.10 to the Bridge ports field of br-lan.
    • Add @ROUTER.3 to the Bridge ports field of br-guest.
  • Interfaces:
    • No need to define the firewall.
    • Protocol of the 2 interfaces is DHCP Client
    • The DHCP Server tab should still have a button Set up DHCP Server, else just check the Ignore interface in the General Setup of the DHCP Server tab.
  • Create a wifi-mesh point has the same configuration as the main router.

Double check

  • No interface should have Use default gateway option checked except the WAN.
  • Only LAN and GUEST interfaces of the main router can have Static address protocol, have firewall and the button Set up DHCP Server clicked. Everything else on other dumb APs must use DHCP client protocol.
  • firewall, dnsmasq and odhcpd are disabled on all dumb APs.

Wifi settings

The configuration are pretty self-explanatory, but there’re some things to keep in mind:

Gerenal Setup

Make sure WMM Mode is enabled.

Wireless Security


References