OpenWrt is a Linux-based open-source operating system specifically designed for embedded devices. Short for Open Wireless RouTer, OpenWrt started as an operating system for wireless routers but is now fully adapted for embedded network devices in general. 

Instead of providing a single, static firmware, OpenWrt offers a fully writable filesystem that allows for package management. It is a more customizable alternative to stock firmware provided by device manufacturers. 

OpenWrt lets you step away from the vendor's preset application selections and configurations and customize the device through packages to suit any application you envision. 

For developers, OpenWrt is a framework to build an application without needing to construct an entire firmware around it. This saves time and effort and offers complete customization freedom. You can use the device in ways that the original manufacturer never considered.

What is the advantage of using OpenWrt?

Cost-efficiency

OpenWrt lets you mix and match hardware to fit your needs and budget. Whether it's using an old, repurposed PC or buying a moderately-priced router and upgrading it with OpenWrt, the cost savings and performance benefits are hard to ignore.

Apart from its compatibility with a wide array of hardware, it’s also worth talking about OpenWrt’s power savings. It's another area where OpenWrt routers can save you money.

If you’re looking to future-proof your setup, OpenWrt’s flexibility offers that too. For example when setting up a system using a Dell Wyse 5070 with a J5005 processor. With a bit of initial investment, you can get a setup that handles tasks like SQM at gigabit speeds effortlessly. This brings a whole new level of cost-effectiveness because you won’t need to upgrade anytime soon.

Enhanced security features

First, let’s talk about HTTPS. If your router has at least 8MB of flash, consider enabling HTTPS on your router’s web interface. Head over to the package manager and install the ssl package. This acts as an extra layer of encryption, especially if you share your network with others.

Not a fan of web interfaces? You can disable the uHTTPd web server. Simply navigate to the router’s interface and stop the uHTTPd service. This reduces the attack surface by eliminating a service you don’t use.

Moving to physical security. OpenWrt disables TTY and serial console authentication by default. But you can enable it for added security. Use the command `uci set system.@system[0].ttylogin="1"`, then commit with `uci commit system` and restart the service with `service system restart`.

Another neat trick is securing management frame protection in your wireless settings. Enable 802.11w to protect management frames from spoofing attacks. It's especially vital if you're in a dense Wi-Fi environment.

If you use multiple access points, 802.11r is your friend. This feature allows devices to roam seamlessly between access points without dropping the connection. It's great for a smooth experience, but remember, not all devices support it. Test it out and disable it if you run into connectivity issues.

Maintaining your firewall is crucial. The default settings are quite robust, but if you must tweak, be cautious. For instance, instead of opening ports for remote access, consider setting up a WireGuard VPN. It’s more secure and keeps your network shielded from unauthorized access.

Don't forget about regular updates. OpenWrt and your custom packages need to stay updated. Run `opkg update; opkg list-upgradable` to see what needs an upgrade. But be careful with `opkg upgrade`; it can lead to issues. Focus on specific packages instead of bulk upgrades to avoid headaches.

Lastly, high-value targets like LuCI and the Dropbear SSH server need your attention. Make sure they’re always up-to-date to fend off potential malware attacks. If you’ve enabled additional services like Samba or SFTP, keep an eye on those too.

Advanced network management tools with OpenWrt

OpenWrt isn't just for home use; it's robust enough for corporate and large-scale deployments. Let's explore some advanced tools and techniques.

Monitoring and logging

If you want to monitor network usage on a per-device basis, including sites visited, you can use tools like `vnstat` for bandwidth monitoring, though it might not capture detailed data. For detailed logs, a proxy server like `Squid` can be invaluable. 

Squid can log all the websites accessed without restricting them. You can set up Squid in less than an hour, especially with the luci app, making it a strong candidate for detailed logging.

Access control

You can use `iptables` for basic blocking, but Squid again is handy here with advanced access control rules. You can block specific sites or allow only whitelisted domains. This can be more efficient and easier to manage than iptables, especially for web access.

Automation and network management at scale

OpenWISP is a remarkable tool perfect for automation tasks. It is an open-source network management system that works seamlessly with OpenWrt. 

OpenWISP allows you to automate the deployment of new nodes, manage configurations, and monitor networks efficiently. One convenient feature it has is the use of NetJSON templates for configuration, which makes your network setup both flexible and scalable.

We can also talk about telemetry. If you're looking at telemetry support, OpenWrt supports SNMP, and you can also use NetFlow with the `softflowd` package. This can help you track detailed data flows across your network, which is crucial for enterprise environments.

For managing thousands of routers, OpenWISP again shines. It's used by many ISPs to manage vast networks of OpenWrt routers. It supports TR-069 if you're inclined that way, but for something more modern, OpenWISP's RESTful API and planned integration of a monitoring solution should be of interest.

Security

When managing routers, ensuring secure bootloaders is critical. This prevents unauthorized firmware changes. OpenWrt provides tools for secure updates over HTTPS. Consider using mutual TLS authentication to ensure that only authorized devices connect to your management server.

When combined with tools like Squid and OpenWISP, OpenWrt can transform your network management, offering fine-grained control and robust monitoring capabilities.

Hardware requirements of OpenWrt

To run OpenWrt smoothly, your setup must meet certain hardware requirements. 

Ensure the SoC or target device has OpenWrt support

If your device isn't supported, you can’t run OpenWrt. Additionally, having sufficient flash storage is crucial. You need at least 4MB of flash, but keep in mind that with only 4MB, you won't be able to install the GUI for some devices. If you can, go for 8MB or more; this will allow you to install the GUI and some other applications. 

Prioritize router memory

RAM is another important aspect to consider. A minimum of 32MB is needed for stable operation, but 64MB is better. You don't want your router to struggle with memory issues, especially if you're planning to use features like SQM (Smart Queue Management) or adblock. 

When it comes to more advanced setups or if you're planning future expansions, be sure to have sufficient power. If you're thinking about x86 hardware, consider using SSDs for storage. Even a 256GB SSD might feel like overkill, but it provides room for future needs. 

On the RAM front, anything above 1GB is generally sufficient. For practical purposes, you should aim for 2GB and above if possible. 

Adding extra Ethernet ports is usually straightforward, especially if you stick with common network cards like Intel e1000/e1000e or Realtek r8168/r8169. These are generally preinstalled in x86_64 images of OpenWrt, making your life much easier. Just avoid USB Ethernet adapters if you can, as internal options are more robust.

Choose low-power components

Another thing to consider is idle power consumption. This might seem trivial, but it can significantly impact your running costs. Aim for low-power components, especially if your router will be running 24/7. Some CPUs like the Intel Bay Trail-D or AMD’s Jaguar series offer good performance while keeping power usage in check.

As for CPU performance, dual-core 64-bit CPUs are generally a good starting point. The Intel Celeron J4125, for instance, does a great job handling SQM and adblock without going above a .30 max load. If you're planning to tinker with advanced features or expect higher data rates, consider CPUs that score well on benchmarks like cpubenchmark.net. 

Lastly, in terms of overall system performance, WAN speeds and VPN usage are the main factors. PPPoE connections require more CPU power than plain Ethernet/DHCP setups. 

Having at least two network cards is also a smart move, as it gives you the flexibility to handle multiple connections. And again, prioritize components with low idle power consumption and minimal noise, as these will contribute to a more efficient and pleasant setup.

How to install OpenWrt

Step 1 - Prepare a bootable USB with Debian

This will act as your installation environment. You can download a live Debian ISO image preloaded with all the necessary software. It’s recommended to use the `debapu-live-2023-11-26.iso` image. You can flash it onto a USB stick using Rufus if you're on Windows, or `dd` if you're on Linux. 

Step 2 - Connect the serial and a LAN cable.

Connect those to the first NIC port on your APU board. Then, insert the USB and boot the system. Your Debian USB should automatically boot and present a root shell without needing to log in. 

Use Putty to connect to the serial port. Once logged in, ensure you have internet connectivity through the WAN cable. Download the latest OpenWrt image from [OpenWrt Releases](http://archive.openwrt.org/releases/). 

Look for the `x86/64/generic-ext4-combined.img.gz` file. At the time of writing, the latest version is `openwrt-22.03.2`. After downloading, unpack it. You should now have a file named `openwrt-22.03.2-x86-64-generic-ext4-combined.img` (without the .gz extension). Next, flash this image onto the SSD. This process is quick due to the SSD's speed. 

At this point, you have a bootable OpenWrt installation. However, to make full use of the disk space, you should resize the OpenWrt partition. Reboot using your Debian USB and install `parted` if it's not already there. 

Once resized, your OpenWrt is ready. Connect the second port to your computer to access the OpenWrt web interface and configure your settings. From here, you can reconfigure WAN and LAN settings, and install additional software packages as needed.

Network Management with OpenWrt

When managing a network with OpenWrt, the key lies in the `/etc/config/network` file. This file holds the UCI network subsystem configuration, crucial for defining switch VLANs, interface configurations, and network routes. For any changes to take effect, you need to either reload or restart the network service.

Reloading the network is simple. Use the command `service network reload` for a soft reload or `service network restart` for a hard restart. To manage individual interfaces, you can bring them up with `ifup <name>` or down with `ifdown <name>`. 

Keep in mind, if you're dealing with wireless interfaces, after running `ifup`, you might need to run `wifi up` to re-establish the bridge connections. For example, reconnecting the `wan6` interface involves running `ifdown wan6` followed by `ifup wan6`.

Consider the default network configuration of an OpenWrt device like the TL-WR1043ND. It includes the loopback interface, global settings, device settings for LAN bridging, and interface settings for LAN and WAN. Look at this snippet for direction:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'
 
 
config globals 'globals'
	option ula_prefix 'fd27:70fa:5c1d::/48'
 
config device 'lan_br'
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0.1'
 
config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option ipaddr '192.168.1.1'
 
config interface 'wan'
	option device 'eth0.2'
	option proto 'dhcp'
 
config interface 'wan6'
	option device 'eth0.2'
	option proto 'dhcpv6'
 
config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'
 
config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 4 5t'
 
config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '0 5t'

Understanding the structure of such a configuration helps. It's divided into interface and device sections, with specific options for each. For instance, the LAN interface is bridged through `br-lan` and uses a static protocol with an IPv4 address `192.168.1.1` and a subnet mask of `255.255.255.0`.

The `globals` section sets interface-independent options affecting the network in general. One key option here is `ula_prefix`, which configures the IPv6 ULA prefix for the device.

In the `device` section, you'll find configurations like creating a bridge. For example, naming the bridge `br-lan` and listing `eth0.1` as a port in the bridge allows devices connected to the LAN to communicate.

When defining a new interface, you need to specify the necessary options. For the `wan` interface in our example, it's associated with `eth0.2` and uses DHCP to obtain its network settings. Here's the minimal declaration:

config 'interface' 'wan'
	option 'proto' 'dhcp'
	option 'device' 'eth0.2'

‍

The `device` option indicates the physical interface, which in this case, is `eth0.2`. Each interface must have a unique logical name like `wan` and an interface protocol such as `dhcp`.

Managing the switch configuration, especially for devices using `swconfig` before OpenWrt 21.02, involves defining the switch and VLAN settings. You might use commands like `swconfig dev switch0 show` to view the current settings and `swconfig list` to identify the switch device.

Each `switch_vlan` section configures a VLAN on the switch. For instance, VLAN 1 could include ports `1, 2, 3, 4` tagged on port 5 (`5t`), which might be linked to the WAN or LAN interface depending on your network setup.

By managing these configurations carefully, you can ensure a robust and flexible network tailored to your needs. The key is understanding and manipulating the `/etc/config/network` file effectively.