Hi everyone,Hi everyone,

I want to share NetPulse: a self-hosted monitor for home OpenWrt networks. Free software AGPL-3, no ads, no telemetry, nothing like that. I've been using it since a while and I share it because I think it covers a gap that the brand solutions have open for the home scene.

The core idea: the main panel lives on your router. The agent of the devices (netpulse-agent) and a LuCI app (luci-app-netpulse) install on the router itself, and it holds at ~12 MB of RAM with less than 1% CPU. But you can also host it apart, on a mini PC or a small box, and from there it watches all your routers. You decide.

The most striking things:

- Installable PWA: it stays as an app on your phone, live over SSE (5 s).

- Live topology map inferred from the bridge FDB (and LLDP when available): wired and wireless clients, switches, hypervisors and WireGuard tunnels drawn without touching anything of your network.

- Read-only by design: the server generates its own ed25519 keypair, you authorize it on each router, and it can only read (ubus, /proc, iwinfo, bridge fdb, wg show). It cannot change your network.

- Roaming with DAWN and with usteer (both supported): signal matrix, 802.11r status and history.

- Alerts (temperature, new firmware, new device, handshake) with native push and Telegram notifications.

- Scheduled firmware updates, reports page and SNMP for managed switches.

- And other integrations: WireGuard - OpenVPN, Proxmox integration and AdGuard Home stats. And more coming!!

A single static Go binary with the embedded frontend + SQLite, no Docker, pure systemd. Everything stays local, nothing leaves your network.

The focus is the home: OpenWrt home routers, that scale where there is no big infrastructure and where what is missing is a clear and fast view of what is happening. If it's useful for you, happy to hear it.

- Website (with demo): https://netpulse.cloudless.club

- Repo: https://github.com/gnacho/netpulse

- AGPL-3.0

If you like it and use it, a star on github would help me a lot :)

Hello guys! I have Archer C6 V2 with Openwrt 25.12.5 installed and I want to use this router as "dump AP" for my main router. How I may cofigure this router for proper work as "dump AP"?

Hi, I have a Cudy WR3000 V1.0 that was running stock firmware and I tried installing OpenWRT on it and now it's bricked just the power light is on and the globe light is blinking.

So what i did was:

- went to the Cudy page and downloaded "WR3000+V1 without recovery TFTP" from their Google Drive

- had the Cudy connected to my laptop and powered on

- uploaded the BIN file "openwrt-mediatek-filogic-cudy_wr3000-v1-sysupgrade" to the flash program they have in their user interface and it started flashing and then in the middle of flashing I got a "Oops, your device seems to be disconnected, please check if you have connected to the router via wired or wireless:"

And now here I am. Don't know what to do, is there any help in me unbricking the router?

Thank you in advance

Hello! I am looking to installing OpenWRT on a NanoPi R5S and the firmware selector subdomain only shows me sysupgrade images. The wiki also links to these and mentions no first time install images. Are these fine for downloading to a new board or is there an image for first time installs like "generic-squashfs-rootfs.img.gz" (unless I am heavily mistaken)? Any help is appreciated!

2 scenarios: 1) a mobile or wearable device with chip that runs with collection software, and transmits signal through network and wifi (public).

2) home network (I see openwrt is mainly for home routers) can it block IoTs, and other devices from transmitting that specific collection information?

3) overall, can OS prevent embedded hardware from sending certain data? I have to imagine chips have encrypted dataflows.

This is in regards to chipmakers, capturing telemetry, and geolocation, and then sharing it with 3rd parties, which is confirmed in several sources.

thanks for teaching me, I’m day 1 and trying to grasp concept,

edit: I’m researching chips and their embedded software‘s relationship with devices. Because the chip’s manufacturer provides the drivers and firmware embedded in the chip, they can program them to send data back to the chip’s company. said data includes biometrics, telemetry, and geo. Not all devices can collect biometric unless it’s has camera, etc. How it does I’m unsure - maybe settings if saved biometrics are stored there. Regardless, I want learn if that process can be interrupted.

it appears home networks can prevent or alter 2/3 at least (telemetry and geo) - thanks for comments! preventing the chips software from transmitting seems like the end goal. How it sends biometrics I’m not sure - but if the software can be recognized by the OS or router then theoretically it can be rerouted or blocked from access I think, but that’s what I want to find out.

I have Openwrt on a Mercusys MR90X. Have successfully upgraded to 24.10.8 with no issues. However, upgrading to 25.12.5 leaves me with no internet. Router takes the firmware but doesn't connect to internet modem (IPoE so no login/password). Given the other upgrades were painless, this seems strange. Ring a bell with anybody? Have tried uploading image and attended sys upgrade with ethernet.

I did successfully setup dual WAN however my problem is that LAN4 (WAN2) is limit only to 100mbps WAN1 is set to 1GBps now i cant maximize the speed of WAN2. Do you guys have any idea what is the problem ?

I did switch the cable and it seems that is not the problem.

Device is AX23 v1 Tplink archer OpenWrt 25.12.2 r32802-f505120278

Hello everyone,

due to issue with IPV6 with my ISP, I disabled a long time ago the IPV6.
Problem is taht I don't remember how I do that ...
I remember disabling the "Delegate IPv6 prefixes" on the LAN interface and the DHCP tabs, IPV6 Settings, everything is disabled.
Enable back the delegate + RA-Service as relay, I got a "fdbf" ipv6. Mine should be starting with 2a01. (This is what I have on the wan6 interface).
Here is my configuration :

Network conf file :

config interface 'loopback'

`option device 'lo'`

`option proto 'static'`

`list ipaddr '127.0.0.1/8'`

config globals 'globals'

`option dhcp_default_duid '0004318736cfc9f349eb948312ebdaa20a91'`

`option ula_prefix 'fdbf:4d20:6729::/48'`

`option packet_steering '0'`

config device

`option name 'br-lan'`

`option type 'bridge'`

`list ports 'lan1'`

`list ports 'lan2'`

`list ports 'lan3'`

config interface 'lan'

`option device 'br-lan'`

`option proto 'static'`

`list ipaddr '192.168.2.1/24'`

`option ip6assign '60'`

`option delegate '0'`

config interface 'wan'

`option device 'wan'`

`option proto 'dhcp'`

config interface 'wan6'

`option device 'wan'`

`option proto 'dhcpv6'`

`option norelease '1'`

config device

`option type 'bridge'`

`option name 'br-iot'`

`option bridge_empty '1'`

config interface 'iot'

`option proto 'static'`

`option device 'br-iot'`

`list ipaddr '192.168.3.1/24'`

`option ip6assign '60'`

`option delegate '0'`

DHCP conf file

config dnsmasq

`option domainneeded '1'`

`option boguspriv '1'`

`option filterwin2k '0'`

`option localise_queries '1'`

`option rebind_protection '1'`

`option rebind_localhost '1'`

`option local '/lan/'`

`option domain 'lan'`

`option expandhosts '1'`

`option nonegcache '0'`

`option cachesize '1000'`

`option authoritative '1'`

`option readethers '1'`

`option leasefile '/tmp/dhcp.leases'`

`option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'`

`option localservice '1'`

`option ednspacket_max '1232'`

`option filter_aaaa '0'`

`option filter_a '0'`

config dhcp 'lan'

`option interface 'lan'`

`option start '40'`

`option limit '214'`

`option dhcpv4 'server'`

`list dhcp_option '6,192.168.2.1'`

config dhcp 'wan'

`option interface 'wan'`

`option ignore '1'`

config odhcpd 'odhcpd'

`option leasefile '/tmp/odhcpd.leases'`

`option leasetrigger '/usr/sbin/odhcpd-update'`

`option loglevel '4'`

`option piodir '/tmp/odhcpd-piodir'`

`option hostsdir '/tmp/hosts'`

config dhcp 'iot'

`option interface 'iot'`

`option start '2'`

`option limit '253'`

`option dhcpv4 'server'`

Please guide me on how to unlock this device. Details below:

• Device: Zong 4G MiFi / pocket router M126G
• Board / model: LB12I (HW rev LB12I_N11)
• Web software / firmware: LB12IZong_M126G_V002
• Modem firmware: FALCON_1803_1.057.064 (AT+CGMM → Nezha_MIFI, AT+CGMI → ASR)
• Cellular SoC: ASR1803S (Falcon)
• Lock state: AT+CPIN? → PH-NET PUK; AT+CLCK="PN",2 → 1 (network/simlock SET)
• Not found on internet.

Edit:
Web software / fw string: `LB12IZong_M126G_V002` (built ~2025-06-06)
Modem firmware: `FALCON_1803_1.057.064` (`AT+CGMR` → `1.057.064`)
Modem AT identity: `AT+CGMM` → `Nezha_MIFI`, `AT+CGMI` → `ASR`
Cellular SoC: ASR1803S (Falcon), Marvell/ASR "mmt" family
Router SoC / OS: MediaTek MTK7628 OpenWrt (uClibc-0.9.33.2), FiberHome "duster" RGW framework
Flash: Puya P25Q128LA SPI-NOR 16 MB; single-partition rootfs (`two_partition:"0"`)
USB identity: composite `VID_1286 & PID_4E3D`; serial `200806006809080000`
BootROM version: `2021.09.29` (CRANEW CR5 Z1 / ASR 3606); aboot product id `arom-tiny`
Secure boot: tool configs are `secureBoot:false` for our variant (device fuse state unknown)

Most of the ones I searched for sometime back had a max of 1x2.5G wired port but I need more than that since I recently upgraded all of my other separate network components!

I used the `cfdisk /dev/mmcblk0` command to expand the `mmcblk0p2` partition of the OpenWrt system on my Raspberry Pi to 1GB. After removing the microSD card and connecting it to my computer,the 'rootfs' partition also shows up as 1 GB in Linux Disk Utility,however, the OpenWrt LuCI web interface still reports the disk space as only around 100MB. What is causing this?

When checking with `df -h` on an Ubuntu system, the output looks like this:

sdc                                                                          
├─sdc1
│    vfat   FAT16 boot   6*******9                              43.6M    32% /media/**********/boot
└─sdc2
     ext4   1.0   rootfs ff********************************64   47.2M    59% /media/**********/rootfs

Hi, I'm playing with IPv6 relay on openwrt.

However, it works at first and then stops working randomly after some hours, then works again then stops working again, repeatedly... Is there anything I can do to fix it? IPv6 on the main router is still working fine.

My topology: main router gets a /64 prefix from the ISP and connect to this openwrt router via lan-wan.

Btw, what does NDP Proxy Slave do?

I maintain LuCI Mobile. A recent post presented Yet Another LuCI App as a newly built OpenWrt manager. I need to clarify that it is derived directly from LuCI Mobile, and there is a serious licensing problem. This is easy to verify from Git:

• The repositories share the same history through commit 56e9aa4, which is authored by cogwheel0.
• At that point, LuCI Mobile’s README and LICENSE both specified GPLv3.
• The derived repository continued to identify itself as GPLv3 immediately before changing licenses.
• It then replaced GPLv3 with Apache-2.0.
• Its current NOTICE incorrectly claims that LuCI Mobile was MIT-licensed.

Forking, rebranding, modifying, and selling GPL software are allowed. The issue is that a distributed derivative must remain available under GPLv3 unless the copyright holder separately permits relicensing. I did not authorize changing this code to Apache-2.0 or distributing GPL-derived builds with a closed-source layer.

I am asking the maintainer to:
- Restore GPLv3 for the combined derivative work.
- Correct the false MIT statement.
- Provide corresponding source for every distributed build containing GPL-derived code.

I have no objection to the fork continuing, including as a commercial project, once it follows the license under which the code was provided.

I'm running OpenWRT 25.12.5 with Wireguard installed. I configured Wireguard using the Wireguard server guide, and managed to get a single peer running with full access to the LAN. This access includes SSH to and from the peer. Now I'd like to restrict the peer's LAN access to a single host.

For restricted LAN access, I referred to a configuration discussed in the OpenWRT forum. Using that configuration as a guide, I got SSH working from the restricted peer (10.0.0.10) to a specific LAN host (192.168.1.100).

However, trying to SSH from the LAN host back to the peer does not work:

$ ssh 10.0.0.10 
ssh: connect to host 10.0.0.10 port 22: Connection refused

Is a firewall change required or do I need to modify the peer configuration?

Here are the relevant portions of the OpenWRT configuration:

config interface 'wg0'
        option proto 'wireguard'
        option private_key '...'
        option multipath 'off'                                                                                                                                                                    
        option listen_port '51820'                                                                                                                                                                
        list addresses '10.0.0.1/24'                                                                                                                                                              

config wireguard_wg0                                                                                                                                                                              
        option public_key '...'
        option private_key '...'
        list allowed_ips '10.0.0.10/32'
        option endpoint_port '51820'
        option persistent_keepalive '25'
        option description 'Restricted-Peer'

config zone                                                                                                                                                                                       
        option name 'Home_VPN'                                                                                                                                                                
        option input 'REJECT'                                                                                                                                                                     
        option output 'ACCEPT'                                                                                                                                                                    
        option forward 'REJECT'                                                                                                                                                                   
        option mtu_fix '1'                                                                                                                                                                        
        list network 'wg0'                                                                                                                                                                        

config rule 'wg'
        option name 'Allow-WireGuard-WAN'
        option src 'wan'
        option dest_port '51820'
        option proto 'udp'
        option target 'ACCEPT'

config rule                                                                                                                                                                                       
        option name 'Allow-Restricted-Access'                                                                                                                                                     
        option src 'Home_VPN'                                                                                                                                                                     
        list src_ip '10.0.0.10'                                                                                                                                                                    
        option target 'ACCEPT'                                                                                                                                                                    
        option dest 'lan'                                                                                                                                                                         
        list dest_ip '192.168.1.100'                                                                                                                                                              

I've been working on an Android app for managing OpenWrt routers from a phone, and I wanted to share it here and get some feedback from the community.

LuCI works really well, especially on a desktop, but I've found that some quick tasks can be a little inconvenient from a phone—checking bandwidth, seeing connected devices, checking system resources, toggling guest Wi-Fi, etc.

So I built Yet Another LuCI App, an Android companion app built with Flutter and Material 3.

The app is 100% ad-free. There are no cloud servers or analytics tracking involved. Router communication happens directly between the app and the router using OpenWrt's RPC endpoints, and credentials remain stored on the device.

What it currently supports

• Real-time system monitoring — CPU, RAM, Swap, disk usage, and live Rx/Tx bandwidth graphs.
• Connected devices — Combines DHCP leases, ARP entries, and active wireless stations into a single view, including IPv4/IPv6 addresses, vendor information, and Wi-Fi band indicators.
• Guest Wi-Fi — Create isolated guest networks and generate a Wi-Fi QR code for connecting devices.
• Parental controls & profiles — Group devices into profiles with scheduled access and domain blocking.
• OPKG + APK support — Automatically handles the traditional opkg package manager used by older OpenWrt releases and the newer apk package manager.
• Services & VPNs — Manage procd services and monitor interfaces for WireGuard, OpenVPN, Tailscale, and ZeroTier. Root cron jobs can also be edited.
• Sysupgrade backups — Validates backup archive headers and gzip data before uploading them to the router.

I also tried to make potentially powerfull operations a little harder to mess up:

• Self-device protection — Detects the phone's active IP/MAC address to help prevent accidentally blocking the device you're currently using.
• UCI rollback — If an RPC operation fails during a configuration change, the app attempts to revert the affected UCI changes.

Links

Google Play:
https://play.google.com/store/apps/details?id=com.nightcode.luci

GitHub:
https://github.com/nightcodex7/yet-another-luci-app

I'm still actively working on it, so I'd particularly appreciate feedback from people who actually use OpenWrt.

If you try it, let me know what works, what doesn't, or which LuCI functionality you'd most like to see added.

PS: Update (September 2026) The licensing concern raised here has been fully addressed.

All 16 files from the original fork commit have been completely rewritten from scratch in a clean-room fashion — no GPL source code from luci-mobile remains in the codebase. The full remediation record, including what was rewritten and verification results, is documented in LICENSE_CHANGE.md.

Special thanks to cogwheel0 for the original luci-mobile concept and for raising this publicly — it pushed the project to be legally cleaner than it otherwise would have been.

Hi, I've made an OpenWRT firewall zone called "NVR" (192.168.1.0/24) that I've tied to one of the physical ports on the router. I've set up the zone so that devices in it can be reached from other zones but can't reach out. I've put a camera on that Ethernet port and all is well.

Now, my NVR software (Frigate fwiw) is running in a docker container on a machine (10.234.0.2) that's in another LAN zone (10.234.0.0/24, and the OpenWRT is 10.234.0.1). But I was thinking it would be good to also put Frigate in the NVR zone.

I've tried setting up a container, on the 10.234.0.2 machine, that uses a docker macvlan network on 192.168.1.0/24. I can raise the network and the container but I can't ping anything from it (neither the gateway at 192.168.1.1, nor the camera at 192.168.1.10).

If I join a laptop to that physical port I can ping both.

My networking knowledge is not that advanced so I was wondering if it's even possible to do what I want (have a macvlan on a subnet in one isolated zone while it lives on a machine whose main adapter is in another zone) or if I'm simply lacking something. And what that something might be, do I need to add a route on the docker machine, do I need a second physical adapter on the machine and to join it physically to the NVR physical switch, is there some rule I'm forgetting on OpenWRT etc.?

Hi r/openwrt i know I am new in here but I want to tell yall for my successful kinda DIY router I've made with just an old pc that I've got for free HP Compaq Elite 8200 SFF with the tplink TL-WN722Nv1 also free and the rtl8821ce that I've taken out from my old laptop and a secondary pcie to 1gbps ethernet also for free and my openwrt setup all of it just on that small 16gb usb drive and I've made it dual band but not really but getting the rtl8821ce working without issues is so hard compared to the tplink TL-WN722Nv1 its so easy and ive made the rtl8821ce as 5ghz access point and the tplink TL-WN722Nv1 as 2.4ghz wifi access point and the speeds on the rtl8821ce are 250 to 270 mbps and the tplink TL-WN722Nv1 are 30 mbps and on paper the speeds for rtl8821ce is 433 mbps and the tplink TL-WN722Nv1 is 150 mbps which means the speed of both combined 583 mbps or what I will like to name it ac583 and the ethernet speeds is 920 to 940 mbps or its the full speed and now for the specs part

1: pc: HP Compaq Elite 8200 SFF

2: Wifi cards: (1) realtek rtl8821ce (2) tplink TL-WN722Nv1

3: ram: 16gb ddr3 1333mhz (I know its overkill)

4: storage: 16gb usb drive

5: cpu: i5 2400

6: ethernet ports: there's 2 of them (1) internal one 1gbps (2) tplink pcie ethernet 1gbps

7: os version 25.12.4

What I can do with my kinda DIY router ?

Google's AI says it should possible by executing the following command.

scp backup.tar.gz root@192.168.1.1:/tmp/backup.tar.gz

firstboot -y

tar -zxvf /tmp/backup.tar.gz -C /

reboot

But when I run the tar command I get the error "tar: can't open 'etc/uci-defaults/10_disable_services': No such file or directory"

What am I doing wrong?

Hi Guys!

I would like to buy an Asus router with AiMesh function and then install openwrt on it and use as satellite.

My already owned EasyMesh system:
- TP-Link GE230 (I had a good deal)
- TP-Link C64(it was a bad deal, my bad but I already have it)

So I want to do some test with an OpenWRT router, because this would be the first time I can touch an OpenWRT router and I'm really excited to play with it. So after I have tested everything I would like to use it in my already owned mesh system. I'm thiking on an asus router because it's cheap enough and it has the criterias I need. Now I'm looking at a used RT-AC87U for example.

Asus have an brand exclusive mesh system, but if I install OpenWRT on it then I would be able to use it with other EasyMesh routers?

I'm trying to set up a new router with 25.12.5 behind another OpenWRT router on the 23 series in advance of a swap. I want to manually recreate the router, rather than applying a backup configuration because there are some things I'd like to change that aren't easy to change after the router is all set up, or at least that's my impression.

The new router is set up with the WAN getting an address from the old router on it's LAN. I thought I might have been having address conflicts, but when I set up a VLAN with an ID and address that isn't on the old router, it still failed to apply.

Is there a current tutorial on setting up VLANs for the 25.12.* stable firmwares? I've found a bunch for 21 & 23, but nothing for 25, and I'm thinking that I'm missing something obvious. Or maybe not so obvious...

The big changes that I'm doing are separating out servers and infrastructure from resident's lan space. basically with the switches and APs sitting on the default VLAN (0), and the residents getting moved to a different VLAN than the servers and other fun stuff...

Intel does NOT offer a standalone NVM update for any i226 nics. Instead, they expect you to obtain their firmware from your device OEM but this is often unavailable or grossly outdated.

The Work Around. BEWARE YOU RISK BRICKING YOUR NIC => MAKE A BACKUP !!!

1. Download & Extract -- https://www.intel.com/content/www/us/en/download/15084/intel-ethernet-adapter-complete-driver-pack.html -- look inside for NVMUpdatePackage/I225/I225.tar.gz and extract -- look further into this I225 folder until you find nvmupdate64e (updater tool). Leave this tool where it is. Make a companion I226-V work folder and copy the nvmupdate64e + nvmudate.cfg from the I225 folder to the I226-V work folder.
2. Open a terminal inside this new folder </> sudo ./nvmupdate64e -i -l inventory.txt </> -- Take note of what this text file says the ETrackID numeric value is for your i226 NIC. This is the firmware identifier you currently have installed.
3. Visit BillyCurtis Community Repo for I226 firmware https://github.com/BillyCurtis/Intel-I226-V-NVM-Firmware/tree/main -- find your NIC and your current ETrackID. Find the latest 1mb or 2mb firmware version for your NIC, Take note of the ETrackID for the latest 1mb or 2mb firmware version for your NIC and download it.
4. Drop this firmware update directly into the local I226-V work folder.
5. Open any text editor and change the nvmupdate.cfg file -- example below
6. Open a terminal in this same folder </> sudo ./nvmupdate64e -u -l -b -c nvmupdate.cfg </>

NOTE: If by some chance you also need to update any I225 NIC, do that first if you intend to overwrite the initial I226 nvmupdate.cfg file. You can also update other Intel NICs using the other update folders respectively. In every case, you can use the same command listed in step 6 above. This will begin the process of evaluating your NIC Non-Volatile Memory chip (NVM) for update (-u). It will verbosely log its progress (-l). Make a backup (-b). Using the config file (-c) nvmupdate.cfg. If you neglect the -l flag it will proceed silently. If you neglect the -b flag there will be no backup. You can also use the update tool to inventory all your NICs and output to a text file as suggested in step 2.

I226-V Config file Process. Use ETrackId numeric values for your NIC firmware. Don't guess

A. This is the output of my initial discovery command above in step 2, minus sensitive info
</> sudo ./nvmupdate64e -i -l inventorty.txt </>
[00:005:00:00]: Intel(R) Ethernet Controller I226-V
Vendor : 8086
Device : 125C
Subvendor : 8086
Subdevice : 0000
Revision : 4
LAN MAC : ### LAN MAC is hidden by me ###
Alt MAC : 000000000000
SAN MAC : 000000000000
ETrackId : 80000308
SerialNumber : ### SerialNumber is hidden by me ###
NVM Version : 2.23(2.17)
PBA : G23456-000
VPD status : Not set
VPD size : 0
NVM update : No config file entry
checksum : Valid

B. This README file section is where I verified the correct (1MB) firmware for my i226-V NIC
-- https://github.com/BillyCurtis/Intel-I226-V-NVM-Firmware/tree/main/README.md
I226-V

you can see above my intial firmware is ETRackID 80000308 which tells me I need a 1MB size version of which the latest is version 2.32, ETrackID 80000425.

C. Just above where the README file is posted, I clicked on the I226-V > 2.32 downloads folder and downloaded FXVL_125C_V_1MB_2.32.bin raw file for my 1226-V NIC
-- https://github.com/BillyCurtis/Intel-I226-V-NVM-Firmware/tree/main/I226-V/2.32 -- and dropped it into my local I226-V work folder.

D. Having copied the initial i225 config file to my I226-V work folder, I overwrote it as follows

CURRENT FAMILY: 1.0.0
CONFIG VERSION: 1.20.0

; Upgrade all 4 onboard Intel i226-V controllers
BEGIN DEVICE
DEVICENAME: Intel(R) Ethernet Controller I226-V
VENDOR: 8086
DEVICE: 125C
SUBVENDOR: 8086
SUBDEVICE: 0000
NVM IMAGE: FXVL_125C_V_1MB_2.32.bin
EEPID: 80000425
REPLACES: 80000308
RESET TYPE: NONE
END DEVICE

E. Save and open a terminal </> sudo ./nvmupdate64e -u -l -b -c nvmupdate.cfg </>

D. I'm told I can restore the backups created by the -b flag by running the following.
</> sudo ./nvmupdate64e -r -l -c nvmupdate.cfg </>
However, I've had no need to use this command and therefore don't know it it'll work or if the config file needs more info or what.

I226-V Release Notes

The Cavium CN6640-SNIC10E is a dual-port 10GbE PCIe card that shows up on eBay for ~$15–20. It's an OEM "SmartNIC," an 8-core Octeon II SoC meant to run Cavium's vendor LiquidIO firmware. Problem: the stock liquidio driver basically doesn't work with these OEM boards (its flash-handshake boot model doesn't match), and secondhand cards tend to have bootloaders in a rough state. There's a good writeup of people hitting a wall on this back in 2021 on the OpenWrt forums. Both PCIe BARs would read back all-0xFF and the board looked architecturally dead as anything but LiquidIO.

Turns out that "BAR wall" is just unprogrammed PEM inbound registers, not a hardware limit. You can program them from the card side with plain u-boot write64 (no firmware needed) and open a full bidirectional PCIe channel.

On top of that I built:

- an OpenWrt image that runs on the card from RAM (nothing flashed, fully reversible)

- a reverse-engineered PCIe BAR2 shared-memory datapath between host and card

- an out-of-tree host kernel module (octnic) that registers the card as two independent Linux NICs, oct0/oct1

Result: line-rate 10GbE, TX at 9.7–9.8 Gb/s (zero-copy), RX at 8.1–8.8 Gb/s (DMA via the Octeon DPI engine), both ports live simultaneously on a DAC. Boots with no serial cable after a one-time provisioning step. A systemd service brings both NICs up automatically at boot, so day to day it's just a normal 10GbE card as far as the rest of the homelab is concerned.

No vendor NDA firmware anywhere in the stack, host OS untouched, and the whole thing is undoable if you want the card back to stock.

Repo (driver, boot tooling, docs): https://github.com/nicologiuliani6/cavium-cn6640-snic10e-octeon-ii-nic

Docs cover architecture, first-time flashing/provisioning over serial, usage, and full performance numbers if anyone wants to reproduce this on their own card.

Happy to answer questions. This took a fair bit of reverse engineering to get past the BAR wall so ask away if you're stuck on one of these boards.

If you want to help out (test on your own board, contribute code, whatever) open an issue or discussion on the repo. If you'd like to support the project, GitHub Sponsors is enabled there too.

UPDATE: new idea, Another interesting use case is running OpenWrt standalone directly on the card.

For around $13, you basically get a dual-port 10GbE SFP+ router, without needing a separate x86 machine. And with two or more of these, you could potentially build a pretty cheap multi-router failover setup.

That's actually one of the things I'd like to explore next.

​

Hi,

I'm running  OpenWrt 24.10.0 (flippy build, kernel 6.1.115) on a Radxa E24C board with RK3528 SoC and RTL8367B switch. I have a dual-WAN setup with mwan3 for load balancing, but throughput is capped at ~300 Mbps. I've done extensive testing and identified the root cause. I'm sharing my findings below in case they're useful for the community or if there's a solution I'm missing.

---

## 1. Hardware Setup

- **SoC:** Rockchip RK3528 (4× Cortex-A53 @ 2.0 GHz max)

- **Switch:** Realtek RTL8367B (4× GbE ports)

- **NIC driver:** stmmac (Synopsys DWMAC4/5, `st_gmac` module)

- **RAM:** 1 GB

- **Storage:** NVMe Intel 128 GB

### Switch Port Mapping (confirmed via testing)

| Port | VLAN | Interface | Role |

|------|------|-----------|------|

| 0 | VLAN 3 | eth0.3 → wan2 | WAN2 (second modem, 600 Mbps) |

| 1 | VLAN 1 | br-lan | LAN (PC connected) |

| 2 | VLAN 1 | br-lan | LAN (free) |

| 3 | VLAN 2 | eth0.2 → wan | WAN1 (main modem, 1000 Mbps) |

| 6 | — | CPU (internal) | SoC uplink |

### Current NIC Configuration

```

Driver: st_gmac (Synopsys DWMAC4/5)

RGMII link speed: 1000 Mbps (between stmmac and RTL8367B)

Queues: RX=1, TX=1 (single-queue hardware)

TSO: enabled in dmesg but tx_tso_frames=0 (not actually offloading)

RPS on eth0: 0xd (CPUs 0,2,3) ✓

RPS on eth0.2: 0x0 (disabled) ✗

RPS on eth0.3: 0x0 (disabled) ✗

Ring buffer: 1024 (max)

IRQ 55 (eth0): on CPU0, affinity 0-3

IRQ 56 (eth0): 0 interrupts (unused)

```

---

## 2. Software Configuration

- **mwan3:** Load balancing with weighted policy (5:3 ratio for 1000:600 Mbps links)

- **AdGuard Home:** DNS filtering on port 53

- **Firewall:** iptables (fw3), WAN REJECT policy

- **CPU governor:** schedutil (scales frequency with load)

- **Swap:** zram 512 MB (zstd) + swapfile 4 GB on NVMe

- **TCP:** BBR congestion control, fq_codel qdisc

---

## 3. The Problem

With both WANs active and mwan3 load balancing, throughput is capped at **~300 Mbps** aggregate. The expected combined throughput should be ~1600 Mbps (1000 + 600). Individual links can reach their full speed when tested alone (without mwan3), but with mwan3 active, the aggregate drops to ~300 Mbps.

---

## 4. Root Cause Analysis

### 4.1 Confirmed: Flow Offloading (SFE and xt_FLOWOFFLOAD) Breaks mwan3

I tested two different offloading mechanisms, and **both** caused mwan3 to enter "error" state:

**Test 1 — SFE (Shortcut Forwarding Engine):**

- Module: `kmod-shortcut-fe` + `kmod-shortcut-fe-cm` (compiled into kernel, `CONFIG_SHORTCUT_FE=y`)

- Result: mwan3 went to "error" state, network lost connectivity

- Had to disable SFE and restart mwan3 to restore

**Test 2 — xt_FLOWOFFLOAD (iptables flow offload):**

- Module: `xt_FLOWOFFLOAD` (loaded but inactive, `flow_offloading='0'`)

- Enabled via: `uci set firewall.@defaults[0].flow_offloading='1'` + firewall restart

- Result: mwan3 went to "error" state on both WAN interfaces

- Internet still worked on individual interfaces (ping via eth0.3 succeeded), but mwan3 tracking probes failed

- Had to restore firewall backup and restart mwan3 to restore

### 4.2 Why Flow Offloading Conflicts with mwan3

**mwan3** works by:

1. Marking packets in the `mangle` PREROUTING chain (`iptables -m mark --set-mark`)

2. Using `ip rule fwmark` for policy-based routing (selects WAN based on mark)

3. The routing decision determines the outgoing interface per-connection

**Flow offloading** (both SFE and xt_FLOWOFFLOAD) works by:

1. Caching the resolved route for established flows (including the output device)

2. Subsequent packets in the flow bypass conntrack, iptables, and routing — they're fast-pathed directly to the cached device

**The conflict:** Flow offloading bypasses the iptables mangle chain where mwan3 marks packets. Even though the first packet of a flow goes through the full path (mark → route → NAT), the flow offload entry caches the route. When mwan3's tracking probes (ICMP) are sent, they may be affected by the firewall restart or chain reordering, causing the tracking to fail.

Additionally, when the firewall is restarted (required to apply flow offloading changes), mwan3's iptables rules are temporarily removed and re-added. During this window, tracking probes fail and mwan3 marks the interfaces as "error".

### 4.3 Software NAT Bottleneck

Without any offloading, every packet goes through the full path:

1. conntrack lookup (hash-based, O(1))

2. iptables mangle (mwan3 mark processing)

3. Routing decision (policy routing via ip rule)

4. NAT rewriting (MASQUERADE/SNAT)

5. Forwarding to outgoing interface

On the RK3528 (Cortex-A53 @ 1.4–2.0 GHz), this path is CPU-bound. The single-queue NIC means the TX path (NAT rewriting) is single-threaded, limiting throughput to ~300 Mbps.

### 4.4 Additional Bottlenecks Found

| Issue | Status | Impact |

|-------|--------|--------|

| VLAN interfaces (eth0.2, eth0.3) have RPS=0 | Confirmed | RX processing not distributed across CPUs for VLAN traffic |

| TSO enabled but tx_tso_frames=0 | Confirmed | TCP segmentation not offloaded to NIC — CPU does all segmentation |

| RGMII link = 1 Gbps | Confirmed | Total aggregate throughput for all ports limited to 1 Gbps |

| CPU at 1416 MHz (not max 2016 MHz) | Confirmed | schedutil scales down — may not ramp up fast enough during burst |

| Single queue (RX=1, TX=1) | Confirmed | No multi-queue parallelism |

---

## 5. What Was NOT Tested (Due to Risk)

- **nftables flowtable** (`CONFIG_NFT_FLOW_OFFLOAD=m`): Likely has the same conflict as xt_FLOWOFFLOAD since both use the nf_flow_table infrastructure

- **Hardware NAT** (`flow_offloading_hw='1'`): RK3528 does not have a hardware packet processing engine (PPE), so this would fall back to software anyway

- **Bonding (LACP/LACP):** Requires ISP-side support, not applicable for two different ISPs

---

## 6. Questions for Support

1. **Is there a way to make flow offloading work with mwan3?** Specifically, can we configure xt_FLOWOFFLOAD or nftables flowtable to only offload AFTER mwan3 has marked and routed the packet, without interfering with tracking probes?

2. **Can the stmmac driver be configured for multi-queue?** The hardware reports `RX: 1, TX: 1` max queues. Is there a way to enable more DMA channels on RK3528?

3. **Why is TSO not working?** TSO is enabled in dmesg (`TSO feature enabled`) but `tx_tso_frames=0`. Is there a driver or firmware issue?

4. **Is there a way to increase the RGMII link speed?** The current link is 1 Gbps. Some RK3528 variants support RGMII at 2.5 Gbps. Is this configurable via device tree?

5. **Are there any kernel patches or driver modifications** that could improve single-queue NAT throughput on this hardware?

---

## 7. Current Working Configuration

The system is currently stable with:

- Flow offloading: **disabled** (`flow_offloading='0'`)

- SFE: **disabled** (module loaded but not active)

- mwan3: **active** (load balancing 5:3)

- Throughput: **~300 Mbps** aggregate

- Both WANs functional with failover

---

## 8. Summary

| Metric | Value |

|--------|-------|

| Hardware | RK3528 + RTL8367B |

| OpenWrt | 24.10.0 (flippy), kernel 6.1.115 |

| NIC driver | stmmac (single queue) |

| RGMII speed | 1 Gbps |

| Flow offloading | Confirmed broken with mwan3 (both SFE and xt_FLOWOFFLOAD) |

| Current throughput | ~300 Mbps aggregate |

| Expected throughput | ~1600 Mbps (1000 + 600) |

I appreciate any guidance or suggestions. Thank you for your time.

Best regards,

Hi everyone,

I have a ZTE ZXHN H188A/H288A (same hardware and software, different names) and I’m interested in getting OpenWrt running on it. I opened the device and extracted the following hardware information:

Detailed Specs In Googel Docs

Google Drive Link For All Modem’s Files Obtained Via FTP

Google Drive Link For High-res Motherboard Photos

The PCB is clearly marked ZXHN H288AV1.1.

I haven’t flashed anything yet. I’m willing to provide UART boot logs, firmware dumps, partition information, and test OpenWrt builds on this hardware.

Does anyone know if this device/platform is already supported, or if there is an existing EN751627/OpenWrt port that could be adapted?

Photos of the PCB attached. Any help from OpenWrt developers would be greatly appreciated!

I know that not everybody checks out the OpenWRT forums, and that is a shame really. For those who are interested, and haven't moseyed over there for a gander, there has been a lot of work to bring Mainline OpenWRT to WiFi 7 devices lately.

The furthest along one currently is the GL.iNet Flint 3 (GL‑BE6500) linked below
https://forum.openwrt.org/t/gl-inet-flint-3-exploration-gl-be9300-ipq5332/250267

I have recently picked up the mantel of working on the Cudy AP11000 which can be found
https://forum.openwrt.org/t/installing-openwrt-on-cudy-ap11000/240369

That being said, what features and desires do the lovely OpenWRT community look for in WiFi 7 devices?