OpenWrt, without losing your network

01Features

OpenWrt, feature by feature.

Everything new in 25.12

• 24.1025.12

  OpenWrt 25.12 “Dave’s Guitar”

  Out since March 2026; 25.12.6 is the current service release. Over 2200 supported devices.

• opkg install→apk add

  apk replaces opkg

  New package format and new commands. Don’t mix them with 24.10.

• • linux6.6→6.12
  • gcc13.3→14.3
  • binutils2.42→2.44

  Kernel 6.12, newer toolchain

  Linux 6.6 → 6.12, GCC 13.3 → 14.3. Kernel modules must match.

• /etc/config/firewall/etc/config/dhcp/etc/config/wireless/etc/config/networkuci commit

  UCI: one config system

  Every service reads /etc/config. LuCI edits the same files.

• lanwan✓

  wanlan✕

  nftables · fw4

  firewall4 on nftables

  Default since 22.03. Same zones, same UCI syntax.

• br-lan VLAN 1 · 3lan1lan2lan3lan4

  DSA switch ports

  Each port is a Linux interface; VLANs live on br-lan.

• wg0

  WireGuard in the kernel

  Mainline since Linux 5.6; configured as a network interface.

• • fifo
  • cake
  • latency under load

  SQM with CAKE

  Keeps latency low under load. Start at 90% of measured speed.

• 192.168.1.1

  Failsafe and sysupgrade

  A boot-time way back on 192.168.1.1; upgrades keep config.

02Before step one

Every guide opens with the same five facts.

Most broken home networks start with a command copied from the wrong firmware. So each page says what it was written against, where each command runs, and how you get back if it goes wrong.

env · network/dns

Firmware

OpenWrt 25.12.624.10 differences called out inline

Device

x86 VM on PVE 9.2hardware revision when it matters

Package manager

apkopkg commands kept separate

Runs in

Router shell · LuCI · Computermarked on every step

Way back

backup.tar.gz + failsafewritten before the change, not after

03Guides

Start from the job in front of you.

01

Getting Started

6 pages

• Download OpenWrtE1
• Overview
• First LuCI loginE2
• Which OpenWrt?E1
• Firmware downloadE1
• x86 imageE2

02

Network

6 pages

• DNSE2
• IPv6E2
• LAN addressE2
• WAN connectivityE2
• Bypass gatewayE2
• Wired/wireless APE2

03

Wireless & VLAN

2 pages

• DSA VLANE1
• Guest Wi-FiE1

04

Remote access

2 pages

• WireGuard serverE2
• WireGuard clientE2

05

Installation

1 page

• ProxmoxE2

06

Software

5 pages

• AdGuard HomeE2
• SQM / CAKEE2
• OpenClashE2
• Package sourcesE2
• apk vs opkgE2

07

Upgrade & recovery

2 pages

• Backup and restoreE2
• Firmware upgradeE2

04Something broken right now?

Start from the symptom.

Each triage page works layer by layer and keeps the console route open, so a reset is the last resort.

root@OpenWrt:~# logread -e error

1. cannot open 192.168.1.1login page times outlost access after LAN change→Cannot reach LuCIIP, port, DHCP and console recovery
2. apk add failsno LuCI menudependency not satisfied→Package will not installdownload, architecture, dependencies, LuCI and postinst
3. all devices offlineonly one device offlineping IP works but web fails→No internet or intermittent dropsall devices, one client, one app

05Evidence levels

We label how sure we are.

A page only says “tested” when a fixed recipe has been run. Real-hardware claims such as throughput and coverage wait for E3.

1. E14

   Read from official docs

   Specs and documentation, not yet run in our lab.

2. E221

   Reproduced in a lab VM

   A fixed recipe run step by step on OpenWrt x86 under PVE.

3. E30

   Measured on real hardware

   Physical routers and real networks. None published yet.

06One habit

Make a backup before you change anything.

It takes a minute in LuCI or one sysupgrade command, and it is the difference between a rollback and a reinstall.

Backup and restoreFirmware upgrade