OpenWrt

For some time, I have been covering topics concerning OpenWrt on my website. One of the primary interests among my users has been the implementation of WireGuard and adding a Cloudflare WARP tunnel, as well as managing multiple internet connections on a single router.

What I have not yet covered is how to conditionally route traffic once we have established two internet connections, or when we have added a virtual connection (such as a VPN) to the router on a single physical connection.

While firewall rules can be used to route traffic, they are not always straightforward to implement; consequently, I looked for an alternative solution.

I was particularly interested in being able to quickly configure a router to direct traffic from a specific device over a VPN tunnel whenever necessary. To assist with this, I looked into the PBR (Policy-Based Routing) package.

In the past, I have followed a method of updating OpenWrt devices with an option to restore all installed packages and their configurations without needing to spend hours on reconfiguring and testing everything.

This method uses a simple script run in the terminal to generate a list of installed packages, followed by a web interface to generate a backup file used to restore everything.

As long as the backup file is generated correctly, the restoration process works well, but the problem arises when it isn’t!

On several routers with OpenWrt (24.10.x) that I worked with over recent weeks, I experienced a strange issue that caused me to rethink how I generate a backup file to later use to restore all packages and settings after updating OpenWrt to the latest version.

I discovered this issue the hard way when I wanted to extract a backup to retrieve some configuration from individual files. I noticed that the backup failed to extract correctly.

The day has come when my £25pm Toob Fibre 900/900Mbps, via CityFibre infrastructure, was finally installed.

After all the wiring was done, the new Toob router was connected, and I started testing.

To my surprise, Toob switched to a different Linksys Velop model than I initially expected. I have been supplied with Linksys SPNMX56 (SPNMX56TB to be exact), which, by default, comes with a 2.5 Gbps WAN port.

From my previous post, where I chose £40 Linksys MX4200 as my next router, I did an analysis of my needs, and I concluded that I am fine with a 1Gbps WAN port. Toob’s approach to go with 2.5Gbit is more future-proof thinking. If they want to offer higher plans, they will not need to replace hardware. For my needs and 900Mbps connection, the 1Gbps (1000Mbps) port is more value for money.

In my previous post, In search of the perfect OpenWrt router, I discussed my potential future router. When I started researching it more thoroughly, I paused purchasing the Brume 2 and tried to think of what would be better.

I looked into the Brume 2 when I began researching a potential change of broadband provider from Virgin Media to a full (synchronous) fibre connection (CityFibre).

With the provider (reseller) that I am currently considering (Toob), a 900/900Mbps connection offered the best value for money (£25 per month with no price increases over the whole contract period). However, to achieve that speed, they need to provide me with the right hardware.

I’ve noticed that most resellers of CityFibre services utilise Linksys devices, particularly the MX4200 in its second version (v2). This model is sometimes branded as the Linksys Velop MX4200 (AX4200) or ISP-branded as the Linksys SPNMX42, which is simply a v2 in disguise. However, Linksys has already discontinued this device.

Recently, I faced an issue with mwan3, a package on OpenWrt routers that is designed to manage multiple internet connections, either for load balancing or a failover.

At work, we have two fibre connections, where the main one is used primarily and the second is online, but only activated when the first goes down – typical failover approach.

First connection (lets call it fibre) is with metric 10 wheras second connection (fibre2) is with metric 20.

For tech guys, first fibre is uncontended with static IP, whereas our backup fibre is contended over PPPoE.

My main policy in mwan3 is fibre_fibre2.

fibre_fibre2 policy contain fibre_m1_w3 (Metric 1, Weight 3) and fibre2_m2_w2 (Metric 2, Weight 2) member.

When fibre is down, the fibre2 takes over and all traffic flows through nicely, almost.

A router with custom firmware (OpenWrt) is a basic device on my home network, but I am also using it in the business environment as a main device, and all works great.

In the past I used DD-WRT on my routers. Despite that their project is still ongoing, I found it lacking behind current needs.

OpenWrt use strictly depends on the device – router, that I am using. I always choose a device that will work for me and it will not bend under spikes of load.

Cloudflare, let’s be honest, is an incredibly generous organization, offering a range of services that we rarely have to pay for. Individuals, families, small or medium-sized businesses can use their technology without having to spend money unless they need to.

Among the range of services, DNS servers (1.1.1.1) and DNS encryption service deserve recognition. In combination with their software available on a range of platforms, not only can we speed up our internet surfing, but we can also increase our security.

OpenWrt on the other hand is an incredible software designed to increase the security of our network device, which is the router, and also adds the ability to expand the capabilities of our hardware.

By combining Cloudflare with OpenWrt software and an additional software package, we can introduce Secure DNS to our network, which I wrote about some time ago.

Moreover, when we need to access our local network resources from anywhere in the world, we can use the Cloudflare Zero Trust service by creating a secure tunnel.

Zero Trust, offered as part of our Cloudflare account (and in the free version), is not just a “VPN” tunnel. Zero Trust also offers a number of other options. One of them is the ability to create “your own” secure DNS server.

If you follow my website and posts related to OpenWrt you have probably come across my post about installing a VPN server on an OpenWrt router using WireGuard.

WireGuard is one of the fastest protocols available for creating a VPN connection. Thanks to it, from the Internet, we can easily connect to our network and use it, either for local purposes (access to a printer or network drive) or to limit regional restrictions. Being outside the country, I can connect to my router at any time and my device will appear on the Internet as if it were where the router is, i.e. in the UK.

Do you encounter a problem that your router slows down from time to time? Websites that usually open very quickly suddenly slow down. It’s not always your internet connection’s fault. Sometimes the fault lies with the router.

Have you ever struggled to measure the true speed of your internet?

Each router is different, and additionally, WiFi wireless networks come in different standards, on different frequencies and offering different speeds depending on external factors.

If our computer has a card that only supports 2.4GHz at a speed of 54Mbps, we can have 100, 200 or more Mbps, and we will not go faster than 54Mbps.

Some 2.4GHz networks can even offer 300Mbps. In the case of 5GHz and speeds go up significantly. This does not mean that we are always able to achieve the offered speed.

If we have 3 devices that actively use the WiFi network, the network capacity, i.e. the maximum speeds we can achieve, is also divided by three.

Therefore, to properly measure the internet speed, you would need to connect directly, preferably by cable, to the router and be the only user for whom the entire bandwidth would be available.

If you have a router with OpenWrt software, you can measure the connection speed directly from the router, bypassing all users.