OpenWRT

OpenWrt 是適用於嵌入式裝置的一個Linux發行版。 相對原廠韌體而言，OpenWrt 不是一個單一、靜態的韌體，而是提供了一個可添加軟體套件的可寫的檔案系統。這使使用者可以自由的選擇應用程式和組態，而不必受裝置提供商的限制，並且可以使用一些適合某方面應用的軟體套件來客製化你的裝置。

NanoPi R4S

URLs

Hardware

FriendlyWRT

Install OS

Flash Utility
First Boot

 

Hardware SPEC.

OpenWRT One

URLs

Hardware

Specification
SoC MediaTek MT7981B (Filogic 820) dual-core Cortex-A53 processor @ 1.3 GHz
System Memory 1GB DDR4
Storage
  • 256 MB SPI NAND flash for U-boot and Linux
  • 16 MB SPI NOR flash for write-protected (by default) recovery bootloader (reflashing can be enabled with a jumper)
  • Two types of flash devices are used to make the board almost unbrickable
  • M.2 2242/2230 socket for NVMe SSD (PCIe gen 2 x1)
Networking
  • 1 x 2.5GbE RJ45 port
  • 1 x Gigabit Ethernet RJ45 port
  • Dual-band WiFI 6 via MediaTek MT7976C (2×2 2.4 GHz + 3×3/2×2 + zero-wait DFS 5Ghz)
  • 3x MMCX antenna connectors
USB
  • 1x USB 2.0 Type-A host port
  • USB Type-C (device, console) port using Holtek HT42B534-2 UART to USB chip
Expansion MikroBUS socket for expansion modules
Debugging Console via USB-C port or 3-pin header, 10-pin JTAG/SWD header for main SoC
RTC support RTC onboard
Misc
  • Reset and User buttons
  • Boot select switch: NAND (regular) or NOR (recovery)
  • 2x PWM LEDs, 2x Ethernet LED (GPIO driven)
  • EM6324 External hardware watchdog
  • NXP PCF8563TS (I2C) RTC with battery backup holder for CR1220 coin-cell
Power Supply
  • 15V USB-PD on USB-C port
  • Optional 802.3at/af PoE via RT5040 module
Dimensions 148 x 100.5 mm compatible with Banana Pi BPI-R4 case design
Certifications FCC/EC/RoHS compliance
Interface

banna_pi_openwrt_one_interface.jpg

Installation

Firmware Download
First Power up

第一次啟動時，每台Openwrt One都會根據目前的製造批次日期更新最新的OpenWrt版本韌體。 

  1. 在裝置開機之前，請確認 NAND/NOR 開關設定為 NAND
  2. 透過乙太網路 192.168.1.1 連接到裝置的 1G 連接埠
  3. 開啟裝置電源，等待綠燈亮起表示裝置已開機
  4. 將瀏覽器指向 192.168.1.1 來使用 LuCI GUI，或從終端會話透過 ssh root@192.168.1.1。 

FAQ

Why are there are 2 different flash chips?

The idea is to make the device (almost!) unbrickable and very easy to recover.

What will the M.2 slot be used for?

We will use M.2 with M-key for NVMe storage. There is a work-in-progress patch to make PCIe work inside the U-Boot bootloader. This will allow booting other Linux distributions such as Debian and Alpine directly from NVMe.

Why is there no USB 3.x host port on the device?

The USB 3.x and PCIe buses are shared in the selected SoC silicon, hence only a single High-Speed USB port is available

What is the purpose of the console USB-C port?

Holtek UART to USB bridge with CDC-ACM support on USB-C makes the device ultra easy to communicate with. No extra hardware or drivers will be required. Android for example has CDC-ACM support enabled by default.

What MAC OUI will the device have?

We plan to register an OUI block for OpenWrt which can also be used for other vendor extensions such as Wi-Fi beacon IEs.

What is the purpose of the mikroBUS connector?

mikroBUS was chosen as we wanted to make the hardware extendable. There are dedicated pins for UART, SPI, I2C buses and RST/INT signals. The standard uses regular 2.54 mm pitch connectors (you can use available mikroBUS modules or just connect to it something else, with 2.54 mm jumper cables).

Why have the RTC on board instead of a mikroBUS module?

We believe there are many things a Wi-Fi (or networking in general) device should have on-board by default. Always having a correct time on the device is crucial in many applications, like VPN, DNSSEC, …

Upgrade Firmware

Download

選擇適合機型的韌體

Using LuCI GUI

Using CLI

Command

# example downloading the OpenWrt 15.05 upgrade image for a TP-LINK TL-WR1043ND ver. 1.x router
cd /tmp
wget http://downloads.openwrt.org/chaos_calmer/15.05/ar71xx/generic/openwrt-15.05-ar71xx-generic-tl-wr1043nd-v1-squashfs-sysupgrade.bin
 
# check the integrity of the image file via md5sums (older images)
wget http://downloads.openwrt.org/chaos_calmer/15.05/ar71xx/generic/md5sums
md5sum -c md5sums 2> /dev/null | grep OK
 
# check the integrity of the image file via sha256sums
wget http://downloads.openwrt.org/chaos_calmer/15.05/ar71xx/generic/sha256sums
sha256sum -c sha256sums 2> /dev/null | grep OK
 
# the desired result is that the downloaded firmware filename is listed with "OK" afterwards
 
####################################################
# Initiate sysupgrade with your desired options
# by default ( no -n ) settings are kept
####################################################
sysupgrade -v /tmp/openwrt-15.05-ar71xx-generic-tl-wr1043nd-v1-squashfs-sysupgrade.bin

Using USB drive

OpenWRT One
  1. prepare a FAT32 formatted USB drive that contains the sysupgrade.itb file from either the SNAPSHOT or Release repositories
  2. remove power
  3. insert the USB stick in the Type A USB Port.
  4. make sure NAND boot switch is selected.
  5. press and hold the button on the back side labeled Reset
  6. power up the device. Release the Reset button as soon as all LEDS turn off.
  7. wait for the middle LED to go green.

The device will boot from NAND and the bootloader will reflash the kernel and root filesystem on the NAND.

Network Hardening

Solutions

 

VPN

PPTP

PPTP in LAN not working

LAN 網路的電腦無法連接外網的 PPTP VPN Server

解決：OpenWRT 預設不支援 PPTP 連線，需安裝 kmod-nf-nathelper-extra。

opkg update
opkg install kmod-nf-nathelper-extra

  重啟設備後，重新再試一次。

OpenVPN

OpenVPN Server

Preparation

# Install packages
opkg update
opkg install openvpn-openssl openvpn-easy-rsa luci-app-openvpn luci-i18n-openvpn-zh-tw

Generate PKI (Public Key Infrastructure)

# Configuration parameters
cat << EOF > /etc/profile.d/50-openvpn-easy-rsa.sh
export EASYRSA_PKI="/etc/openvpn/pki"
export EASYRSA_TEMP_DIR=${EASYRSA_TEMP_DIR:-${TMPDIR:-/tmp/}}
export EASYRSA_CERT_EXPIRE="3650"
export EASYRSA_BATCH="1"
EOF
. /etc/profile.d/50-openvpn-easy-rsa.sh

# Remove and re-initialize PKI directory
easyrsa init-pki
 
# Generate DH parameters
easyrsa gen-dh
 
# Create a new CA
easyrsa build-ca nopass
 
# Generate server keys and certificate
easyrsa build-server-full server nopass
openvpn --genkey tls-crypt-v2-server ${EASYRSA_PKI}/server.pem
 
# Generate client keys and certificate
easyrsa build-client-full client nopass
openvpn --tls-crypt-v2 ${EASYRSA_PKI}/server.pem \
--genkey tls-crypt-v2-client ${EASYRSA_PKI}/client.pem

OpenVPN  Service Configuration

  1. LuCI UI → VPN → OpenVPN → Delete : custom_config/sample_server/sample_client
  2. LuCI UI → VPN → OpenVPN → Add : Template based configuration
    • Name : ovpnServer
    • Template : Server configuration for a routed multi-client VPN
  3. LuCI UI → VPN → OpenVPN → Edit : ovpnServer
    • server : 10.9.8.0 255.255.255.0  ( 用戶端 tun 介面網段)
    • ca : /etc/openvpn/pki/ca.crt 
    • dh : /etc/openvpn/pki/dh.pem
    • cert : /etc/openvpn/pki/issued/server.crt
    • key : /etc/openvpn/pki/private/server.key
    • port : 1194
    • proto : UDP
    • dev_type : tun
    • client_to_client : check
  4. LuCI UI → VPN → OpenVPN → Edit : ovpnServer (Advanced configuration)
    1. Cryptography
      • tls_crypt_v2 : /etc/openvpn/pki/server.pem
    2. Networking
      • persist_tun : check
      • persist_key : check
      • topology : subnet
    3. VPN
      • client_to_client : check
      • duplicate_cn : check
      • push : route 192.168.8.0 255.255.255.0  (主機端 LAN 網段)
      • push : redirect-gateway

Firewall Configuration

  1. LuCI UI → Network → Firewall → Traffic Rules → Add: 
    • Name : Allow-OpenVPN
    • Protocol : UDP
    • Source zone : wan/wan6
    • Destination zone : Device (input)
    • Destination port : 1194
    • Action: accept
  2. LuCI UI → Network → Firewall → General Settings → Edit: lan → Advances Settings 
    • Covered devices : tun0

Generate client configuration file

VPN_CONF="/etc/openvpn/client.ovpn"
VPN_SERV="192.168.0.12"
VPN_PORT="1194"
VPN_PROTO="udp"
VPN_TC="$(cat /etc/openvpn/pki/server.pem)"
VPN_KEY="$(cat /etc/openvpn/pki/private/server.key)"
VPN_CERT="$(openssl x509 -in /etc/openvpn/pki/issued/server.crt)"
VPN_CA="$(openssl x509 -in /etc/openvpn/pki/ca.crt)"
cat << EOF > ${VPN_CONF}
remote ${VPN_SERV} ${VPN_PORT} ${VPN_PROTO}
dev tun
nobind
client
auth-nocache
remote-cert-tls server
<tls-crypt-v2>
${VPN_TC}
</tls-crypt-v2>
<key>
${VPN_KEY}
</key>
<cert>
${VPN_CERT}
</cert>
<ca>
${VPN_CA}
</ca>
EOF

Wireguard

Preparation

opkg update
opkg install wireguard-tools kmod-wireguard luci-proto-wireguard qrencode
reboot

Create Wireguard Interface

  1. LuCI → Network → Interfaces → Add new interface
    • Name : Wireguard
    • Protocol : Wireguard VPN
  2. LuCI → Network → Interfaces → Wireguard → General Settings
    • Generate new key pair
    • Listen Port : 51820
    • IP Addresses : 10.9.7.1/24
  3. LuCI → Network → Interfaces → Wireguard → Advanced Settings
    1. Use custom DNS servers : 8.8.8.8
  4. Save & Apply
  5. LuCI → Network → Interfaces → Devices → Configure: Wireguard
    1. Save
  6. Save & Apply

Configure Firewall

  1. LuCI → Network → Firewall → Add zone
    • Name : 
    • Input/Output/Forward : Accept
    • Masquerading : check
    • MSS Clamping : check
    • Covered networks : lan/Wireguard
    • Allow forward to destination zones : wan/wan6
    • Allow forward from source zones : lan
    • Save
  2. Save & Apply

Configure Port Forwarding

  1. LuCI → Network → Firewall → Port Forwards → Add
    • Name : Wireguard
    • Restrict to address family : automatic
    • Protocol : TCP/UDP
    • Source zone : wan/wan6
    • External port : 51820
    • Destination zone : lan
    • Internal IP address : 10.9.7.1
    • Internal port : 51820
    • Save
  2. Save & Apply

Configure Peer Settings

  1. LuCI → Network → Interfaces → Edit: Wireguard → Peers → Add peer
    • Description : My Linux Fedora
    • Generate new key pair
    • Allowed IPs : 10.9.7.2/32
    • Save → Save
  2. Save & Apply
  3. LuCI → Network → Interfaces → Wireguard → Restart
  4. LuCI → Network → Interfaces → Edit: Wireguard → Peers → Edit: My Linux Fedora → Generate Configuration
    • DNS Servers : 8.8.8.8

Wireless

Enable Wi-Fi

LuCI Web → Network → Wireless → Edit :

Additional Software

Network Monitor

nlbwmon
opkg install luci-app-nlbwmon luci-i18n-nlbwmon-zh-tw
Netdata
  1. Add the custom feed: fantastic-packages
  2. Run opkg install luci-app-netdata 

中文化介面

opkg install luci-i18n-base-zh-tw

Themes

Argon
  1. Download *.ipk: https://github.com/jerrykuku/luci-theme-argon 
  2. Install: opkg install luci-theme-argon_2.3.2-r20250207_all.ipk

DDNS

Duck DNS

Install the packages

opkg install ddns-scripts luci-app-ddns
NoIP

Install the packages

opkg install ddns-scripts ddns-scripts-noip luci-app-ddns

Quick Start

DHCP

Enable DHCP Server

LuCI Web → Network → Interfaces → Edit: lan → DHCP Server → General Setup

LuCI Web → Network → DHCP and DNS → General

Disable IPv6 for LAN

LuCI Web → Network → Interfaces → Edit: lan → DHCP Server → IPv6 Settings

DHCP Options

可以指定 IP 配發時的 DNS 位址與 Gateway 位址，且透過 tag 設定，可以設定不同裝置有不同的 DNS 與 Gateway 位址。

LuCI Web → Network → Interfaces → Edit: lan → DHCP Server → Advanced Settings → DHCP-Options

為 IP（裝置）設定 tag

LuCI Web → Network → DHCP and DNS → Static Leases 

Custom Feeds Source

fantastic-packages

/etc/opkg/customfeeds.conf :

# fantastic-packages Packages
# URL: https://github.com/fantastic-packages/packages/tree/gh-pages#readme
src/gz fantastic_packages_luci https://fantastic-packages.github.io/packages/releases/<major.minor version>/packages/<package arch>/luci
src/gz fantastic_packages_packages https://fantastic-packages.github.io/packages/releases/<major.minor version>/packages/<package arch>/packages
src/gz fantastic_packages_special https://fantastic-packages.github.io/packages/releases/<major.minor version>/packages/<package arch>/special

Add usign pub-keys to opkg

KEYID=<KEY-ID>
mkdir /etc/opkg/keys 2>/dev/null
curl -sSL -o /etc/opkg/keys/${KEYID,,} "https://fantastic-packages.github.io/packages/releases/<major.minor version>/${KEYID}.pub"

 

Ad Blocking

廣告封鎖、防釣魚及防惡意網站

AdGuard Home

Adblock-lean