7 ms·

I'm a staunch defender of OpenWRT. Having used just about every "router distro" folks care to name (remember SmoothWall?) for the last 20~ years, OpenWRT is bui

I'm a staunch defender of OpenWRT. Having used just about every "router distro" folks care to name (remember SmoothWall?) for the last 20~ years, OpenWRT is built like a tank and just keeps trundling along I hope their experiments with the "OpenWRT One" keep going. I'd love to see OpenWRT take a (deserved) bite out of the "SMB firewall vendors" like Netgate or OPNsense. Or just undercutting Wi-Fi vendors like Ubiquiti who base their work on OpenWRT anyway Something I'm excited to try myself in future is running "OpenWISP" [1] to manage a small fleet (three) OpenWRT devices in parallel for a deployment in a shared workshop. This seems to also be something that OpenWRT could be better at integrating, but it's nice to see "a vendor" tackling it [1] https://openwisp.org/ https://openwisp.org/

whalesalad 1y ago
Related, I used to love going to the monowall website gallery to see all the labgore. It's still there like a time capsule: https://m0n0.ch/wall/gallery.php https://m0n0.ch/wall/gallery.php
foepys 1y ago
OpenWISP states in its docs that you should be running at least 20 devices to make it worth it. [1] So it's not supposed to be a easy way to manage a few devices for home users. > However, OpenWISP may not be the best fit for very small networks (fewer than 20 devices), organizations lacking IT expertise, or enterprises seeking open-source alternatives solely for cost-saving purposes. 1: https://openwisp.org/faq/#suitable https://openwisp.org/faq/#suitable
- CursedSilicon 1y ago
  I saw that. Admittedly I'm only interested in a few of its functions. Namely roaming and guest hotspots I could wire up all of that manually. But I'm excited for the chance to learn something new
- rubenbe 1y ago
  It's for exactly that reason I started with OpenSOHO. It is targeted towards the typical home and small office network with less than 20 OpenWRT devices. (although there is no hard limit). https://github.com/rubenbe/opensoho https://github.com/rubenbe/opensoho It is still a work in progress, but it is easy to deploy (one golang binary based on pocketbase)
  - CursedSilicon 1y ago
    This looks a lot closer to what I'm after. Bookmarked the git repo :)
  - pseudosavant 1y ago
    Very interesting project! I was thinking of something that would fill this gap. Based on your experience, as OpenSOHO seems to use OpenWISP, what do you wish you knew about OpenWISP before you started this?
    - rubenbe 1y ago
      Initially I fiddled a bit with full Open wisp stack to try to make a smaller edition. But I quickly stopped that. But I know their two daemons well. The config one is a neat little piece of software. It will merge UCI configs and check the connectivity. You can adjust virtually any file with it (although not always with merging). My main issue with it is that it can't be easily temporary disabled from the central controller (I currently implement it by not sending the config, but that triggers retries on the AP end) The monitoring one spits out an amazing amount of data, although it needs some post processing to make it actually useful. Unfortunately that one can't be extented to add custom entries. I'm currently missing an easy way to see which MAC address is connected which LAN port since OpenWRT DSA puts everyone one the "br-lan". The whole thing is polling based. So it is quite chatty on the network since I use lower polling rates to make the updates fast. (I suspect on a setup with 100+ you will have longer polling times). All in all the existence of these daemons saved me a ton of time handling networking corner cases. Kudos to the Openwisp team.
      - 1y ago
zokier 1y ago
I hope OpenWrt doesn't turn too commercial (like Netgate or opnsense) because that leads just to subscriptions, enshittification, feature gates, and drama. It is now in a good place as a solid platform to build upon, I hope it stays that way.
- nicce 1y ago
  If they had their money from hardware only, would that be the perfect route?
  - pseudosavant 1y ago
    Selling hardware, or consulting services.
fidotron 1y ago
I definitely believe people underestimate the potential of OpenWRT as an app platform. Before getting sidelined with work I did some proof of concept WebRTC SFU on it https://github.com/atomirex/umbrella https://github.com/atomirex/umbrella which worked surprisingly well. Was also surprised, then not surprised, to learn it's used as the front end on many of the new generation of 3D printers.
- jasonjayr 1y ago
  I have a bunch of old WD MyBook Live NAS drives (PowerPC CPU) from an older project, and was surprised that OpenWRT was the best way to get a modern linux on them: https://openwrt.org/toh/western_digital/mybooklive https://openwrt.org/toh/western_digital/mybooklive They're slow, but great for stuff that doesn't need to be fast.
pseudosavant 1y ago
Ease of managing multiple OpenWRT devices is still its weakest link. OpenWRT is device centric, but I don't want to managed devices, I want to manage a network. Modern mesh WiFi systems I've seen do that so well. I know in theory that I could create a VLAN + SSID on my OpenWRT router and APs just for iot devices to only access the internet. But setting that up on a TP-Link mesh was a couple of taps in their app. Doing it on my OpenWRT devices would be quite a bit more hassle.
- pseudosavant 1y ago
  Thinking about this more, I doubt I'll setup any OpenWRT APs on my network going forward. Most of the things I like about OpenWRT, and need it for, are related to being my router. My OpenWRT APs are just "dumb" APs. Wifi is off on the router. For the APs, I could use a mesh kit like the TP-Link Deco unit I installed for a friend recently. Super easy setup, reasonable price (cheaper than equivalent OpenWRT hardware I'd buy), wired backhaul up to 2.5Gbps.
  - elliotf 1y ago
    To offer a contrasting viewpoint, I don't have openwrt as my router, but only have openwrt APs, because it's the best and cheapest way to have VLAN support in my APs, keeping iot and guest VLANs separate from my main network.
- deleted 1y ago
  [deleted]
- m463 1y ago
  There might be a workaround for some people - get a big openwrt switch. Openwrt supports the zyxel gs1900 switch, which goes up to 48 ports.
neilv 1y ago
At home, I built an OPNsense box to evaluate (using Sophos XG135 Rev 3 hardware, along with an OpenWrt nice Netgear WiFi AP on POE), but then went back to a plastic OpenWrt all-in-one box. OPNsense (and pfSense) are neat, but I personally don't need an IDS/IPS right now, and I like to be able to run the router fanless. One thing that OpenWrt could use immediately, for basic home WiFi router functionality, is easier ways to add guest-like VLANs from the Luci Web-based admin UI. (I currently have a guest VLAN config that I partly cargo-culted with numerous steps in Luci years ago, largely based on a blog post, and that would be a pain to reconstruct on a new install.) For techies whose households include non-techies, a little IDS/IPS could help keep some nasty traffic off your home Internet pipe, and I suppose that could now run alongside OpenWrt on some of the more powerful plastic boxes, or on a PC with the right WiFi devices/APs. (In addition to use of VLANs and routing to minimize damage from all the malware-infested devices, and also thinking "zero trust" for the techie stuff you run.)
- tw04 1y ago
  >I like to be able to run the router fanless. You don't need a fan for OPNsense or pfSense? Plenty of folks running protectli boxes without a fan, they're one of the most popular platforms for both OS'
  - gonzopancho 1y ago
    the entire desktop line from Netgate is fanless.
    - brirec 1y ago
      Netgate are _terrible_ at open source, though — they’re shit at accepting contributions, they’re shit at providing attribution, and they’re shit at providing any support whatsoever to anyone who prefers other hardware (even with their paid software). So I really can’t say I recommend their hardware…
      - gonzopancho 1y ago
nottorp 1y ago
We once delivered a totally not router box running openwrt, just because it was very simple and bastardising openwrt was easier than yocto.
hungmung 1y ago
> I hope their experiments with the "OpenWRT One" keep going. OpenWRT Two is scheduled for late 2025 from GL.iNet and should go for ~$250. https://news.ycombinator.com/item?id=43512495 https://news.ycombinator.com/item?id=43512495
- trelane 1y ago
  I read about this on lwn and am pretty excited for it.
  - hungmung 1y ago
    I've been happy with the One, but two Ethernet ports is definitely not ideal for even casual home use.
    - trelane 1y ago
      I need more, but a switch isn't hard to get. In fact, I mainly plan to use these solely for wifi, and have a more advanced, high-bandwidth switch setup.
gonzopancho 1y ago
> I'd love to see OpenWRT take a (deserved) bite out of the "SMB firewall vendors" like Netgate I'll just leave this here: https://www.netgate.com/blog/pfsense-software-embraces-change-a-strategic-migration-to-the-linux-kernel https://www.netgate.com/blog/pfsense-software-embraces-chang... OPNsense are unlikely to be able to make this transition, as they can't even reliably work on the FreeBSD kernel.
- CursedSilicon 1y ago
  Oh, was that before or after you spent however long spreading FUD by stealing their domain? The one that OPNsense had to go to the WIPO to fix? https://web.archive.org/web/20160314132836/http://www.opnsense.com/ https://web.archive.org/web/20160314132836/http://www.opnsen...
  - gonzopancho 1y ago
    nobody stole anything.
    - CursedSilicon 1y ago
      Why do you lie about things that are so easily provable? https://www.wipo.int/amc/en/domains/decisions/text/2017/d2017-1828.html https://www.wipo.int/amc/en/domains/decisions/text/2017/d201...
      - gonzopancho 1y ago
        I'm not lying. From the URL --- The Complainant is the owner of the European Union trademark registration Nos. 012771457 for OPNSENSE (figurative mark), filed on April 8, 2014 and registered on August 20, 2014, for goods in class 9, and 016287716 for OPNSENSE (word mark), filed on January 26, 2017 and registered on May 9, 2017, for goods in class 9. The Complainant also owns the domain name <opnsense.org>, registered on September 4, 2014, at which it promotes and enables users to download its open-source OPNSENSE firewall. The disputed domain name <opnsense.com> was registered on April 8, 2014, and is not pointed to an active website. --- I want you to look closely at the date April 8, 2014, and then I want you to look for anything that occurred before that date, vs. all that occurred after.
tw04 1y ago
>I'd love to see OpenWRT take a (deserved) bite out of the "SMB firewall vendors" like Netgate or OPNsense. Or just undercutting Wi-Fi vendors like Ubiquiti who base their work on OpenWRT anyway Why? You don't want competition in the space? >Or just undercutting Wi-Fi vendors like Ubiquiti who base their work on OpenWRT anyway Huh? The older edgerouters were based on vyatta. The newer ones on a custom linux distro, neither of which are OpenWRT. They hired the original author of pfsense to build them a firewall based on Debian from scratch when they realized vyatta wasn't going to meet their needs. The UDM kernel is very much not OpenWRT https://github.com/fabianishere/udm-kernel https://github.com/fabianishere/udm-kernel Being excited about OpenWRT is great but spreading bad information and for reasons I can't fathom hoping for the downfall of other players in the market, not so much.
- gonzopancho 1y ago
  > They hired the original author of pfsense to build them a firewall based on Debian from scratch when they realized vyatta wasn't going to meet their needs. The UDM kernel is very much not OpenWRT You're (perhaps unintentionally) also spreading bad information here. The original 'author' of pfSense was Scott Ullrich, not Chris Buechler. While they were partners in the project, Scott was technical, and Chris did a lot of work back then on documentation, by by his own admission back then, "I am not a developer", and this, even though he was CTO. http://freesoftwaremagazine.com/articles/interview_with_jeff_starkweather_chris_buechler_and_scott_ullrich/ http://freesoftwaremagazine.com/articles/interview_with_jeff... Ubiquiti originally hired two of the devs out of Vyatta to maintain their fork of the Vyatta codebase. These two were known on the Ubiquiti forum as 'stig' and 'An Chen'. Both left in the first half of 2016, and then (and only then) did Ubiquiti hire Chris Buechler, in an attempt to maintain and extend the Ubiquiti firmware. Chris has since left Ubiquiti and is now at Alta Labs.
1vuio0pswjnm7 1y ago
"Or just undercutting Wi-Fi vendors like Ubiquiti who basse their work on OpenWRT anyway." Not sure about today, but this company used to sell hardware whose capabilities were IIRC only "fully enabled" if the buyer used the company's closed source OS. An open source OS might work with the hardware but the buyer would not get the same performance. At the time, the HN comments continuously supported this company. It appeared that for these commmenters, this was a worthwhile sacrifice. They would just keep recommending Ubiquiti. (Unsolicted recommendations)
- deleted 1y ago
  [deleted]
brirec 1y ago
> vendors like Ubiquiti who base their work on OpenWRT anyway I thought Ubiquity’s firmwares were all based on Debian. Is this no longer the case?
- bigstrat2003 1y ago
  I don't know about newer devices, but the older ones (the Edge* devices) had software based on Vyatta. Not sure if that was in turn based on Debian, though.
  - gonzopancho 1y ago
    the routers were based on the Vyatta stack. The WiFi APs were not
oso2k 1y ago
I went smallwall after m0n0wall was shutdown. I recall the smallwall & smoothwall maintainers briefly considered joining forces.

whalesalad 1y ago

Related, I used to love going to the monowall website gallery to see all the labgore. It's still there like a time capsule: https://m0n0.ch/wall/gallery.php https://m0n0.ch/wall/gallery.php

foepys 1y ago

OpenWISP states in its docs that you should be running at least 20 devices to make it worth it. [1] So it's not supposed to be a easy way to manage a few devices for home users. > However, OpenWISP may not be the best fit for very small networks (fewer than 20 devices), organizations lacking IT expertise, or enterprises seeking open-source alternatives solely for cost-saving purposes. 1: https://openwisp.org/faq/#suitable https://openwisp.org/faq/#suitable

CursedSilicon 1y ago
I saw that. Admittedly I'm only interested in a few of its functions. Namely roaming and guest hotspots I could wire up all of that manually. But I'm excited for the chance to learn something new
rubenbe 1y ago
It's for exactly that reason I started with OpenSOHO. It is targeted towards the typical home and small office network with less than 20 OpenWRT devices. (although there is no hard limit). https://github.com/rubenbe/opensoho https://github.com/rubenbe/opensoho It is still a work in progress, but it is easy to deploy (one golang binary based on pocketbase)
- CursedSilicon 1y ago
  This looks a lot closer to what I'm after. Bookmarked the git repo :)
- pseudosavant 1y ago
  Very interesting project! I was thinking of something that would fill this gap. Based on your experience, as OpenSOHO seems to use OpenWISP, what do you wish you knew about OpenWISP before you started this?
  - rubenbe 1y ago
    Initially I fiddled a bit with full Open wisp stack to try to make a smaller edition. But I quickly stopped that. But I know their two daemons well. The config one is a neat little piece of software. It will merge UCI configs and check the connectivity. You can adjust virtually any file with it (although not always with merging). My main issue with it is that it can't be easily temporary disabled from the central controller (I currently implement it by not sending the config, but that triggers retries on the AP end) The monitoring one spits out an amazing amount of data, although it needs some post processing to make it actually useful. Unfortunately that one can't be extented to add custom entries. I'm currently missing an easy way to see which MAC address is connected which LAN port since OpenWRT DSA puts everyone one the "br-lan". The whole thing is polling based. So it is quite chatty on the network since I use lower polling rates to make the updates fast. (I suspect on a setup with 100+ you will have longer polling times). All in all the existence of these daemons saved me a ton of time handling networking corner cases. Kudos to the Openwisp team.
    - 1y ago

zokier 1y ago

I hope OpenWrt doesn't turn too commercial (like Netgate or opnsense) because that leads just to subscriptions, enshittification, feature gates, and drama. It is now in a good place as a solid platform to build upon, I hope it stays that way.

nicce 1y ago
If they had their money from hardware only, would that be the perfect route?
- pseudosavant 1y ago
  Selling hardware, or consulting services.

fidotron 1y ago

I definitely believe people underestimate the potential of OpenWRT as an app platform. Before getting sidelined with work I did some proof of concept WebRTC SFU on it https://github.com/atomirex/umbrella https://github.com/atomirex/umbrella which worked surprisingly well. Was also surprised, then not surprised, to learn it's used as the front end on many of the new generation of 3D printers.

jasonjayr 1y ago
I have a bunch of old WD MyBook Live NAS drives (PowerPC CPU) from an older project, and was surprised that OpenWRT was the best way to get a modern linux on them: https://openwrt.org/toh/western_digital/mybooklive https://openwrt.org/toh/western_digital/mybooklive They're slow, but great for stuff that doesn't need to be fast.

pseudosavant 1y ago

Ease of managing multiple OpenWRT devices is still its weakest link. OpenWRT is device centric, but I don't want to managed devices, I want to manage a network. Modern mesh WiFi systems I've seen do that so well. I know in theory that I could create a VLAN + SSID on my OpenWRT router and APs just for iot devices to only access the internet. But setting that up on a TP-Link mesh was a couple of taps in their app. Doing it on my OpenWRT devices would be quite a bit more hassle.

pseudosavant 1y ago
Thinking about this more, I doubt I'll setup any OpenWRT APs on my network going forward. Most of the things I like about OpenWRT, and need it for, are related to being my router. My OpenWRT APs are just "dumb" APs. Wifi is off on the router. For the APs, I could use a mesh kit like the TP-Link Deco unit I installed for a friend recently. Super easy setup, reasonable price (cheaper than equivalent OpenWRT hardware I'd buy), wired backhaul up to 2.5Gbps.
- elliotf 1y ago
  To offer a contrasting viewpoint, I don't have openwrt as my router, but only have openwrt APs, because it's the best and cheapest way to have VLAN support in my APs, keeping iot and guest VLANs separate from my main network.
deleted 1y ago
[deleted]
m463 1y ago
There might be a workaround for some people - get a big openwrt switch. Openwrt supports the zyxel gs1900 switch, which goes up to 48 ports.

neilv 1y ago

At home, I built an OPNsense box to evaluate (using Sophos XG135 Rev 3 hardware, along with an OpenWrt nice Netgear WiFi AP on POE), but then went back to a plastic OpenWrt all-in-one box. OPNsense (and pfSense) are neat, but I personally don't need an IDS/IPS right now, and I like to be able to run the router fanless. One thing that OpenWrt could use immediately, for basic home WiFi router functionality, is easier ways to add guest-like VLANs from the Luci Web-based admin UI. (I currently have a guest VLAN config that I partly cargo-culted with numerous steps in Luci years ago, largely based on a blog post, and that would be a pain to reconstruct on a new install.) For techies whose households include non-techies, a little IDS/IPS could help keep some nasty traffic off your home Internet pipe, and I suppose that could now run alongside OpenWrt on some of the more powerful plastic boxes, or on a PC with the right WiFi devices/APs. (In addition to use of VLANs and routing to minimize damage from all the malware-infested devices, and also thinking "zero trust" for the techie stuff you run.)

tw04 1y ago
>I like to be able to run the router fanless. You don't need a fan for OPNsense or pfSense? Plenty of folks running protectli boxes without a fan, they're one of the most popular platforms for both OS'
- gonzopancho 1y ago
  the entire desktop line from Netgate is fanless.
  - brirec 1y ago
    Netgate are _terrible_ at open source, though — they’re shit at accepting contributions, they’re shit at providing attribution, and they’re shit at providing any support whatsoever to anyone who prefers other hardware (even with their paid software). So I really can’t say I recommend their hardware…
    - gonzopancho 1y ago

nottorp 1y ago

We once delivered a totally not router box running openwrt, just because it was very simple and bastardising openwrt was easier than yocto.

hungmung 1y ago

> I hope their experiments with the "OpenWRT One" keep going. OpenWRT Two is scheduled for late 2025 from GL.iNet and should go for ~$250. https://news.ycombinator.com/item?id=43512495 https://news.ycombinator.com/item?id=43512495

trelane 1y ago
I read about this on lwn and am pretty excited for it.
- hungmung 1y ago
  I've been happy with the One, but two Ethernet ports is definitely not ideal for even casual home use.
  - trelane 1y ago
    I need more, but a switch isn't hard to get. In fact, I mainly plan to use these solely for wifi, and have a more advanced, high-bandwidth switch setup.

gonzopancho 1y ago

> I'd love to see OpenWRT take a (deserved) bite out of the "SMB firewall vendors" like Netgate I'll just leave this here: https://www.netgate.com/blog/pfsense-software-embraces-change-a-strategic-migration-to-the-linux-kernel https://www.netgate.com/blog/pfsense-software-embraces-chang... OPNsense are unlikely to be able to make this transition, as they can't even reliably work on the FreeBSD kernel.

CursedSilicon 1y ago
Oh, was that before or after you spent however long spreading FUD by stealing their domain? The one that OPNsense had to go to the WIPO to fix? https://web.archive.org/web/20160314132836/http://www.opnsense.com/ https://web.archive.org/web/20160314132836/http://www.opnsen...
- gonzopancho 1y ago
  nobody stole anything.
  - CursedSilicon 1y ago
    Why do you lie about things that are so easily provable? https://www.wipo.int/amc/en/domains/decisions/text/2017/d2017-1828.html https://www.wipo.int/amc/en/domains/decisions/text/2017/d201...
    - gonzopancho 1y ago
      I'm not lying. From the URL --- The Complainant is the owner of the European Union trademark registration Nos. 012771457 for OPNSENSE (figurative mark), filed on April 8, 2014 and registered on August 20, 2014, for goods in class 9, and 016287716 for OPNSENSE (word mark), filed on January 26, 2017 and registered on May 9, 2017, for goods in class 9. The Complainant also owns the domain name <opnsense.org>, registered on September 4, 2014, at which it promotes and enables users to download its open-source OPNSENSE firewall. The disputed domain name <opnsense.com> was registered on April 8, 2014, and is not pointed to an active website. --- I want you to look closely at the date April 8, 2014, and then I want you to look for anything that occurred before that date, vs. all that occurred after.

tw04 1y ago

>I'd love to see OpenWRT take a (deserved) bite out of the "SMB firewall vendors" like Netgate or OPNsense. Or just undercutting Wi-Fi vendors like Ubiquiti who base their work on OpenWRT anyway Why? You don't want competition in the space? >Or just undercutting Wi-Fi vendors like Ubiquiti who base their work on OpenWRT anyway Huh? The older edgerouters were based on vyatta. The newer ones on a custom linux distro, neither of which are OpenWRT. They hired the original author of pfsense to build them a firewall based on Debian from scratch when they realized vyatta wasn't going to meet their needs. The UDM kernel is very much not OpenWRT https://github.com/fabianishere/udm-kernel https://github.com/fabianishere/udm-kernel Being excited about OpenWRT is great but spreading bad information and for reasons I can't fathom hoping for the downfall of other players in the market, not so much.

gonzopancho 1y ago
> They hired the original author of pfsense to build them a firewall based on Debian from scratch when they realized vyatta wasn't going to meet their needs. The UDM kernel is very much not OpenWRT You're (perhaps unintentionally) also spreading bad information here. The original 'author' of pfSense was Scott Ullrich, not Chris Buechler. While they were partners in the project, Scott was technical, and Chris did a lot of work back then on documentation, by by his own admission back then, "I am not a developer", and this, even though he was CTO. http://freesoftwaremagazine.com/articles/interview_with_jeff_starkweather_chris_buechler_and_scott_ullrich/ http://freesoftwaremagazine.com/articles/interview_with_jeff... Ubiquiti originally hired two of the devs out of Vyatta to maintain their fork of the Vyatta codebase. These two were known on the Ubiquiti forum as 'stig' and 'An Chen'. Both left in the first half of 2016, and then (and only then) did Ubiquiti hire Chris Buechler, in an attempt to maintain and extend the Ubiquiti firmware. Chris has since left Ubiquiti and is now at Alta Labs.

1vuio0pswjnm7 1y ago

"Or just undercutting Wi-Fi vendors like Ubiquiti who basse their work on OpenWRT anyway." Not sure about today, but this company used to sell hardware whose capabilities were IIRC only "fully enabled" if the buyer used the company's closed source OS. An open source OS might work with the hardware but the buyer would not get the same performance. At the time, the HN comments continuously supported this company. It appeared that for these commmenters, this was a worthwhile sacrifice. They would just keep recommending Ubiquiti. (Unsolicted recommendations)

deleted 1y ago
[deleted]

brirec 1y ago

> vendors like Ubiquiti who base their work on OpenWRT anyway I thought Ubiquity’s firmwares were all based on Debian. Is this no longer the case?

bigstrat2003 1y ago
I don't know about newer devices, but the older ones (the Edge* devices) had software based on Vyatta. Not sure if that was in turn based on Debian, though.
- gonzopancho 1y ago
  the routers were based on the Vyatta stack. The WiFi APs were not

oso2k 1y ago

I went smallwall after m0n0wall was shutdown. I recall the smallwall & smoothwall maintainers briefly considered joining forces.