Openwrt Router Firmware

[windwaver]

Main router (eg: 192.168.50.1) -- EA8100 V1 in AP mode with WiFi disabled, static IP address (eg: 192.168.50.240).

EA8100 V1 running OpenWRT and Adblock-fast and maybe also DNS over HTTPS.

Set the main router LAN clients to use 192.168.50.240 as the DNS server.

@xiaofan , which blocklist you suggest using?

 

[xiaofan]

@xiaofan , which blocklist you suggest using?

Just my personal preference.
1) "Hagezi - Pro" or "OISD - Big" as the first one.
2) Then "StevenBlack - Unified hosts" as the second one.

I believe the blocked sites in #2 are already included in #1. So #2 is just a backup in case there is an issue with #1.

 

[windwaver]

Just my personal preference.
1) "Hagezi - Pro" or "OISD - Big" as the first one.
2) Then "StevenBlack - Unified hosts" as the second one.

I believe the blocked sites in #2 are already included in #1. So #2 is just a backup in case there is an issue with #1.

@xiaofan I'm using StevenBlack and seeing the traffic from the log is amazing, the memory and CPU usage is very low even with DoH enabled.

BTW, what kind of ads are we blocking? Seems like some still can get through.

 

[xiaofan]

@xiaofan I'm using StevenBlack and seeing the traffic from the log is amazing, the memory and CPU usage is very low even with DoH enabled.

BTW, what kind of ads are we blocking? Seems like some still can get through.

Some ads like YouTube video ads are difficult to filter out by DNS filtering.

Some websites may detect adblocker and prevent you from viewing the websites.

++++++
From Google AI Summary.
DNS filtering fails on YouTube because YouTube serves ads and video content from the exact same domain (youtube.com), so a DNS-level blocker cannot tell them apart without breaking the video playback itself.

DNS filtering struggles with any ad or content delivery system that hosts its promotional material on the exact same domains used for its primary content, or uses first-party subdomains that mimic regular functionality.

1. In-Stream Sponsored Content & Sponsored Posts

• Social Media Ads: Sponsored posts on Facebook, Instagram, X (Twitter), and TikTok bypass DNS filters. Because these platforms serve ads directly into your feed from their own core servers (e.g., facebook.com), blocking the ad domain means blocking the entire social network.
• Sponsored Search Results: The paid ad results at the top of Google Search or Bing cannot be hidden by DNS filtering, though clicking on them might result in a blocked page if the redirect URL belongs to a known tracking domain.
• Twitch Ads: Like YouTube, Twitch injects ads directly into the live video stream from the same media servers delivering the broadcast.

2. Native First-Party App Tracking & Analytics

• Smart TVs & Streaming Boxes: DNS filters often fail to block tracking and sponsored recommendations built into the home screens of Roku, Fire TV, and Apple TV. Blocking their domains entirely frequently breaks device updates, app stores, or core system functionality.
• Mobile App Telemetry: Many mobile applications bundle their analytics and ads directly into their main server API endpoints, preventing a DNS filter from separating legitimate app data from usage tracking.

3. Circumvention Tactics (Hardcoded DNS)

• Smart Speakers: Devices like Google Nest/Home and Amazon Echo are often hardcoded to bypass your router's DNS settings entirely. They are programmed to query Google's (8.8.8.8) or Amazon's own DNS servers directly, completely ignoring your custom DNS filter unless you set up advanced firewall rules (like LAN redirection) to force them back.
• DoH/DoT Apps: An increasing number of modern apps and browsers use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) by default. If an app uses its own secure, encrypted DNS protocol, it bypasses your local network-level DNS filter entirely.

4. Malicious Content on Legitimate Sites

• Phishing Links on Cloud Services: DNS filters cannot block a phishing page hosted on a legitimate domain like ://google.com or sharepoint.com. If the filter blocks the root domain to stop the scam, it accidentally blocks the entire cloud service for the user.

 

[xiaofan]

I like to use the following website for testing the effectiveness of the blockers.

https://adblock.turtlecute.org/

 

[xiaofan]

More advanced topic:
How to intercept DNS to prevent LAN clients using DoH/DoT from bypassing the DNS filtering.
https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns

banip can be used to block DoH, ASNs and countries
https://openwrt.org/docs/guide-user/services/banip

 

[xiaofan]

Linksys EA7500v2 SAMBA4.
https://openwrt.org/docs/guide-user/services/nas/cifs.server

Somehow my Sandisk USB 3.0 drive does not work with the router USB 3.0 port and only the USB 2.0 port. Therefore read speed is much lower compared to the previous test using Cudy TR3000 using the same model of Sandisk USB 3.0 drive.

Cudy TR3000 USB 3.0 port (2.5Gbe LAN port)
Read speed at 253.41 MB/s.
Write speed at 14.11 MB/s

Linksys EA7500v2 USB 2.0 port (Gigabit LAN port)
Read speed at 24.66 MB/s
Write speed at 20.21 MB/s.

++++++++++++++
It works with the router USB 2.0 port.

root@OpenWrt:~# lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 0781:5591 SanDisk Corp. Ultra Flair
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub

root@OpenWrt:~# block detect | uci import fstab
root@OpenWrt:~# uci set fstab.@mount[0].enabled='1'
root@OpenWrt:~# uci commit fstab

root@OpenWrt:~# cat /etc/config/fstab

config global
        option anon_swap '0'
        option anon_mount '0'
        option auto_swap '1'
        option auto_mount '1'
        option delay_root '5'
        option check_fs '0'

config mount
        option target '/mnt/sda1'
        option uuid 'a4140316-743f-4071-921d-8eac1ef4b22b'
        option enabled '1'

root@OpenWrt:~# reboot

It does not work with the router USB 3.0 port.

root@OpenWrt:~# lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub

Write speed from the Windows LAN client to the Router USB Share drive.

[11:56:41] C:\temp
> $item = Get-Item 'C:\temp\testfile.dum'
[11:56:53] C:\temp
> ls Y:\USBShare\
[11:57:21] C:\temp
> $time = Measure-Command -Expression { Copy-Item -LiteralPath $item.FullName 'Y:\USBShare' }
[11:58:35] C:\temp
>  $TransferRate = ($item.Length / 1MB) / $time.TotalSeconds
[11:58:49] C:\temp
>  Write-Host "Transfer Speed: [ $TransferRate MB/Sec ]"
Transfer Speed: [ 20.2140940235922 MB/Sec ]

Read speed of the Windows LAN client from the Router USB Share drive.

[11:59:21] C:\temp
> cd .\temp1\
[11:59:23] C:\temp\temp1
> $item = Get-Item 'Y:\USBShare\testfile.dum'
[12:00:00] C:\temp\temp1
> $time = Measure-Command -Expression { Copy-Item -LiteralPath $item.FullName 'C:\temp\temp1' }
[12:01:00] C:\temp\temp1
>  $TransferRate = ($item.Length / 1MB) / $time.TotalSeconds
[12:01:06] C:\temp\temp1
>  Write-Host "Transfer Speed: [ $TransferRate MB/Sec ]"
Transfer Speed: [ 24.6619214833733 MB/Sec ]

 

[xiaofan]

Linksys EA7500v2 Wireless Media Bridge speed.

Archer BE805 -- wireless -- Linksys EA7500 v2 OpenWRT (4m away) -- Windows 11 LAN client

Hostname	OpenWrt
Model	Linksys EA7500 v2
Architecture	MediaTek MT7621 ver:1 eco:3
Target Platform	ramips/mt7621
Firmware Version	OpenWrt 25.12.6 r33311-981c978eff / LuCI (HEAD detached at 75a306df) branch 26.288.56989~75a306d
Kernel Version	6.12.112
Local Time	31 Oct 2026, 04:18:21 UTC
Uptime	0h 40m 42s
Load Average	0.27, 0.13, 0.23

[12:20:38] C:\work\networking\ookla-speedtest-1.2.0-win64
> .\speedtest.exe -s 7311

   Speedtest by Ookla

      Server: M1 Limited - Singapore (id: 7311)
         ISP: M1
Idle Latency:     3.64 ms   (jitter: 0.31ms, low: 3.38ms, high: 3.96ms)
    Download:   742.25 Mbps (data used: 562.4 MB)
                 33.20 ms   (jitter: 5.81ms, low: 6.51ms, high: 53.37ms)
      Upload:   239.89 Mbps (data used: 434.6 MB)
                 59.34 ms   (jitter: 9.18ms, low: 7.04ms, high: 150.82ms)
 Packet Loss: Not available.
  Result URL: https://www.speedtest.net/result/c/60e9c097-4be0-41cf-acdf-52437b048718

[12:24:10] C:\work\networking\ookla-speedtest-1.2.0-win64
> .\speedtest.exe -s 7311

   Speedtest by Ookla

      Server: M1 Limited - Singapore (id: 7311)
         ISP: M1
Idle Latency:     4.33 ms   (jitter: 0.69ms, low: 4.00ms, high: 5.56ms)
    Download:   739.16 Mbps (data used: 545.7 MB)
                 36.93 ms   (jitter: 5.85ms, low: 9.59ms, high: 122.08ms)
      Upload:   277.85 Mbps (data used: 460.8 MB)
                 50.69 ms   (jitter: 10.17ms, low: 9.14ms, high: 322.62ms)
 Packet Loss: Not available.
  Result URL: https://www.speedtest.net/result/c/6662a4a3-fd2c-417b-8063-6f02d9e2c61f

Using wireless (wireless repeater) then the download speed will be half.
Archer BE805 -- wireless -- Linksys EA7500 v2 OpenWRT (4m away) -- wireless -- Windows 11 client (50 cm away).

[12:23:12] C:\work\networking\ookla-speedtest-1.2.0-win64
> .\speedtest.exe -s 7311

   Speedtest by Ookla

      Server: M1 Limited - Singapore (id: 7311)
         ISP: M1
Idle Latency:     4.18 ms   (jitter: 0.40ms, low: 3.84ms, high: 4.82ms)
    Download:   332.85 Mbps (data used: 562.3 MB)
                 76.51 ms   (jitter: 22.98ms, low: 6.65ms, high: 255.92ms)
      Upload:   324.82 Mbps (data used: 372.0 MB)
                134.34 ms   (jitter: 38.96ms, low: 7.76ms, high: 216.41ms)
 Packet Loss: Not available.
  Result URL: https://www.speedtest.net/result/c/c7588234-8fe6-48c7-b3ab-eb75f6ccbc01

 

[xiaofan]

Linksys WRT1900AC V1 ksmbd USB drive sharing (router USB 3.0 port is working).
https://openwrt.org/docs/guide-user/services/nas/ksmbd

root@OpenWrt:~# ksmbd.adduser mcuee
[ksmbd.adduser/4189]: INFO: Wrote `/etc/ksmbd/ksmbdpwd.db'
[ksmbd.adduser/4189]: INFO: Prompting for password
New password:
Retype password:
[ksmbd.adduser/4189]: INFO: Wrote `/etc/ksmbd/ksmbdpwd.db'
[ksmbd.adduser/4189]: INFO: Added user `mcuee'
[ksmbd.adduser/4189]: INFO: Notified mountd
root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 4.0M      4.0M         0 100% /rom
tmpfs                   120.7M    308.0K    120.4M   0% /tmp
/dev/ubi0_1              24.0M      3.2M     19.5M  14% /overlay
overlayfs:/overlay       24.0M      3.2M     19.5M  14% /
ubi1:syscfg              30.7M    328.0K     28.8M   1% /tmp/syscfg
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/sda1                56.1G      1.0G     52.2G   2% /mnt/sda1

root@OpenWrt:~# lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 003 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 002: ID 0781:5591 SanDisk Corp. Ultra Flair

ksmbd seems to be a better solution than SAMBA4 for low storage device like Linksys EA7500v2 and Linksys WRT1900AC V1 (by default got dual partitition for fail-safe).

Read speed: 103.27 MB/s
Write speed: 38.67 MB/s

[13:45:51] C:\temp\temp2
> $item = Get-Item 'X:\USBShare\testfile.dum'
[13:46:14] C:\temp\temp2
> $time = Measure-Command -Expression { Copy-Item -LiteralPath $item.FullName 'C:\temp\temp2' }
[13:46:46] C:\temp\temp2
> $TransferRate = ($item.Length / 1MB) / $time.TotalSeconds
[13:47:04] C:\temp\temp2
> Write-Host "Transfer Speed: [ $TransferRate MB/Sec ]"
Transfer Speed: [ 103.267902696061 MB/Sec ]
[13:47:19] C:\temp\temp2
> $item = Get-Item 'C:\temp\temp2\testfile.dum'
[13:48:04] C:\temp\temp2
>  $time = Measure-Command -Expression { Copy-Item -LiteralPath $item.FullName 'X:\Test' }
[13:49:20] C:\temp\temp2
> $TransferRate = ($item.Length / 1MB) / $time.TotalSeconds
[13:50:53] C:\temp\temp2
> Write-Host "Transfer Speed: [ $TransferRate MB/Sec ]"
Transfer Speed: [ 38.669292079986 MB/Sec ]

 

[xiaofan]

NanoPi R4S (RK3399, dual gigabit ports, SD card, dual USB 3.0 ports)

Hostname	OpenWrt
Model	FriendlyElec NanoPi R4S
Architecture	ARMv8 Processor rev 4
Target Platform	rockchip/armv8
Firmware Version	OpenWrt 25.12.6 r33311-981c978eff / LuCI openwrt-25.12 branch 26.303.28702~0229375
Kernel Version	6.12.112
Local Time	31 Oct 2026, 21:51:32 GMT+8
Uptime	0h 6m 17s
Load Average	0.03, 0.08, 0.04

ksmbd USB file sharing.
https://openwrt.org/docs/guide-user/services/nas/ksmbd

Read speed: 103.89 MB/s
Write speed: 109.96 MB/s

[21:59:15] C:\temp\temp1
>  $item = Get-Item 'W:\USBShare\testfile.dum'
[21:59:33] C:\temp\temp1
>  $time = Measure-Command -Expression { Copy-Item -LiteralPath $item.FullName 'C:\temp\temp1' }
[21:59:58] C:\temp\temp1
> $TransferRate = ($item.Length / 1MB) / $time.TotalSeconds
[22:00:05] C:\temp\temp1
>  Write-Host "Transfer Speed: [ $TransferRate MB/Sec ]"
Transfer Speed: [ 103.889262973654 MB/Sec ]

[22:01:25] C:\temp\temp1
>  $item = Get-Item 'C:\temp\temp1\testfile.dum'
[22:02:02] C:\temp\temp1
>  $time = Measure-Command -Expression { Copy-Item -LiteralPath $item.FullName 'W:\Test' }
[22:02:15] C:\temp\temp1
> $TransferRate = ($item.Length / 1MB) / $time.TotalSeconds
[22:02:20] C:\temp\temp1
> Write-Host "Transfer Speed: [ $TransferRate MB/Sec ]"
Transfer Speed: [ 109.957119729945 MB/Sec ]

 

[xiaofan]

RK3399 CPU is pretty powerful.
https://github.com/cyyself/wg-bench

...
Router details:
{
        "kernel": "6.12.112",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "FriendlyElec NanoPi R4S",
        "board_name": "friendlyarm,nanopi-r4s",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "25.12.6",
                "firmware_url": "https://downloads.openwrt.org/",
                "revision": "r33311-981c978eff",
                "target": "rockchip/armv8",
                "description": "OpenWrt 25.12.6 r33311-981c978eff",
                "builddate": "1792273538"
        }
}
Connecting to host 169.254.200.2, port 4242
[  4] local 169.254.200.1 port 60372 connected to 169.254.200.2 port 4242
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  4]   0.00-1.00   sec  58.9 MBytes   493 Mbits/sec    0    251 KBytes
[  4]   1.00-2.00   sec  60.2 MBytes   505 Mbits/sec    0    251 KBytes
[  4]   2.00-3.00   sec  60.0 MBytes   503 Mbits/sec    0    265 KBytes
[  4]   3.00-4.00   sec  58.6 MBytes   492 Mbits/sec    0    265 KBytes
[  4]   4.00-5.00   sec  59.4 MBytes   498 Mbits/sec    0    265 KBytes
[  4]   5.00-6.00   sec  57.0 MBytes   478 Mbits/sec    0    265 KBytes
[  4]   6.00-7.00   sec  59.5 MBytes   499 Mbits/sec    0    265 KBytes
[  4]   7.00-8.00   sec  61.0 MBytes   512 Mbits/sec    0    265 KBytes
[  4]   8.00-9.00   sec  57.9 MBytes   486 Mbits/sec    0    341 KBytes
[  4]   9.00-10.00  sec  57.1 MBytes   479 Mbits/sec    0    341 KBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  4]   0.00-10.00  sec   590 MBytes   495 Mbits/sec    0            sender
[  4]   0.00-10.00  sec   589 MBytes   494 Mbits/sec                  receiver

iperf Done.
4242/tcp:             6859

Markdown Table Row:
| FriendlyElec NanoPi R4S / ENTER CPU MODEL | OpenWrt 25.12.6 / 6.12.112       | 495 Mbits/sec  |  |

 

[xiaofan]

Pending item for NanoPi R4S: need to see how to extend the root partition and file system as the typical OpenWRT script does not work. Maybe it can be done outside of OpenWRT using gparted under Linux.
https://openwrt.org/docs/guide-user/advanced/expand_root

root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 3.8M      3.8M         0 100% /rom
tmpfs                     1.9G      8.0M      1.9G   0% /tmp
/dev/loop0               98.4M     57.5M     41.0M  58% /overlay
overlayfs:/overlay       98.4M     57.5M     41.0M  58% /
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/sda1                56.1G      2.0G     51.2G   4% /mnt/sda1
tmpfs                     1.9G      8.0M      1.9G   0% /tmp/run/netns
root@OpenWrt:~# fdisk /dev/mmcblk1

Welcome to fdisk (util-linux 2.41.5).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

This disk is currently in use - repartitioning is probably a bad idea.
It's recommended to umount all file systems, and swapoff all swap
partitions on this disk.


Command (m for help): p

Disk /dev/mmcblk1: 14.84 GiB, 15931539456 bytes, 31116288 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xee3feef1

Device         Boot  Start      End  Sectors  Size Id Type
/dev/mmcblk1p1 *     65536    98303    32768   16M 83 Linux
/dev/mmcblk1p2      131072 31116287 30985216 14.8G 83 Linux

Command (m for help): q

 

[xiaofan]

Pending item for NanoPi R4S: need to see how to extend the root partition and file system as the typical OpenWRT script does not work. Maybe it can be done outside of OpenWRT using gparted under Linux.
https://openwrt.org/docs/guide-user/advanced/expand_root

It turns out to be quite troublesome if using squashfs image. So I changed to use ext4 image and use gparted under Ubuntu 26.04 Linux host to expand the root system to 1GB. Then I also created a new partition on the SD card to use the remaining space.

root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root              1006.8M     24.8M    965.9M   3% /
tmpfs                     1.9G      1.7M      1.9G   0% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/sda1                56.1G      1.0G     52.2G   2% /mnt/sda1
/dev/mmcblk1p3           13.5G      2.0M     12.8G   0% /mnt/mmcblk1p3

root@OpenWrt:~# mount
/dev/mmcblk1p2 on / type ext4 (rw,noatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
tmpfs on /dev type tmpfs (rw,nosuid,noexec,noatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,noatime,mode=600,ptmxmode=000)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,noatime)
bpffs on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,noatime,mode=700)
nfsd on /proc/fs/nfsd type nfsd (rw,relatime)
/dev/sda1 on /mnt/sda1 type ext4 (rw,relatime)
/dev/mmcblk1p3 on /mnt/mmcblk1p3 type ext4 (rw,relatime)

Reference:
https://openwrt.org/docs/guide-user/installation/installation_methods/sd_card

ext4-sdcard.img.gz​

• Not optimized for flash memory (journaling increases flash wear)
• SD card can be easily mounted externally for modification
• Updates and changes can be made directly to the partition
• Linux desktop standard

squashfs-sdcard.img.gz​

• Compressed
• Newer images include a hidden F2FS filesystem, which is optimized for flash memory
• Needs special mount procedure to externally modify
• All changes are done in an overlay partition
• Due to overlay partition it is simple to reset system to defaults