AIoT.IO.VN

How to Configure PPPoE on OpenWrt

Tue, 05 Jan 2021 05:21:39 +0000

This guide configures PPPoE on OpenWrt after the ISP modem has been placed in bridge mode.

It covers PPPoE without a VLAN. Use it when your ISP does not require a VLAN, or when the modem can set the VLAN ID in its bridge configuration.

If the modem has no VLAN field but the PPPoE connection requires one, use the OpenWrt PPPoE with VLAN guide instead.

Log in to OpenWrt and open Network > Interfaces.

How to Configure PPPoE with a VLAN ID on OpenWrt

Wed, 06 Jan 2021 03:49:11 +0000

In the previous article, I explained how to configure PPPoE on OpenWrt when the ISP does not use a VLAN, or when the ISP modem can set the VLAN inside its bridge configuration.

This guide configures PPPoE with a VLAN directly on OpenWrt. Some ISP modems do not provide a VLAN field in bridge mode even though the PPPoE connection requires one. In that case, the VLAN must be created on OpenWrt. Your router must support VLANs.

Viettel SDMC NR3053 Teardown

Wed, 14 Oct 2026 05:14:00 +0000

Viettel SDMC NR3053 Teardown: MediaTek Filogic 820 Platform & Hardware Analysis

Wed, 14 Oct 2026 05:14:00 +0000

As part of the rollout strategy for next-generation broadband Internet and the Home WiFi 6 ecosystem, Vietnamese telco Viettel partnered with leading telecommunications equipment manufacturer SDMC (Shenzhen SDMC Technology Co., Ltd.) to deploy the Wi-Fi Mesh router model Viettel SDMC NR3053.

What quickly grabbed the attention of network enthusiasts and hardware tinkerers is its generous internal hardware specifications: a MediaTek Filogic 820 (MT7981BA) processor, 512MB of RAM, and 256MB of Flash storage.

Vietnamese Lunar Calendar & Event Countdowns

Tue, 13 Oct 2026 20:30:00 +0700

Xiaomi AX3000T New Revision Teardown: Qualcomm IPQ5018 Platform & No Custom ROM Support

Tue, 13 Oct 2026 07:00:29 +0000

Xiaomi AX3000T New Revision Teardown: Qualcomm IPQ5018 Platform & No Custom ROM Support

Tue, 13 Oct 2026 07:00:29 +0000

The budget-friendly Wi-Fi 6 router Xiaomi AX3000T earned widespread popularity thanks to its initial MediaTek Filogic 820 (MT7981B) platform, which enjoyed extensive community support, easy SSH unlocking, U-Boot Mod, and rich OpenWrt builds. However, in recent production batches, Xiaomi has silently changed the internal hardware architecture to a Qualcomm chipset.

Crucial notice for buyers seeking to flash OpenWrt / Custom ROMs: Official e-commerce listings in China have confirmed that the original MediaTek version is discontinued. All newly shipped units on the market are now the Qualcomm IPQ5018 version. As of now, this Qualcomm variant cannot be flashed with OpenWrt or third-party custom firmware like the MediaTek revision!

To verify and analyze this silent hardware overhaul, the unit examined here was acquired second-hand (specifically to ensure that it was indeed the Qualcomm revision).

LG SoundBar SK8 - Reviving a Decade-Old Dolby Atmos Soundbar with Custom Firmware

Mon, 28 Sep 2026 09:00:00 +0000

Released around 2018, the LG Soundbar SK8 was once a flagship Dolby Atmos soundbar celebrated for its 360W output, wireless 5.8GHz subwoofer, and immersive cinema-grade audio. Fast forward nearly a decade, and this capable hardware has largely turned into an abandoned smart device: the LG Music Flow app has stopped receiving updates, Google Cast 1.36 services have been deprecated, native Apple AirPlay was never supported, standalone Spotify Connect is absent, and local integration with modern smart home systems like OpenHAB or Home Assistant was virtually non-existent.

Wi-Fi Router Fast Roaming Protocols 802.11k, 802.11v, 802.11r Compatibility Database

Mon, 14 Sep 2026 16:30:00 +0000

This article provides a verified compatibility database for Wi-Fi routers supporting fast roaming protocols (802.11k, 802.11v, and 802.11r). Beyond the raw lookup table, we will break down the real-world mechanics of these standards, clarify the relationship between Mesh networking and seamless roaming, and show how to inspect beacon frames using WinFi on Windows.

The table below is formatted as plain text for quick lookup. Press Ctrl + F (or use “Find in page” on mobile browsers) to search directly for your router model.

I. Technical Breakdown: 802.11k, 802.11v, and 802.11r

When moving through your home or office, your client devices (smartphones, laptops, tablets) need to transition from one Access Point (AP) to another. To ensure this handover occurs without dropping packets or terminating active connections, IEEE defined three complementary roaming standards:

About Me // Engineering Profile

Thu, 10 Sep 2026 08:00:00 +0700

Hello! I am Nghia Nguyen, a Software Engineer and Tech Lead passionate about Distributed Systems Architecture, Golang, Kubernetes, and high-performance cloud-native computing.

AIoT.IO.VN serves as an open technical ledger where I document real-world engineering experiences, system teardowns, and architecture lessons learned while building platforms serving millions of concurrent users.

Engineering Principles

Simplicity Over Cleverness: Explicit, maintainable, and debuggable code trumps overly clever abstractions.
Data-Driven Performance: Never speculate on performance; always measure with benchmarks, pprof traces, and distributed telemetry.
Fail Fast, Recover Faster: Hardware and networks fail constantly. Design with fault isolation and automated self-healing boundaries.

Core Technologies

Backend: Golang, Python, C++, gRPC, Protobuf, WebSockets
Databases & Caching: PostgreSQL, Redis, ScyllaDB, Elasticsearch
Cloud & DevOps: Kubernetes, Docker, Terraform, AWS, Cloudflare, CI/CD
Streaming & Messaging: Apache Kafka, RabbitMQ, NATS
Observability: Prometheus, Grafana, OpenTelemetry, Jaeger

Connect

GitHub: github.com
LinkedIn: linkedin.com
Twitter / X: twitter.com
Email: contact@example.com

Stock ROM Archive for Redmi AX5400 Gaming Edition

Tue, 08 Sep 2026 16:45:00 +0000

This post compiles the direct download links for the official stock firmware of the Redmi AX5400 Gaming Edition (Device Code: RB04).

Important Note: Xiaomi has enabled Secure Boot on the Redmi AX5400 Gaming Edition. This means flashing Custom ROMs (like OpenWrt) via SSH or mtd write is currently impossible.

Redmi AX5400 Gaming Edition Teardown – No 1G Bottleneck

Tue, 08 Sep 2026 16:24:25 +0000

This article shares the internal teardown process of the Redmi AX5400 Gaming Edition router. Before disassembly, the packaging of the Redmi AX5400 looks quite premium:

Back of the package:

Body and included accessories:

Redmi AX5400 Gaming Edition Teardown & Hardware Review

Tue, 08 Sep 2026 16:00:00 +0000

Back Up and Restore OpenWrt Configuration with LuCI and SSH

Tue, 01 Sep 2026 18:13:55 +0000

I separate two operations that are often both called an “OpenWrt backup.” This guide covers configuration files, not a block-level NOR/NAND image. The goal is to keep an archive that can be carried into an installation or restored after an upgrade.[24]

Scope and prerequisites

I need access to LuCI or SSH/console, plus the ability to manage configuration, packages, services, and logs. Extroot or additional overlay layouts require extra consideration; the official page points block-level work to the Generic backup guide instead.[24]

Build a Docker Host inside a Proxmox VE LXC with TurnKey Core

Tue, 01 Sep 2026 18:13:55 +0000

i12bretro tutorial 0595 places a Docker host inside a Proxmox VE Linux container (CT) using the TurnKey Core template. It downloads the template, creates a CT named Docker with 2048 MB RAM, updates the OS, installs Docker, and optionally adds Portainer.[10]

This is the original tutorial video.[15]

1. Create the container

Log into the Proxmox VE web UI.[10]
Select a left-panel storage that permits Container templates.[10]
Select CT Templates in the sub-navigation.[10]
Click Templates.[10]
Search for core, select TurnKey Core, and click Download.[10]
Wait for the download to finish and close the download dialog.[10]
Right-click the Proxmox node and choose Create CT.[10]
Set Hostname to Docker, enter and confirm a password locally, then click Next.[10]
Select the storage holding the template and choose the TurnKey Core template, then click Next.[10]
Select the storage that will hold the container, then click Next.[10]
On CPU, keep the defaults and click Next.[10]
On Memory, set Memory to 2048, then click Next.[10]
On Network, keep the defaults; configure a static IP from the router if needed, then click Next.[10]
On DNS, keep the defaults and click Next.[10]
Review the summary and click Finish.[10]
When creation completes, close the download dialog if it remains open.[10]
Right-click the Docker LXC in the left navigation and choose Start.[10]
Click Console in the sub-navigation.[10]

Enter the CT password during creation; use a unique password and do not store it in a file or script.[10]

DNS over TLS on OpenWrt with Unbound: Configuration and Leak Checks

Tue, 01 Sep 2026 18:13:55 +0000

The goal here is to send DNS from the router to upstream resolvers through DNS over TLS (DoT) with Unbound. I decide first whether dnsmasq will give up its DNS role or keep port 53 and forward to Unbound; the two models use different configuration blocks.[27]

Goals and prerequisites

The OpenWrt page describes DoT for encrypted DNS, reduced DNS leak/hijacking exposure, and optional public providers. I need LuCI or SSH access, package/service/log administration, and a console fallback in case a DNS change breaks resolution.[27]

LuCI Essentials on OpenWrt: Installation, HTTPS, Alternate Ports, and Offline Setup

Tue, 01 Sep 2026 18:13:55 +0000

LuCI is the web interface for many OpenWrt administration tasks. Stable releases usually include it, while snapshots may need an extra install; a device with only 4 MB flash or 32 MB RAM may not have room for the full package. In that situation I select an image with LuCI included or build a smaller image instead of filling flash blindly.[28]

1. Use Firmware Selector

Open:[28]

https://firmware-selector.openwrt.org/?version=SNAPSHOT

Enter the exact device, click the small arrow beside Customize installed packages and/or first boot script, then:[28]

Run an OpenWrt x86 VM on Proxmox VE: i12bretro Tutorial Adaptation

Tue, 01 Sep 2026 18:13:55 +0000

i12bretro tutorial 0405 builds an OpenWrt x86 VM on Proxmox VE. I keep the example values—VM ID 123, storage HDD_500GB, and LAN IP 10.10.27.151—so the original sequence remains reproducible; replace them with values from the local infrastructure.[9]

The original video demonstrates the same process on YouTube.[14]

Prerequisites

I need the Proxmox web UI at https://ProxMoxDNSorIP:8006/, permission to open the node Shell, storage for the imported disk, and a LAN addressing plan. The OpenWrt root password is entered interactively at the console rather than stored in a file.[9]

Run Healthchecks in Docker: Monitor Cron Jobs with HTTP Pings

Tue, 01 Sep 2026 18:13:55 +0000

Healthchecks receives HTTP requests or email “pings” from cron jobs and alerts when a ping is late. Tutorial 0813 runs Healthchecks with PostgreSQL in Docker, then creates an administrator account on port 8000.[12]

The original i12bretro video remains on YouTube.[17]

1. Install Docker

Log into the Linux device.[12]
Run:[12]

# install prerequisites
sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
# add docker gpg key
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
# add docker software repository
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
# install docker
sudo apt install docker-ce docker-compose containerd.io -y
# enable and start docker service
sudo systemctl enable docker && sudo systemctl start docker
# add the current user to the docker group
sudo usermod -aG docker $USER
# reauthenticate for the new group membership to take effect
su - $USER

Reauthenticate after the Docker group change and check the daemon.[12]

Run HostMon in Docker: A HomeLab Host Monitor and Dashboard

Tue, 01 Sep 2026 18:13:55 +0000

HostMon is a small web dashboard for monitoring hosts and services in a HomeLab. i12bretro tutorial 0706 describes real-time ping, Wake-on-LAN, an SSH client, and a link to Apache Guacamole; the application is written in JavaScript and uses SQLite.[11]

The original tutorial video is available on YouTube.[16]

1. Install Docker on the Linux host

Log into the Linux device.[11]
Open a terminal and run:[11]

# install prerequisites
sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
# add docker gpg key
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
# add docker software repository
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
# install docker
sudo apt install docker-ce docker-compose containerd.io -y
# enable and start docker service
sudo systemctl enable docker && sudo systemctl start docker
# add the current user to the docker group
sudo usermod -aG docker $USER
# reauthenticate for the new group membership to take effect
su - $USER

After reauthenticating, check docker version/docker ps before starting HostMon.[11]

Run PhotoPrism in Docker with MariaDB and Persistent Photo Storage

Tue, 01 Sep 2026 18:13:55 +0000

PhotoPrism is a photo application that can tag and find pictures automatically and can run at home, on a private server, or in the cloud.[13] i12bretro tutorial 0902 runs PhotoPrism with MariaDB in Docker, persists storage and originals on the host, and exposes the web UI on port 2342.[13]

The original tutorial video is linked on YouTube.[13]

Samba File Sharing on OpenWrt: Configuration, Firewall, and Troubleshooting

Tue, 01 Sep 2026 18:13:55 +0000

Samba on OpenWrt is useful when I want to share a mounted HDD, SSD, or flash drive with Windows, Linux, or macOS clients on the LAN. OpenWrt also offers ksmbd, a lower-resource SMBv3 kernel server with fewer features; this article follows the official luci-app-samba4 path.[26]

Prerequisites

The USB/eSATA drive must already have its driver, filesystem, and mount point. A common package set is:[26]

USB drivers: kmod-usb3 kmod-usb-storage-uas usbutils block-mount mount-utils
Filesystems: kmod-fs-ext4 e2fsprogs kmod-fs-exfat exfat-fsck kmod-fs-ntfs3
Drive idle: luci-app-hd-idle

In LuCI, mount the drive under System → Mount Points, enable the entry, click Save & Apply, and use Generate Config if needed. Record the mount point, for example /dev/sda1 becoming /mnt/sda1. The source recommends at least 128 MB RAM; lower-memory machines may need another 128–256 MB of swap.[26]

Using a USB Storage Device with OpenWrt: Drivers, Partitions, and Automount

Tue, 01 Sep 2026 18:13:55 +0000

I use OpenWrt’s USB storage page when I need an HDD, SSD, or flash drive for data, Samba/NAS, or a general file store. If the goal is extending the overlay to install more packages, this is not the whole extroot procedure; I keep the two goals separate.[25]

Warning: Formatting deletes data from the partition. Before running mkfs.*, confirm the correct /dev/sda1 or equivalent device and keep a separate backup.[25]

1. Install and verify USB drivers

Refresh package indexes, install storage support, and add UAS if the device needs it:[25]

Add Storage to Proxmox VE: Local ZFS and a CIFS ISO Share

Mon, 31 Aug 2026 18:19:54 +0000

This tutorial has two storage branches: create local ZFS from a disk installed in Proxmox, then create a Windows share and register it as CIFS in Datacenter. The steps below follow the original order; replace the example server, share, user, and password with values from your system.¹

1. Local storage: ZFS Single Disk (steps 1–10)

Install the physical disk in the Proxmox server hardware.
Power on the Proxmox server.
Open a browser and navigate to the Proxmox web UI.
Log in.
Click the node with the new disk in the left navigation menu.
Expand Disks → ZFS.
Click Create ZFS.
Give the ZFS storage a name and set Raid Level = Single Disk.
Select the new disk from the drive list and click Create.
The new disk is now available for storing VMs in the tutorial’s flow.

Single Disk has no redundancy. If the disk fails, this ZFS pool is not a backup; choose another layout when fault tolerance is required.

Connect 2G/3G/4G/5G Modems to OpenWrt with ModemManager

Mon, 31 Aug 2026 18:19:54 +0000

ModemManager is a service that sets up and connects 2G/3G/4G/5G modems while presenting their differences through a common abstraction. The OpenWrt documentation lists modem initialization, Internet access, SMS, and firmware upgrades for selected QMI modems as examples of its capabilities.¹

This article uses the source’s example APN and sysfs path. The username, password, and pincode values below are safe placeholders; replace them locally and never put SIM credentials in Git.

Controlled Docker Image Updates with Watchtower: Preview, Cleanup, and Stopped Containers

Mon, 31 Aug 2026 18:19:54 +0000

Watchtower monitors Docker containers for changes to their source images and can restart them with a newer image. The i12bretro tutorial separates preview, update, and cleanup; Review the changes before enabling an automated update command.¹

1. Pull the Watchtower image

Step 1/10: Log into the Docker host.

Step 2/10: Pull the image:

Expand OpenWrt Overlay with Extroot: USB, ext4, and Recovery Paths

Mon, 31 Aug 2026 18:19:54 +0000

extroot uses external storage as a writable overlay, giving OpenWrt room for packages and persistent data without replacing the router’s internal flash. This article follows the OpenWrt documentation from device discovery and partitioning through the post-reboot checks, recovery paths, and advanced options.¹

Warning: This procedure touches partitions and filesystems. Back up the configuration, identify the correct /dev/sdX, and treat the parted example below as a destructive command. Never run it unchanged on a disk containing data.

OpenWrt 25.12+: Use apk Instead of opkg Without Bricking the Router

Mon, 31 Aug 2026 18:19:54 +0000

From OpenWrt 25.12, the package manager is apk version 3; opkg has ended development and is no longer the primary choice on the new release. This apk is Alpine Package Keeper, not an Android APK.¹

Start with the release check: this guide targets OpenWrt 25.12 and newer. If the firmware still uses opkg, follow that release’s documentation and do not mix package managers or repositories.

cat /etc/openwrt_release
apk --version

1. Basic commands

The OpenWrt documentation lists these core commands:

OpenWrt Wi‑Fi Repeater with relayd: LuCI, CLI, IPv6, and Recovery

Mon, 31 Aug 2026 18:19:54 +0000

relayd is a last-resort way to turn an OpenWrt router into a Wi‑Fi extender when the main router does not run OpenWrt or does not support WDS/802.11s as needed. One radio provides a wireless uplink and another radio provides an AP for local clients; the relayd package provides bridge-like forwarding between the two sides.¹

The source’s example topology is:

The main router is 192.168.1.1/24, with LAN serving clients and WAN reaching the Internet.
The extender has a separate management subnet, 192.168.2.0/24, for example LAN 192.168.2.1.
The wwan interface connects wirelessly to the main router.
Clients behind the relay receive DHCP from the main network, while 192.168.2.1 is used only to manage the extender.

Important: The two subnets must be different. relayd is not a complete Layer 2 bridge and usually handles IPv4 only; DHCP, mDNS, and upstream performance may not behave like a wired bridge. When I control both devices, WDS or 802.11s remains the preferred choice.¹

Pass a Physical Disk Through to a Proxmox VM with /dev/disk/by-id

Mon, 31 Aug 2026 18:19:54 +0000

Passing a physical disk through lets a guest see a real drive rather than a virtual disk. The i12bretro tutorial has exactly five steps; step three contains the DEVICE-ID(S) lookup and qm set command. Replace the identifiers and placeholders with values from the actual system.¹

1. Open the Proxmox web shell

Step 1/5: Log into Proxmox VE at the console or web UI and launch the web shell.

Run Mattermost in Docker: Compose, PostgreSQL, and Workspace Initialization

Mon, 31 Aug 2026 18:19:54 +0000

Mattermost is a self-hosted collaboration platform. The i12bretro tutorial uses the official Docker repository, an .env file, PostgreSQL, and a compose profile without Nginx; Use a private password instead of the sample value.¹

1. Install Docker on Linux

Step 1/12: Log into the Linux device.

Step 2/12: Install the prerequisites and Docker:

Self-Host LimeSurvey CE in Docker: MariaDB, Persistent Data, and Port 8080

Mon, 31 Aug 2026 18:19:54 +0000

LimeSurvey CE is an open-source survey platform. The i12bretro tutorial runs MariaDB and LimeSurvey on one Docker network, persists survey uploads on the host, and exposes the administration page on port 8080. Use a private password instead of the sample value.¹

1. Install Docker on the Linux host

Step 1/5: Log into the Linux host and run the Docker installation sequence in a terminal:

Static Routes on OpenWrt: IPv4, IPv6, and netifd Routing Tables

Mon, 31 Aug 2026 18:19:54 +0000

netifd lets OpenWrt define static IP routes in /etc/config/network. Unlike a temporary ip route add, a route or route6 section is managed by UCI and can be reloaded with its interface.¹

Scope: This is about static routes, not dynamic routing protocols. Before applying a route, know which interface reaches the next hop and keep a console or SSH recovery path in case management traffic loses its return route.

1. Basic IPv4 routes

An IPv4 route is a route section attached to a logical interface. The source’s minimal example is:

802.11s mesh on OpenWrt: wpad preparation, configuration, and peer checks

Sun, 30 Aug 2026 18:38:31 +0000

802.11s is a Layer 2 mesh: nodes can see one another as if they were connected to one switch, while DHCP, routing, or Batman/OLSR sits above it. I check the driver and wpad first; a mesh interface alone does not mean every radio supports mesh point mode.¹

Prerequisites and limits

The source records reliable operation with OpenWrt 19.07 and later when the hardware/driver supports it and wpad-mesh-openssl (or an equivalent) is installed. It also records an ARP relay issue in 19.07.4 that made Mesh Points reliable only within range of a Mesh Portal. I therefore verify the release and topology before production use.

Build a WireGuard server on OpenWrt with UCI and verify the tunnel

Sun, 30 Aug 2026 18:38:31 +0000

A WireGuard server on OpenWrt has three boundaries: server/client keys, the firewall rule for the UDP listen port, and the VPN interface’s firewall zone. Generate private keys, PSKs, and passwords locally; never store them in Markdown.¹

Goals and assumptions

The source targets encrypted VPN access, remote LAN services, split/full tunnel operation, and client-side leak prevention. I assume a working WAN, a client that can generate keys, and a UDP port forward to VPN_PORT if the router is behind another modem. This is not a substitute for the WireGuard client/extras pages.

Disable the Proxmox enterprise repository and subscription notice

Sun, 30 Aug 2026 18:38:31 +0000

A Proxmox VE installation may point at the enterprise repository and display a subscription notice. This i12bretro tutorial switches to pve-no-subscription and provides separate notice-edit branches for Proxmox 6, 7, 8, and 9. Each branch targets a different release; choose the one that matches the installed version.¹

Prerequisites

Log in to Proxmox VE at the console or root web shell. This changes package repositories and Proxmox Perl/JavaScript files, so I record pveversion --verbose, keep the console available, and retain the .bak files for rollback. Use the community repository only with a clear understanding of support and licensing.

Homepage dashboard in Docker: collect HomeLab services on port 8006

Sun, 30 Aug 2026 18:38:31 +0000

Homepage is a fast, static, customizable dashboard for collecting HomeLab services. The i12bretro tutorial uses Docker, stores configuration under ~/homepage, and mounts the Docker socket so Homepage can discover containers through labels.¹

Install Docker

# install prerequisites
sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
# add docker gpg key
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
# add docker software repository
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
# install docker
sudo apt install docker-ce docker-compose containerd.io -y
# enable and start docker service
sudo systemctl enable docker && sudo systemctl start docker
# add the current user to the docker group
sudo usermod -aG docker $USER
# reauthenticate for the new group membership to take effect
su - $USER

Run Homepage

The source first checks the UID/GID, creates the configuration directory, and runs the container. Check the UID/GID of the user that will run the container, then set PUID/PGID:

IPv6 configuration on OpenWrt: WAN, prefix delegation, RA, and relay

Sun, 30 Aug 2026 18:38:31 +0000

IPv6 on OpenWrt has two halves: receiving an address/prefix upstream and distributing a prefix downstream to LAN. I do not treat a single checkbox as a finished configuration; I identify whether the ISP uses native DHCPv6, PPPoE, static addressing, relay, or a tunnel, then test RA, DHCPv6, routes, and source policy.¹

Compliance and general features

The default firmware commonly includes odhcp6c as the DHCPv6 client, odhcpd as the RA/DHCPv6 server, and IPv6 firewall support; LuCI needs luci-proto-ipv6. A custom image must include the corresponding packages. The source aims at RFC 7084 but lists known gaps, so I test the actual behavior instead of treating the RFC target as an absolute guarantee.¹

OpenWrt failsafe and factory reset: recover configuration before wiping it

Sun, 30 Aug 2026 18:38:31 +0000

When OpenWrt becomes unreachable after a network or firewall change, I do not jump straight to a factory reset. Failsafe boots a minimal state so I can repair /etc/config, while a factory reset removes the overlay and installed packages. Recovery/re-flashing is a separate path controlled by the device bootloader.¹

Check the prerequisites

Failsafe is useful with a SquashFS image that has a read-only root and a separate overlay. It cannot repair failed hardware or a broken kernel. x86 builds using an ext4 read-write rootfs do not reset this way. First check:

PBR with netifd on OpenWrt: split VPN, WAN, and exception routes

Sun, 30 Aug 2026 18:38:31 +0000

I use netifd to separate routing decisions instead of piling several default routes into one table. The official guide covers both IPv4 and IPv6, so this adaptation keeps every meaningful scenario rather than reducing it to one generic VPN configuration.¹

Scope and limits

PBR selects a path from administrator-defined policies. With pbr_netifd, each interface receives its own routing table and rules with explicit priorities select the table for matching traffic. This is suitable for interfaces, subnets, IP addresses, and ports; domain matching belongs in PBR app. mwan3 is for multi-WAN load balancing or failover, not a direct replacement for the individual rules below.¹

Pi.Alert in Docker: detect unknown devices on the LAN

Sun, 30 Aug 2026 18:38:31 +0000

Pi.Alert monitors Wi-Fi/LAN devices and can alert on unknown devices or devices that should remain online. I run it on a Linux Docker host with host networking so it can observe the local network; that also requires a trust boundary and the UI should not be exposed directly to the Internet.¹

Install Docker on Linux

Self-host Mastodon with Docker: PostgreSQL, Redis, SSL, and Nginx

Sun, 30 Aug 2026 18:38:31 +0000

Mastodon is federated, so this tutorial is more than one Docker container: it needs a stable domain, PostgreSQL, Redis, secrets, VAPID, streaming, Sidekiq, and an HTTPS reverse proxy. LOCAL_DOMAIN should not be changed casually after the instance is in use.¹

1. Domain and Docker prerequisites

The Certbot host must be reachable from the Internet on port 80 or 443 for Let’s Encrypt validation. In a HomeLab I forward port 80 to the host during the handshake, verify DNS, and stop any web server already using port 80.

VSCodium in Docker: a web IDE for the HomeLab on port 8003

Sun, 30 Aug 2026 18:38:31 +0000

VSCodium is a community build of Visual Studio Code intended to provide binaries without Microsoft’s telemetry/tracking. The i12bretro tutorial runs the LinuxServer image in Docker, persists config and code on the host, and exposes the IDE on port 8003.¹

Install Docker

# install prerequisites
sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
# add docker gpg key
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
# add docker software repository
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
# install docker
sudo apt install docker-ce docker-compose containerd.io -y
# enable and start docker service
sudo systemctl enable docker && sudo systemctl start docker
# add the current user to the docker group
sudo usermod -aG docker $USER
# reauthenticate for the new group membership to take effect
su - $USER

Run VSCodium

Check UID/GID, create persistent directories, and start the container. Check the UID/GID of the user that will run the container, then set PUID/PGID:

ZTE Starry MAX and BE3600Pro+: wired mesh first, wireless mesh second

Sun, 30 Aug 2026 18:38:31 +0000

This ACWiFi article answers a practical question: can the ZTE Starry MAX mesh with the Starry BE3600Pro+ kit? I classify it as a serial/network guide rather than a teardown; it also has a different purpose from the BE3600Pro+ hardware article already on the blog.¹

Build the wired mesh

If the BE3600Pro+ is fresh from the box, connect a LAN port on the Starry MAX, acting as the main router, to the WAN port of the node with Ethernet. The system should create a wired mesh automatically. In the ZTE Smart Life app, open 组网管理 and confirm that the method 有线 is shown.

Connect OpenWrt to another Wi‑Fi network as a routed client

Sat, 29 Aug 2026 18:30:50 +0000

This guide turns OpenWrt into a routed Wi‑Fi client: an OpenWrt radio joins an upstream network, the wwan interface receives DHCP, and the downstream LAN uses a different subnet and NAT. This is not a bridged AP design; use the source’s WDS or relayd guides when both sides must share one subnet.¹

Warning: Do not connect the OpenWrt router to the main router while changing its LAN address. Reset to OpenWrt defaults when necessary, configure through a LAN port, and keep a direct recovery path for any change that removes LuCI access.¹

Firewall4 and /etc/config/firewall on OpenWrt

Sat, 29 Aug 2026 18:30:50 +0000

From OpenWrt 22.03 onward, firewall4 (fw4) uses nftables as its default backend while retaining the familiar UCI syntax in /etc/config/firewall. UCI covers a reasonable subset of Netfilter; special nftables behavior should use the include mechanisms instead of forcing everything into one config rule.¹

Warning: Back up /etc/config/firewall before editing. Double-check the result before reloading; if access is lost, use Failsafe to restore it. Never expose an Internet port just because a rule looks plausible.¹

Installing OpenWrt: four methods and the recovery boundary

Sat, 29 Aug 2026 18:30:50 +0000

OpenWrt installation is device-specific. The generic page is a map of technical paths, not a universal flashing recipe; before writing anything, open the correct device page in the Table of Hardware and never reuse another router’s IP, filename, or command.¹

Warning: These operations can damage firmware or hardware. If installation fails, move to the model-specific debrick/recovery documentation. Do not overwrite or alter the bootloader unless the device page explicitly says to do so.¹

Prepare TFTP recovery over Ethernet for OpenWrt

Sat, 29 Aug 2026 18:30:50 +0000

TFTP recovery over Ethernet is only the host preparation part. The router’s bootloader decides the IP address, filename, button, port, and flash procedure; not every model supports TFTP. The OpenWrt page describes two directions: the router can run a TFTP client and download from the computer, or the router can run a TFTP server and receive an upload. This guide prepares the TFTP host and does not invent a model-specific trigger.¹

Run Actual Budget in Docker

Sat, 29 Aug 2026 18:30:50 +0000

Actual Budget is a local-first finance tool written in NodeJS, with synchronization between devices. This procedure runs the server in Docker, stores config.json and data separately, and creates an administrator password through the web interface.¹

Install Docker

Log into Linux with sudo access and run:

# install prerequisites
sudo apt install apt-transport-https ca-certificates git curl software-properties-common gnupg-agent -y
# add docker gpg key
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
# add docker software repository
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
# install docker
sudo apt install docker-ce docker-compose containerd.io -y
# enable and start docker service
sudo systemctl enable docker && sudo systemctl start docker
# add the current user to the docker group
sudo usermod -aG docker $USER
# reauthenticate for the new group membership to take effect
su - $USER

apt-key is deprecated on current distributions; compare the command with the current Docker documentation before using the older form.¹

Run MeshCentral for remote computer management in Docker

Sat, 29 Aug 2026 18:30:50 +0000

MeshCentral is a self-hosted web site for managing and controlling computers on a LAN or over the Internet. This adaptation keeps the i12bretro order: one MongoDB container, one MeshCentral container, separated data directories, and HTTPS on port 8086.¹

Install Docker on Linux

Log into Linux with sudo access and run the source command set:

Run MkDocs in Docker and switch to the Read the Docs theme

Sat, 29 Aug 2026 18:30:50 +0000

MkDocs is a static site generator that uses Markdown and one YAML configuration file to build project documentation. This guide runs the polinux/mkdocs image, stores the project under ~/docker/mkdocs, then stops the container to switch mkdocs.yml to the readthedocs theme.¹

Install Docker on Linux

Log into the Linux device and run:

Run OctoPrint in Docker with a USB printer device

Sat, 29 Aug 2026 18:30:50 +0000

OctoPrint provides a web UI for controlling a 3D printer. This guide runs the container with data under ~/docker/octoprint, passes through /dev/ttyACM0, and exposes the web UI on port 8041.¹

Install Docker on Linux

Log into Linux and run:

# install prerequisites
sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
# add docker gpg key
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
# add docker software repository
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
# install docker
sudo apt install docker-ce docker-compose containerd.io -y
# enable and start docker service
sudo systemctl enable docker && sudo systemctl start docker
# add the current user to the docker group
sudo usermod -aG docker $USER
# reauthenticate for the new group membership to take effect
su - $USER

Check the current Docker documentation if the distribution has removed apt-key.¹

Run the Dashy dashboard in Docker

Sat, 29 Aug 2026 18:30:50 +0000

Dashy is a self-hosted personal dashboard with status checking, widgets, themes, icon packs, and a UI editor. This guide uses lissy93/dashy:latest, binds the user-data directory, and exposes the dashboard on port 8080.¹

Install Docker

Log into the Linux Docker host and run:

# install prerequisites
sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
# add docker gpg key
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
# add docker software repository
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
# install docker
sudo apt install docker-ce docker-compose containerd.io -y
# enable and start docker service
sudo systemctl enable docker && sudo systemctl start docker
# add the current user to the docker group
sudo usermod -aG docker $USER
# reauthenticate for the new group membership to take effect
su - $USER

If the current distribution no longer supports apt-key, use the current Docker documentation instead of ignoring the warning.¹

VLAN on OpenWrt: swconfig, driver VLANs, and DSA

Sat, 29 Aug 2026 18:30:50 +0000

VLANs on OpenWrt are not just a matter of adding .106 to an interface name. First identify whether the device uses a legacy hardware switch, driver-created VLANs, or DSA; since the OpenWrt 21.02 transition, the syntax and port mapping can differ substantially. This guide keeps all three paths from the official documentation.¹

Warning: A wrong tagged/untagged state or CPU port can remove the entire LAN. Back up the configuration and keep a console path before editing /etc/config/network. Never copy a port map from another model.¹

Host draw.io on Windows with Apache Tomcat

Fri, 28 Aug 2026 03:00:00 +0000

draw.io is a web-based diagramming and whiteboard application. This rewrite keeps the source choices while adding official download links and separating Tomcat, draw.io, and the optional root-path steps.

Download and prepare Java

Download OpenJDK, Apache Tomcat 10, and the latest draw.war from draw.io releases.
Extract the OpenJDK ZIP archive.
Copy the extracted folder to C:\Program Files\OpenJDK.
Open Start and go to Control Panel > System > Advanced System Settings.
Click Environment Variables. Under System Variables, click New.
Set Variable Name to JAVA_HOME and Variable Value to C:\Program Files\OpenJDK, then click OK to close the dialogs.

Install Apache Tomcat

Run the Apache Tomcat installer.
Click Next, then I Agree.
On Choose Components, clear everything except Core, Service Startup, and Native, then click Next.
Set port 8000 and the Service Name, then click Next.
At the Java Virtual Machine screen, select C:\Program Files\OpenJDK.
Confirm the install location, click Install, then Finish.
Open http://DNSorIP:8000. The Tomcat splash page should show the running version.

Install draw.io

Copy draw.war into Apache Tomcat’s webapps directory.
Wait for Tomcat to extract it into a draw directory. If it does not, open services.msc and restart the Apache Tomcat service.
Open http://DNSorIP:8000/draw to test draw.io.

Remove `/draw` from the URL (optional)

Open the webapps folder in File Explorer.
Delete ROOT if it exists.
Rename draw to ROOT.
Open http://DNS-or-IP:8000/ to reach draw.io at the root path.

Check the Tomcat service write permissions and back up webapps before renaming directories.

Run Easy!Appointments in Docker

Fri, 28 Aug 2026 03:00:00 +0000

Easy!Appointments is an open-source web application for customer bookings and can synchronize with Google Calendar. This guide uses a private Docker network and stores the database under ~/docker/mariadb.

Install Docker

Log into Linux with a sudo-capable account and run the commands below. The source uses apt-key; on a current distribution, also check the official Docker installation documentation because this command is deprecated.

Run OpenVPN Access Server in Docker

Fri, 28 Aug 2026 03:00:00 +0000

OpenVPN Access Server is a self-hosted VPN solution with a web administration interface. This version keeps the source ports, volume, and operation order while separating commands and adding practical safety notes.

Install Docker on Linux

Run Seafile in Docker

Fri, 28 Aug 2026 03:00:00 +0000

Seafile is an open-source file synchronization and sharing platform. This guide runs MariaDB and Seafile on one Docker network and stores their data under ~/docker/mariadb and ~/docker/seafile.

Install Docker

Log into Linux with sudo access and run:

sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
sudo apt install docker-ce docker-compose containerd.io -y
sudo systemctl enable docker && sudo systemctl start docker
sudo usermod -aG docker $USER
su - $USER

For a current distribution, also see the Docker documentation because apt-key is deprecated.

Running a macOS 15 Sequoia VM in VMware

Fri, 28 Aug 2026 03:00:00 +0000

This rewrite follows the source tutorial in four sections: preparing VMware, creating the VM, installing macOS, and installing VMware Tools. The procedure requires a CPU with AVX2 support. Running macOS on non-Apple hardware may also be restricted by Apple’s license and VMware compatibility, so use it only lawfully. Take a snapshot before editing .vmx.

Prepare VMware and the Unlocker

Obtain a macOS Sequoia ISO lawfully, or create one using the source video.
Download VMware Workstation Player and MacOS Unlocker.
Install VMware with the default options.
Extract the Unlocker, right-click Unlocker.exe, choose Run as administrator, and click Patch.
Wait for patching to finish.

Create the Sequoia VM

Launch VMware, choose Continue for free non-commercial use, then click Finish.
Choose Create a New Virtual Machine.
Select Installer disc image file (iso), browse to the ISO, and click Next.
Select Apple Mac OS X and macOS 13, or the closest version to macOS 15, then Next.
Name the VM MacOS15, choose its storage path, and click Next.
Set the disk size, choose to store it as a single file, and click Next.
Open Customize Hardware…, assign 8 GB or more RAM and 4 cores, and set Network Adapter: Bridged.
Click Close > Finish. With the VM powered off, open its .vmx file.
Set or append:

board-id.reflectHost = "FALSE"
ethernet0.virtualDev = "vmxnet3"
board-id = "Mac-AA95B1DDAB278B95"
hw.model.reflectHost = "FALSE"
hw.model = "iMac20,1"
serialNumber.reflectHost = "FALSE"
serialNumber = "C01234567890"

Return to VMware, right-click MacOS15, and choose Power On.

Install macOS Sequoia

Select a language, then choose Disk Utility.
Select VMware Virtual SATA Hard Drive Media and click Erase.
Name it MacOS, choose APFS, click Erase > Done, and close Disk Utility.
Choose Install macOS > Continue > Agree > Agree, select MacOS, and click Install.
Wait while the VM reboots several times.
Select the country, language, and keyboard layout.
Choose Not Now for Accessibility and Migration Assistant; choose Continue for Data & Privacy.
On Apple ID, choose Set Up Later > Skip.
Accept the terms, create a local account, choose Location Services and a time zone.
Clear Share Mac Analytics with Apple, choose Set Up Later for Screen Time, choose a theme, and reach the desktop.

Install VMware Tools

Right-click Install macOS on the desktop and choose Eject.
Open Player > Removable Devices > CD/DVD > Settings.
Click Browse, open the Unlocker tools folder, select darwin.iso, check Connected, and click OK.
In macOS, open VMware Tools and run the installer.
Open Security, scroll down, click Allow beside VMware, and reboot.
After rebooting, run the installer again and reboot once more after it succeeds.

Tài trợ / Quảng cáo

Checks

Confirm that the VM can reboot, has networking, and sees its assigned resources. If it will not boot, restore the snapshot and recheck AVX2, VMware compatibility, and the .vmx lines. Do not use the sample serial as a real identity.

Audit and Manage OpenWrt Base Services

Fri, 28 Aug 2026 01:00:00 +0000

Before installing DNS, DDNS, VPN, or another service, record what is running, which ports are listening, where configuration lives, and how the init script behaves.

1. Record the baseline

ubus call system board
cat /etc/openwrt_release
free -h
df -h
uci show system
uci show dhcp
ls -l /etc/init.d/
service list 2>/dev/null || true
ss -lntup 2>/dev/null || netstat -lntup

Record each port, process, bind address, interface, and service owner.

2. Inspect logs and dependencies

logread | tail -n 100
logread -e dnsmasq
logread -e netifd
ps w

Before replacing DNS, determine whether dnsmasq provides DHCP, DNS forwarding, or both. Do not stop it simply because an external guide says so.

Block-Level NOR Backups on OpenWrt

Fri, 28 Aug 2026 01:00:00 +0000

This guide covers block-level flash backups on NOR-based OpenWrt devices. It is different from sysupgrade -b, which archives configuration files. The goal is to preserve MTD partition contents for analysis or targeted recovery.

Warning: Confirm that the device uses NOR before following this procedure. Do not use dd casually on NAND; NAND requires tools that understand ECC and bad-block handling. Never write a dump from another device. Bootloader, ART/NVRAM, factory/calibration, and similar partitions may contain device-specific data; losing them can remove Wi-Fi calibration or MAC data and may prevent booting.

Building a bridged Wi-Fi AP with LuCI, DHCP, and configuration files

Fri, 28 Aug 2026 01:00:00 +0000

OpenWrt can act as a bridged access point, but “bridge” does not mean that every port can be used interchangeably. This guide uses a simple LAN-to-LAN design: the main router provides DHCP and DNS while OpenWrt only provides Wi-Fi and forwards traffic to the main LAN.

Warning: connect the management computer to the correct LAN port, back up the network configuration first, and keep a direct recovery path. Never run two DHCP servers on the same LAN.

Install Debian Sid in a Proxmox VE VM

Fri, 28 Aug 2026 01:00:00 +0000

Debian Sid is Debian’s rolling/unstable branch and is better suited to a HomeLab experiment than a production service. This article adapts the complete installation sequence from i12bretro and uses placeholders for accounts so credentials are not published.

Source reference: i12bretro – Debian Sid in Proxmox VE. The original video belongs to i12bretro on YouTube.

What is Debian Sid?

Sid is a rolling/unstable branch where packages can change quickly. Take a VM snapshot before upgrades and do not use this VM as the only copy of important data.

Installing and expanding OpenWrt on x86: PC, VM, and server

Fri, 28 Aug 2026 01:00:00 +0000

OpenWrt on x86 uses different images and installation steps from a conventional router flash. Distinguish a combined image with a partition table from a filesystem-only image, and identify the destination disk before writing. One incorrect dd target can erase an entire server.

Choose the image and identify the disk

Download the image for the intended use from the OpenWrt x86 documentation. For bare-metal installs, a generic-ext4-combined image normally contains boot and rootfs. For a VM, select a disk/controller that matches the hypervisor and decide whether it boots through BIOS or UEFI.

OpenWrt Network Configuration with UCI: Devices and Interfaces

Fri, 28 Aug 2026 01:00:00 +0000

This guide keeps the complete practical workflow for editing /etc/config/network. UCI separates physical devices, bridges, logical interfaces, addresses, and routes. Confusing these layers can immediately disconnect LAN or SSH.

1. Prepare and back up

Use wired LAN or a console when changing WAN, bridge, or VLAN settings. Record the model, release, current address, and recovery method. Create a configuration archive and a direct copy:

sysupgrade -b /tmp/config-backup.tar.gz
cp /etc/config/network /tmp/network.before
ubus call system board
ip -br link
ip -br addr

2. Inspect the current model

cat /etc/config/network
uci show network
ip addr
ip route

A config device describes a low-level device or bridge. A config interface describes a logical network such as lan or wan. A logical name is not necessarily an Ethernet card name. Wireless interfaces should normally be attached through the network option in /etc/config/wireless; do not assume dynamic Wi-Fi names are stable devices.

OpenWrt owut: controlled upgrades and package handling

Fri, 28 Aug 2026 01:00:00 +0000

owut is a shell-based OpenWrt upgrade tool. It cannot make an image for the wrong target safe, and it is not a substitute for a backup. A controlled upgrade checks the board, release, packages, and free space before allowing a reboot and flash.

Do not start with owut upgrade. Keep a spare SSH/LuCI access path and copy the configuration off the router first.

Inspect the router and create a backup

ubus call system board
cat /etc/openwrt_release
df -h
sysupgrade -b /tmp/config-backup.tar.gz

Copy /tmp/config-backup.tar.gz to another machine. Record the model, target/subtarget, current release, extra packages, and the device’s recovery method.

Organizing OpenWrt Interfaces and Firewall Zones

Fri, 28 Aug 2026 01:00:00 +0000

OpenWrt firewall policy is applied through zones. A zone contains one or more logical networks; forwarding controls traffic between zones.

1. Back up and identify the backend

sysupgrade -b /tmp/firewall-network-backup.tar.gz
cp /etc/config/firewall /tmp/firewall.before
cp /etc/config/network /tmp/network.before
ubus call system board
uci show firewall
uci show network

Newer releases commonly use firewall4/nftables; older releases may use firewall3/iptables. Do not mix configuration or inspection commands without checking the release.

2. Understand the baseline

Typical policy boundaries are lan (trusted management), wan (outside), and guest (untrusted Internet-only). Inspect existing sections before adding duplicates:

Reducing bufferbloat on OpenWrt with SQM and CAKE

Fri, 28 Aug 2026 01:00:00 +0000

Bufferbloat occurs when a network device builds an oversized queue while the link is full. Latency rises even though download and upload speed still look high. OpenWrt SQM controls that queue by shaping traffic; it does not increase the line rate.

Measure first

Measure the connection while idle and during a loaded download/upload test. Record the real WAN rates rather than the advertised plan. SQM normally needs a value below the measured rate to leave headroom; 90% is only a starting point, not a universal setting.

Run Debian Sid in VirtualBox for a Lab

Fri, 28 Aug 2026 01:00:00 +0000

This article adapts the complete VirtualBox workflow for running Debian Sid, useful for testing packages and Linux procedures without touching a physical host. Debian Sid is rolling/unstable, so take a snapshot before major changes.

Source reference: i12bretro – Debian Sid in VirtualBox. The original video belongs to i12bretro on YouTube.

Create the VM and attach the ISO

Download Debian Unstable/Sid, for example the Debian mini.iso.
Open VirtualBox.
Select Machine > New.
Finish the initial VM wizard and click Create.
In Create Virtual Hard Disk, create a disk sized for the lab and click Create.
Select the VM and open Settings > System > Processor.
Assign at least 2 processors.
Open Display and set Video Memory to 128 MB.
Open Network and select Bridged Adapter if the VM must appear as a separate LAN device; use NAT when it only needs Internet access.
Open Storage and select the CD-ROM drive.
Open the disk menu on the right and choose Choose a virtual optical disc file….
Select the downloaded Debian mini.iso.
Click OK.
Select the Debian Sid VM and click Start > Normal.

Install Debian Sid

When the installer appears, press Enter to select Install.
Select a language.
Select a location.
Select a keyboard layout.
Enter a hostname.
Enter a domain name or leave it empty.
Choose a mirror location.
Choose a mirror.
Enter an HTTP proxy if needed, or leave it empty.
Leave the root password empty, press Enter, and press Enter again to confirm.
Enter the full name for the new user.
Enter the username.
Enter and confirm the user’s password.
Select a timezone.
Select Guided - use entire disk.
Select VBOX HARDDISK.
Select All files in one partition.
Select Finish partitioning and write changes to disk.
Select Yes to write the changes.
Select a country for the apt mirror.
Select a mirror.
Configure the HTTP proxy if necessary.
Choose whether to participate in the package usage survey.
Select the optional software to install.
Wait while Debian Sid installs its files.
Select Yes to install GRUB.
Select /dev/sda as the boot loader location.
Press Enter after installation to reboot.
If VirtualBox boots the installer again, use Devices > Optical Drives to remove the ISO.
Log into Debian Sid with the account created during installation.
Confirm that the system has loaded.

Tài trợ / Quảng cáo

Install Guest Additions

From the VM menu, select Devices > Insert Guest Additions CD image….
Open Files.
Select the Guest Additions Disc.
Right-click the empty area and choose Open terminal here.
Update repositories:

sudo apt update

Install available updates:

sudo apt upgrade -y

Clean the apt cache:

sudo apt clean

Install build tools, DKMS, and the current kernel headers:

sudo apt-get install build-essential dkms linux-headers-$(uname -r)

Run the Guest Additions installer:

sudo sh ./VBoxLinuxAdditions.run

Reboot the VM:

sudo reboot

After reboot, test full-screen mode and confirm that the resolution follows the window size.
Log back into Debian.

Note: Bridged Adapter puts the VM on the physical LAN. Debian Sid is less predictable than stable; NAT and snapshots are safer for initial experiments.

Run HomeDash on Linux: a Lightweight HomeLab Dashboard

Fri, 28 Aug 2026 01:00:00 +0000

HomeDash is a Java dashboard for collecting information about HomeLab services and servers. This article keeps the complete command sequence from the i12bretro tutorial while resolving the latest release through the GitHub API instead of committing a binary to the repository.

Source reference: i12bretro – Run HomeDash on Linux. The original video belongs to i12bretro on YouTube.

Install Java and Maven

Log into the Linux device.
Update the package list:

sudo apt update

Install available updates:

sudo apt upgrade -y

Install the default JDK and Maven:

sudo apt install default-jdk maven -y

Check Java:

java --version

Check Maven:

mvn -version

Download and run HomeDash

Create the working directory:

sudo mkdir /opt/homedash2 -p

Assign the directory to the current user:

sudo chown $USER:$USER /opt/homedash2 -R

Change into the directory:

cd /opt/homedash2

Resolve the latest JAR release URL through the GitHub API:

regex='"browser_download_url": "(https:\/\/github.com\/lamarios\/Homedash2\/releases\/download\/[^/]*\/Homedash-[^/]*\.jar)"'
response=$(curl -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/lamarios/Homedash2/releases/latest)
[[ $response =~ $regex ]] && downloadURL="${BASH_REMATCH[1]}"

Download the JAR to a fixed local filename:

wget -O ./homedash.jar $downloadURL

Generate the configuration file:

java -jar ./homedash.jar -create-config

Run HomeDash with the generated configuration:

java -Dconfig.file=/opt/homedash2/homedash.properties -jar homedash.jar

Open http://DNSorIP:4567 in a browser.
Confirm that the HomeDash page is available.

Tài trợ / Quảng cáo

Operations note: Do not expose port 4567 directly to the Internet. Use a VPN or an authenticated reverse proxy for remote access. Protect homedash.properties, inspect logs, and create a systemd unit only after confirming the Java/JAR versions work together.

Run macOS Sequoia 15 in a Proxmox VE VM

Fri, 28 Aug 2026 01:00:00 +0000

This article adapts i12bretro’s complete workflow for running macOS Sequoia 15 in Proxmox VE. It is a HomeLab experiment; verify licensing, hardware compatibility, and the ability to recover the VM before using it for anything important.

Source reference: i12bretro – Running a MacOS 15 Sequoia VM in Proxmox VE. The original video belongs to i12bretro on YouTube.

Files and prerequisites

A CPU with AVX2 support for macOS versions newer than 12.
A legally obtained macOS Sequoia ISO. The source tutorial references Internet Archive; verify your own usage rights.
The KVM OpenCore bootloader ISO from KVM-OpenCore releases.
The KVM OpenCore EFI folder for the post-install EFI step.
MountEFI from GitHub.
An unused VM ID; the examples below use 1500.

Create the VM in Proxmox

Upload the Sequoia ISO and KVM OpenCore ISO to the Proxmox ISO library.
Log into the Proxmox Web UI.
Right-click the Proxmox node name and select Create VM.
Set the VM name to MacOSSequoia; use VM ID 1500 if it is free, then click Next.
On OS, choose Type: Other and select the KVM OpenCore ISO in ISO Image, then click Next.
On System, set Graphic card to VMware compatible.
Set BIOS to OVMF (UEFI).
Clear Pre-Enroll Keys.
Enable Add EFI Disk.
Set Machine to q35.
Set SCSI Controller to VirtIO SCSI, then click Next.
On Hard Disk, set Bus/Device to VirtIO Block.
Set the disk size to 64 GB or more.
Set Cache to Write back (unsafe), then click Next.
On CPU, set Cores to 4 and Type to host, then click Next.
On Memory, assign 8192 MB or more, then click Next.
On Network, set Model to VMware vmxnet3, then click Next.
Verify the summary and click Finish.

Attach the Sequoia ISO and edit the VM configuration

Select MacOSSequoia and open Hardware.
Choose Add > CD/DVD Drive.
Select the uploaded Sequoia ISO and click Add.
Right-click the Proxmox node and open Console.
Edit the VM configuration. Replace 1500 if the VM ID is different:

nano /etc/pve/qemu-server/1500.conf

On an Intel host, append this line to the configuration:

args: -device isa-applesmc,osk="ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc" -smbios type=2 -device qemu-xhci -device usb-kbd -device usb-tablet -global nec-usb-xhci.msi=off -global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=off -cpu host,vendor=GenuineIntel,+invtsc,+hypervisor,kvm=on,vmware-cpuid-freq=on

On an AMD host, use this CPU argument instead:

args: -device isa-applesmc,osk="ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc" -smbios type=2 -device qemu-xhci -device usb-kbd -device usb-tablet -global nec-usb-xhci.msi=off -global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=off -cpu Haswell-noTSX,vendor=GenuineIntel,+invtsc,+hypervisor,kvm=on,vmware-cpuid-freq=on

Press Ctrl+W and search for ,media=cdrom.
Remove ,media=cdrom from the KVM OpenCore and Sequoia ISO entries.
Add cache=unsafe to the two ISO devices according to the source workflow.
Press Ctrl+O, Enter, then Ctrl+X to save and exit nano.

Install macOS Sequoia

Return to the Proxmox Web UI, right-click MacOSSequoia, and select Start.
Open Console.
At the OpenCore menu, press Enter to start the installer.
If Install macOS is not listed, select UEFI Shell and press Enter.
In the UEFI Shell, switch to the filesystem containing the Sequoia ISO. The number may differ:

fs0:

Launch the installer:

System\Library\CoreServices\boot.efi

Wait through the initialization sequence until macOS Setup appears.
Select Disk Utility.
Select VIRTIO Block Media and click Erase.
Name the disk MacOS, choose APFS, and click Erase.
Click Done and close Disk Utility.
Select Install macOS Sequoia.
Click Continue, Agree, and Agree again.
Select the formatted macOS disk and click Install.
Wait while macOS copies files; the VM will reboot several times.
Select the country or region and click Continue.
Confirm the languages and keyboard layout and click Continue.
Select Not Now on the Accessibility screen.
Click Continue on Data & Privacy.
Select Not Now on Migration Assistant.
On the Apple ID screen, choose Set Up Later, then choose Skip.
On Terms and Conditions, click Agree, then Agree again.
Enter a name, username, and password, then click Continue.
Click Continue, then choose Use or Don’t Use for Location Services.
Select a timezone and click Continue.
Clear Share Mac Analytics with Apple and click Continue.
Select Set Up Later on Screen Time.
Select a theme and click Continue.
Confirm that macOS Sequoia 15 has loaded.

Tài trợ / Quảng cáo

Configure booting without the OpenCore ISO

Log into the MacOSSequoia VM.
Open a browser and download the KVM OpenCore EFI folder.
Download MountEFI from GitHub.
Open LaunchPad from the dock.
Search for Terminal and launch it.
Run:

cd ~/Downloads/MountEFI-update
chmod +x MountEFI.command
./MountEFI.command

Enter the number corresponding to the macOS disk created during installation, for example 2, and press Enter.
Open a Finder window.
Navigate to the mounted EFI location.
If an EFI folder already exists, rename it to EFI.orig as a backup.
Copy the downloaded KVM OpenCore EFI folder to the mounted EFI partition.
Shut down the VM after the copy completes.
In Proxmox, select MacOSSequoia and open Hardware.
Select the OpenCore ISO and click Detach.
Select the macOS Sequoia ISO and click Detach.
Right-click MacOSSequoia and select Start.
Open Console and confirm that Sequoia still boots without the OpenCore disk image mounted.

Warning: This is an experimental workflow. Snapshot or back up the VM configuration before updates, avoid untrusted ISO/EFI files, and verify the macOS license before use.

Self-Host BookStack on Linux

Fri, 28 Aug 2026 01:00:00 +0000

BookStack is a self-hosted wiki platform for organizing HomeLab documentation. This article adapts the complete Linux installation flow from i12bretro, including Apache, MariaDB, PHP, Composer, the .env file, and the Apache site configuration. Example credentials from the source are replaced with placeholders; generate your own secrets during deployment.

Source reference: i12bretro – Install BookStack on Linux. The original video belongs to i12bretro on YouTube.

Requirements

A Linux host with sudo access.
A hostname or domain for BookStack.
MariaDB, Apache, and PHP compatible with the BookStack release being installed.
A separate database password and an app key generated by Artisan.

Install the base packages

Log into the Linux host.
Update the package list:

sudo apt update

Install available updates:

sudo apt upgrade -y

Install the required tools:

sudo apt install git openssl curl wget zip composer -y

Install Apache and MariaDB:

sudo apt install apache2 mariadb-server mariadb-client -y

Install PHP and the extensions commonly required by BookStack:

sudo apt install php libapache2-mod-php php-curl php-tokenizer php-ldap php-cli php-json php-gd php-mbstring php-mysql php-xml php-zip php-bcmath -y

Secure MariaDB

Start the MariaDB security wizard:

sudo mysql_secure_installation

Press Enter at the root login prompt if the installation does not yet have a root password.
Choose Y to set a root password and enter it twice. Never put the real password in this article, logs, or Git.
Choose Y to remove anonymous users.
Choose Y to disallow remote root login.
Choose Y to remove the test database.
Choose Y to reload privilege tables.
Log into MariaDB:

mysql -u root -p

Enter the root password created earlier.
Create a dedicated BookStack database and user. Replace [DB_PASSWORD] with a secret stored outside the repository:

CREATE DATABASE bookstack;
GRANT ALL ON bookstack.* TO 'bookstack_rw'@'localhost' IDENTIFIED BY '[DB_PASSWORD]';
FLUSH PRIVILEGES;
EXIT;

Exit the shell if necessary:

exit

Download BookStack and create the environment file

Clone the release branch into /var/www/bookstack:

sudo git clone https://github.com/BookStackApp/BookStack.git --branch release --single-branch /var/www/bookstack

Copy the sample environment file:

sudo cp /var/www/bookstack/.env.example /var/www/bookstack/.env

Open the configuration file:

sudo nano /var/www/bookstack/.env

Adjust the main variables below. Do not use sample passwords, mail hosts, or app keys:

APP_ENV=production
APP_DEBUG=false
APP_KEY=
APP_URL=http://DNSorIP/bookstack
APP_TIMEZONE=Asia/Ho_Chi_Minh
APP_LOCALE=en

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_DATABASE=bookstack
DB_USERNAME=bookstack_rw
DB_PASSWORD=[DB_PASSWORD]

MAIL_DRIVER=smtp
MAIL_HOST=[SMTP_HOST]
MAIL_PORT=25
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDR=bookstack@[YOUR_DOMAIN]
MAIL_FROM_NAME='BookStack'
MAIL_REPLYTO_ADDR=bookstack@[YOUR_DOMAIN]
MAIL_REPLYTO_NAME='BookStack'
MAIL_AUTO_EMBED_METHOD='attachment'

Set APP_URL to the real URL. Use https:// when the site is served through HTTPS.
Press Ctrl+O, Enter, then Ctrl+X to save and close nano.

Install dependencies and generate the app key

Set the BookStack directory owner:

sudo chown -R www-data:www-data /var/www/bookstack

Create the Composer working directory and assign its owner:

sudo mkdir /var/www/.composer
sudo chown -R www-data:www-data /var/www/.composer

Change into the BookStack directory:

cd /var/www/bookstack

Install production dependencies:

sudo -u www-data composer install --no-dev --no-plugins

Generate the app key with Artisan:

sudo php artisan key:generate --no-interaction --force

Run the database migration:

sudo php artisan migrate --no-interaction --force

Open the Apache site configuration:

sudo nano /etc/apache2/sites-available/bookstack.conf

Add the following configuration and adjust the path/domain if using a different deployment path:

Alias /bookstack "/var/www/bookstack/public"
<Directory /var/www/bookstack/public>
 Options Indexes FollowSymLinks
 AllowOverride None
 Require all granted

 <IfModule mod_rewrite.c>
 <IfModule mod_negotiation.c>
 Options -MultiViews -Indexes
 </IfModule>

 RewriteEngine On

 RewriteCond %{HTTP:Authorization} .
 RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteCond %{REQUEST_URI} (.+)/$
 RewriteRule ^ %1 [L,R=301]

 RewriteCond %{REQUEST_FILENAME} !-d
 RewriteCond %{REQUEST_FILENAME} !-f
 RewriteRule ^ index.php [L]
 </IfModule>
</Directory>

Press Ctrl+O, Enter, then Ctrl+X to save the file.
Enable rewrite, enable the BookStack site, and restart Apache:

sudo a2enmod rewrite
sudo a2ensite bookstack
sudo systemctl restart apache2

Tài trợ / Quảng cáo

Complete the Web Installer

Open http://DNSorIP/bookstack.
Use the default first-login information only when confirmed by the BookStack version documentation; immediately replace it with a unique account and password.
Open the user dropdown in the top-right corner and select My Account.
Update the username and email, then click Save.
Select Access & Security in the left navigation.
Enter and confirm a new password, then click Update.
Open the user dropdown and select Logout.
Log in again with the updated email and password.
Verify that BookStack can read the database, write uploads, and load the wiki pages.

Operations note: Enable HTTPS, back up both the database and /var/www/bookstack, protect .env, disallow remote MariaDB root login, and test compatibility before updating the release branch.

Separating Guest Wi-Fi with OpenWrt VLAN and Firewall

Fri, 28 Aug 2026 01:00:00 +0000

A different SSID is not a security boundary. This procedure separates the guest network at the network/VLAN layer, gives it its own DHCP scope, attaches the SSID to the correct interface, and permits only Internet forwarding.

1. Model and prerequisites

Example: management/LAN VLAN 10 with 192.168.1.0/24, guest VLAN 20 with 192.168.20.0/24, and a trunk between router, switch, and AP. Confirm VLAN tagging support and the target’s DSA/switch layout. Names such as br-guest and eth0.20 are not universal.

Upgrading OpenWrt with LuCI and CLI without accidental configuration loss

Fri, 28 Aug 2026 01:00:00 +0000

Upgrading OpenWrt writes firmware. “Keep configuration” does not mean that every package and local change will remain valid. Before using LuCI or the CLI, confirm the model/target, image, release, and recovery path.

Prepare and back up

ubus call system board
cat /etc/openwrt_release
df -h
sysupgrade -b /tmp/config-backup.tar.gz

Copy the backup off the router. A configuration archive is not a full flash dump and cannot restore a damaged bootloader or ART partition. For an important device, prepare the model-specific UART or recovery method.

Run Home Assistant in Docker

Thu, 27 Aug 2026 13:25:00 +0000

Home Assistant is an open-source home automation platform that works well on a Linux server or HomeLab. This article adapts the Docker-based setup and stores the application configuration in a dedicated directory.

Source reference: i12bretro – Running Home Assistant in Docker. The original video belongs to i12bretro on YouTube.

Install Docker on Linux

On the Linux host, run the following commands to install Docker:

Install OPNsense Firewall/Router in VirtualBox

Thu, 27 Aug 2026 13:20:00 +0000

This article adapts the installation of OPNsense in VirtualBox with two network adapters for a HomeLab firewall/router test. Identify the WAN and LAN roles before connecting the VM to a physical network.

Source reference: i12bretro – Install OPNsense in VirtualBox. The original video belongs to i12bretro on YouTube.

Create the virtual machine

Download OPNsense from opnsense.org/download.
Extract the .bz2 archive and open VirtualBox.
Select Machine > New.
Name the VM OPNSense, set Type to BSD, and Version to FreeBSD (64-bit).
Assign 1024 MB of memory and create a virtual hard disk.
Name the disk OPNSense.vdi, set its size to 8 GB, choose VDI, and use Dynamically Allocated storage.
Open Settings > Display and set Video Memory to 128 MB.
Open Storage and attach the OPNsense ISO to the CD-ROM drive.
In Network, set Adapter 1 to Bridged Adapter.
Enable Adapter 2 and also set it to Bridged Adapter.

Install OPNsense

Start the VM with Start > Normal and wait for the login prompt.
Log in to the installer with installer / opnsense.
Press Enter at the Welcome screen.
Change the keymap or video font if necessary, then select Accept these Settings.
Select Guided installation.
Select the ada0 disk and choose GPT/UEFI mode.
Wait for OPNsense to copy files and complete the installation.
Set and confirm a new root password, then choose Accept and Set Password.
Select Reboot.
Before rebooting, use VirtualBox Devices > Optical Drives > Remove disk from virtual drive.
Select Machine > Reset so the VM boots from its virtual disk.

Configure the LAN and Web UI

Log in to the terminal as root with the new root password.
Select Set interface IP address by entering 2.
Select the interface that will be used as LAN.
Enter n at the DHCP prompt.
Enter a LAN IP on the same subnet as the management network.
Enter bit count 24 when using a /24 subnet.
Leave the IPv4 upstream gateway empty.
Enter n for IPv6 WAN tracking.
Enter n for IPv6 DHCP, then leave the IPv6 address empty.
Enter n at the DHCP server prompt.
Enter y at the revert-to-HTTP prompt if this is only initial setup on a trusted LAN.
Record the Web UI address shown by the terminal.
Open that address in a browser and log in as root with the new password.

Tài trợ / Quảng cáo

Warning: Do not keep the default password. Bridged Adapter can place OPNsense directly on the physical network; assigning the two adapters incorrectly can create a loop or interrupt connectivity.

Connect to Your HomeLab Remotely with Tailscale in Docker

Thu, 27 Aug 2026 13:15:00 +0000

Tailscale creates a private WireGuard-based network for reaching HomeLab services without exposing every service port to the Internet. This article adapts the Docker-based setup and enables subnet routing into a LAN.

Source reference: i12bretro – Tailscale in Docker. The original video belongs to i12bretro on YouTube.

Prepare the Tailscale account

Open login.tailscale.com and sign in with an available SSO method.
Open DNS > Add nameserver > Custom….
Enter the DNS server used by the LAN and click Save.
Open Settings > Keys under Personal Settings.
Click Generate auth key…, enable Reusable, and generate the key.
Keep the auth key secure for the container step. Never place the real key in Markdown, logs, or Git.

Install Docker on the Linux host

On the Linux machine that will run the gateway, install Docker and enable its service:

Run Home Assistant OS as a VM on Proxmox VE

Thu, 27 Aug 2026 13:10:00 +0000

This article adapts the process of creating a Home Assistant OS (HAOS) VM on Proxmox VE, downloading the latest qcow2 image from GitHub, and importing it into Proxmox storage. The CPU and memory values are starting points; adjust them for the actual integrations and add-ons in use.

Source reference: i12bretro – Running HAOS VM in Proxmox VE. The original video belongs to i12bretro on YouTube.

Tài trợ / Quảng cáo

Create the HAOS VM on Proxmox

Log into the Proxmox Web UI.
Right-click the Proxmox node and select Create VM.
Assign a unique VM ID and name; record the VM ID for the disk import step.
On the OS tab, select Do not use any media, leaving Type as Linux and Version as 5.x - 2.6 Kernel.
On the System tab, select BIOS OVMF (UEFI), enable Add EFI Disk, and disable Pre-Enroll Keys.
On the Hard Disk tab, delete the default scsi0 disk.
On the CPU tab, assign at least 2 cores and set Type to host.
On the Memory tab, set memory to 2048 MB or more as needed.
Keep the defaults on the Network tab, verify the summary, and click Finish.

Download and import the qcow2 image

Select the Proxmox node and open Shell.
Install the xz extraction utility:

apt update
apt install xz-utils -y

Resolve the latest HAOS release image through the GitHub API:

regex='"browser_download_url": "(https:\/\/github.com\/home-assistant\/operating-system\/releases\/download\/[^/]*\/haos_ova-[^/]*\.qcow2\.xz)"'
response=$(curl -s https://api.github.com/repos/home-assistant/operating-system/releases/latest)
[[ $response =~ $regex ]] && downloadURL="${BASH_REMATCH[1]}"

Download the image to a temporary directory and extract it:

wget -O /tmp/HAOS.qcow2.xz $downloadURL
unxz /tmp/HAOS.qcow2.xz -v

Import the disk into the VM. Replace 104 with the real VM ID and SSD_100GB with a Proxmox storage name:

qm importdisk 104 /tmp/HAOS.qcow2 SSD_100GB

Attach the disk and boot HAOS

Return to the Web UI, select the HAOS VM, and open Hardware.
Double-click Unused Disk and click Add.
Open Options.
Double-click Boot Order, enable scsi0, and move it above net0.
Click OK, then click Start.
Open Console to confirm that HAOS has started.

Complete Home Assistant setup

Open http://DNSorIP:8123 in a browser.
Create a Home Assistant Name, Username, and Password.
Name the installation, for example Home.
Click Detect to set the installation location.
Verify the Unit System and Currency, then click Next.
Select any anonymous data to share with the Home Assistant development team.
Click Finish.

Note: Do not reuse the example VM ID or storage name unless they exist on the local system. Back up Proxmox and make sure the target storage has enough free space before importing the image.

Install AdGuard Home on an OpenWrt Router

Thu, 27 Aug 2026 13:05:00 +0000

AdGuard Home can act as a network DNS server that centrally filters ads and tracking domains. This article adapts the direct-on-router installation flow for OpenWrt; check RAM, flash storage, and the current owner of DNS port 53 before starting.

Source reference: i12bretro – Install AdGuard Home on an OpenWRT Router. The original video belongs to i12bretro on YouTube.

Tài trợ / Quảng cáo

Requirements

An OpenWrt router with working LuCI and SSH access.
The router CPU architecture: arm32, arm64, mipsel, or another supported target.
Enough storage for the binary, filters, query logs, and statistics.
The router IP address, SSH credentials, and a management computer.

AdGuard Home normally needs DNS port 53 to receive queries directly. Dnsmasq or another resolver may need to move to a different port, so inspect the current services before stopping anything.

Install pfSense Firewall/Router in VirtualBox

Thu, 27 Aug 2026 13:00:00 +0000

This article adapts the process of creating a pfSense virtual machine in VirtualBox with two network adapters for WAN and LAN. It focuses on the initial installation; network subnets, DHCP, and firewall rules should be designed for the actual lab topology.

Source reference: i12bretro – Install pfSense Firewall and Router in VirtualBox. The original video belongs to i12bretro on YouTube.

Tài trợ / Quảng cáo

Requirements

The pfSense installer from the official download page.
VirtualBox installed on the host.
Two network connections if the VM will operate as a router: one WAN and one LAN connection.
Back up the current network configuration before testing.

Create the VM and attach the ISO

Extract the pfSense .gz archive if the download is compressed.
Open VirtualBox, select Machine > New, create the VM, and click Create.
Create a virtual disk sized for the lab and finish the wizard.
Select the VM, open Settings > Display, and set Video Memory to 128 MB.
Open Storage, select the CD-ROM drive, then choose Choose a virtual optical disc file….
Select the pfSense ISO and click OK.
Open Network and set Adapter 1 to Bridged Adapter.
Open the Adapter 2 tab, enable it, and also select Bridged Adapter.
Click OK, select the VM, and choose Start > Normal.

Install pfSense

Press Enter to accept the copyright and distribution notice.
Select Install pfSense and press Enter.
Select the required keyboard mapping.
Select Auto (UFS) Guided Disk Setup.
Wait while pfSense copies files and installs to the virtual disk.
At Manual Configuration, select No.
Select Reboot.
Before the VM boots again, use Devices > Optical Drives > Remove disk from virtual drive in VirtualBox.
Select Machine > Reset so the VM boots from its virtual disk.

Assign the LAN address and open the Web UI

In the pfSense menu, select Set interface(s) IP address by entering 2.
Select the interface that will be used as LAN.
Enter a LAN address on the same subnet as the management computer.
Enter 24 at the bit-count prompt when using a /24 network.
Leave the IPv4 upstream gateway empty for the LAN interface.
Leave the IPv6 address empty if IPv6 is not being used.
Enter n when asked whether to enable the DHCP server; DHCP can be configured later in the Web UI.
Enter y when asked to revert to HTTP if this is only an initial setup on a trusted lab network.
Note the Web UI address shown in the terminal.
Open that address in a browser from the management computer.
Log in initially with admin / pfsense, then open System > User Manager.
Edit the admin account, set a new password, save it, log out, and log in again.

Warning: Do not keep the default password. Use Bridged Adapter only when the role of each interface is understood; an incorrect topology can create a loop or interrupt the physical network.

OpenWrt Multi-WAN with mwan3-nft: Requirements and Preparation

Thu, 27 Aug 2026 06:30:00 +0000

Multi-WAN allows a router to use several Internet connections for load balancing or failover. On newer OpenWrt releases, mwan3-nft is the nftables-compatible branch, but several requirements must be checked before installation.¹

Tài trợ / Quảng cáo

Version requirements

The OpenWrt documentation currently states that the nftables version of mwan3 is supported only on OpenWrt 25.12 or newer. Although OpenWrt has used firewall4 and nftables since 22.03, compatibility with older releases has not been verified.¹

Reduce Bufferbloat on OpenWrt with SQM for a Home Network

Thu, 27 Aug 2026 06:20:00 +0000

When someone downloads a file, watches video, or synchronizes large data, ping can rise sharply even though the connection is still fast. This is commonly called bufferbloat. On OpenWrt, SQM can control the queues and keep latency more stable.¹

Tài trợ / Quảng cáo

What does SQM solve?

SQM does not make an Internet plan faster. It schedules and regulates packets so the router does not keep too much data in its buffers. Latency-sensitive activities such as video calls, VoIP, and gaming are therefore less affected by background traffic.

Basic Network Configuration on OpenWrt with LuCI and UCI

Thu, 27 Aug 2026 06:10:00 +0000

In OpenWrt, a logical interface does not necessarily correspond to one physical Ethernet port.¹ An interface can represent a bridge, VLAN, Wi-Fi network, or tunnel. Understanding this helps avoid mistakes when adding VLANs or multiple WANs.

Three components to distinguish

Device: a lower-level network device or bridge.
Interface: a logical configuration containing a protocol, IP address, and gateway.
Firewall zone: a group of interfaces sharing firewall policies.

For example, lan can run on a bridge device containing several LAN ports and internal SSIDs.

OpenWrt Firewall Zone: Create a Guest Network with Internet-Only Access

Thu, 27 Aug 2026 06:00:00 +0000

Creating a Guest SSID alone does not protect the internal network. To prevent Guest clients from reaching NAS devices, cameras, or management interfaces, create a separate network and control forwarding with a firewall zone.¹

Suggested model

A simple model contains:

lan: the home network, allowed to access the router and internal services.
guest: the Guest network with its own DHCP service.
wan: the path to the Internet.

The Guest zone should:

Basic Wi-Fi Configuration on OpenWrt for Beginners

Thu, 27 Aug 2026 05:50:00 +0000

OpenWrt separates the physical radio from the Wi-Fi network configuration.¹ After installing the firmware, Wi-Fi may remain disabled until the radio is enabled, an SSID is configured, and the interface is attached to the correct network.

Preparation

Before configuring Wi-Fi, confirm:

The router is running firmware for the correct model.
The computer can access LuCI over Ethernet.
The name of the current LAN network, usually lan.
A country code appropriate for the location.

Configure Wi-Fi with LuCI

Open Network → Wireless.
Select the 2.4 GHz or 5 GHz radio.
Click Enable if the radio is disabled.
Click Edit on the Wi-Fi interface.
Set the SSID in General Setup.
Under Network, select lan.
Open Wireless Security and choose WPA2-PSK or WPA3-SAE if clients support it.
Set a strong password and click Save & Apply.

Do not reuse the same SSID for different networks unless you understand how the bridge and firewall zones work.

How to Safely Back Up and Restore OpenWrt Configuration

Thu, 27 Aug 2026 05:40:00 +0000

Once an OpenWrt configuration is stable, the first thing I usually do is create a backup.¹ It makes recovery much faster after testing packages, changing firewall rules, or upgrading firmware.

When should you create a backup?

Back up before:

Upgrading firmware.
Changing network, VLAN, or firewall settings.
Installing packages that affect DNS, DHCP, or Wi-Fi.
Moving a configuration to the same model and compatible firmware version.

A configuration backup does not replace firmware verification. A backup from one router may not be suitable for another model.

RouterOS v7: Route Clients Through Multiple WANs with Routing Rules

Thu, 27 Aug 2026 05:30:00 +0000

This article uses a real RouterOS 7.21.5 configuration to demonstrate how individual clients can be routed through multiple WANs. The IP addresses and interface names are kept in the examples so they can be compared with WinBox.

Do not copy the complete configuration to another router. Check interface names, gateways, routing tables, and IP ranges first.

Configuration goal

The goal is to select a WAN for each LAN client:

Client 10.0.0.10 uses VNPT1.
Client 10.0.0.11 uses VT2.
Client 10.0.0.12 uses the main table.
Client 10.0.0.15 uses VNPT1.
Client 10.0.1.25 uses VNPT1.

This is commonly called policy routing or source-based routing: the router selects a path based on the source address instead of using only one shared default route.¹

OpenWrt SDK and Toolchain: Choosing the Correct Build Tool

Thu, 27 Aug 2026 05:10:00 +0000

The SDK and toolchain can produce incompatible packages when the branch, target, or ABI differs. Always use the tool that matches the target firmware.

SDK, toolchain, and build system

These concepts are related but different:

Build system: the complete OpenWrt build environment. It can create the toolchain, kernel, root filesystem, packages, and firmware image.
Toolchain: the compiler and cross-compilation tools used to build for the target architecture, such as ARM or MIPS rather than the build computer’s CPU.
SDK: a smaller environment normally used to compile external packages for a known firmware target.

The SDK is useful when you need to build an individual package without rebuilding the entire firmware.

How to Use the OpenWrt ImageBuilder

Thu, 27 Aug 2026 05:05:00 +0000

ImageBuilder is suitable only when its version, target, subtarget, and profile match the router. Never use an ImageBuilder for another model.

What is ImageBuilder?

ImageBuilder is a precompiled environment for quickly creating a customized firmware image from packages already available in the repository. It can add or remove packages, add configuration files, and create a flashable image without compiling all of OpenWrt from source.

If you need to modify the kernel, drivers, target, or a package that has no matching binary, use the full source build system instead.

How to Build OpenWrt from Source for Beginners

Thu, 27 Aug 2026 05:00:00 +0000

This article is based on the official OpenWrt documentation, with additional explanations for beginners. Never flash an image built for one model onto another model without checking the target, profile, and recovery method.

When should you build OpenWrt from source?

A source build is useful when you want to customize the kernel, packages, patches, default configuration, or firmware for a specific target. If you only need to add packages to an existing image, ImageBuilder is usually faster and simpler.

TP-Link TL-AC100 v6.0: Hardware and Feature Overview

Thu, 27 Aug 2026 04:30:00 +0000

What is the TL-AC100 v6.0 used for?

The TP-Link TL-AC100 is a centralized controller for TP-Link access point systems. It can discover, authorize, and manage multiple APs from one interface, making it suitable for a large home network, a small office, or a shop that needs to manage several access points.

Tài trợ / Quảng cáo

Notable points of version 6.0

According to the acwifi.net teardown, the TL-AC100 v6.0 retains a metal enclosure and five Gigabit Ethernet ports. This is a notable improvement over versions up to v4.0, which used Fast Ethernet ports.

Xiaomi BE3600 Black Edition (RD16) Teardown: MediaTek Platform & Impressive 5GHz Range

Sun, 21 Jun 2026 09:00:00 +0000

Xiaomi BE3600 Black Edition (RD16) Teardown: MediaTek Platform & Impressive 5GHz Range

Sun, 21 Jun 2026 09:00:00 +0000

Following the release of the Qualcomm-powered white version, Xiaomi released a new Black Edition of the BE3600, designated under product model RD16.

While it carries the identical BE3600 commercial badge, the internals are entirely different: Xiaomi replaced the entire Qualcomm platform with a MediaTek / Airoha chipset, omitted the 2.5GbE port, and fitted four standard Gigabit Ethernet ports.

Xiaomi BE3600 1.25A White Teardown: Internal Hardware & Cost-Down Analysis

Thu, 11 Jun 2026 09:00:00 +0000

Xiaomi BE3600 1.25A White Teardown: Internal Hardware & Cost-Down Analysis

Thu, 11 Jun 2026 09:00:00 +0000

The popular budget Wi-Fi 7 router Xiaomi BE3600 has recently seen a new hardware revision in the market. In this article, we tear down the Xiaomi BE3600 1.25A white version.

We specifically designate this unit as the 1.25A White version for two main reasons:

Xiaomi subsequently introduced a black version under model code RD16 (which features all 1Gbps Gigabit Ethernet ports without the 2.5G port).
The initial white BE3600 batches shipped with a 12V / 1.5A DC power adapter, whereas this recent production batch ships with a 12V / 1.25A power supply.

The unit examined here was manufactured in April 2024. Its serial number (SN) prefix remains 54817, and its product model number is still officially RD15.

TP-LINK 7DR7299 No-Disassembly OpenWrt Flashing Guide & Performance Benchmark

Fri, 27 Mar 2026 08:00:00 +0000

The TP-LINK TL-7DR7299 Wi-Fi 7 router is powered by the MediaTek MT7988AV (Filogic 880) quad-core Cortex-A73 SoC @ 1.8GHz, complemented by 1GB of RAM and a potent dual 10G + quad 2.5G port array. Recently, a breakthrough flashing method has emerged that allows deploying OpenWrt / ImmortalWrt on this device without physical disassembly or UART soldering.

Here is a hands-on walkthrough of the web-based flashing procedure, CoreMark CPU benchmark results, Argon theme and iStore deployment, as well as an honest look at existing software limitations.

TP-LINK TL-7DR7299 BE7200 Specifications and Firmware

Thu, 26 Mar 2026 01:00:00 +0000

I. Overview

The TP-Link TL-7DR7299 is a dual-band BE7200 Wi-Fi 7 router housed in TP-Link’s renowned “Feiliu” chassis. It delivers a standout combination of multi-gigabit interfaces and powerful processing at an accessible price point (~999 RMB / $140 USD):

Processor (SoC): MediaTek MT7988AV (Filogic 880) featuring 4x ARM Cortex-A73 cores at 1.8GHz on an efficient 12nm process, with dual 10G USXGMII buses.
Memory: 1GB DDR4 RAM (2x 512MB EtronTech) and 128MB SPI NAND Flash.
Port Array: Dual 10G interfaces (1x 10G SFP+ optical cage and 1x 10G RJ45 copper port), four 2.5GbE ports, two 1GbE ports, and a USB 3.0 Type-C port.
Wireless Performance: Wi-Fi 7 BE7200 (2.4GHz 1376 Mbps + 5GHz 5765 Mbps) with 4T4R on 2.4G and 4T5R on 5G, supported by high-power external Front-End Modules (Vanchip VC5333 + Kangxi KCT8548HE-1).
Custom Firmware: Supported by OpenWrt / ImmortalWrt builds with a web-based flashing method requiring no physical chassis disassembly.

II. Detailed Hardware Specifications

Category	Hardware Details
Model	TP-LINK TL-7DR7299 (Hardware Ver: 1.0)
Wi-Fi Standard	IEEE 802.11a/b/g/n/ac/ax/be (Wi-Fi 7 BE7200)
Max Wireless Rates	2.4GHz: 1376 Mbps (40MHz, 4096-QAM)
5GHz: 5765 Mbps (160MHz, 4096-QAM)
Antenna Layout	6 external antennas (1 dual-band 2.4G/5G, 1 dedicated 2.4G, 4 dedicated 5G)
2.4G: 4T4R, 5G: 4T5R
Processor (SoC)	MediaTek MT7988AV (Quad-core Cortex-A73 @ 1.8GHz, 12nm)
RAM	1GB DDR4-3200 (EtronTech M16U4G16256A-QLBG x2)
Flash Memory	128MB SPI NAND (ESMT F50L1G41LC)
Switch & PHY Silicon	2.5G Switch: Realtek RTL8372N (2x 10G USXGMII + 4x 2.5G PHY)
10G PHY: Realtek RTL8261D (100M/1G/2.5G/5G/10G)
Physical I/O	- 1x 10G SFP+ optical cage

1x 10G RJ45 copper port
4x 2.5GbE RJ45
2x 1GbE RJ45
1x USB 3.0 Type-C (ASMedia ASM1543 controller) | | Wireless Features | 802.11k/v Fast Roaming, MU-MIMO, Beamforming, MLO, 4096-QAM | | Power Supply | Included 12V/4A (48W). Real consumption: 8.2W (idle) to 13.8W (all ports linked) |

III. Featured Articles for TP-LINK 7DR7299

1. Hardware Teardown & Component Analysis

Explore the internal layout, aluminum heat spreaders, individual chip packages, and the 14.21 Mpps small-packet test: 👉 TP-Link TL-7DR7299 Teardown: BE7200 Wi-Fi 7, Dual 10G Ports, Quad 2.5G Ports, and MediaTek MT7988A

TP-LINK TL-7DR7299 Teardown: BE7200 Wi-Fi 7, Dual 10G Ports, Quad 2.5G Ports

Thu, 26 Mar 2026 01:00:00 +0000

TP-LINK TL-7DR7299 Teardown: BE7200 Wi-Fi 7, Dual 10G Ports, Quad 2.5G Ports

Thu, 26 Mar 2026 01:00:00 +0000

The TP-Link TL-7DR7299 might easily be the coolest-running wireless router to date housed in the iconic “Feiliu” dual-band chassis (the classic mold shared with the XDR5480, XDR6080, and 7DR7290).

In the dual-band BE7200 Wi-Fi 7 space, the 7DR7299 makes a bold statement by packing dual 10-Gigabit ports (one 10G SFP+ optical cage and one 10G RJ45 copper port), accompanied by four 2.5GbE ports, two Gigabit ports, and a USB 3.0 Type-C interface—all under a price tag of roughly 999 RMB (around $140 USD).

KiddoCare: The All-in-One Digital Journal & Pediatric Growth Assistant

Tue, 23 Dec 2025 16:00:00 +0000

Medical Disclaimer: The app provides information derived from established research published by world-renowned health institutions (WHO, CDC, US National Institutes of Health NIH), and vaccination timelines adhere to national expanded immunization guidelines. All data and tools are designed for scientific educational reference and should never substitute professional medical advice, diagnosis, or clinical care.

When vibrant Neo-Brutalism design meets stringent WHO & Denver II pediatric benchmarks – empowering parents with a child-care companion that is scientifically rigorous, dependable, intuitive, and inspiring.

Introducing the AIoT.IO.VN Firmware Translator

Fri, 31 Oct 2025 02:00:00 +0000

I. Main features

unPack / rePack Firmware: Extract and repack firmware images.
Resign Firmware: Automatically re-sign firmware with a custom RSA key.
Translation Tool: Scan, extract, and translate the language strings in a firmware user interface, making it easier to localize firmware into another language.
Firmware Customization: Add personal branding, customize SSH settings such as the port and password, disable automatic upgrades, and change firmware signatures.
Flash Tool: Flash firmware quickly over SSH, send firmware directly to the router, monitor progress in real time, and automatically verify the result.

At the moment, the software supports Xiaomi router firmware only. Support for other router families may be added in the future based on user contributions.

AIoT.IO.VN Firmware Translator

Xiaomi BE3600 — The Popular Wi-Fi 7 Successor to AX3000/CR880x?

Sun, 04 May 2025 02:53:29 +0000

I. Overview

Xiaomi Router BE3600 is Xiaomi’s most affordable Wi-Fi 7 router. It launched in China on January 30, 2024, in three versions: RD15 (2.5G), RD16 (Gigabit), and RN06 (Global). It uses a Qualcomm IPQ5312, 256MB RAM, and 128MB flash; supports Wi-Fi 7 (802.11a/n/ac/ax/be); reaches up to 3600 Mbps (2.4GHz: 688 Mbps, 5GHz: 2882 Mbps); and has four high-performance antennas, dual WAN/LAN, one 2.5G port on RD15/RN06, and three Gigabit ports. It uses passive cooling and supports IoT.

[OpenHAB] Share a Vietnamese Lunar Calendar Script for OpenHAB

Sat, 12 Apr 2025 10:59:00 +0000

OpenHAB Lunar Calendar

Vietnamese lunar calendar for OpenHAB by AIoT.io.vn. The file is based on the original repository: https://github.com/quangvinh86/SolarLunarCalendar/blob/master/LunarSolar.py.
Adds solar terms, Buddhist calendar dates, and annual holidays and anniversaries using the algorithm by Ho Ngoc Duc.

Requirements

Download OpenHABLunarCalendar.py.
Create these items in OpenHAB:
- AL_PhatLich - String
- AL_ThangNhuan - Number (0 = not a leap month, 1 = leap month)
- AL_Holiday - String
- AL_TietKhi - String
- AL_CanChiNam - String
- AL_CanChiThang - String
- AL_CanChiNgay - String
- AL_Today - DateTime
Edit the information on lines 296 and 319-326 of the script.
Create a rule that runs the script every day at 00:01.

Copy the file to OpenHAB userdata

The default userdata directory is /var/lib/openhab/; adjust it for your installation.

[OpenHAB] Xiaomi LYWSD03MMC Temperature and Humidity Sensor with ESPHome on ESP32-C3

Sat, 12 Apr 2025 10:59:00 +0000

Requirements

OpenHAB version: 4.3.3
The MQTT binding is installed.
LYWSD03MMC sensors — see Shopee. Flash them with the ATC_MiThermometer custom firmware (guide).
An ESP32 or ESP32-C3 SuperMini. For an ESP32-C3 SuperMini, a model with an antenna is recommended (see Shopee).

Build with ESPHome

See the ESPHome project here.
Install ESPHome on your PC using this guide.
The following configuration sends data to the MQTT broker.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79


esphome:
 name: lywsd03mmc-mqtt
 friendly_name: LYWSD03MMC to MQTT
 min_version: 2025.3.2
 name_add_mac_suffix: true
 platformio_options:
 board_build.f_flash: 40000000L
 board_build.flash_mode: dio
 board_build.flash_size: 4MB

esp32:
 board: esp32-c3-devkitm-1
 framework:
 type: esp-idf
 sdkconfig_options:
 CONFIG_BT_BLE_42_FEATURES_SUPPORTED: y
 CONFIG_BT_BLE_50_FEATURES_SUPPORTED: n

logger:
 level: INFO

ota:
 - platform: esphome
 password: "******"

wifi:
 ssid: "WIFI SSID"
 password: "password"

mqtt:
 broker: "192.168.0.4"
 username: "username"
 password: "password"
 discovery: false
 discover_ip: false

esp32_ble_tracker:
 scan_parameters:
 active: false

sensor:

 - platform: ble_rssi
 mac_address: aa:aa:aa:aa:aa:aa
 name: "pNgu BLE Thermometer RSSI"

 - platform: ble_rssi
 mac_address: bb:bb:bb:bb:bb:bb
 name: "pKhach BLE Thermometer RSSI"

 - platform: atc_mithermometer
 mac_address: "aa:aa:aa:aa:aa:aa"
 temperature:
 name: "pNgu Temperature"
 humidity:
 name: "pNgu Humidity"
 battery_level:
 name: "pNgu Battery Level"

 - platform: atc_mithermometer
 mac_address: "bb:bb:bb:bb:bb:bb"
 temperature:
 name: "pKhach Temperature"
 humidity:
 name: "pKhach Humidity"
 battery_level:
 name: "pKhach Battery Level"

 - platform: wifi_signal
 name: "WiFi Signal dB"
 id: wifi_signal_db
 update_interval: 300s

 - platform: copy
 source_id: wifi_signal_db
 name: "WiFi Signal Percent"
 filters:
 - lambda: return min(max(2 * (x + 100.0), 0.0), 100.0);
 unit_of_measurement: "Signal %"

Line 24 configures the OTA update password.
Lines 27-28 configure Wi-Fi.
Lines 31-33 configure the MQTT broker.
Lines 44, 48, 52, and 61 contain the sensor Bluetooth MAC addresses.

Check the MQTT broker to confirm that it has received the sensor data.

[OpenHAB] Energy Meter with PZEM004T and ESPHome on ESP32-C3

Fri, 11 Apr 2025 02:47:00 +0000

Requirements

OpenHAB version: 4.3.3
The MQTT binding is installed.
PZEM004T v1 (export version) or local V3 — see Shopee.
An ESP32 or ESP32-C3 SuperMini. For an ESP32-C3 SuperMini, a model with an antenna is recommended (see Shopee).

Additional hardware reference

If the current PZEM004T model is unsuitable or you want to compare another version, see another PZEM004T model on Shopee. Before wiring it, verify the exact version, pinout, and module voltage.

[OpenHAB] Share a Remote-Control Widget for LG WebOS TV

Wed, 12 Mar 2025 02:40:00 +0000

Requirements

OpenHAB version: 4.3.3
The LG WebOS binding is installed.

I redesigned this widget based on widgets shared on the OpenHAB community site. If you copy it, please keep the attribution. ^^.

Usage

Open MENU > Developer Tools > Widgets, add a new widget, paste the code, and enjoy.

uid: LGWebOSremote
tags: []
props:
 parameters:
 - context: item
 description: Select the RCButton item
 label: Simulate a Remote Control button press
 name: item
 required: true
 type: TEXT
 - context: item
 description: Select the Power switch item
 label: Power ON/OFF TV
 name: power
 required: true
 type: TEXT
 - context: item
 description: Select the Mute switch item
 label: Mute audio of the device
 name: mute
 required: true
 type: TEXT
 parameterGroups: []
timestamp: Mar 11, 2025, 8:00:38 PM
component: f7-card
config:
 style:
 --f7-card-margin-horizontal: 0px
 background-color: rgb(26, 26, 26)
 border-radius: 50px
 height: 48rem
 width: 23rem
slots:
 default:
 - component: Label
 config:
 style:
 color: white
 font-size: 18px
 left: 20px
 top: 22px
 line-height: 32px
 overflow: hidden
 position: absolute
 text-overflow: ellipsis
 text-shadow: -1px 1px 1px hsl(0,0%,66%)
 white-space: nowrap
 text: ="LG WebOS TV"
 - component: oh-button
 config:
 action: command
 actionCommand: "=(items[props.power].state === 'OFF') ? 'ON' : 'OFF' "
 actionItem: =props.power
 iconF7: power
 iconSize: 30
 color: white
 style:
 background-color: rgb(53,53,53)
 color: "=(items[props.power].state === 'OFF') ? 'green' : 'red' "
 display: flex
 border-radius: 50%
 height: 60px
 left: 154px
 position: absolute
 top: 10px
 width: 60px
 - component: oh-button
 config:
 action: command
 actionCommand: HOME
 actionItem: =props.item
 iconF7: house
 iconSize: 30
 style:
 background-color: rgb(53,53,53)
 border-radius: 50px 0 0 50px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 45px
 position: absolute
 top: 80px
 width: 136px
 - component: oh-button
 config:
 action: command
 actionCommand: EXIT
 actionItem: =props.item
 text: THOÁT
 style:
 background-color: rgb(53,53,53)
 border-radius: 0 50px 50px 0
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 187px
 position: absolute
 top: 80px
 width: 136px
 - component: oh-button
 config:
 action: command
 actionCommand: VOLUMEUP
 actionItem: =props.item
 iconF7: plus
 iconSize: 35
 style:
 background-color: rgb(53,53,53)
 border-radius: 50px 50px 0 0
 color: white
 display: flex
 font-size: 25px
 height: 95px
 left: 11px
 position: absolute
 top: 153px
 width: 60px
 z-index: 2
 - component: oh-button
 config:
 action: command
 actionCommand: VOLUMEDOWN
 actionItem: =props.item
 iconF7: minus
 iconSize: 35
 style:
 background-color: rgb(53,53,53)
 border-radius: 0 0 50px 50px
 color: white
 display: flex
 font-size: 25px
 height: 95px
 left: 11px
 position: absolute
 top: 253px
 width: 60px
 z-index: 2
 - component: oh-button
 config:
 action: command
 actionCommand: UP
 actionItem: =props.item
 iconF7: chevron_up
 iconSize: 35
 style:
 border-radius: 50%
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 154px
 position: absolute
 top: 150px
 width: 60px
 z-index: 2
 - component: oh-button
 config:
 action: command
 actionCommand: RIGHT
 actionItem: =props.item
 iconF7: chevron_right
 iconSize: 35
 style:
 border-radius: 50%
 color: white
 display: flex
 font-size: 25px
 height: 60px
 right: 84px
 position: absolute
 top: 220px
 width: 60px
 z-index: 2
 - component: oh-button
 config:
 action: command
 actionCommand: DOWN
 actionItem: =props.item
 iconF7: chevron_down
 iconSize: 35
 style:
 border-radius: 50%
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 154px
 position: absolute
 top: 290px
 width: 60px
 z-index: 2
 - component: oh-button
 config:
 action: command
 actionCommand: LEFT
 actionItem: =props.item
 iconF7: chevron_left
 iconSize: 35
 style:
 border-radius: 50%
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 84px
 position: absolute
 top: 220px
 width: 60px
 z-index: 2
 - component: f7-badge
 config:
 style:
 border: white solid 1px
 background-color: rgb(53,53,53)
 border-radius: 50%
 height: 65px
 left: 150px
 position: absolute
 top: 220px
 width: 65px
 z-index: 2
 - component: f7-badge
 config:
 style:
 border-radius: 50%
 background-color: rgb(53,53,53)
 height: 200px
 left: 84px
 position: absolute
 top: 150px
 width: 200px
 z-index: 1
 - component: oh-button
 config:
 action: command
 actionCommand: ENTER
 actionItem: =props.item
 style:
 border-radius: 50px
 color: white
 display: flex
 font-size: 25px
 height: 65px
 left: 149px
 position: absolute
 top: 220px
 width: 65px
 z-index: 2
 text: OK
 - component: oh-button
 config:
 action: command
 actionCommand: CHANNELUP
 actionItem: =props.item
 iconF7: arrow_up
 iconSize: 35
 style:
 background-color: rgb(53,53,53)
 border-radius: 50px 50px 0 0
 color: white
 display: flex
 font-size: 25px
 height: 95px
 left: 297px
 position: absolute
 top: 153px
 width: 60px
 z-index: 2
 - component: oh-button
 config:
 action: command
 actionCommand: CHANNELDOWN
 actionItem: =props.item
 iconF7: arrow_down
 iconSize: 35
 style:
 background-color: rgb(53,53,53)
 border-radius: 0 0 50px 50px
 color: white
 display: flex
 font-size: 25px
 height: 95px
 left: 297px
 position: absolute
 top: 253px
 width: 60px
 z-index: 2
 - component: oh-button
 config:
 action: command
 actionCommand: BACK
 actionItem: =props.item
 iconF7: arrow_uturn_left
 iconSize: 25
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 11px
 height: 55px
 left: 11px
 position: absolute
 top: 357px
 width: 90px
 text: BACK
 - component: oh-button
 config:
 action: command
 actionCommand: MENU
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 height: 55px
 left: 140px
 position: absolute
 top: 357px
 width: 90px
 text: MENU
 - component: oh-button
 config:
 action: command
 actionCommand: INFO
 actionItem: =props.item
 text: INFO
 style:
 background-color: rgb(53,53,53)
 color: white
 display: flex
 height: 55px
 left: 267px
 position: absolute
 top: 357px
 width: 90px
 - component: oh-button
 config:
 action: command
 actionCommand: MUTE
 actionItem: =props.item
 color: "=(items[props.mute].state === 'OFF') ? 'white' : 'red'"
 iconF7: speaker_slash_rtl
 iconSize: 30
 style:
 background-color: rgb(53,53,53)
 border-radius: 50px 0 0 50px
 display: flex
 font-size: 25px
 height: 60px
 left: 44px
 position: absolute
 top: 428px
 width: 90px
 - component: oh-button
 config:
 action: command
 actionCommand: PAUSE
 actionItem: =props.item
 iconF7: pause_fill
 iconSize: 30
 style:
 background-color: rgb(53,53,53)
 color: white
 display: flex
 height: 60px
 left: 140px
 position: absolute
 top: 428px
 width: 90px
 - component: oh-button
 config:
 action: command
 actionCommand: PLAY
 actionItem: =props.item
 iconF7: play_fill
 iconSize: 30
 style:
 background-color: rgb(53,53,53)
 border-radius: 0 50px 50px 0
 color: white
 display: flex
 height: 60px
 left: 236px
 position: absolute
 top: 428px
 width: 90px
 - component: oh-button
 config:
 action: command
 actionCommand: 1
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 44px
 position: absolute
 top: 494px
 width: 90px
 text: 1
 - component: oh-button
 config:
 action: command
 actionCommand: 2
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 140px
 position: absolute
 top: 494px
 width: 90px
 text: 2
 - component: oh-button
 config:
 action: command
 actionCommand: 3
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 236px
 position: absolute
 top: 494px
 width: 90px
 text: 3
 - component: oh-button
 config:
 action: command
 actionCommand: 4
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 44px
 position: absolute
 top: 560px
 width: 90px
 text: 4
 - component: oh-button
 config:
 action: command
 actionCommand: 5
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 140px
 position: absolute
 top: 560px
 width: 90px
 text: 5
 - component: oh-button
 config:
 action: command
 actionCommand: 6
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 236px
 position: absolute
 top: 560px
 width: 90px
 text: 6
 - component: oh-button
 config:
 action: command
 actionCommand: 7
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 44px
 position: absolute
 top: 625px
 width: 90px
 text: 7
 - component: oh-button
 config:
 action: command
 actionCommand: 8
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 140px
 position: absolute
 top: 625px
 width: 90px
 text: 8
 - component: oh-button
 config:
 action: command
 actionCommand: 9
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 236px
 position: absolute
 top: 625px
 width: 90px
 text: 9
 - component: oh-button
 config:
 action: command
 actionCommand: 0
 actionItem: =props.item
 style:
 background-color: rgb(53,53,53)
 border-radius: 10px
 color: white
 display: flex
 font-size: 25px
 height: 60px
 left: 140px
 position: absolute
 top: 690px
 width: 90px
 text: "0"

Adding a VLAN to Guest Wi-Fi on Xiaomi AX9000 Stock Firmware

Tue, 28 Jan 2025 14:50:20 +0000

I am using a Xiaomi AX9000. Xiaomi’s stock firmware has many limitations. I tried several custom firmware options, from official OpenWrt builds to Qualcomm-based QSDK versions, but none of the AX9000 builds I tested was stable enough. The stock firmware remains the most practical choice for this setup.

Xiaomi firmware is also based on OpenWrt, although it has been heavily customized. This makes it possible to configure some functions directly in the system without using Xiaomi’s normal web interface.

After reading the wiki and other references, I successfully configured a VLAN on the Xiaomi AX9000.

This guide is not intended for beginners.

I. Overview

SSH is enabled on the Xiaomi AX9000.
The Xiaomi AX9000 is running in AP mode.
The main router is RouterOS (MikroTik), with VLAN 10 configured for Guest using 10.0.3.0/24 and the main LAN using 10.0.0.1/23.
The AX9000 WAN port is connected to the MikroTik router. The remaining AX9000 ports are used by a PC and a TV on the main LAN.
The guest Wi-Fi added to the AX9000 is assigned to VLAN 10. Clients connected to it receive addresses from 10.0.3.0/24 through the main router.

These values depend on your network. Other Xiaomi routers may use a similar approach, but the exact configuration is not guaranteed because the CPU, switch, and vendor changes can affect the commands.

Tài trợ / Quảng cáo

II. Configuration

The two main files to edit are /etc/config/network and /etc/config/wireless.

How to Enable SSH on the Xiaomi BE3600 2.5GbE

Wed, 13 Nov 2024 09:55:03 +0000

This is a quick guide for advanced users. If you get stuck, leave a comment with the exact step and error.

I. Requirements

Xiaomi BE3600 running firmware 1.0.65.
MobaXterm, PuTTY, PowerShell, or an equivalent terminal application.

If the firmware is newer than the version above, downgrade it with MiWiFi RepairTool.

Exploring the New CR880x Hardware Revision

Tue, 05 Mar 2024 00:20:03 +0000

Information about new CR880x hardware appeared on the Chinese Right.com.cn forum in late 2023. Some Vietnamese shops have since received this revision. I have not personally handled this version, so this article collects information from forum reports. Let us see what changed.

The information comes from CR8808 units reported by users on right.com.cn.

The new revision ships with firmware 1.4.01 for CR8808 and 7.0.1 for CR8806. The management interface identifies it as CR8808 VER.B, codename CR8818. It does not share firmware with the older CR8808 revision.

Stock Firmware CR8816, CR8819 - Also known as CR880x Ver.B.

Tue, 05 Mar 2024 00:20:03 +0000

Link collected from Chinese forums, currently I only have 2 versions, 8816 and 8819, haven’t found the link for 8818, you can use them for now.

Use MiWifiRepairTool to flash

Version 8816 can use MiHome app and open SSH

Download link for CR8816: Xiaomi CDN

Download link for CR8819: Xiaomi CDN

Enable SSH for CR8816:

http://\/cgi-bin/luci/;stok=\/api/misystem/set_telnet?enable=1

IPv4 Subnets Cheat Sheet

Fri, 26 Jan 2024 04:05:59 +0000

Subnets

CIDR	SUBNET MASK	NUMBER OF ADDRESSES	WILDCARD
/32	255.255.255.255	1	0.0.0.0
/31	255.255.255.254	2	0.0.0.1
/30	255.255.255.252	4	0.0.0.3
/29	255.255.255.248	8	0.0.0.7
/28	255.255.255.240	16	0.0.0.15
/27	255.255.255.224	32	0.0.0.31
/26	255.255.255.192	64	0.0.0.63
/25	255.255.255.128	128	0.0.0.127
/24	255.255.255.0	256	0.0.0.255
/23	255.255.254.0	512	0.0.1.255
/22	255.255.252.0	1,024	0.0.3.255
/21	255.255.248.0	2,048	0.0.7.255
/20	255.255.240.0	4,096	0.0.15.255
/19	255.255.224.0	8,192	0.0.31.255
/18	255.255.192.0	16,384	0.0.63.255
/17	255.255.128.0	32,768	0.0.127.255
/16	255.255.0.0	65,536	0.0.255.255
/15	255.254.0.0	131,072	0.1.255.255
/14	255.252.0.0	262,144	0.3.255.255
/13	255.248.0.0	524,288	0.7.255.255
/12	255.240.0.0	1,048,576	0.15.255.255
/11	255.224.0.0	2,097,152	0.31.255.255
/10	255.192.0.0	4,194,304	0.63.255.255
/9	255.128.0.0	8,388,608	0.127.255.255
/8	255.0.0.0	16,777,216	0.255.255.255
/7	254.0.0.0	33,554,432	1.255.255.255
/6	252.0.0.0	67,108,864	3.255.255.255
/5	248.0.0.0	134,217,728	7.255.255.255
/4	240.0.0.0	268,435,456	15.255.255.255
/3	224.0.0.0	536,870,912	31.255.255.255
/2	192.0.0.0	1,073,741,824	63.255.255.255
/1	128.0.0.0	2,147,483,648	127.255.255.255
/0	0.0.0.0	4,294,967,296	255.255.255.255

Tài trợ / Quảng cáo

IP address classes

Class	Address range
A	0.0.0.0 – 127.255.255.255
B	128.0.0.0 – 191.255.255.255
C	192.0.0.0 – 223.255.255.255
D	224.0.0.0 – 239.255.255.255
E	240.0.0.0 – 255.255.255.255

Private address ranges

Range type	Address range
Class A private	10.0.0.0 – 10.255.255.255
Class B private	172.16.0.0 – 172.31.255.255
Class C private	192.168.0.0 – 192.168.255.255
Localhost	127.0.0.0 – 127.255.255.255
Zeroconf (APIPA/Bonjour)	169.254.0.0 – 169.254.255.255

Xiaomi AX3000T (RD03) Firmware Collection and Related Information

Wed, 24 Jan 2024 08:33:29 +0000

Xiaomi presents this router almost like a flagship, complete with a polished landing page (see it here).

The Xiaomi AX3000T has an attractive design and strong specifications for its price, and it is highly regarded by Chinese users.

Overview


Dimensions	Length × width × height	With antennas: 225mm × 172mm × 208.8mm
		Without antennas: 225mm × 172mm × 51mm
Hardware	Model	Xiaomi Router AX3000T (RB03)
		CPU
		2.4GHz Wi-Fi
		5GHz Wi-Fi
		Antennas
		Cooling
		Ethernet
		Standards
Wireless	Dual-band	2.4GHz and 5GHz
		Channels
5GHz: 36, 40, 44, 48, 52, 56, 60, 64, 149, 153, 157, 161, 165
		Modulation
		Rate set

I. Enable SSH

See the Xiaomi AX3000T SSH guide here.

How to Enable SSH on Xiaomi BE6500 Pro / AX3000T

Thu, 18 Jan 2024 03:14:03 +0000

This is a quick guide for advanced users. If you get stuck, leave a comment with the exact step and error.

I. Requirements

Xiaomi AX3000T running firmware 1.0.47.
Xiaomi BE6500 Pro running firmware 1.0.46 (password: gwhx).
MobaXterm, PuTTY, PowerShell, or an equivalent terminal application.

If the firmware is newer than the versions above, downgrade it with MiWiFi RepairTool.

TP-LINK BE6500/7DR6560 Specifications and Stock Firmware

Tue, 16 Jan 2024 05:35:21 +0000

I. Specifications


Wi-Fi	IEEE 802.11a/b/g/n/ac/ax/be
	Maximum wireless rate 6500Mbps (2.4GHz 689Mbps, 5GHz 5765Mbps)
	Beamforming
	4×4 MU-MIMO
	Wi-Fi multi-frequency combination
	Multi-Link Operation (MLO)
	Preamble puncture
Ethernet ports	4 × 2.5Gbps (the four ports share a maximum of 5Gbps)
Dimensions	293 × 264 × 72 mm; weight 620g
Antenna type	2 dual-band antennas, 4 5GHz antennas
Software	Bridge (wireless repeater)
Signal conditioning
Terminal management
IP and MAC address binding
AP isolation
Virtual server
Dynamic Domain Name Service (DDNS)
DMZ host
Automatic cleaning
Wireless time switch
Local online/local firmware/remote upgrade
Power	12V, 2.5A

See the inside of the TP-LINK BE6500/7DR6560 here.

Inside the TP-LINK BE6500 7DR6560 Wi-Fi 7 Router

Tue, 16 Jan 2024 10:15:14 +0700

TP-LINK BE6500 7DR6560 is a new Wi-Fi 7 router from TP-LINK. Let us explore the inside.

The 7DR6560 box:

TL-7DR6560 Easy Turbo version, EasyMESH 3.0, with four 2.5G ports.

The product and accessories:

It uses a 12V/2.5A power adapter. In testing, standby power was 9.2W with one 1Gbps optical-modem LAN port connected. With all four 2.5Gbps ports connected, consumption reached 12.8W, which is relatively high.

Wi-Fi 7 Has Been Officially Introduced

Tue, 16 Jan 2024 00:00:05 +0000

This article summarizes the Wi-Fi Alliance announcement about Wi-Fi CERTIFIED 7. See the original announcement for the complete information.

Tài trợ / Quảng cáo

On January 8, 2024, in Austin, Texas, the Wi-Fi Alliance officially introduced the next generation of Wi-Fi with new features designed to improve performance and connectivity across many environments. Wi-Fi 7’s advanced features support higher throughput, more predictable latency, and greater reliability for important traffic.

MikroTik Firewall Filter Rules for Better Security

Sun, 14 Jan 2024 01:30:21 +0000

MikroTik security problems often come from configuration mistakes: unchanged admin passwords, weak credentials, factory-reset devices, or unnecessary SSH and Telnet services left enabled. These settings can allow attackers to take control of the router or use it for abuse.

The following filter rules are collected from public references. Review every rule against your own RouterOS version and network before applying it.

Copy each command and paste it into the Terminal in WinBox.

What Is UART on a Router? How to Identify and Use It

Fri, 12 Jan 2024 09:16:15 +0700

I. A brief introduction to UART

Most routers today include a UART interface connected to the system processor. Its pins are routed to the printed circuit board (PCB) to support debugging, firmware replacement, or connection to serial devices such as modems.

A router normally starts with its built-in bootloader. The bootloader handles the first steps of locating firmware, checking hardware, and launching the system. During these early stages, it often outputs information through a serial port and may respond to its own command set. These are not commands from a normal operating system; they are predefined commands built into the bootloader. Different bootloaders from different vendors have different command sets.

Flash International Firmware on ZTE E1600/E2603/E2615

Thu, 11 Jan 2024 00:20:03 +0000

Overview

The ZTE E1600/E2603/E2615 share the same hardware and differ mainly by carrier distribution. They use a ZX279128R CPU, 256MB RAM, and 128MB NAND for Wi-Fi 6 AX1800. In Vietnam, FPT distributes related units under the H3601 (AZ1800) name.

I. Prepare

A USB-to-TTL adapter using an IC such as CH340, CH340G, or FT232. I use this FT232.
If you need a device for practice, see the ZTE E1600/E2603/E2615 on Shopee.
A LAN connection to the PC.
Three copper probes for the board (1mm copper wire sharpened at one end).

RG-MA3062 ROM Collection (Stock and ASUSWRT) and Flashing Guide

Wed, 10 Jan 2024 00:20:03 +0000

Overview


CPU	Broadcom BCM6756, 4 cores, 1.7GHz
RAM/ROM	512MB/256MB or 256MB/256MB
Wi-Fi	4 antennas, AX3000, 2 × 2.4GHz FEM + 2 × 5GHz FEM

There is little international information about this model; the component photos are shown below.

How to Unbrick the Redmi AX6000

Thu, 28 Dec 2023 01:06:53 +0000

A router can be bricked by flashing the wrong firmware, damaging the bootloader, or interrupting a flash.

Bootloader damage is the hardest case because it requires hardware intervention. A wrong firmware image may be recoverable depending on which bootloader is installed.

Case 1: Bricked by incorrect firmware

With the stock bootloader

Use MiWiFiRepair Tools to return to the manufacturer’s stock ROM, then reinstall the desired firmware.

With OpenWrt U-Boot Mod

When the system breaks, OpenWrt may enter recovery automatically. Set up a TFTP server so recovery can load the initramfs image, then reinstall firmware.

Return the Redmi AX6000 to Stock ROM from OpenWrt

Wed, 27 Dec 2023 03:12:53 +0000

For OpenWrt using the stock U-Boot, download stock firmware from Xiaomi and use MiWiFiRepair Tool to return to stock. See the MiWiFiRepair Tool guide.

For OpenWrt using U-Boot Mod, restore the stock U-Boot first, then use MiWiFiRepair Tool to return to stock.

Flash the stock U-Boot

Touching the bootloader has a high brick risk. Verify everything before starting.
- Ensure a reliable connection between the router and PC.
- Verify downloaded-file integrity.
- Be careful with commands and understand the terminal output.
This guide uses the official OpenWrt.org U-Boot Mod layout. Other ROMs or U-Boot versions such as hanwckf may use different partitions and numbers; check them first.

The U-Boot Mod installation guide explains how to back up the original bootloader. Use the backup from the same router whenever possible so all partitions match. If no backup exists, using another user’s backup has a higher brick risk.

How to Install OpenWrt on the Redmi AX6000

Mon, 25 Dec 2023 01:06:53 +0000

WARNING: These procedures are not for beginners. Proceeding means accepting the risk; I am not responsible for damage, although I will try to help if problems occur.

Xiaomi Redmi AX6000: Firmware Collection and SSH Guide

Sun, 24 Dec 2023 12:39:03 +0000

The Redmi AX6000 uses eight spatial streams, supports 160MHz bandwidth, and reaches up to 6000 megabits of wireless throughput. Compared with the AX3000, it doubles the connection rate and increases coverage distance by about 40%.

If you need the exact router for this guide, see the Redmi AX6000 on Shopee.

It is Redmi’s first router with an eight-channel signal amplifier. Inside is a quad-core MediaTek Filogic 830 at 2GHz per core, 512MB RAM, and support for up to 248 simultaneous devices. It has four adaptive network ports, supports LAN aggregation and IPTV, and can be managed through the Xiaomi mobile app.

How to Resize the OpenWrt RootFS for EXT4 and SquashFS

Mon, 18 Dec 2023 00:48:40 +0000

When OpenWrt is flashed to storage such as a microSD card or USB drive on a Raspberry Pi, NanoPi, or Orange Pi, it may initially use only a small part of the available capacity.

Even if the card or drive is 32 GB or 64 GB, OpenWrt may use only a few hundred megabytes. This prevents installing larger packages or applications such as Docker and PassWall.

This guide explains how to expand OpenWrt’s root filesystem to use more of the available SD-card or USB capacity.

How I Flashed Global Firmware on a Huawei AX3 Pro

Sun, 17 Dec 2023 01:43:59 +0000

This article summarizes how I dumped a global ROM from an AX3 Pro Global unit and flashed it onto a domestic AX3 Pro.

Tài trợ / Quảng cáo

Huawei firmware is very different from that of many other brands such as Xiaomi, ZTE, and H3C. Although the CPU and Wi-Fi chips may be similar, Huawei encrypts and packages many parts of its software. Even a small mistake while dumping the ROM can brick the router.
There are generally two ways to modify the system:
- The first is through software: find and use a security vulnerability, then install new firmware. This avoids hardware work and can use a backup supplied by someone with a global-ROM device, but finding a usable vulnerability is difficult and reliable information is scarce. I did not use this method.
- The second is through hardware. It can dump the system storage without the software restrictions, but requires hardware skills, several tools, and many complicated steps. It also requires access to a router already running global firmware. I used this method after CheeStore provided a device for the work.
Huawei uses common NAND manufacturers such as Winbond, MXIC, Toshiba, and GigaDevice. These NAND chips commonly have capacities from 128 MB to 512 MB and use a WSON8 package.
- Unlike leaded NAND packages that can be quickly connected to a T48 with a clip, WSON8 is an SMD package and cannot be connected with the same type of clip.

WSON8

How to Install AdGuard Home Directly on OpenWrt

Thu, 19 Oct 2023 08:28:22 +0000

I. Preparation

Routers with low RAM or storage, or a slow CPU, may not be suitable for running AdGuard Home. This is a general guide for OpenWrt devices. If you run into resource or performance problems, remove AdGuard Home or move it to a stronger device such as a Raspberry Pi or mini PC.

At least 50 MB of free RAM.
At least 100 MB of free storage.
Preferably a higher-performance CPU, such as a dual-core processor with a higher clock speed.

Required RAM also depends on the filter lists you enable. Routers with less than 128 MB of RAM or only a single CPU core tend to perform poorly.

Manually Install AdGuard Home in a MikroTik Container (Method 2)

Fri, 22 Sep 2023 05:06:33 +0000

In the previous guide, I installed an AdGuard Home container using a ready-made Docker image.

That approach is fast, but some installations fail even after repeated attempts. This guide uses a blank Docker image with no service installed, then installs AdGuard Home inside it.

The offline image can reduce image-pull failures and allows other services to be added. The trade-off is more setup work.

I. Enable Container support

Open Terminal and run /system/device-mode/update container=yes.

0
When prompted, power-cycle the router.
After reboot, run /system/device-mode/print and confirm container: yes.

0.1

II. Prepare container networking and install the blank image

II.A. Prepare networking

Create a bridge named dockers.

1
Assign an IP address.

2
Create a VETH interface.

3
Add the port to the dockers bridge.

4

II.B. Install the blank Docker image

This image was built for x86_64. Do not use it on ARM, ARM64, or 32-bit x86 routers.

Download the blank image from Google Drive or the Mega mirror.
- It is based on Alpine Linux 3.17 Slim.
- It uses Supervisor to start services.
- It contains no personal customization or harmful scripts.
- If you do not trust a prebuilt image, build your own.
Upload the image to MikroTik through Files in WinBox.

B1

B1_1
Open Container, click Add, and configure:

Field	Value
File	The Docker image filename (`file.tar`)
Interface	The VETH created in II.A
Root Dir	The container storage directory
Logging	Show logs in WinBox; enable while troubleshooting
Start On Boot	Start after MikroTik boots

Tips for Optimizing Ping and Bufferbloat on MikroTik

Tue, 29 Aug 2023 13:02:07 +0000

What is FQ_CoDel?

FQ-CoDel combines Fair Queuing with Controlled Delay. It classifies incoming packets into flows and shares bandwidth fairly between them. Each flow is managed by the CoDel queue discipline, which internally uses a FIFO algorithm. Learn more in the MikroTik FQ-CoDel documentation.

This guide was originally shared by Phạm Đình Đức in the Wi-Fi Technology Community Facebook group.

Wi-Fi 6 vs. 6E vs. 7: A Detailed Comparison

Fri, 09 Jun 2023 03:31:05 +0000

The main features of Wi-Fi 6 and Wi-Fi 6E are similar, except that Wi-Fi 6E adds the 6 GHz band, making it easier to operate in congested environments. The next generation, Wi-Fi 7, doubles the bandwidth and can deliver up to three times the throughput.

With more advanced modulation and twice as many spatial streams ¹, Wi-Fi 7 aims to make wireless networking feel closer to a wired connection. How does it do that? Let’s take a closer look.

How to Unlock SSH on Xiaomi Routers with Vulnerable Stock Firmware

Sat, 03 Jun 2023 05:07:46 +0000

0. Firmware versions affected by the vulnerability

Tài trợ / Quảng cáo


Model	Version
AX3600	1.0.17
AX1800	1.0.34/1.0.328/1.0.336
AX5	1.0.16/1.0.26
AC2100	2.0.722

1. Downgrade the firmware

To enable OpenSSH, first downgrade the firmware to one of the vulnerable versions listed in section 0.
- Log in to the router’s management page and downgrade to a vulnerable version.

Screenshot

MiWiFi downgrade 0

MiWiFi downgrade 1

The router will reboot automatically after the downgrade.

2. Enable OpenSSH

After the router reboots, log in to its management page again. The URL should look similar to this:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/web/home#router

Replace the token in the URL with the copied token, using a request similar to this:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit%3B

Press Enter. If the screen shows {"code":0}, continue with the next request.

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/set_config_iotdev?bssid=Xiaomi&user_id=longdike&ssid=-h%3B%20nvram%20set%20ssh_en%3D1%3B%20nvram%20commit%3B%20sed%20-i%20's%2Fchannel%3D.*%2Fchannel%3D%5C%22debug%5C%22%2Fg'%20%2Fetc%2Finit.d%2Fdropbear%3B%20%2Fetc%2Finit.d%2Fdropbear%20start%3B

Log in to SSH with the username root.

How to Change TTL on Padavan Firmware

Wed, 31 May 2023 13:42:45 +0000

Time to live can be understood as the number of hops a packet is allowed to remain in a network. When the value reaches zero, the packet is discarded and is not forwarded any further.

Tài trợ / Quảng cáo

TTL is not measured in seconds; it is a hop count. If a packet starts with TTL n, every router or Layer 3 device it crosses decreases the value by 1 before forwarding it. When the value reaches 0, the device discards the packet. TTL helps prevent routing loops; switched networks use mechanisms such as spanning tree for a different class of loop prevention.

Using Python to Automatically Create Subtitles for Videos

Mon, 29 May 2023 09:03:58 +0000

Sometimes I find interesting videos in English while browsing the web, but my English is not good enough to follow everything. Creating subtitles and translating them into my native language is a practical solution. One option is to upload the video to YouTube and let YouTube generate subtitles, but that can take time.

A few days ago, I found a useful Facebook post explaining how to use Python to automatically create an .srt subtitle file. Once the subtitle file is available, it can be translated with another tool.

Xiaomi Mi AIoT Router AX3600 Firmware Collection and Related Information

Wed, 24 May 2023 23:55:29 +0000

I. Specifications

Specifications table


Hardware	CPU	1.4GHz quad-core A53 IPQ8071A
		Network processor
		ROM
		Memory
		2.4G Wi-Fi
		5G Wi-Fi
		Antennas
		Cooling
		Ports
		LEDs
		Reset buttons
		Power ports
		Standards
Wireless	Dual-band	2.4GHz and 5GHz
		Modulation
Software	Operating system	Mi Wi-Fi Smart Router OS based on a heavily customized OpenWrt version
		Wireless security
		Management
		Security

II. Stock ROM collection


China stock ROM	Version	Download
		1.0.17
		1.0.50
		1.0.66
		1.0.67
		1.0.74
		1.0.79
		1.1.15
		1.1.19
International stock ROM	Version	Download
		3.0.22

III. Enable OpenSSH on stock firmware

1. Downgrade the firmware

To enable OpenSSH, first downgrade to a vulnerable firmware version. Log in to the router and downgrade to 1.0.17 using the Xiaomi CDN or mirror. The router reboots after the downgrade.

[Tutorial] MiWiFi Firmware Modification

Mon, 22 May 2023 01:44:51 +0000

Xiaomi router stock firmware uses a custom format and verifies an RSA signature during flashing. This makes flashing modified firmware nearly impossible through the normal process.

Tài trợ / Quảng cáo

By analyzing the firmware tool mkxqimage, the firmware packaging and unpacking process can be understood. If you package the firmware with your own RSA private key and replace /usr/share/xiaoqiang/public.pem with the corresponding public key, the web interface can accept a self-made firmware image.

How to Install AdGuard Home Directly on a MikroTik Router

Sat, 11 Feb 2023 03:02:21 +0000

What is AdGuard Home?

AdGuard Home blocks advertisements and trackers for an entire network. Once configured, all clients can use it without installing software on each device.

It works as a DNS server and redirects tracking domains to a non-routable destination, preventing devices from connecting to those servers.

Containers on MikroTik

A container is similar to Docker on Linux or Windows. It provides an isolated Linux environment in which services can run.

NX30

Sat, 11 Feb 2023 03:02:21 +0000

Placeholder

RT-AC86U

Sat, 11 Feb 2023 03:02:21 +0000

A dual-band Gigabit Wi-Fi AC2900 gaming router with MU-MIMO, AiMesh for whole-home Wi-Fi, Trend Micro AiProtection network security, WTFast game acceleration, and Adaptive QoS.

High-end gaming experience — built-in WTFast® game acceleration and Adaptive QoS deliver smoother online gaming and 4K UHD streaming.
High-performance Wi-Fi — AC2900 speeds are enhanced by NitroQAM™ for busy home networks.
Wide coverage — high-performance antennas, ASUS AiRadar, and Range Boost reduce dead zones, while MU-MIMO improves multi-device performance.
Powerful processor — a PC-class 1.8 GHz dual-core processor provides smoother networking and faster data transfer.
Business-grade security — Trend Micro™ AiProtection blocks and neutralizes Internet security threats for connected smart devices.
AiMesh support — combine the RT-AC86U with compatible ASUS networking products to create one whole-home Wi-Fi network.
Coverage up to 400 m² **
Supports approximately 50–70 connected devices *

Model	RT-AC86U
Standards	IEEE 802.11a
IEEE 802.11b
IEEE 802.11g
Wi-Fi 4 (802.11n)
Wi-Fi 5 (802.11ac)
IPv4
IPv6
Product Segment	AC2900 ultimate AC performance: 750+2167 Mbps
Data rate	802.11a: up to 54 Mbps
802.11b: up to 11 Mbps
802.11g: up to 54 Mbps
802.11n: up to 450 Mbps
Wi-Fi 5 (802.11ac): up to 1734 Mbps
1024QAM (2.4GHz): up to 750 Mbps
1024QAM (5GHz): up to 2167 Mbps
Antenna	3 × external detachable antennas
1 × internal antenna
Transmit/receive	MIMO technology
2.4 GHz 3 × 3
5 GHz 4 × 4

See the detailed specifications here.

Xiaomi CR880x (M79) / CR8808 and AX3000 (M81) Firmware Collection

Sat, 24 Dec 2022 00:20:03 +0000

Xiaomi CR880x uses the carrier number as the suffix: CR8806 is China Unicom, CR8808 is China Mobile, and CR8809 is China Telecom. The main difference is that CR880x M79 uses the MXD7223 2.4GHz Wi-Fi FEM, while CR8808 M81 uses the RTC66266 FEM. They can use similar firmware and flashing methods.

CR8808 has two motherboard revisions, M79 and M81. M81 is essentially the same platform as the Redmi AX3000, so stock AX3000 firmware can be flashed without reduced signal performance. M79 is similar to 8806/8809 and is not fully compatible with stock AX3000 firmware because 2.4GHz cannot use the full range when the FEM lacks an integrated LNA.

How to Configure DDNS on OpenWrt

Wed, 30 Nov 2022 11:28:12 +0000

Many services provide DDNS, and each service has its own configuration and usage policy. This guide uses Cloudflare for a domain you already own and manage through Cloudflare. Other DDNS services follow a similar process.

I. Preparation

I.1 Install the required packages

Screenshot

Click Update Lists to refresh the package list.

Screenshot

Find and install ddns-scripts and luci-app-ddns.

Screenshot

For Cloudflare DDNS, also install ddns-scripts-cloudflare.

I.1.1 Configure Cloudflare DDNS

Open Services > Dynamic DNS, remove the two default entries, and click Save & Apply.

Screenshot

Click Add new service….

Screenshot

2.1. Enter any name and select **Cloudflare.com-v4** as the **DDNS Service provider**.

Screenshot

2.2. Click **Create service**, then **Cancel** to close the dialog.

Click Edit on the new service.

Screenshot

For Cloudflare, obtain the Global API Key using Cloudflare’s documentation.

In Basic Settings, enter:

How to Use MiWiFi RepairTool

Sun, 30 Oct 2022 05:40:09 +0000

Temporarily disable antivirus on the PC before starting.
If the router is running stock firmware normally, upgrade through OTA or the router’s management interface instead.
Use an Ethernet cable to connect the router to the PC.

B1. Download MiWiFi RepairTool

Open http://www.miwifi.com/miwifi_download.html.
- Scroll down to the middle of the page and click the blue download button.
- Download English versions here: Link Mega.nz

Screenshot

Click the button highlighted in red.

Download MiWiFi RepairTool

If antivirus software blocks the download, disable it temporarily and enable it again when finished.
This is Xiaomi’s official tool, downloaded from Xiaomi’s official website.
Some network adapters disconnect automatically. If this happens, try another adapter.
Some Windows 11 versions may be incompatible or produce errors.

Tài trợ / Quảng cáo

B2. Restore stock firmware with MiWiFi RepairTool

Unplug the router, hold the reset button, and reconnect power. Wait until the yellow light flashes quickly.
Connect the router to the PC with an Ethernet cable.
Extract the downloaded MiWiFiRepairTool.x86.zip archive.
Double-click MiWiFiRepairTool.x86.exe to launch the tool.

Follow the instructions shown in each screenshot:

How to Redirect All DNS Queries to OPNsense

Thu, 15 Sep 2022 16:18:12 +0700

Outdated

My OPNsense installation runs AdGuard Home to filter advertisements and malicious websites, but many phone and computer applications hard-code external DNS servers such as Google DNS or 1.1.1.1. This can bypass AdGuard Home.

Online Router Interface Demos: DD-WRT, Gargoyle, TP-Link, ASUS, Linksys, D-Link, Belkin, Cisco, and MikroTik

Mon, 12 Sep 2022 09:16:15 +0700

These demos are useful if you are considering router firmware but do not yet know what the interface looks like or how easy it is to configure. They let you explore the menus before making a decision.

They can also help when choosing a new wireless router and comparing brands such as Netgear, TP-Link, ASUS, Linksys, and D-Link.

Tài trợ / Quảng cáo

The following table lists online emulators for common wireless-router interfaces:

How to Port Forward on OpenWrt

Wed, 27 Jul 2022 02:16:39 +0000

Practical example: I use the domain [https://openwrt.router.io.vn] and want to reach [https://openwrt.router.io.vn:5353] remotely to configure the OpenWrt router at home. I use DDNS and open port 5353, forwarding it to the router’s port 80.

How to configure DDNS on OpenWrt

Log in to OpenWrt

Open Network > Firewall.

Screenshot

OpenWrt port forwarding 1

Open the Port Forward tab and click Add.

Screenshot

Fill in the popup as follows:
- Name: Any memorable name.
- External port: The Internet-facing port, such as 5353.
- Internal IP address: The LAN IP of the target device. For example, the router may be 192.168.1.1, with its web interface on port 80. For a camera, use its IP, such as 192.168.1.10.
- Internal port: The port used by the target device. If a camera uses port 1234, enter 1234 here.
Click Save.

Screenshot

Do not forget to click Save & Apply to apply the change.

Xiaomi Redmi AX6: OpenSSH and OpenWrt Installation

Tue, 20 Jul 2021 15:59:36 +0700

The router is not officially supported by OpenWrt, but the LEDE project by Lean provides firmware for the Redmi AX6.
This guide covers unlocking SSH and installing OpenWrt on the Redmi AX6 (RA69).

Specifications


CPU	IPQ8071A 4-core A53 1.4GHz + dual-core 1.7GHz NPU
ROM	128MB
RAM	512MB
Router class	AX3000
Wi-Fi class	2T2R 2.4GHz 574Mbit/s + 4T4R (2T2R-160MHz, 4T4R-80MHz) 2402Mbit/s
2.4GHz	Qualcomm QCN5024, 2x2 802.11ax, up to 574Mbps
5GHz	Qualcomm QCN5054, 4x4 802.11ax, up to 2402Mbps
Antenna	6 external high-gain antennas with external dual-band amplifiers
Ports	1x 10/100/1000 WAN + 3x 10/100/1000 LAN, Auto MDI/MDIX
Modulation	DSSS: DBPSK, DQPSK, CCK
11a/g	OFDM: BPSK, QPSK, 16QAM, 64QAM
11n: MIMO-OFDM	BPSK, QPSK, 16QAM, 64QAM; MCS0–MCS15
11ac: MIMO-OFDM	BPSK, QPSK, 16QAM, 64QAM, 256QAM; MCS0–MCS9
Rate set	MCS0–MCS9, up to 4 streams
11ax	MIMO-OFDM with BPSK, QPSK, 16QAM, 64QAM, 256QAM, and 1024QAM; MCS0–MCS11

!!! HIGH-RISK PROCEDURE

Xiaomi CR660x: ROM Collection, OpenSSH, and Related Tips

Sat, 10 Jul 2021 09:01:56 +0700

Xiaomi CR660x uses the carrier number as its suffix: CR6606 is China Unicom, CR6608 is China Mobile, and CR6609 is China Telecom. The hardware is essentially the same, so the firmware and SSH procedure are similar.

Most units imported into Vietnam are CR6608.

Warning: The procedures below are collected from community reports and were not all tested by me. Following them means accepting the risk. I am not responsible for damage, although I will try to help when possible.

Configuring Multi-WAN Load Balancing on Gocloud Firmware

Thu, 10 Jun 2021 07:40:17 +0700

If you use a Newifi3 D2 or Gocloud firmware, you have probably seen the terms load balancing and Multi-WAN on networking forums. This guide shows how to configure them on Gocloud.

Tài trợ / Quảng cáo

This configuration may not work in some regions.
This guide uses the Gocloud 4.x interface. Some menus may be different in version 5.x.

Download Gocloud firmware for Newifi3 D2.

How to Configure NordVPN and VietPN on Padavan Firmware

Wed, 09 Jun 2021 07:33:40 +0700

To use NordVPN or VietPN, you must have an account with the service first.

Tài trợ / Quảng cáo

PADAVAN is well known for its stability and relatively simple interface. Routers such as the Newifi 3D2 can run it well. See the Newifi 3D2 firmware collection for related information.

Xiaomi Mi Router 3C Firmware Collection

Thu, 27 May 2021 19:45:12 +0700

Mi Router 3C

Hardware overview


Type	Router
Model	Mi Router 3C / R3L
CPU	MT7628N
ROM	16MB
RAM	64MB
Network	2.4GHz up to 300Mbps, 802.11b/g/n
Security	WPA-PSK, WPA2-PSK
Antenna	4 external 5dBi
Ports	2 LAN, 1 WAN (100Mbps)
Power supply	5V / 1A

Firmware upgrade notes

Updating this router requires some electronics and software knowledge.
One method that does not require opening the case or using a CH341 programmer is the OpenWRTInvasion script. It enables OpenSSH, after which Breed can be flashed and used to install firmware. A mistake while flashing Breed can brick the router and require a CH341 programmer for recovery.
This page collects firmware; a detailed upgrade tutorial may be added later.

Attachments
1 files

breed-mt7628-hiwifi-hc5661a.bin 88.0 KB

GET

Firmware collection

1. Chinese stock firmware

Version 2.14.45 (updated March 26, 2019). Download the official file here.

Changelog

Solves DNS-resolution errors and intermittent network instability.
Solves a rare configuration-loss issue after power failure.
Optimizes the app-binding process.
Optimizes system memory; the system is smaller and more stable.
Fixes several minor issues and further improves stability.

2. English stock firmware

Can be flashed directly through the Chinese firmware web interface.
Version 2.8.51. Download from Google Drive here.

3. PADAVAN Jump firmware (port)

Flash through Breed Bootloader or a CH341 programmer.
Download from Google Drive here.
Credit: Stels8800, 4PDA Russia.

4. PADAVAN Linaro firmware, version 3.4.3.9L-100_939f130 + USB + Breed

Flash through Breed Bootloader or a CH341 programmer.
Download from Google Drive here.
Credit: Sedy, 4PDA Russia.

5. OpenWrt 18.06.1

Flash through Breed Bootloader or a CH341 programmer.
- Wi-Fi password: 1234567890
Download from Google Drive here.
Credit: mogvai, 4PDA Russia.

6. ZyXEL Keenetic Lite III rev:B

Flash through Breed Bootloader or a CH341 programmer.
- Wi-Fi: Keenetic-3C / Password: 1234567890 / WPS: 76133565
Download from Google Drive here.
Credit: Sedy, 4PDA Russia.

Screenshot

Keenetic

Some hardware revisions fail to boot after flashing this firmware. To fix that, desolder the two resistors at R23 and move them to R24 and R25 to R26 as shown in the images.

Fix Keenetic not booting

Leave questions in the comments or message me; I will help if possible. Good luck.

How to Connect NordVPN and Isolate VPN Traffic on a Separate AP (Part 1)

Sat, 01 May 2021 08:25:14 +0700

Outdated

This is an advanced, multi-part configuration covering VLANs, interfaces, firewall rules, VPN, and the Wi-Fi AP. Read the menus carefully before applying changes.

I. Create a VLAN and interface

1. Create a VLAN

Log in to OPNsense and open Interfaces > Other Types > VLAN.
Click Add.
Select the LAN port as Parent interface.
Enter a VLAN tag such as 11, add a description such as VPN, and click Save.

2. Create an interface for the VLAN

Open Interfaces > Assignments and add an interface. Under New interface, select vlan11 on xxx (VPN).
The new interface may be named OPT1. Open it, enable it, and configure:

Field	Value	Notes
Description	VPN_LAN	Easy-to-remember name
Block Private networks	Unchecked
Block bogon networks	Unchecked
IPv4 Configuration Type	Static IPv4
IPv6 Configuration Type	None
MAC address / MTU / MSS	Empty
Speed and duplex	Default
Static IPv4 address	`192.168.200.1/24`	Use a subnet appropriate for your OPNsense LAN
IPv4 Upstream Gateway	Auto-detect

Click Save, then Apply changes.

How to Connect NordVPN and Isolate VPN Traffic on a Separate AP (Part 2)

Sat, 01 May 2021 08:24:14 +0700

Outdated

This is an advanced configuration. You should understand the OPNsense menus and have a recovery path before changing VPN routing.

See Part 1 — Add a VLAN and assign it to an interface.

How to Configure Fast Roaming with OpenWrt

Sun, 21 Mar 2021 02:49:09 +0000

What is Fast Roaming?

Fast Roaming allows a client to move from one Wi-Fi coverage area to another with less interruption. IEEE 802.11r and 802.11k are designed to make wireless roaming more seamless.

A roaming system needs:

All APs configured with the same SSID, encryption, and password. Channels may be the same or different.
All APs on the same LAN and able to communicate with one another.

Advantages:

Each AP uses Ethernet backhaul to the same router or switch, so roaming does not reduce the backhaul speed.
The connection speed in each AP area usually suffers less loss.

Disadvantages:

How to Change Newifi3 D2 Stock Firmware from Chinese to English

Wed, 06 Jan 2021 10:38:05 +0000

This guide changes the interface from Chinese to English (you can translate it to Vietnamese yourself 🤣). It is for users who like the stock firmware but do not read Chinese.

Requirements

A computer or phone that can use SCP. This guide uses a PC.
WinSCP for Windows, available here.
The English language file. You can translate it into Vietnamese if needed, but keep the syntax and leave the filename as base.cn.json.

Attachments

1 files

base.cn.json 36.2 KB

GET

If the attachment cannot be downloaded, use this Drive link: Download.

How to Configure a Captive Portal on OPNsense

Fri, 25 Dec 2020 02:30:14 +0000

Outdated

See the OPNsense configuration series.

Cloudflare DDNS, Let's Encrypt SSL, and Reverse Proxy on OPNsense

Thu, 24 Dec 2020 06:01:14 +0000

Outdated

See the OPNsense configuration series.

Install AdGuard Home on OPNsense

Thu, 24 Dec 2020 06:00:39 +0000

Outdated

See the OPNsense configuration series.
To redirect all client DNS queries through AdGuard Home, see Redirect all DNS queries to OPNsense.

Important notes

Basic command-line and SSH knowledge is required.
Copy and type commands carefully. A mistake can make the installation fail or require OPNsense to be reinstalled.
You can use Windows PowerShell, PuTTY, Linux Terminal, or an Android SSH client such as Termius or ConnectBot.
Connect the computer to OPNsense by LAN or Wi-Fi; it must be on the same network.
This guide uses 192.168.1.1 as the example OPNsense address.

Step 1: Configure DNS and enable SSH

Enable SSH

Log in to https://192.168.1.1.
Open System > Settings > Administration.
Under Secure Shell, enable SSH, select the wheel,admins login group, and enable Permit root user login and Permit password login.
Leave other options at their defaults and click Save.

Configure DNS

Open System > Settings > General.
Add Google DNS (8.8.8.8, 8.8.4.4) or Cloudflare DNS (1.1.1.1, 1.0.0.1) under DNS Servers.
Enable Do not use the local DNS service as a nameserver for this system and save.

Disable Unbound DNS

Unbound normally uses port 53. Disable it so AdGuard Home can listen on port 53:

Create a Guest VLAN, Limit Bandwidth, and Configure Captive Portal on OPNsense

Thu, 24 Dec 2020 05:58:08 +0000

Outdated

See the OPNsense configuration series.

A Guest VLAN allows one LAN port to carry separate networks, which is useful on routers with limited ports. It can provide free guest Wi-Fi, limit guest speed, use a separate DHCP server, or show a captive-portal page before Internet access.

How to Configure PPPoE on OPNsense

Thu, 24 Dec 2020 05:45:58 +0000

Outdated

See the OPNsense configuration series.

Newifi3 D2 Firmware Collection

Thu, 03 Sep 2020 02:46:40 +0000

Newifi3-D2 offers unusually strong hardware for its price: a dual-core, four-thread CPU and up to 512MB RAM. Its 2.4GHz Wi-Fi is not outstanding, but 5GHz performance is good, making it an interesting platform for custom firmware.

Newifi 3 D2 overview

CPU architecture: Ramips
Package architecture: Mipsel_24kc
Bootloader: U-Boot; can be replaced by Breed Bootloader
CPU: MediaTek MT7621AT
Cores/threads: 2/4
CPU speed: 880MHz
ROM/RAM: 32MB/512MB
WAN: 1 × 10/100/1000
LAN: 4 × 10/100/1000
Switch: MediaTek MT7621AT
VLAN: Yes
WLAN hardware: MediaTek MT7603EN and MT7612EN, 2x2 MIMO
WLAN 2.4GHz: b/g/n
WLAN 5GHz: a/n/ac
Stock OpenWrt WLAN driver: mt76
USB: 1 × USB 3.0

Newifi3 D2 firmware upgrade guide

Follow the Newifi3 D2 firmware upgrade guide.
Default LAN IP, username, and password vary by firmware. Most Padavan builds use 192.168.123.1; OpenWrt and OpenWrt-based builds commonly use 192.168.1.1.

0. Stock firmware — xCloudOS

The factory firmware is called xCloudOS and uses Chinese by default. The English-language guide explains how to replace the language file.

How to Configure OpenWrt as an Access Point and Add a Guest VLAN

Mon, 15 Jun 2020 13:07:56 +0000

Purpose

Configure OpenWrt as an AP when another modem or router already provides DHCP.
- In this mode, the OpenWrt router mainly provides Wi-Fi. DHCP, load balancing, DNS server, and firewall functions are disabled on it.
Create a VLAN-backed Guest Wi-Fi with multiple SSIDs and separate bandwidth policies.
- Both the modem and router must support VLANs. Bandwidth limits, load balancing, and captive-portal features depend on the upstream router.
- This example uses an OPNsense PC router behind a Viettel PPPoE connection. The main DHCP range is 172.16.1.1 to 172.16.3.254; the Guest range is 172.16.16.1 to 172.16.16.254.

Configure OpenWrt as an AP

Connect a LAN cable from a LAN port on the modem to a LAN port on the router. You can use a Cat6 network cable from Shopee if you need a separate cable for configuration.

Use LAN-to-LAN. OpenWrt does not use the WAN port in this AP mode.

Set a static LAN IP in the same subnet as the main modem.

For example, if the modem is 172.16.1.1, set the AP to 172.16.1.2.

Set the DNS server and gateway to the modem address, 172.16.1.1 in this example.

LAN interface
Under DHCP Server, select Disable DHCP for this interface.

LAN interface 2
In the IPv6 tab, disable the options shown in the screenshot.

Disable IPv6
Open System → Startup and disable DHCP Server, Firewall, DNSMASQ, and ODHCPD if present.

Disable startup services
Click Save and Apply, connect the computer to port 2, and browse to 172.16.1.2 to test.

If the home network uses DLNA, UPnP, or SMB devices such as smart TVs and Chromecast speakers, enable igmp_snooping to avoid discovery problems.

Upgrade Newifi3 D2 with Custom Firmware

Sat, 04 Apr 2020 01:59:53 +0000

I. Specifications

	Newifi 3 D2 specifications
Target	Ramips
CPU	MT7621AT, 2 cores / 4 threads, 800MHz
ROM/RAM	32MB / 512MB
Wi-Fi	MT7603EN, MT7612EN

More information is available on the OpenWrt hardware page.

II. OpenSSH and Breed Bootloader

Newifi3-D2 uses a simple U-Boot that does not support online firmware upgrades or a web interface. Breed is an alternative bootloader designed for routers and adds web-based firmware flashing. Breed is not open source, so using it means accepting the risk.

OpenWrt by Lean (LEDE) for Newifi3 D2

Thu, 02 Apr 2020 12:51:12 +0000

Firmware upgrade guide

This ROM was built by @kizimirua from Lean OpenWrt https://github.com/coolsnowwolf/lede for NEWIFI3 D2, the third-generation OpenWrt build.

[Bash Script] Update a Cloudflare DNS Record with a Dynamic IPv4 Address

Sun, 22 Mar 2020 07:04:20 +0000

This script checks your current public IP and quickly updates the corresponding Cloudflare DNS records.

cloudflare_dynamic_ip_update.bash

#!/usr/bin/env bash

## Author: Hyecheol (Jerry) Jang
## Shell Script that checks the current public (dynamic) IP address of a server
## and updates the Cloudflare DNS record after comparing it with the registered address.
## Basic shell scripting guide: https://blog.gaerae.com/2015/01/bash-hello-world.html
## Use dig (https://en.wikipedia.org/wiki/Dig_(command)) to get the current public IP address.
currentIP=$(dig -4 TXT +short o-o.myaddr.1.google.com @ns1.google.com)
if [ $? == 0 ] && [ ${currentIP} ]; then ## when dig runs without an error,
 ## Keep only the IP address from the response.
 ## https://stackabuse.com/substrings-in-bash/
 currentIP=$(echo $currentIP | cut -d'"' -f 2)
 echo "current public IP address is "$currentIP
else ## an error occurred,
 echo "Check your internet connection, or the Google DNS server may be interrupted."
 exit
fi
## Use the Cloudflare API to retrieve the existing record IP.
## https://api.cloudflare.com/
## Read configuration from a separate cloudflare_config file in the same directory.
## https://stackoverflow.com/questions/10929453/read-a-file-line-by-line-assigning-the-value-to-a-variable
## https://stackoverflow.com/questions/10586153/split-string-into-an-array-in-bash
SCRIPT_PATH=$(dirname $(realpath $0))
readResult="" ## Store configuration.
while IFS= read -r line || [[ -n "$line" ]]; do
 readResult+=" " ## Delimiter: space.
 readResult+="$line"
done < $SCRIPT_PATH"/cloudflare_config" ## Use cloudflare_config.
unset IFS
unset SCRIPT_PATH
## Split the configuration string into its elements.
key=$(echo $(echo $readResult | cut -d' ' -f 1) | cut -d'=' -f 2)
email=$(echo $(echo $readResult | cut -d' ' -f 2) | cut -d'=' -f 2)
zoneID=$(echo $(echo $readResult | cut -d' ' -f 3) | cut -d'=' -f 2)
IFS=',' read -r -a updateTarget <<< "$(echo $(echo $readResult | cut -d' ' -f 4) | cut -d'=' -f 2)"
unset readResult
unset IFS
## Allocate arrays for record IP addresses, types, and names.
declare -a recordIP
declare -a recordType
declare -a recordName
declare -a dnsID
declare -a recordProxied
for string in ${updateTarget[@]}; do ## Retrieve each record's IP address.
 content=$(
 curl -s -X GET "https://api.cloudflare.com/client/v4/zones/$zoneID/dns_records?name=${string}" \
 -H "X-Auth-Email: $email" \
 -H "X-Auth-Key: $key" \
 -H "Content-Type: application/json"
 )
 ## Parse JSON with jq.
 ## https://stackoverflow.com/questions/42427371/cloudflare-api-cut-json-response
 ## https://stedolan.github.io/jq/
 ip=$(echo $content | jq '.result | map(.content) | add' | cut -d'"' -f 2)
 rType=$(echo $content | jq '.result | map(.type) | add' | cut -d'"' -f 2)
 name=$(echo $content | jq '.result | map(.name) | add' | cut -d'"' -f 2)
 id=$(echo $content | jq '.result | map(.id) | add' | cut -d'"' -f 2)
 proxied=$(echo $content | jq '.result | map(.proxied) | add' | cut -d'"' -f 2)
 recordIP=(${recordIP[@]} $ip)
 recordType=(${recordType[@]} $rType)
 recordName=(${recordName[@]} $name)
 dnsID=(${dnsID[@]} $id)
 recordProxied=(${recordProxied[@]} $proxied)
 unset id
 unset rType
 unset name
 unset ip
 unset content
 unset string
 unset proxied
done
unset updateTarget
## Compare currentIP with each recordIP.
declare -a needUpdate ## Store whether each record needs updating.
for string in ${recordIP[@]}; do
 if [ ${string} == ${currentIP} ]; then
 needUpdate=(${needUpdate[@]} 'False')
 else
 needUpdate=(${needUpdate[@]} 'True')
 fi
 unset string
done
unset recordIP ## No longer needed.
## Update records that need it.
count=0
while [ $count -lt ${#needUpdate[@]} ]; do
 if [ ${needUpdate[count]} == 'True' ]; then
 echo "record IP needs to be updated for "${recordName[count]}
 success=$(
 curl -s -X PUT "https://api.cloudflare.com/client/v4/zones/$zoneID/dns_records/${dnsID[count]}" \
 -H "X-Auth-Email: $email" \
 -H "X-Auth-Key: $key" \
 -H "Content-Type: application/json" \
 --data '{"type":"'"${recordType[count]}"'","name":"'"${recordName[count]}"'","content":"'"$currentIP"'","proxied":'${recordProxied[count]}'}' | \
 jq '.success' | cut -d'"' -f 2
 )
 if [ $success == true ]; then
 echo "Success: updated the record IP of "${recordName[count]}
 else
 echo "Failed to update the record IP of "${recordName[count]}"\n""Please check the result."
 fi
 else
 echo "record IP does not need to be updated for "${recordName[count]}
 fi
 count=$((${count}+1))
done
unset count
unset currentIP
unset key
unset email
unset zoneID
unset recordType
unset recordName
unset dnsID
unset recordProxied
unset needUpdate

cloudflare_config

Auth-Key=[Global API Key]
Auth-Email=[Login Mail]
Zone-ID=[Zone ID]
Update-Target=subdomain.router.io.vn

Credit: Hyecheol (Jerry) Jang

Attachments

2 files

cloudflare_config 870 B

GET

cloudflare_dynamic_ip_update.bash 4.2 KB

GET