LuCI Essentials on OpenWrt: Installation, HTTPS, Alternate Ports, and Offline Setup

LuCI is the web interface for many OpenWrt administration tasks. Stable releases usually include it, while snapshots may need an extra install; a device with only 4 MB flash or 32 MB RAM may not have room for the full package. In that situation I select an image with LuCI included or build a smaller image instead of filling flash blindly.[28]

1. Use Firmware Selector

Open:[28]

https://firmware-selector.openwrt.org/?version=SNAPSHOT

Enter the exact device, click the small arrow beside Customize installed packages and/or first boot script, then:[28]

1. Scroll down and click REQUEST BUILD.[28]
2. Wait for the build and download the SYSUPGRADE image.[28]
3. Transfer the image to the router and perform the matching sysupgrade procedure.[28]

HTTP access

The source’s Firmware Selector flow applies to releases newer than 24.10 and snapshots. I do not guess the target; I select the exact model in the selector before building.[28]

Replace HTTP with HTTPS

1. Open the same URL and expand package customization.[28]
2. Prefix luci with - to remove the HTTP package.[28]
3. Add luci-ssl.[28]
4. Generate the image, download SYSUPGRADE, and upgrade.[28]

Add a language

When I know the language package name, I add it to the customization list, generate the image, transfer it, and sysupgrade. The package must match the release/target; I do not copy a package from another build.[28]

2. Move LuCI to alternate ports

The source’s example ports are HTTP 8080/TCP and HTTPS 8443/TCP:[28]

uci -q delete uhttpd.main.listen_http
uci add_list uhttpd.main.listen_http="0.0.0.0:8080"
uci add_list uhttpd.main.listen_http="[::]:8080"
uci -q delete uhttpd.main.listen_https
uci add_list uhttpd.main.listen_https="0.0.0.0:8443"
uci add_list uhttpd.main.listen_https="[::]:8443"
uci commit uhttpd
/etc/init.d/uhttpd restart

After restarting, I use the new scheme/port and update the management firewall if needed. Changing the port is not a reason to expose LuCI to the Internet or a guest network.[28]

LuCI, uHTTPd, and configuration files

LuCI is a meta package with several dependencies, notably uHTTPd. The default structure described in the documentation is:[28]

• document root: /www;[28]
• /www/index.html redirects to /cgi-bin/luci;[28]
• the CGI gateway invokes Lua at /usr/bin/lua;[28]
• main configuration files: /etc/config/uhttpd and /etc/config/luci.[28]

LuCI can also run on nginx with either package:[28]

luci-nginx
luci-ssl-nginx

luci-ssl-nginx adds nginx-ssl, uwsgi-cgi, and a default configuration that redirects HTTP to HTTPS. The source also mentions BusyBox httpd for very constrained images, but that arrangement is uncommon and needs manual configuration; I use it only when I understand the limits.[28]

3. Install LuCI packages offline

Download packages for the correct platform and release first. The Basic list is:[28]

liblua
libubus
libubus-lua
libuci-lua
lua
luci-base
luci-lib-ip
luci-lib-jsonc
luci-lib-nixio
luci-mod-admin-full
luci-theme-bootstrap
rpcd
uhttpd

The Extended list is:[28]

luci
luci-app-firewall
luci-app-opkg
luci-proto-ipv6
luci-proto-ppp

Transfer the packages to the router’s RAM disk, install them, and remove the temporary directory:[28]

# Upload packages to the router
ssh root@openwrt.lan mkdir -p /tmp/luci-offline
scp *.ipk root@openwrt.lan:/tmp/luci-offline

# Install packages
ssh root@openwrt.lan opkg install /tmp/luci-offline/*.ipk

# Clean up
ssh root@openwrt.lan rm -f -R /tmp/luci-offline

When the router has no Internet connection, download packages elsewhere. Do not leave large .ipk files in /tmp, which is RAM.[28]

4. Offline script for 24.10 and older

The source provides this script for a router with Internet access, or for splitting the workflow into two parts: rsync from a machine that can reach the package repository, followed by upload/install to the router. The package names, target paths, and sample host values remain unchanged; replace OWRT_HOST with the real hostname/IP before running:[28]

cat << "EOF" > opkg-offline-luci.sh
#!/bin/sh

# Exit on error
set -e

# Configuration parameters
OWRT_USER="root"
OWRT_HOST="openwrt.lan"
OWRT_TEMP="/tmp/luci-offline"
OWRT_PKGS="libiwinfo20210430 libiwinfo-lua liblua5.1.5 \
liblucihttp0 liblucihttp-lua libubus20220601 libubus-lua \
libuci-lua lua luci-base luci-lib-ip luci-lib-jsonc \
luci-lib-nixio luci-mod-admin-full luci-mod-network \
luci-mod-status luci-mod-system luci-theme-bootstrap \
rpcd uhttpd"

# Fetch OpenWrt release
eval $(ssh "${OWRT_USER}@${OWRT_HOST}" cat /etc/os-release)

# Fetch LuCI packages
REPO_LOCAL="file://${1:-${OWRT_TEMP}}/"
REPO_URL="https://downloads.${HOME_URL#*//}"
case "${VERSION_ID}" in
(snapshot) REPO_DIR="downloads/snapshots" ;;
(*) REPO_DIR="downloads/releases/${VERSION_ID}" ;;
esac
REPO_CORE="${REPO_DIR}/targets/${OPENWRT_BOARD}"
REPO_PKGS="${REPO_DIR}/packages/${OPENWRT_ARCH}"
for REPO_DIR in "${REPO_CORE}" "${REPO_PKGS}"
do mkdir -p "${REPO_LOCAL#*//}${REPO_DIR#*/}"
rsync -n --bwlimit="8M" --del -r -t -v \
--include="*/" --include-from="-" --exclude="*" \
"${REPO_URL/https/rsync}${REPO_DIR}/" \
"${REPO_LOCAL#*//}${REPO_DIR#*/}/" << EOI
$(echo "${OWRT_PKGS// /$'\n'}" \
| sed -e "s|^|/**/|;s|$|_*.ipk|")
EOI
done

# Upload packages to OpenWrt
ssh "${OWRT_USER}@${OWRT_HOST}" "mkdir -p ${OWRT_TEMP}"
find "${OWRT_TEMP}" -name "*.ipk" -exec scp "{}" "${OWRT_USER}@${OWRT_HOST}:${OWRT_TEMP}" ";"
ssh "${OWRT_USER}@${OWRT_HOST}" "opkg install ${OWRT_TEMP}/*.ipk"
ssh "${OWRT_USER}@${OWRT_HOST}" "rm -f -R ${OWRT_TEMP}"
rm -f -R "${OWRT_TEMP}"
EOF
chmod +x opkg-offline-luci.sh
./opkg-offline-luci.sh

The script uses eval on /etc/os-release received from the router, so I run it only with a trusted host and SSH path. It also assumes the package names match the release; for another target, I obtain the correct repository rather than guessing a path.[28]

Final checks

After installation, open the router’s IP/hostname, use the correct HTTP or HTTPS port, sign in with the local account, and inspect System → Software and the LuCI menus. LuCI is an administration surface; I keep SSH/console available and do not treat HTTPS on port 8443 as permission to open the interface on WAN.[28]

Source

Original source: [LuCI essentials]¹, published/updated 2026-08-26.[28]

Sources

[28] https://openwrt.org/docs/guide-user/luci/luci.essentials — OpenWrt Wiki: LuCI essentials