WrtNova Firmware Builder

Firmware target

OpenWrt version

Device

Required: ≥16MB flash, ≥128MB RAM

Mode

Main router Access point

System

Hostname

Root password

Used for SSH login and AdGuard Home admin.

SSH public keys

One key per line.

Timezone

Time format

Default 24-hour 12-hour

LuCI HTTPS

Enable HTTP-to-HTTPS redirect for LuCI

Network

Default IP prefix

Networks & addressing

On	Network	Interface name	IP prefix	VLAN ID	Subnet	Router IP
	LAN					—
	Guest					—
	IoT					—
	VPN					—

VPN network is a dedicated network with its own WiFi SSID; all its traffic is routed through the WireGuard VPN client.

Additional VLANs

Extra VLAN IDs to trunk (tagged) through every port on this device. Space-separated; ranges as low-high.

Advanced Network options

Default subnet

Packet steering

Enable packet steering across CPUs. May help or hinder network speed.

IPv6 ULA prefix

Leave empty to auto-generate a random prefix on first boot.

Per-Network Dnsmasq

Enable multiple DHCP/DNS instances

To add DHCP on a new interface, use the built-in dhcp-instance-add command.

Tag LAN VLAN

Turn all LAN ports into trunk-only ports

WireGuard VPN client

Don't have a WireGuard config? Use Cloudflare's free WARP.

Interface

Private key

Client IPv4

Client IPv6

DNS IPv4

DNS IPv6

Peer

Peer public key

Preshared key

Endpoint

Allowed IPs

You can change to a different WireGuard config later via LuCI → Network → Interfaces → vpn → Edit → Load configuration. After importing a config, remember to enable Route Allowed IPs in the Peers settings.

Advanced WireGuard options

Split tunnel

Destination IPs or subnets to bypass the tunnel. Traffic from VPN-network clients to these destinations uses the normal routing table instead of the tunnel.

Exclude IPv4

Exclude IPv6

WiFi

Country code

Dense environment Tighten usteer roaming/steering thresholds

Wireless mesh

Enable 5GHz 802.11s mesh backhaul

Tip: Prefer wired backhaul over wireless whenever feasible.

Network SSIDs

LAN

Leave password blank to use the default: 12345678

SSID and password must match between nodes for seamless roaming to work.

Advanced WiFi options

802.11k/v Neighbor reports and assisted roaming

802.11r Fast transition (fast roaming) support

Per-VLAN PSK One SSID; password decides which VLAN a client joins

Add band suffix Add 2G/5G/6G to the end of each SSID

2.4 GHz mesh

Enable 2.4 GHz 802.11s mesh backhaul

Longer range than 5GHz but requires tuning for higher throughput.

Backhaul-only Turn off AP interfaces (useful for backhaul-only nodes)

2.4 GHz channel

5 GHz channel

5 GHz channel (second radio)

6 GHz channel

WiFi log level

Note: 802.11r works well with most modern devices, but some older or low-cost devices may fail to connect. If a device can't connect, try disabling 802.11r. For IoT devices, use the IoT: 802.11r toggle above.

WAN

Connection type

DHCP PPPoE

WAN MAC address

Advanced WAN options

Tagged WAN VLAN (required by some ISPs)

WAN VLAN ID 802.1Q VLAN tag for the WAN interface.

Enable secondary WAN (WAN-B)

WAN-B VLAN ID 802.1Q VLAN tag for WAN-B.

Bridge WAN port

Add WAN port to br-vlan bridge, useful for IPTV, VoIP, and multi-PPPoE setups.

IPv4 port forwarding

Hostname	Last octet	Ports (space-separated)

Each row create a static DHCPv4 lease and add port forwarding from WAN. Ports must be unique.

IPv6 server exposure

Hostname	Last octet	Ports (empty = all)

Each row create a static hostid (IPv6 Token) in DHCP leases, IPv6 firewall forward rule, and Cloudflare DDNS entry. After boot, go to Network -> DHCP Leases and update the DUID for each host to match the actual client DUID.

DDNS (Cloudflare)

Enable DDNS

Lookup hostname

Cloudflare API token

DDNS entries for IPv6-exposed hosts are derived from the IPv6 server exposure table.

Failover

USB tethering

Enable USB tethering (Android / iPhone, device usb0)

Cellular modem (MBIM)

Enable MBIM modem failover

DNS & Ad blocking

AdGuard Home

Ad blocking + DNS over HTTPS upstream. Requires ≥32 MB flash / ≥230 MB RAM.

dnsproxy + adblock-fast

Lightweight ad blocking + DNS over HTTPS upstream. For ≥16 MB flash / ≥128 MB RAM.

https-dns-proxy + adblock-fast

Lightweight ad blocking + DNS over HTTPS upstream. For ≥8 MB flash / ≥64 MB RAM.

adblock-fast

Lightweight ad blocking. No encrypted DNS, small footprint.

None

Plain dnsmasq only. No encrypted DNS, smallest footprint.

Block DNS over TLS/QUIC

Enforce ad blocking on stubborn client devices.

Block public DNS over HTTPS servers

Block known DoH resolvers via banIP so clients cannot bypass filtering.

Force DNS to router

Redirect all DNS queries (TCP/UDP port 53) from LAN, Guest, and IoT networks to the router.

Advanced DNS options

Add DoH preset

DoH upstreams

DoH resolver URLs, one per line. Blank uses Quad9 / Cloudflare / Google.

Bootstrap DNS

Plain IPs to resolve upstream hostnames + fallback. Blank uses 1.0.0.1 / 9.9.9.9.

Firewall

Threat feeds

Pre-configured IP blocklist feeds for banIP.

Active feeds

Country blocking

Drop WAN traffic from these countries via banIP.

Blocked countries

Additional rules

Block guest internet at night

Block guest internet from 9 PM to 7 AM. Requires guest network.

Additional packages

Final packages

Extra packages

Appended to the final list. Prefix with - to remove an auto-added package.

Performance & misc

Software flow offload

Can increase network throughput.

Hardware flow offload

Higher network throughput where supported. Do not enable if using QoS/SQM.

Enable irqbalance

Recommended for systems with ≥4 CPU cores. Automatically balances IRQs across CPU cores. Some devices may require manual IRQ affinity tuning for the best performance.

Quarterly auto-reboot

Reboot at 3:30 AM once every quarter.

Enable debug log

Trace first-boot script execution to /root/99-asu-defaults.log.

WrtNova firmware builder