WrtNova — Multi-node fleet builder

Firmware target

OpenWrt version

Default version for all nodes.

System

Hostname

Root password

Used for SSH login and AdGuard Home admin. Deployed to every node.

SSH public keys

One key per line. Deployed to every node.

Timezone

Network

Default IP prefix

Default subnet

Networks & addressing

VLAN IDs are identical across all nodes in this network.

On	Network	IP prefix	VLAN ID	Subnet	Router IP
	LAN				—
	Guest				—
	IoT				—
	WireGuard VPN				—

WireGuard VPN network is a dedicated network with its own WiFi SSID; all its traffic is routed through the WireGuard VPN client.

Additional trunk VLANs

Extra VLAN IDs to trunk (tagged) through every port on every node.

WireGuard VPN client

Private key

Peer public key

Endpoint

Endpoint port

Preshared key

Client IPv4

Client IPv6

Allowed IPs

Router terminates the tunnel, AP nodes bridge the VPN VLAN and broadcast the VPN SSID automatically.

WiFi

Country code

Dense environment Tighten roaming/steering thresholds

Wireless mesh

Enable 802.11s mesh backhaul (default — overridable per node)

Note: Wired backhaul is always better when feasible.

Network SSIDs

LAN

Leave password blank to use the default: 12345678

Advanced channels & logging

2.4 GHz channel

5 GHz channel

6 GHz channel

WiFi log level

WAN router node only

Connection type

DHCP PPPoE

WAN MAC address

WAN options

Tagged WAN VLAN (required by some ISPs)

Enable secondary WAN (WAN-B)

IPv4 port forwarding router node only

Hostname	Last octet	Ports (space-separated)

Each row creates a static DHCPv4 lease and NAT port forward. Ports must be unique.

IPv6 server exposure router node only

Hostname	Last octet	Ports (empty = all)

Each row create a static hostid (IPv6 Token) in DHCP leases, IPv6 firewall forward rule, and Cloudflare DDNS entry. After boot, go to Network -> DHCP Leases and update the DUID for each host to match the actual client DUID.

DDNS (Cloudflare) router node only

Enable DDNS

Lookup hostname

Cloudflare API token

DDNS entries for IPv6-exposed hosts are derived from the IPv6 server exposure table

Failover router node only

USB tethering

Enable USB tethering (Android / iPhone, device usb0)

Cellular modem (MBIM)

Enable MBIM modem failover

Encrypted DNS & ad blocking router node only

AdGuard Home

Ad blocking + DoH/DoQ upstream. Requires ≥32 MB flash / ≥230 MB RAM.

dnsproxy

Lightweight ad blocking + DoH/DoQ upstream. For ≥16 MB flash / <230 MB RAM.

None

Plain dnsmasq only. For severely constrained devices (8 MB flash).

Additional packages

Extra packages

Appended to every node's build. Prefix with - to remove an auto-added package.

Performance & misc

Software flow offload

Can increase network throughput.

Hardware flow offload

Higher throughput where supported. Do not enable with QoS/SQM.

Block DoT and DoQ

Enforce ad blocking on stubborn client devices.