FreshTomato Infrastructure¶

FreshTomato is a third-party firmware for Broadcom-based consumer routers, derived from the Tomato firmware by Jonathan Zarate. It provides a streamlined web interface, advanced QoS, VPN support, and comprehensive bandwidth monitoring while maintaining stability on supported hardware.

Overview¶

Supported Hardware¶

FreshTomato targets Broadcom ARM and MIPS routers. Primary supported models:

flowchart LR
    subgraph ARM["ARM (Recommended)"]
        direction TB
        A1["RT-AC68U<br/>BCM4708 / AC1900"]
        A2["RT-AC3100<br/>BCM4709 / AC3100"]
        A3["R7000<br/>BCM4709 / AC1900"]
    end

    subgraph MIPS["MIPS (Legacy)"]
        direction TB
        M1["RT-N66U<br/>BCM4706 / N900"]
        M2["WNDR4500<br/>BCM4706 / N900"]
    end

    style ARM fill:#4a90d9
    style MIPS fill:#f5a623

Hardware selection considerations:

Firmware Variants¶

FreshTomato distributes multiple build types:

Feature Set¶

VPN¶

Quality of Service (QoS)¶

FreshTomato provides multiple QoS implementations:

Ad Blocking¶

Administration > Ad Blocking
  Enable: Yes
  Blocklist source: StevenBlack hosts
  Custom blocklist: URL or local file
  Whitelist: exceptions

The ad blocker operates at the DNS level using dnsmasq with a hosts-format blocklist. All LAN DNS queries are checked against the blocklist before resolution.

Bandwidth Monitoring¶

Web Interface Sections¶

flowchart TD
    subgraph Basic["Basic"]
        B1["Network<br/>(WAN/LAN/DHCP)"]
        B2["IPv6<br/>(Native/6rd/6to4)"]
        B3["Identification<br/>(Name/NTP)"]
    end

    subgraph Advanced["Advanced"]
        A1["Virtual Wireless<br/>(Guest SSIDs)"]
        A2["VLAN<br/>(802.1Q)"]
        A3["DHCP/DNS<br/>(dnsmasq)"]
        A4["Firewall<br/>(SPI/NAT)"]
    end

    subgraph Admin["Administration"]
        AD1["Access<br/>(SSH/Web)"]
        AD2["Scripts<br/>(Init/Firewall/WAN)"]
    end

    subgraph VPN["VPN"]
        V1["OpenVPN Client"]
        V2["OpenVPN Server"]
        V3["WireGuard"]
    end

    subgraph QoS["QoS"]
        Q1["Basic Settings"]
        Q2["Classification"]
    end

    style Basic fill:#4a90d9
    style Advanced fill:#7ed321
    style Admin fill:#f5a623
    style VPN fill:#9013fe
    style QoS fill:#bd10e0

Custom Scripts¶

FreshTomato provides hook scripts that run at specific lifecycle points:

# /jffs/scripts/init.sh - Runs at boot
# /jffs/scripts/firewall.sh - Runs when firewall restarts
# /jffs/scripts/wanup.sh - Runs when WAN comes up
# /jffs/scripts/wandown.sh - Runs when WAN goes down

Firewall Custom Rules¶

# /jffs/scripts/firewall.sh
# Block IoT devices from accessing management interfaces
iptables -I FORWARD -s 192.168.30.0/24 -d 192.168.1.1 -p tcp --dport 22 -j DROP
iptables -I FORWARD -s 192.168.30.0/24 -d 192.168.1.1 -p tcp --dport 80 -j DROP
iptables -I FORWARD -s 192.168.30.0/24 -d 192.168.1.1 -p tcp --dport 443 -j DROP
iptables -I FORWARD -s 192.168.30.0/24 -d 192.168.1.1 -p tcp --dport 8080 -j DROP

# Allow IoT to internet only
iptables -I FORWARD -s 192.168.30.0/24 -d 192.168.0.0/16 -j DROP
iptables -I FORWARD -s 192.168.30.0/24 -d 10.0.0.0/8 -j DROP
iptables -I FORWARD -s 192.168.30.0/24 -d 172.16.0.0/12 -j DROP

DNS Configuration¶

FreshTomato uses dnsmasq for DHCP and DNS forwarding. DNS-over-TLS can be configured via stubby (available in AIO builds):

Advanced > DHCP/DNS
  DNS Servers: Custom (enter upstream resolvers)
  Use dnscrypt-proxy: Enable (if available in build)
  Prevent DNS-rebind attacks: Enable
  Intercept DNS port: Enable (forces all LAN DNS through router)

Custom dnsmasq configuration can be added:

Advanced > DHCP/DNS > Dnsmasq Custom Configuration
  # Force all DNS through router
  dhcp-option=6,0.0.0.0

  # Custom domain for LAN
  local=/home.local/192.168.1.1

  # Static host entries
  address=/server.home.local/192.168.1.10

IPv6 Configuration¶

Basic > IPv6
  IPv6 Service Type: Native DHCPv6
  Request PD (Prefix Delegation): Enable
  PD Size: /60 (requests /60 from ISP, provides /64 subnets to LAN)
  DUID: Default (or custom)
  LAN IPv6: Static or SLAAC
  Announce Subnets: Enable

Related Pages¶

• Router Firmware: OpenWRT and FreshTomato — Comparative firmware reference
• GL.iNet / LuCI — GL.iNet router specifics and LuCI interface
• OpenWRT LuCI — OpenWRT web interface documentation
• DNS and Firewall — DNS resolver configuration and iptables reference
• WireGuard Server — WireGuard tunnel configuration

Related Deep Hole¶

• FreshTomato Wiki — Official documentation
• FreshTomato Firmware Downloads — Build repository
• LinksysInfo Forums — Community forums for Tomato-based firmware
• FreshTomato GitHub — Source code repository