Router Firmware: OpenWRT and FreshTomato¶

Third-party router firmware replaces the manufacturer's stock firmware with open-source alternatives that provide advanced features, security updates, and greater control over network infrastructure. This page covers OpenWRT and FreshTomato, the two leading firmware projects for consumer and prosumer router hardware.

Overview¶

OpenWRT¶

OpenWRT is a Linux-based router firmware derived from the Linux kernel and BusyBox userland. It uses the opkg package manager and provides a fully writable filesystem with package management.

Architecture¶

flowchart TD
    subgraph OpenWRT["OpenWRT System"]
        direction TB
        K["Linux Kernel"]
        BB["BusyBox<br/>(userland)"]
        OPKG["opkg<br/>(package manager)"]

        subgraph Net["Networking Stack"]
            NFT["nftables / fw4"]
            DNS["dnsmasq"]
            WG["WireGuard"]
        end

        subgraph FS["Filesystem"]
            SQUASHFS["SquashFS<br/>(read-only)"]
            OVERLAY["OverlayFS<br/>(writable)"]
        end
    end

    K --> BB
    BB --> OPKG
    K --> Net
    OPKG --> FS

    style OpenWRT fill:#4a90d9
    style Net fill:#7ed321

Supported Hardware¶

Installation¶

# General procedure (verify device-specific steps first)
# 1. Download factory image from https://firmware-selector.openwrt.org/
# 2. Upload via stock firmware web interface (or TFTP recovery)
# 3. Wait for reboot
# 4. Access LuCI at http://192.168.1.1 (root, no password)

DNS Configuration (dnsmasq)¶

OpenWRT uses dnsmasq as the default DNS forwarder and DHCP server. DNS-over-HTTPS can be enabled via https-dns-proxy:

# Install DNS-over-HTTPS proxy
opkg update
opkg install https-dns-proxy

# Configure for Cloudflare
uci set https-dns-proxy.main.url='https://cloudflare-dns.com/dns-query'
uci set https-dns-proxy.main.bootstrap_dns='1.1.1.1,1.0.0.1'
uci commit https-dns-proxy
/etc/init.d/https-dns-proxy enable
/etc/init.d/https-dns-proxy start

# Force all LAN clients to use router DNS
uci set dhcp.lan.dhcp_option='6,192.168.1.1'
uci commit dhcp
/etc/init.d/dnsmasq restart

Firewall (fw4 / nftables)¶

OpenWRT 22.03+ uses fw4 based on nftables. Configuration is managed through UCI:

# View firewall configuration
uci show firewall

# Add custom rule
uci add firewall rule
uci set firewall.@rule[-1].name='Block-WAN-SSH'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].dest_port='22'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].target='REJECT'
uci commit firewall
/etc/init.d/firewall restart

Ad Blocking (adblock)¶

opkg install adblock
uci set adblock.global.adb_enabled='1'
uci set adblock.global.adb_sources='blocklist_firefox_tracking blocklist_dating blocklist_gambling'
uci commit adblock
/etc/init.d/adblock enable
/etc/init.d/adblock start

FreshTomato¶

FreshTomato is a fork of the Tomato firmware for Broadcom-based routers. It emphasizes ease of use with a streamlined web interface while providing advanced features.

Supported Hardware¶

FreshTomato targets Broadcom ARM and MIPS routers, including:

Key Features¶

DNS Configuration¶

FreshTomato uses dnsmasq for DNS forwarding. To configure DNS-over-HTTPS:

Advanced > DHCP/DNS > DNS Servers > 1.1.1.1, 1.0.0.1
Advanced > DHCP/DNS > Use dnscrypt-proxy > Enable (if available)
Advanced > DHCP/DNS > Prevent DNS-rebind attacks > Enable

Firewall Configuration¶

FreshTomato provides a web-based firewall with the following sections:

OpenWRT vs FreshTomato¶

flowchart TD
    subgraph Comparison["Feature Comparison"]
        direction LR
        subgraph O["OpenWRT"]
            direction TB
            O1["Broad hardware<br/>(many archs)"]
            O2["opkg: 3000+<br/>packages"]
            O3["LuCI: extensive<br/>web interface"]
            O4["Steeper<br/>learning curve"]
            O5["nftables<br/>firewall"]
        end

        subgraph F["FreshTomato"]
            direction TB
            F1["Broadcom<br/>only"]
            F2["Built-in<br/>features"]
            F3["TomatoUI:<br/>streamlined"]
            F4["Gentler<br/>learning curve"]
            F5["iptables<br/>firewall"]
        end
    end

    style O fill:#4a90d9
    style F fill:#7ed321

DNS Security on Router Firmware¶

Both OpenWRT and FreshTomato support DNS security measures:

Related Pages¶

• FreshTomato Infrastructure — Detailed FreshTomato configuration
• GL.iNet / LuCI — GL.iNet router specifics
• OpenWRT LuCI — OpenWRT web interface
• DNS and Firewall — DNS resolver reference
• WireGuard Server — VPN tunnel configuration

Related Deep Hole¶

• OpenWRT Documentation — Official wiki and guides
• OpenWRT Firmware Selector — Device-specific firmware downloads
• FreshTomato Wiki — FreshTomato documentation
• OpenWRT Package Index — Available packages
• WireGuard on OpenWRT — Router WireGuard setup
• nixCraft: OpenWRT dnsmasq Setup — DNS configuration guide