OpenWrt Explained — Install, Configure, VLANs, WireGuard, OpenVPN and More

1. What is OpenWrt and why does it matter?

Beginner

OpenWrt is a full Linux operating system for routers. When you buy a router from a manufacturer, it comes with stock firmware — proprietary software that does the basics but gives you very little control. OpenWrt replaces that stock firmware entirely, turning your router into a proper configurable Linux box running on your network.

The project started in 2004 when Linksys accidentally released GPL source code for their WRT54G router, and developers ran with it. Twenty years later it supports over 2,600 devices from 399 brands and has around 8,000 installable packages.

What you can do with OpenWrt that stock firmware can't

• Full VLAN control — proper 802.1Q VLANs with trunk ports, not the simplified guest network most stock firmware offers
• WireGuard and OpenVPN — run VPN servers and clients directly on the router, covering every device on your network
• SQM (Smart Queue Management) — genuine bufferbloat fix. Makes video calls and gaming buttery smooth even with heavy downloads happening simultaneously
• AdGuard Home or adblock — network-wide ad and tracker blocking for every device including smart TVs and IoT devices
• 5G/4G interface configuration — proper control over which SIM interface carries which traffic, with failover rules
• Dynamic DNS — keeps a domain name pointing at your router even if your IP changes
• Bandwidth monitoring — see exactly which devices are using how much data
• Proper firewall rules — real iptables/nftables firewall, not the simplified NAT most consumer routers give you
• Regular security updates — long after the manufacturer has abandoned your hardware

2. Choosing compatible hardware

Beginner

Not every router runs OpenWrt well even if it technically supports it. Before you buy or flash anything, check the official table of hardware — it tells you the support status, known issues and installation method for every supported device.

📋 OpenWrt Table of Hardware → 💾 OpenWrt Firmware Selector →

What to look for in hardware

• Minimum 128MB RAM — 64MB will work but you'll hit limits quickly if you install packages. 256MB+ is ideal.
• Minimum 16MB flash storage — 8MB is technically sufficient for base OpenWrt but leaves almost no room for packages. 32MB+ is comfortable.
• Multi-core CPU — if you want to run WireGuard or OpenVPN at real speeds while routing traffic simultaneously, single-core routers will struggle above 200 Mbps.
• Qualcomm Atheros or MediaTek chipsets — these have the best open-source WiFi driver support. Avoid Broadcom for WiFi — the closed-source drivers are a constant headache.
• Check the hardware revision — the same model number with a different hardware revision (v2, v3, etc.) can be a completely different device internally. Always verify your exact revision.

3. How to install OpenWrt

Beginner — Intermediate

The three main installation methods

Method 1 — Web UI flash (easiest, most common)

Most routers allow you to upload custom firmware through the stock admin panel's firmware upgrade page. This is the preferred method where available.

1. Go to the OpenWrt Firmware Selector and search for your exact model and revision
2. Download the Factory image (not the sysupgrade — that's for updating an existing OpenWrt install)
3. Log into your router's stock admin panel — usually at 192.168.1.1 or 192.168.0.1
4. Find the firmware upgrade section — usually under Administration, Advanced, or System
5. Disable any "check for official firmware" options if present
6. Upload the OpenWrt factory image and confirm
7. Wait — do not interrupt. Takes 2–5 minutes typically
8. Router reboots to OpenWrt. Access it at 192.168.1.1

Method 2 — TFTP recovery flash

Some routers support TFTP — a simple file transfer protocol used during boot for emergency recovery. This method works even if the stock web UI won't accept third-party firmware. The general process:

1. Set your computer's IP address to a static address in the same subnet as the router's TFTP mode (usually 192.168.0.x or 192.168.1.x — check your device page)
2. Rename the OpenWrt factory image to exactly the filename the router expects (specified on the device page)
3. Start a TFTP server on your computer pointing to the firmware file
4. Power cycle the router while holding the reset button to enter TFTP recovery mode
5. The router fetches and flashes the file automatically

📖 OpenWrt TFTP installation guide →

Method 3 — SSH / command line on existing OpenWrt

If you're upgrading an existing OpenWrt installation:

First steps after installation

The moment OpenWrt is running, do these things before anything else:

1. Set a root password — the default has none. Go to System → Administration → Set Password, or run passwd via SSH
2. Update the package list — System → Software → Update lists (or opkg update in SSH)
3. Install LuCI if it's missing — some images ship without the web interface. If your browser shows nothing at 192.168.1.1 after a minute, SSH in and run opkg install luci
4. Set your timezone — System → System → Timezone

4. The LuCI interface — finding your way around

Beginner

LuCI is OpenWrt's web interface. It lives at 192.168.1.1 by default. The menu structure is consistent across versions though the visual design has evolved over the years.

5. Interfaces explained — LAN, WAN, 5G and more

Intermediate

This is the section most guides gloss over and most people get confused by. Understanding interfaces is the key to understanding everything else in OpenWrt.

In OpenWrt, an interface is a logical network connection with an IP address, a protocol, and a set of firewall zone rules. The same physical ethernet port or wireless radio can carry multiple logical interfaces through VLANs and subinterfaces.

The default interfaces

A fresh OpenWrt install typically has three interfaces:

• LAN — your internal network. Includes the LAN ethernet ports and WiFi by default. Uses protocol: static, typically 192.168.1.1/24. Devices on LAN get DHCP addresses from the router. Firewall zone: lan — trusted, full access.
• WAN — your internet connection. The single WAN ethernet port. Uses protocol: DHCP client (gets an IP from your ISP or modem). Firewall zone: wan — untrusted, reject incoming, allow outgoing.
• WAN6 — IPv6 WAN interface. Uses DHCPv6 or similar. Often auto-configured alongside WAN.

Adding a 5G / 4G modem interface

If your router has a built-in 5G modem — like the Rocket Pro with its Qualcomm X75 module — you'll see the modem presented as a network device. Depending on the modem and firmware, this will typically appear as one of:

• USB/QMI interface — modern 5G modems often use the QMI protocol over USB. Install kmod-usb-net-qmi-wwan and luci-proto-qmi packages.
• MBIM interface — another common modem protocol. Install kmod-usb-net-cdc-mbim and umbim.
• PPP interface — older approach. Still works but QMI/MBIM are preferred for 5G.
• NCM / RNDIS — some modems present as ethernet adapters. Generally plug-and-play but with less control over connection parameters.

In LuCI, go to Network → Interfaces → Add new interface. Name it something like WWAN or 5G. Select QMI Cellular as the protocol. Select the modem device (usually /dev/cdc-wdm0). Enter your SIM's APN.

Which interface for which purpose — the honest guide

Interface / Protocol	Best for	Why
DHCP client (WAN)	Fixed broadband (FTTC, FTTP, cable)	Your ISP hands you an IP automatically. Simple and standard.
PPPoE	DSL connections, some FTTP	ISP requires username/password authentication. Common with BT, Sky, TalkTalk.
QMI / MBIM	5G/4G modems (recommended)	Full modem control — signal info, APN settings, band locking, SIM switching.
NCM / RNDIS	5G/4G modems (simpler)	Modem presents as ethernet adapter. Less control but easier to set up.
WireGuard	VPN tunnel interface	Creates a virtual network interface (wg0) for encrypted VPN traffic.
Static	LAN, fixed server connections	Fixed IP address. Used for LAN and any device that needs a permanent address.

WAN failover — 5G backup for your fixed line

One of the best things you can do with OpenWrt is set up automatic failover — if your fixed broadband drops, traffic switches to 5G automatically. This requires the mwan3 package.

📖 mwan3 documentation →

6. Configuring VLANs on OpenWrt

Intermediate

OpenWrt supports proper 802.1Q VLANs — the same standard used in enterprise switches. There are two places VLANs are configured depending on your hardware: the switch configuration (for devices with a built-in managed switch chip) and bridge VLANs (the newer approach used in OpenWrt 21.02 and later).

The DSA change in OpenWrt 21.02 — important

This is the version difference that trips most people up. Before OpenWrt 21.02, VLANs were configured under Network → Switch using a VLAN table. From 21.02 onwards, OpenWrt moved to DSA (Distributed Switch Architecture), which changes how VLANs and bridge configuration works.

Creating a VLAN — new DSA method (21.02+)

1. Go to Network → Interfaces → Devices tab
2. Click Configure on the br-lan bridge device
3. Click the Bridge VLAN filtering tab
4. Enable bridge VLAN filtering
5. Add your VLAN IDs (e.g. VLAN 10 for staff, VLAN 20 for guest)
6. Assign ports as tagged (trunk) or untagged (access) for each VLAN
7. Go to Network → Interfaces → Add new interface
8. Name it (e.g. staff), set protocol to Static, device to br-lan.10
9. Set IP address (e.g. 192.168.10.1/24), enable DHCP server
10. Assign firewall zone

📖 OpenWrt VLAN configuration documentation →

7. WiFi configuration

Beginner

WiFi in OpenWrt is configured under Network → Wireless. Each physical radio (2.4 GHz, 5 GHz, 6 GHz) appears separately. On each radio you can create multiple SSIDs — each appearing as a separate WiFi network to clients.

Creating a guest WiFi network on its own VLAN

1. Go to Network → Wireless
2. Under your 5 GHz radio, click Add to create a second SSID
3. Set the SSID name (e.g. "Guest")
4. Under the Network tab, assign it to your guest interface (e.g. guest) rather than lan
5. Enable WPA2 or WPA3 password
6. Save and Apply

The guest SSID now puts clients directly onto the guest VLAN — they get internet access but cannot reach your main LAN at all.

Band steering and WiFi 7 on OpenWrt

One honest note: WiFi driver support in OpenWrt sometimes lags behind the hardware capabilities of newer routers. On WiFi 7 hardware, some advanced features like Multi-Link Operation (MLO) may not be fully supported in the current OpenWrt stable release. The snapshot builds are often ahead of stable in driver support. Check the device page on the Table of Hardware for current driver status before expecting full WiFi 7 feature support.

8. The OpenWrt firewall — zones and rules

Intermediate

OpenWrt uses a zone-based firewall. Every interface belongs to a zone, and rules are defined between zones rather than between specific IP addresses. This makes it much easier to reason about than raw iptables rules.

Default zones

• lan — trusted. Input: accept. Output: accept. Forward: accept. Masquerade: no.
• wan — untrusted. Input: reject. Output: accept. Forward: reject. Masquerade: yes.

Adding a zone for a new VLAN

Every new VLAN interface needs its own firewall zone, or you assign it to an existing zone. For a guest network:

📖 OpenWrt firewall documentation →

9. Setting up WireGuard VPN

Advanced

WireGuard is a modern VPN protocol — fast, lean, and far simpler to configure than OpenVPN. It's now built into the Linux kernel. On OpenWrt it requires a few packages and creates a virtual network interface (typically wg0).

There are two scenarios — WireGuard client (your router connects to a VPN provider or remote server) and WireGuard server (your router IS the VPN server, allowing you to connect back to your home network from anywhere).

WireGuard server on your router — access your home network remotely

After reboot, in LuCI go to Network → Interfaces → Add new interface:

• Name: wg0
• Protocol: WireGuard VPN
• Click Create interface
• Click Generate new keypair — this creates your server's private and public key
• Listen port: 51820 (standard WireGuard port)
• IP Addresses: 10.0.0.1/24 (the VPN subnet — clients will get addresses in this range)

Adding a peer (client device)

In LuCI, in your wg0 interface, scroll to the Peers section and click Add peer:

• Public key: paste your client's public key
• Allowed IPs: 10.0.0.2/32 (the specific IP this client gets)
• Persistent keepalive: 25 (keeps connection alive through NAT)

Firewall for WireGuard server

Client config file to put on your phone or laptop

📖 OpenWrt WireGuard documentation →

10. Setting up OpenVPN

Advanced

OpenVPN is older than WireGuard and more complex to configure, but it's extremely widely supported and is often required for corporate VPN connections. It also works on port 443 (TCP), making it difficult for firewalls to block — useful in restrictive network environments.

OpenVPN client — connecting to a VPN provider

If you have an OVPN config file from a VPN provider (ExpressVPN, NordVPN, Mullvad etc.), this is the simplest route:

Routing specific traffic through OpenVPN

A common setup is to put one VLAN (say, your work devices) through the VPN while other devices use the direct internet connection. This is called policy-based routing — OpenWrt handles it well via the ip rule and routing table system.

📖 OpenWrt OpenVPN documentation →

11. Ngrok on OpenWrt — remote access without port forwarding

Expert

Ngrok is a tunnelling service that creates a secure public URL pointing at your router — without needing to open ports on your firewall or have a static IP. It's particularly useful if you're behind CGNAT (Carrier-Grade NAT), which many 5G and mobile broadband connections are.

The use case: you want to SSH into your home network, access a local web service, or expose a local device to the internet temporarily — without dealing with your ISP's NAT or dynamic IP.

Installing Ngrok on OpenWrt

Ngrok doesn't have an official OpenWrt package, but you can run the ARM or MIPS binary directly depending on your router's architecture.

Making Ngrok start on boot

📖 Ngrok documentation →

12. Essential packages worth installing

Intermediate

Package	What it does	Install command
luci-app-sqm	Smart Queue Management — eliminates bufferbloat, makes video calls smooth even with heavy downloads	opkg install luci-app-sqm
adguardhome	Network-wide DNS ad blocking. Covers every device including smart TVs	opkg install adguardhome
luci-app-ddns	Dynamic DNS — keeps a domain name pointing at your router even when your IP changes	opkg install luci-app-ddns ddns-scripts
mwan3	Multi-WAN load balancing and failover — automatic switchover to 5G if fixed line drops	opkg install mwan3 luci-app-mwan3
luci-app-nlbwmon	Network bandwidth monitor — see which devices are using how much data	opkg install luci-app-nlbwmon
tcpdump	Packet capture — see exactly what's passing through your network for debugging	opkg install tcpdump
htop	Interactive process viewer — see router CPU and memory usage	opkg install htop
luci-app-upnp	UPnP support — useful for gaming consoles and some streaming devices that need automatic port forwarding	opkg install luci-app-upnp miniupnpd

12b. What is Bash — and how do you actually use it?

Complete Beginner

Before we get to reading SMS messages on your router, there is something important to understand — because nearly everything in the more advanced sections of this guide involves typing commands into something called Bash. If you have never done this before, do not skip this section. It will make everything else click.

What is Bash?

Bash is a command line shell — a way of talking to a computer by typing instructions rather than clicking buttons. When you use Windows or macOS normally, you are clicking on icons and menus. Behind all of that, the computer is actually running text commands. Bash lets you talk to the computer directly in that language, without the icons in the way.

Think of it like this. Using a GUI (graphical interface — the clickable kind) is like ordering food at a restaurant by pointing at pictures on a menu. Using Bash is like walking into the kitchen and telling the chef exactly what you want. More powerful, more precise, and faster once you know what to say — but you do need to learn the words.

On OpenWrt, Bash (or more precisely its lighter cousin ash, which works identically for everything we need) is how you do anything the LuCI web interface does not cover. Installing packages from third-party repositories, reading SMS messages, configuring advanced routing — all of it involves typing commands into the shell.

How to get to Bash on your OpenWrt router

You access your router's command line via SSH — Secure Shell. SSH is an encrypted connection from your computer to the router over your network. You type commands on your computer and they run on the router.

On Windows (Windows 10 and 11)

Windows 10 and 11 have SSH built in. Open PowerShell or Command Prompt — press the Windows key, type PowerShell, press Enter. Then type:

On Mac

Open Terminal — press Cmd + Space, type Terminal, press Enter. Then type the same command:

Via LuCI (no separate app needed)

If you install the luci-app-ttyd package, you get a terminal window right inside the LuCI web interface — no SSH client needed. Just go to Services → Terminal in LuCI after installing it.

Solving the "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED" error

If you have SSH'd into your router before and then reflashed or reset OpenWrt, you may see this alarming-looking message when you try to connect:

Do not panic. This almost certainly is not an attack. Here is what is actually happening.

When you first SSH into any device, your computer saves that device's unique identity key in a file called known_hosts. Think of it like saving someone's face in your memory. Next time you connect, your computer checks — does this face match what I remember? If the router has been reflashed, reset, or reinstalled, it generates a brand new identity key. Your computer sees a different face at the same address and refuses to connect, warning you something might be wrong.

In the context of your own home or office router — especially right after setting up OpenWrt — this is completely normal and safe. The fix is a single command that tells your computer to forget the old key so it can save the new one.

The fix — run this in PowerShell or Terminal:

What you see when you are in

Once connected via SSH you will see something like this:

That root@OpenWrt:~# is called the prompt. It is the router waiting for you to type a command. The # symbol means you are logged in as root — the administrator with full control over the system.

Basic Bash commands every beginner should know

Command	What it does	Example
ls	List files and folders in the current location	ls /etc/opkg/
cat	Print the contents of a file to the screen	cat /etc/opkg/customfeeds.conf
cd	Change directory — move to a different folder	cd /etc/config/
opkg install	Install a package (OpenWrt's package manager)	opkg install htop
opkg update	Refresh the list of available packages	opkg update
reboot	Restart the router	reboot
passwd	Change the root password	passwd
logread	Show the system log — useful for troubleshooting	logread | tail -20

What is grep — and why does it keep appearing?

grep stands for Global Regular Expression Print. That sounds intimidating. The practical meaning is simple: grep searches through text for a pattern and shows you the matching lines.

Think of it like the Ctrl+F find function in a browser — except it works on files and command output, and you can use it in combination with other commands.

That last point — the exit code — is what makes grep so powerful when combined with other commands. When grep finds something, it exits with code 0 (success). When it finds nothing, it exits with code 1 (failure). Other commands can react to that result, which leads us nicely to explaining the command that is needed to install the SMS tool.

Breaking down that repo command — line by line

Here is the command that trips up most beginners. Let us pull it apart completely so every part makes sense before you run it:

At first glance that looks like a wall of symbols. Let us go through each part:

What is a repository (repo)?

Before we decode the command, you need to understand what a repository is. A repository — or repo — is simply a server on the internet that hosts software packages. When you run opkg install something, OpenWrt goes to its official repository servers and downloads that package.

The problem is that not every useful package is in the official OpenWrt repository. Some packages are made by community developers and hosted on their own servers. To install those, you first have to tell OpenWrt where to find them — you add the developer's repository to the list of places OpenWrt knows to look. That list lives in a file called /etc/opkg/customfeeds.conf.

The 4IceG SMS tool is one of these community packages. The developer — a Polish OpenWrt community member who has done excellent work on modem tools — hosts it on their own GitHub repository. We need to add that location to OpenWrt before we can install it.

Part 1: grep -q IceG_repo /etc/opkg/customfeeds.conf

This searches the customfeeds.conf file for the text IceG_repo. The -q flag means quiet — do not print anything, just check whether it is there or not. This is a safety check: we are asking "has this repo already been added?" before trying to add it again. Adding it twice would cause problems.

Part 2: ||

This is the OR operator in Bash. It means: "if the previous command failed, then run the next command." Since grep -q exits with failure when it finds nothing, the logic is: "if IceG_repo was NOT found in the file, then do the next thing." If it WAS already there, skip the next part entirely. This is how the whole command protects itself from running twice.

Part 3: echo 'src/gz IceG_repo https://...'

echo simply prints text. In this case it is printing the line we want to add to the config file. The text src/gz IceG_repo https://github.com/4IceG/Modem-extras/raw/main/myrepo is in OpenWrt's package feed format — src/gz means it is a compressed package source, IceG_repo is the name we are giving it, and the URL is where the packages actually live.

Part 4: >> /etc/opkg/customfeeds.conf

The >> symbols mean append to file. They take the output of the echo command (our new repo line) and add it to the end of the customfeeds.conf file. One important distinction: >> adds to the end. A single > would overwrite the whole file — which would wipe your existing config. Always use >> when you want to add to a file without destroying what is already there.

Part 5: The backslashes \

The backslash at the end of a line means "this command continues on the next line." It is just for readability — the whole thing is actually one single command split across multiple lines so it is easier to read. You can type it all on one line if you prefer, without the backslashes.

Part 6: opkg update

Now that we have added the new repository, we tell OpenWrt to refresh its package list — going out to all repositories including our newly added one and fetching the current list of what is available. Without this step, OpenWrt would not know about the new packages even though the repo address is now in the config.

Part 7: opkg install luci-app-sms-tool-js

Finally — install the package. OpenWrt now knows where to find it (from our new repo), the package list is up to date, and this command downloads and installs the SMS tool along with any dependencies it needs.

12c. Reading SMS and checking your data balance

Beginner — Intermediate

Your router has a SIM card inside it. That SIM can receive text messages — from your network provider, from automated systems, sometimes from people if the number is known. More usefully, most UK mobile networks have USSD codes — short dial codes like *#100# — that you can send to check your remaining data, your balance, or your account status. With the right OpenWrt packages you can do all of this from the router's web interface or command line, without needing to put the SIM in a phone.

Which package to install — the important choice first

The package you need depends on how your modem is connected to OpenWrt. There are two paths and they use different tools:

Your modem setup	Package to use	How to check
QMI protocol (most Quectel modems including RM520N-GL)	sms-tool + luci-app-sms-tool-js	Run ls /dev/cdc-wdm* — if you see a result, this is you
ModemManager	mmcli (built into ModemManager)	Run mmcli -L — if it lists a modem, this is you
Not sure	Try QMI path first	The Rocket Pro uses QMI by default

Path A — Installing sms-tool with LuCI interface (QMI modems)

This gives you a proper web interface inside LuCI for reading and sending messages. Here is the full process step by step:

Step 1 — SSH into your router (as explained in the Bash section above)

Step 2 — Install the base sms-tool package from the official repo

Step 3 — Add the 4IceG community repository

The LuCI interface for sms-tool is not in the official OpenWrt repo — it lives in the 4IceG community repo. Here is that command again, now you understand exactly what every part does:

Step 4 — Find your modem's AT port

The SMS tool needs to know which device port to talk to your modem through. Run this to see what is available:

Step 5 — Configure sms-tool in LuCI

After installing, refresh LuCI (log out and back in, or clear your browser cache). You should see a new SMS Tool section appear in the LuCI menu. Go into it and set your modem's AT port (usually /dev/ttyUSB2 for the RM520N-GL). Then you can read all incoming messages, send texts, and send USSD codes.

Path B — Reading SMS via mmcli (ModemManager)

Checking your data balance — USSD codes

USSD codes are short codes you dial to get information from your network. Every UK network has them. On a phone you would dial them like a number. On your router you send them via the AT command interface or through the sms-tool LuCI interface.

Network	Data balance code	Account balance
EE	*#100#	*#100#
Vodafone	*#1345#	*#1345#
Three	*100#	*100#
O2	*10#	*#10#

Via AT commands directly (works regardless of which SMS tool you use):

📖 luci-app-sms-tool-js on GitHub →

13. Combining two connections — from beginner to enterprise

This is one of the most asked-about topics in 5G networking — and one of the least honestly explained. Can you combine two mobile connections and get double the speed? Yes — but the details matter enormously, and there are several different approaches depending on what you need and how deep you are prepared to go.

First, an important hardware note. The Rocket Pro and Rocket Plus each have one M.2 modem slot, fitted with one 5G modem. The ZBT platform supports one M.2 module — so fitting two modems inside the same unit is not possible on current hardware. What IS possible — and very practical — is connecting a second 5G source via USB (a USB 5G dongle or a phone tethered by USB cable), which OpenWrt treats as a second WAN interface. Everything in this section works with that setup.

Level 1 — Beginner: Load balancing with mwan3

Beginner

Think of this like having two checkout queues at a supermarket. You cannot put one shopping trolley through both at once — but if you have ten customers, you split them across both queues and everyone gets served faster. That is load balancing in a nutshell.

You have your router's built-in 5G modem as Connection 1. You plug in a USB 5G dongle or tether your phone via USB as Connection 2. OpenWrt sees both as separate internet connections. mwan3 then automatically sends different devices — or different sessions — across whichever connection is least busy at that moment.

The practical benefit: if you have an office with ten people all browsing, video calling and downloading simultaneously, they spread across both connections. You effectively double the total available bandwidth for your whole network. What it will not do is give a single device a single download at double speed — that still uses one connection at a time.

In LuCI under Network → Load Balancing there are four tabs to configure:

1. Interfaces — add both WAN connections. Set a tracking IP of 8.8.8.8 on each so mwan3 checks if the connection is actually alive
2. Members — each member is a connection with a weight. Give your main 5G modem weight 2 and your secondary weight 1 — main carries twice the traffic
3. Policies — create a "balanced" policy using both members. Or a "failover" policy that only switches to the backup if the main goes down
4. Rules — assign your default traffic to the policy you created

📖 mwan3 official documentation →

Level 2 — Intermediate: True bonding with OpenMPTCProuter

Intermediate

This is where it gets genuinely exciting. OpenMPTCProuter uses a technology called MPTCP — Multipath TCP. Instead of one connection carrying all your traffic, MPTCP splits that traffic across multiple connections simultaneously at the packet level, and a server in the cloud reassembles it into a single seamless stream.

The result: a single download genuinely uses both connections at once. If each 5G connection does 200 Mbps, you can see close to 400 Mbps from a single download. This is not load balancing — it is actual aggregation at the packet level.

What you need

• A device running OpenMPTCProuter — this is a fork of OpenWrt, so it is a separate firmware image. A Raspberry Pi 4 is the most popular choice (around £50–£70). It also runs on x86 mini-PCs and some dedicated router platforms
• Two internet connections — two 5G USB modems, or one modem plus your existing fixed broadband, or your router's built-in modem plus a USB dongle
• A KVM VPS — a cheap cloud server close to you. Hetzner in Germany, Vultr in London, DigitalOcean in London all work well. Must be KVM — OpenVZ and LXC containers will not work. 1GB RAM, 1 vCPU, Debian 12 is the recommended spec. Around £3–£6 per month

Step 1 — Set up the VPS (about 5 minutes)

SSH into your fresh Debian 12 VPS and run one command. That is genuinely all it takes on the server side:

Step 2 — Flash OpenMPTCProuter onto your router device

Download the image for your device from openmptcprouter.com. Flash it to a microSD card using Balena Etcher. Insert into your Pi or device, power on. The interface is at 192.168.100.1 — default login is root with no password. Set a password immediately.

Step 3 — Connect router to VPS and add your WANs

In the web interface go to System → OpenMPTCProuter → Settings Wizard:

1. Enter your VPS IP address in the Server IP field
2. Paste the server key from your config file
3. Go to Network → Interfaces and add your WAN connections
4. Primary connection: set Multipath TCP: Master
5. Secondary connection: set Multipath TCP: Enabled
6. Enable SQM on both interfaces — this smooths out latency differences between the two connections
7. Save and Apply

🌐 OpenMPTCProuter official site → 📖 OpenMPTCProuter wiki →

Level 3 — Enterprise: SD-WAN and multi-site bonding

Enterprise

For enterprise deployments — multiple sites, mission-critical uptime, dozens of connections across a whole organisation — the OpenMPTCProuter approach still works but you are looking at commercial SD-WAN solutions that sit on top of the same principles, adding professional management, SLAs and centralised control.

Platforms like Cisco Meraki, Fortinet SD-WAN and Cradlepoint do essentially the same thing as OpenMPTCProuter but with managed cloud orchestration — you configure all sites from a single dashboard. They add per-application routing policies (video calls down the lowest-latency link, bulk downloads down the highest-bandwidth link, VoIP on a dedicated path), guaranteed SLAs, and automatic failover with sub-second detection so traffic moves before users even notice a link has dropped.

The Rocket Pro running OpenWrt with mwan3 or OpenMPTCProuter is genuinely enterprise-capable for small and medium sites — offices up to around 50 people, temporary deployments, construction sites, and anywhere fixed broadband is unavailable or unreliable. For sites needing fully managed multi-gigabit connectivity with professional SLAs, dedicated SD-WAN hardware makes sense. But for a small office wanting to combine two 5G connections cost-effectively without a big budget, the Rocket Pro plus OpenMPTCProuter on a five pound a month VPS is the most cost-effective solution available.

Approach	Monthly cost per site	True bonding?	Best for
mwan3 only	Free — software only	No — load balance only	Failover, multi-user load spreading
OpenMPTCProuter + VPS	~£5/month VPS	Yes — full MPTCP aggregation	SMB, remote sites, rural, 5G-only locations
Commercial SD-WAN	£50–£300+/month	Yes — with managed SLAs	Multi-site enterprise, mission-critical uptime
ISP-provided bonding	Varies — ask your ISP	Yes — ISP handles it end-to-end	Where available — mainly ADSL/FTTC lines

14. Version differences and compatibility — the honest truth

Intermediate

This is the section most OpenWrt guides skip because it's awkward. The truth is that OpenWrt version compatibility is genuinely complex and you will hit walls if you're not aware of it.

The DSA migration — the biggest breaking change

As mentioned in the VLANs section, OpenWrt 21.02 introduced DSA (Distributed Switch Architecture) which fundamentally changed how switch and VLAN configuration works. Guides written for 19.07 will not work on 21.02+ and vice versa. Always check what version a guide was written for.

Snapshot vs stable builds

• Stable releases (e.g. 23.05.x) — tested, reliable, package-compatible. Use these for anything important.
• Snapshot builds — latest code, sometimes daily builds. Have newer drivers and features but packages from the stable repo won't always install. Use only if you need cutting-edge driver support and are comfortable troubleshooting.

WiFi driver limitations — be honest with yourself

Some WiFi chipsets have significantly better driver support than others on OpenWrt. The honest matrix:

Chipset family	OpenWrt support quality	Notes
Qualcomm Atheros (ath9k, ath10k)	Excellent	Full open-source drivers. Best choice for OpenWrt.
MediaTek (mt76)	Very good	Open-source mt76 driver. Good WiFi 6 support improving rapidly.
Qualcomm (ath11k — WiFi 6)	Good	Open-source ath11k driver. Some features still maturing.
Broadcom (b43, brcmfmac)	Poor	Relies on proprietary blobs. Avoid for OpenWrt if you want full WiFi functionality.
Intel (iwlwifi)	Good on x86	Fine for x86 OpenWrt builds, not relevant for most routers.

When OpenWrt might not be the right choice

Worth being straight about this: OpenWrt is not always the right answer. If you need rock-solid WiFi performance above all else and aren't planning to use VLANs, VPNs or advanced routing features, the stock firmware on a high-quality router will often give better WiFi throughput than OpenWrt — because manufacturers tune their proprietary drivers for maximum speed. OpenWrt's strength is control and flexibility, not always raw performance.

The sweet spot for OpenWrt is anyone who wants full control over their network, needs VPNs or VLANs, runs a home server or NAS, or has a CGNAT connection and needs remote access solutions. For those use cases, OpenWrt is genuinely transformative.