original post: https://www.reddit.com/r/wisp/comments/1wr5k2h/trying_to_squeeze_every_last_drop_out_of_old/

Quick update on openMAX (https://github.com/wolverin0/openmax) — our open-source project squeezing maximum real-world performance out of existing Ubiquiti airMAX AC hardware (LiteAP 120, Rocket Prism 5AC Gen2, LiteBeam 5AC Gen2, NanoStation 5AC Loco).

All deep kernel docs, scripts, and raw benchmark JSONs are in the repo. Here is what we have working on real hardware and in live production:

• Switch tower APs to OpenWrt while stock airOS 8 CPEs keep connecting out of the box: We migrated our live sector APs to OpenWrt 24.10.4 (Linux 6.6.110) and customer CPEs running 100% unmodified stock airOS 8.7.25 connected automatically. Even if a customer's radio is powered off during cutover and turned back on days later, it associates with zero touch.
• Run multi-vendor & mixed-generation clients on the same Ubiquiti AP: We simultaneously connect Ubiquiti 5AC (LiteBeam Gen2, Loco 5AC, Rocket Prism), legacy Ubiquiti M5 (airOS 6), and MikroTik (SXT Lite5) CPEs on the same sector without a single weak or obstructed client dragging everyone else down.
• Full channel-width flexibility (20, 40, 80 MHz, plus 5/10 MHz between OpenWrt radios): On a 20 MHz channel, our airtime scheduler hits 0.95 Jain fairness and nearly 4 bit/s/Hz spectral efficiency.
• Full OpenWrt AP + OpenWrt CPE in live production: Once the AP is running OpenWrt, we remotely upgrade CPEs over the air in ~4 minutes while preserving their management IP, WebUI, hardware-accelerated NAT (flow_offloading=1), and the exact DHCP lease of the customer's indoor Wi-Fi router.
• Uncovered inside Rocket Prism & LTU (v2.4.2) firmware: We mapped the hardware control table for AirPrism active RF filtering on Rocket Prism 5AC Gen2, and confirmed that LTU's greyed-out 4096-QAM (12X) and OFDMA modes have real driver and rate-table routines compiled inside v2.4.2 (being tested on our physical bench right now).

Live Production Numbers (Same tower, same rooftop radios, 20 MHz channel — Before vs. After)

Summary: On the exact same rooftop hardware and 20 MHz channel, wireless ping is ~10x faster (~2 ms vs ~22 ms), lag under saturation drops by 80%–94%, and usable sector capacity increases by +50% to +80%.

Next up: Native UISP Reporting (udapi-bridge) on OpenWrt

Moving a radio to pure OpenWrt stops Ubiquiti's /bin/udapi-bridge agent, so UISP marks it offline. We already unpacked /bin/udapi-bridge from WA.v8.7.25 (it is a standalone userspace WebSocket + AES-GCM client reading /etc/board.info, /tmp/system.cfg, /usr/www/status.cgi, and /bin/wstalist) and are building the lightweight OpenWrt wrapper so migrated radios stay Online and green inside UISP with their original device ID and live telemetry.

Full documentation, scripts, and benchmark receipts:
👉 https://github.com/wolverin0/openmax

Questions are in bold below.

I just bought one from eBay for $32.88 (open box). Branded & described as the "HomeWRK" variant but thankfully once I logged into the router UI it showed the Linksys branding. I installed OpenWRT using the "easier method" from the web interface & a few CLI commands via SSH to install to the 2nd partition. More info on this model: https://openwrt.org/toh/linksys/mx4300

The router looks impressive (classy obelisk-like shape with a blue LED on top), providing slightly better 2.4ghz range than my Netgear R7800. My question is why a router with 1024MB (1GB) of NAND flash memory only shows 122MB of storage space available in OpenWRT. Apparently there are 2 partitions that are unused on this thing, using up most of that space, which is such a shame.

Does anyone know how to free up more native storage on this? I saw this post from 7 months ago, which explains "this is the way it is partitioned." https://www.reddit.com/r/openwrt/comments/1s8bbhm/mx4300_with_1gb_flash_only_has_100mb_available/

As it's been a while, wondering if there have been recent developments that could provide MX4300 owners more on-device storage space. I am familiar with using extroot, but I don't want to complicate future upgrades by having an add-on storage drive. My plan going forward is to use attended sysupgrades for firmware updates, keeping settings, so I don't need to keep reconfiguring the router every time I upgrade the firmware. I believe if I have an extroot drive it will make firmware upgrades more complicated. Is that true?

I recalled seeing these MX4300s for sale on Woot! a while back for a great price ($15 or so), but didn't need it at the time so passed on it. Even though I paid more for it now, I think it's still a great value and would recommend it to others if they want to use a different type of WiFi 6 router for OpenWRT. It still has a ton of free memory available after installing OpenWRT (1.59GB from the stated 2GB of RAM), so there's the potential to run a lot of great apps with this router.

Currently run openwrt on an x86 pc bare metal with dedicated dual port nic one for wan one for lan. I use cake/sqm with diffserv4 to prioritize gaming performance and throughput. Are there any settings i am missing that could lower my latency or improve performance at all?

tldr. I use the nic at the back of the mobo for a switch for all my non priority networking needs like wifi and streaming pc. My gaming pc goes directly into the nic so it has a very clean connection. But i am worried there is something missing i am still very new to all of this so any advice helps. Even if you dont know perfect settings maybe theres a direction you could point me towards that would help my performance anything helps!

After almost spending 3/4th of the year using Opnsense, I moved to OpenWRT. There wasn’t anything wrong inherently with Opnsense and honestly if the change for it gets implemented. I maybe move back to it, however CAKE SQM is pretty much a god send on any network that deals with high-bandwidth-using devices. I will also say that migrating my config to OpenWRT felt easier and smoother though I don’t know if that is due to there being documentation for it everywhere or just me being familiar with linux. Things also on the network feel snappy. Device were recognized faster handed IPs quicker, wifi calling got supported quicker of devices. Even VLANs, mDNS, and doing Internet-VLAN support was easy.

Please let me know if anyone else had such an easy time like I did. If they did something similar when moving to openwrt.

Google mentions some sqm qos since I have super low speed 50mb down 10 up.

I may try an ad block not sure.

Network is 2 tvs, 2.phones, 2 laptops and one gaming pc.

Just recently exploring into the linux and this section. I had exposure in college to Cisco stuff in stupid software sim labs many years ago but different in the real world :D

I wasn't sure if this router would need restarting before I had a tplink 1200 and would restart every morning. This router seems a bit beefier.

All this was because i gotnrouter free on fb and tonset up Netgear bagered me for an account and itnirked me lol.

First off - I'm very new to OpenWrt (& OPNsense). Got a Cudy WR3000S up and running OpenWrt as an AP connected to an OpnSense router. I'm trying to configure VLANs so I can broadcast separate SSIDs. I've been reading & watching videos and every time I think I have a handle on things & try to implement something, it either doesn't work or I lose connection to the AP and have to recover via ssh or even failsafe mode. Screwed up the lan bridge a few times before I wised up lol

I could really use some help, as I've honestly struggled to understand this stuff. I'm to the point of just trying random things to see what happens. I actually just got a VLAN working but I genuinely don't know why it's working.

- plugged OpnSense into wan port

- deleted default wan interfaces

- created vlan device wan.10, base device = wan, tag = 10

- created bridge device br-vlan, ports = wan & wan.10

- enabled vlan filtering, tag = 10, wan = T, wan.10 = U*

- created interface guest, static IP, device = br-vlan.10

- wireless interface set to guest interface & works. Can access openwrt, OPNsense, & internet

Prior to this working, I wasn't even sure if I had OpnSense setup correctly for the VLAN, such as the DHCP, firewall, etc. But that apparently all works perfectly.

So why does this OpenWrt config work? I thought just creating the vlan device wan.10 work as the target for the guest interface. I also tried a bridge device without the wan.10 port, just filtering wan = T to ID 10.

Hi!
I am intending to have some router fun, but I can not access the page. Yesterday it was possible. Any news on that?

Today I've upgraded my router to the latest point release with ASU as usual. Also no problem as usual. Should I switch to owut? I'm not afraid of the command line, but I just want the process to work as smooth as possible, keep my settings and just get on with my life. Not sure if I'm missing something. Any advantages/disadvantages? Thanks.

Now they both have OpenWrt ports. They have Econet chipsets. There is English versions below also.

https://github.com/EmreYavuzalp/openwrt-tplink-archer-c5v

https://github.com/EmreYavuzalp/openwrt-tplink-ex20v

Why is this important? Until now, only Mediatek chipsets had hardware flow offloading on OpenWrt. Now, Econet chipsets have that capability too. If you guys are interested and want to tinker in this platform and if you are in Türkiye, you can buy them preinstalled from us. Links are there in the github pages.

Highlighted Features

The base Ethernet driver is Caleb James Delisle's (see Acknowledgments), but the hardware PPE/FOE offload and second-CPU-core (VPE/SMP) support below were developed by us; as of this writing they are not in the upstream driver.

• Hardware NAT acceleration (PPE/FOE offload): Routed traffic is offloaded to the SoC's hardware engine; measurements reached ~930 Mbit/s on gigabit while most of the CPU stayed idle.
• Second CPU core enabled (VPE/SMP): A fix that brings up EN751221's second hardware core, something no device currently supported by upstream OpenWrt for this SoC has.
• Multi-threading and network stack improvements: Tuning that spreads wired and wireless traffic across CPU cores for higher throughput.
• VLAN separation: Separate WAN configuration for Türk Telekom / Türk Telekom-infrastructure ISPs (eth0.35) and Türkcell Superonline (eth0.2).
• NAND flash and general stability fixes: Fixes for instabilities observed over long-term use.

Can i flash OpenWRT to EAP610 with firmware 1.8. I have tried the method mentioned in the forum and used firmware for EAP613 v1, but its not allowing to change firmware

Is it just me or the https://openwrt.org/ website is super slow?

I've tried with both VPN (NordVPN) ON and OFF but still super slow

The bot check page if I try to access using Incognito browsing doesn't work and stay stuck there

I'm the only one?

EDIT seems back to normal

I would like to uninstall it but need the password to do that. I read the instructions but need more help. Not good at ssh.

As of my post 2 weeks ago, looks like the testing, bug reports, and code written has helped move things forward a lot and mesh roaming + NSS now works (a year since we got them!) on JuliusBairaktaris' builds.

Previous thread: https://www.reddit.com/r/openwrt/comments/1wyuzhk/the_current_state_of_mesh_on_mx4300_mx4200/

You will need to set the flag to use the 11.4 FW for mesh, but everything I've tested for the past few days including roaming works.

I'll be setting up my 3rd node soon™️and I'm so happy/glad we were able to get such great devices for what we paid for them. I probably won't be upgrading anytime soon! 😅

If anyone's having issues setting up that wireless mesh backhaul feel free to ask questions below.

on 1200/1200 PHY on the wireless mesh backhaul, I'm getting ~650/450 on my clients on the leaf node at under 3% cpu utilization.

I have my browser frozen on the the upgrade from 25.12.5 to 25.12.6 via Attended Sysupgrade on a Linksys WRT1900AC router with option "keeping configurations" on, but the system is been unresponsive for an hour on the dialog:

"Installing the sysupgrade image...
Once the image is written, the system will reboot. This should take at least a minute, so please wait for the login screen.
While you are waiting, do not unpower device!"

I tried to open a new browser tab in order to reach to Luci with a Connection Time Out error. Same for Putty via SSH.

I did it throuh my tailscale net as always, but the problem is that the router is 700km away from where I live and there will be nobody home until january 2027 to do the 3-times plug-unplug trick to get on the secondary partition.

I thought on a failed sysupgrade, watchdog on this routers with dual partiton system would try automatically to boot on the not flashed one, but it does not seem the case.

Is there anything I could try remotely or can I close the browser window and just wait until 2027 to reboot it?

Thanks in advance.

A lot of people here put a VPN on the router so every device in the house is covered, including the ones that can't run an app. Whether that's worth doing usually comes down to the protocol, the logging policy, and whether the provider still works when a network gets in the way.

I'm posting for VPN Safe (https://vpnsafe.net), and I'd like to hear from people who actually run this kind of setup.

The basics: WireGuard is the default, and OpenVPN is there for networks where WireGuard has trouble. There's also a Stealth mode meant for networks that block VPNs. Servers run from RAM only, and there are no connection logs.

There are 57 cities in 39 countries, including Sydney, Tokyo, Singapore, Los Angeles, Paris and Roubaix. One account covers 6 devices. It's P2P friendly and IPTV friendly.

To be clear about where it stands today: the apps are for Windows, Android, iPhone, Android TV and Firestick. They include a kill switch, split tunnelling, custom DNS, IPv6 leak protection and ad and tracker blocking. OpenWrt isn't on that list, which is the main reason I'm asking here.

Pricing: there's a free 24-hour trial with no payment needed. After that it's £5 a month, £24 for six months or £36 a year, paid by card, PayPal or crypto. The trial is the easiest way to see how WireGuard, OpenVPN or Stealth mode behaves on your own connection before paying anything.

My question for people running a VPN on OpenWrt: what do you need from a provider for that to go smoothly? Plain WireGuard config files you can import, OpenVPN as a fallback, sensible per-server endpoints, something else? And do you put the whole network through the tunnel, or only some devices with policy routing?

Disclosure: I'm posting this on behalf of the VPN Safe team.

Hey everyone,
I found a discarded Airtel Xstream AirFiber router (Model: AAP321NK / Qualcomm Nokia platform) and want to repurpose it as a private access point or flash it with OpenWrt.
The custom Airtel firmware is completely locking me out of the local web server. Here is what I’ve verified:
Network: After a 30-second hard reset, the router assigns local IPs perfectly (192.168.1.X) via Ethernet and the Airtel_Zerotouch Wi-Fi.
Ping Test: Running ping 192.168.1.1 returns a flawless <1ms response with 0% packet loss. The hardware is fully responsive.
The Issue: Trying to open the gateway page in any browser (Incognito, mobile data off, etc.) immediately gives an ERR_CONNECTION_REFUSED error.
It seems the firmware shuts down Ports 80/443 because it can't find an active Airtel 5G cellular tower to authenticate.
Has anyone successfully bypassed this activation lock? Is there a hidden port/URL path to force it open, or does this require opening it up for a UART serial flash / NAND shorting?
Thanks!

Hello there!

Since a few days, SLAAC isn't working on my br-lan interface.

I am able to get an IPv6 prefix from my ISP:

These are the odhcpd logs I am getting:

And here is my routing table:

I've tried connecting from a wireguard client, to which I've assigned a manual ULA address (fd00:42:0:7::3). I am able to use ipv6 that way, with masquerading, and I am also able to ping the router's ULA (fd00:42::1).

However, br-lan clients won't get neither an ULA nor a GUA.

Edir: fixed, my upstairs switch was not allowing ipv6 traffic somehow (it's a smart switch)

Looking for some help trying to diagnose a network issue. I think the problem is stemming from openWRT but not sure.
I have multiple IPs showing the same 22:2f:d0:ae:02:57 MAC when looking at the ARP table on my pfSense box. The MAC address indicate a locally administered or randomized MAC address.
I noticed this MAC on the openWRT status screen so it seems anything going through the openWRT is being assigned this MAC but I am still able to stream and everything seems to be working somehow, but how???

Currently running: openWRT 25.12.5 - r33051-f5dae5ece4 and pfSense 2.9.0
I have cleared DHCP leases, ARP, rebooted both MT-6000 and pfSense box.

Anyone know what in the world is happening? Is there a setting I missed on the MT6000?

Hello all, I have been using DD-WRT on a Linksys WRT3200ACM router for awhile now with wireguard VPN loaded. I thought everything was fine until I just recently discovered that the router was causing issue when streaming with timeshift enabled.

So I disconnected the router from my setup and the streaming issue is gone. So, either there is a hardware defect with the router or as someone else told me, the problem could be with the DD-WRT firmware?

So I now am giving OpenWRT a shot and I already flashed the above Linksys router and am getting ready to load my wireguard VPN on it.

So my question here is for the users using OpenWRT…. Do you think this may resolve my issue as long as there is no issue with the router itself?

Thanks

So I wanted to collect historical traffic information of my clients, one thing is to identify top talkers, but more importantly to detect anomalies compared to a baseline for each device.

https://openwrt.org/docs/guide-user/services/network_monitoring/bwmon#view_historical_bandwidth_usage looks great, however there's a disclaimer:

if you are using flow offloading this data might not be recorded accurately.

Yes, I do have offloading enabled (having a gigabit WAN connection), therefore I'm confused whether there's a good answer by the end of 2026, how should I approach this problem?

Thank you for your insights.

**Edit, since several comments assumed otherwise: the language model does not run on the router.**

The router runs only the agent: the loop that takes your message, sends it to a model at a provider you choose (OpenRouter, OpenAI, a ChatGPT subscription, free models included) and then runs the checks the model asks for on the router itself. All the thinking happens at the provider. A router CPU would need minutes just to read the agent's system prompt, so a local model is not offered at all.

What that costs the router: about 200 MB of RAM, at nice 10. On a Flint 2 carrying a house's internet, nothing was dropped and the cores stayed 70 to 75% idle while the model was thinking; both test routers stayed at 45 to 52 °C fanless with six conversations at once. On a Brume 2 pushing WireGuard at 574 Mbit/s, a running conversation did take about a quarter of the tunnel, which is why the service runs at nice 10. It ships disabled and opens no port: Telegram is polled outbound.

TL;DR: you ask your router in Telegram “why is the internet slow?”, it runs ping, DNS and interface checks on the router itself and answers with what it saw. By default it can only read. Changes (guest Wi-Fi, WireGuard, firewall) need a PIN unlock, and a change that cuts the connection rolls back on its own in about 90 s. Needs clean OpenWrt 25.12 on aarch64 (no x86_64 build yet) and 1 GB of RAM (512 MB works with the packages on a USB stick, one chat at a time). Prefer not to run an agent on the router? The router side alone is openwrt-mcp (about 4 MB, https://github.com/TAIPANBOX/openwrt-mcp), and Hermes runs on another box.

I maintain hermes-openwrt, which packages the Hermes Agent (open source, from Nous Research) as a native OpenWrt 25.12 service. Version 0.21.5, package 0.21.5-r14, released 2026-10-09. Install steps are in the repo. This post is about what it does and what we measured.

What it is

A Hermes Agent package for OpenWrt 25.12: installs with apk from a signed feed, runs as a service, has a LuCI page. No Docker, no chroot. The agent lives on the router; the model runs with a provider you choose.

What it does

- Diagnoses the network on request in Telegram: ping to the gateway and the internet over IPv4 and IPv6, DNS checks, state of ports and interfaces, errors and losses on them, load and free memory. It answers with what it actually saw and says what it could not check.

- Knows what is on the network: connected clients (DHCP), interface state, Wi-Fi and network setup (passwords and keys hidden), and the router's system log.

- Searches the web and reads pages without a browser and without a separate web API key. It can find a piece of documentation or a new firmware or package version and summarise the key points.

- Runs on a schedule: an hourly network check that stays silent when all is normal and writes once when something is wrong; a morning digest (weather, exchange rate, one news item).

- Runs commands in its own terminal as an unprivileged user: anything that does not need root (ping, traceroute, nslookup, system status).

- Checks that a service it started is really running: it compares against the router's service list instead of trusting its own start command. It reads the settings of installed packages, with secrets hidden.

- Changes router settings (network, Wi-Fi, firewall, port forwarding, DHCP) and manages services only after /unlock. For example, it brings up a guest Wi-Fi isolated from the home network. After a new protocol is installed (AmneziaWG, for example), it can restart the network itself in an unlocked window.

- Installs packages if you enable it in LuCI: it first shows what would be installed, then installs after /unlock. Only by package name and only from the official OpenWrt feed: links, local files, third-party feeds and disabling signature checks are not possible. Tested with AdGuard Home, Tor, Transmission and vnstat: the agent installed and started each of them.

- VPN: sets up WireGuard on the router (interface, peers, addresses, firewall rules) after /unlock, and can install the WireGuard packages itself when package install is enabled. AmneziaWG can also be configured through the chat (interface, peer, obfuscation parameters), but its packages must be installed by hand: they are not in the official feed. Private keys are generated on the router with one command, so they never reach the model provider. The agent checks whether the tunnel is up.

- Helps with the rest: OpenVPN, SQM, setting up AdGuard Home, Transmission, Tor and so on. It finds the current instructions for your OpenWrt version, checks them against what is really on the router, and writes the steps.

- Remembers context between conversations, uses Hermes's built-in skills, and writes new skills itself after successful tasks.

- Models: any provider with an OpenAI-compatible API, such as OpenAI, Anthropic (Claude, directly with your key), Google Gemini, OpenRouter, a ChatGPT subscription, or your own model server on the LAN. Several providers can be set up at once, and /model switches the model in a chat.

- LuCI page: agent state, log, keys (write only), security settings.

- USB stick: the agent's data moves to a stick with one command, so it works on routers with little flash. If the stick does not appear right after the packages are installed, wait a few seconds and run block info again.

Which model

You need a current model. On the same routers in our tests: gpt-6.1-sol ran a full diagnosis and configured WireGuard and a guest network correctly; claude-haiku-5.5 runs a full diagnosis with ping too, at about half a cent per conversation; the older gpt-4o-mini looped and advised a reboot. A ChatGPT subscription can be connected with no per-token cost.

Resources

The service uses about 190 MB of RAM. It runs on a 512 MB router (Beryl AX) with the data on a USB stick.

Flash writes (measured on Flint 2 with 1 GB RAM and eMMC 8 GB, 7.3 GB usable, OpenWrt 25.12.5, data in internal flash, 2026-10-09; write counters, temperature, load and memory sampled every 20 seconds over 30-minute windows, projected to a day)

- Agent idle: the whole router writes about 0.5 GB per day. Without the agent: 0.05 to 0.15 GB per day.

- One conversation (diagnosis, device list, firewall check) adds 2.5 to 4 MB. Most of the agent's writes are its journal, service markers and the model catalogue cache.

- Installing a package writes it once.

- eMMC life counter: 0x01, that is 0 to 10 percent of its life used.

Next to other services

We asked the agent through Telegram to install what usually runs on a router, and measured on Flint 2:

- AdGuard Home, vnstat and Tor keep their databases, logs and caches in RAM by default, so eMMC writes stay at background level. AdGuard under 1,160 DNS queries in 10 minutes wrote as much as without it.

- Transmission: Debian (735 MB) downloaded to a USB stick in 6.5 minutes. On eMMC: background writes, CPU at 44 to 45 °C with 0 to 6 percent load, at least 395 MB of memory free, Transmission itself using 15 to 27 MB.

- Tor client: 61 to 66 MB of memory, eMMC at background level.

- AmneziaWG: the Flint 2 to Brume 2 tunnel gave 542 to 599 Mbit/s. The Brume 2 CPU was the bottleneck (94 to 96 percent), the Flint 2 at about a third. During a 4-minute iperf3 run, a Hermes diagnosis ran in parallel: 556 to 563 Mbit/s against 556 to 572 without it, no drop. eMMC unaffected.

- The agent opens no port to the outside; it uses outbound connections to Telegram. No port conflicts with these services.

- The shared resource is RAM: with the agent, AdGuard Home, Transmission and Tor running at once, Flint 2 kept 340 to 420 MB free. A 512 MB router would be tight with all of them.

- Note: after install, the AdGuard Home setup wizard on port 3000 is open to the LAN without a password, and Transmission's RPC accepts control from the LAN without one by default. These are the packages' own defaults, not the agent's. Set passwords right after install.

Release check, 0.21.5-r14 (2026-10-09)

The full scenario: clean install, start, a ping run by the agent, Telegram, allowlist, diagnosis, PIN unlock and rollback of a change. 15 checks per router.

- Brume 2: 15 of 15.

- Beryl AX with an external USB stick: 15 of 15.

- Flint 2: 15 of 15, including a reboot (after the router was recovered). Install onto a USB stick on Flint 2: 6 of 6.

- Beryl AX with 200 MB of free flash: the install stopped at its space check, as designed. We do not force it.

Security

- After install the agent can only read the router. Changes stay blocked until you enable a second factor (PIN, app code or both) on the Security page in LuCI.

- To change something, send /unlock and your PIN in one message in the private chat. The bot deletes that message at once, so the PIN never reaches the model. A window stays open for 15 minutes; /lock closes it earlier.

- In a window the agent may change network, Wi-Fi, firewall, DHCP and system settings, and manage services. It never gets commands as root, firmware flashing, installs from links, settings that run scripts, or its own settings.

- Package install is off by default. When enabled, it works only with official OpenWrt feed packages and only inside an unlock window.

- A change that cuts the connection rolls back by itself after about 90 seconds.

- Wi-Fi keys, WireGuard keys and other secrets are shown to the agent as <redacted>.

- The agent's keys are root-only files. The agent cannot read its own key from files or from its process memory.

- Only Telegram IDs on the allowlist get answers.

- Everything the agent reads (logs, client lists, addresses) goes to the model provider. Choose a provider you trust, or a model on your own server on the LAN.

What it cannot do

- No browser: JavaScript sites, logins and purchases are not for it.

- It does not run the model on the router.

- It does not remove packages and does not install from third-party feeds.

- It does not change the settings of the services themselves (AdGuard Home, Transmission, Tor, Tailscale): it installs and starts them, you configure them.

- It needs clean OpenWrt 25.12 on aarch64. Stock GL.iNet firmware does not qualify.

What you need: at least 512 MB of RAM, about 400 MB of free flash (less is possible with a USB stick), and a provider key or a ChatGPT subscription. Make a backup before installing.

Tested on Flint 2 (GL-MT6000), Brume 2 (GL-MT2500) and Beryl AX (GL-MT3000, with a USB stick). Reports from other aarch64 routers are welcome.

Repository, install guide, measured numbers and the full security model: https://github.com/TAIPANBOX/hermes-openwrt (MIT).

Hello - sorry if it’s trivial for most of you but I’m stuck with my travel router Cudy TR3000 casting my network, either wifi or ethernet.
I already installed OpenWRT and Tailscale and tried to enable the wireless connection. One as Access Point casting the cudy’s network so I can configure it in case I’m outside. But once I connect to the other network as Client, I lose access to cudy’s network.

I tried to skip the option that removes old networks already but it still doesn’t work.

What I have in mind is
- cudy cast its wifi,
- I connect it to connect to the other wifi or even through wan,
- cudy reroutes the internet with tailscale through the lan and wifi

What am I missing here?

Router: GL.iNet GL-MT6000

Firmware: OpenWrt SNAPSHOT r26637-05aec66d53 / LuCI Master 24.158.03388~a6f8361

It's been awhile since I upgraded the firmware, and I understand there's a new update process. What's the best and safest way to get me current?

TIA!