WrtNova — Multi-node fleet builder

Firmware target

OpenWrt version

Default version for all nodes.

System

Root password

Used for SSH login and AdGuard Home admin. Deployed to every node.

SSH public keys

One key per line. Deployed to every node.

Timezone

Time format

Default 24-hour 12-hour

LuCI HTTPS

Enable HTTP-to-HTTPS redirect for LuCI

Network

Default IP prefix

Networks & addressing

VLAN IDs are identical across all nodes in this network.

On	Network	Interface name	IP prefix	VLAN ID	Subnet	Router IP
	LAN					—
	Guest					—
	IoT					—
	VPN					—

VPN network is a dedicated network with its own WiFi SSID; all its traffic is routed through the WireGuard VPN client.

Additional VLANs

Extra VLAN IDs to trunk (tagged) through every port on every node.

Advanced Network options

Default subnet

Packet steering

Enable packet steering across CPUs. May help or hinder network speed.

IPv6 ULA prefix

Leave empty to auto-generate a random prefix on first boot.

Per-Network Dnsmasq

Enable multiple DHCP/DNS instances

To add DHCP on a new interface, use the built-in dhcp-instance-add command.

Tag LAN VLAN

Turn all LAN ports into trunk-only ports

WireGuard VPN client router node only

Don't have a WireGuard config? Use Cloudflare's free WARP.

Interface

Private key

Client IPv4

Client IPv6

DNS IPv4

DNS IPv6

Peer

Peer public key

Preshared key

Endpoint

Allowed IPs

You can change to a different WireGuard config later via LuCI → Network → Interfaces → vpn → Edit → Load configuration. After importing a config, remember to enable Route Allowed IPs in the Peers settings.

WiFi

Country code

Dense environment Tighten usteer roaming/steering thresholds

Wireless mesh

Enable 5GHz 802.11s mesh backhaul (overridable per node)

Tip: Prefer wired backhaul over wireless whenever feasible.

Network SSIDs

LAN

Leave password blank to use the default: 12345678

Advanced WiFi options

802.11k/v Neighbor reports and assisted roaming

802.11r Fast transition (fast roaming) support

Per-VLAN PSK One SSID; password decides which VLAN a client joins

Add band suffix Add 2G/5G/6G to the end of each SSID

2.4 GHz channel

5 GHz channel

6 GHz channel

WiFi log level

Note: 802.11r works well with most modern devices, but some older or low-cost devices may fail to connect. If a device can't connect, try disabling 802.11r. For IoT devices, use the IoT: 802.11r toggle above.

WAN router node only

Connection type

DHCP PPPoE

WAN MAC address

Advanced WAN options

Tagged WAN VLAN (required by some ISPs)

WAN VLAN ID 802.1Q VLAN tag for the WAN interface.

Enable secondary WAN (WAN-B)

WAN-B VLAN ID 802.1Q VLAN tag for WAN-B.

Bridge WAN port

Add WAN port to br-vlan bridge, useful for IPTV, VoIP, and multi-PPPoE setups.

IPv4 port forwarding router node only

Hostname	Last octet	Ports (space-separated)

Each row creates a static DHCPv4 lease and NAT port forward. Ports must be unique.

IPv6 server exposure router node only

Hostname	Last octet	Ports (empty = all)

Each row create a static hostid (IPv6 Token) in DHCP leases, IPv6 firewall forward rule, and Cloudflare DDNS entry. After boot, go to Network -> DHCP Leases and update the DUID for each host to match the actual client DUID.

DDNS (Cloudflare) router node only

Enable DDNS

Lookup hostname

Cloudflare API token

DDNS entries for IPv6-exposed hosts are derived from the IPv6 server exposure table.

Failover router node only

USB tethering

Enable USB tethering (Android / iPhone, device usb0)

Cellular modem (MBIM)

Enable MBIM modem failover

DNS & Ad blocking router node only

AdGuard Home

Ad blocking + DNS over HTTPS upstream. Requires ≥32 MB flash / ≥230 MB RAM.

dnsproxy + adblock-fast

Lightweight ad blocking + DNS over HTTPS upstream. For ≥16 MB flash / ≥128 MB RAM.

https-dns-proxy + adblock-fast

Lightweight ad blocking + DNS over HTTPS upstream. For ≥8 MB flash / ≥64 MB RAM.

adblock-fast

Lightweight ad blocking. No encrypted DNS, small footprint.

None

Plain dnsmasq only. No encrypted DNS, smallest footprint.

Block DNS over TLS/QUIC

Enforce ad blocking on stubborn client devices.

Block public DNS over HTTPS servers

Block known DoH resolvers via banIP so clients cannot bypass filtering.

Force DNS to router

Redirect all DNS queries (TCP/UDP port 53) from LAN, Guest, and IoT networks to the router.

Advanced DNS options

Add DoH preset

DoH upstreams

DoH resolver URLs, one per line. Blank uses Quad9 / Cloudflare / Google.

Bootstrap DNS

Plain IPs to resolve upstream hostnames + fallback. Blank uses 1.0.0.1 / 9.9.9.9.

Firewall

Threat feeds

Pre-configured IP blocklist feeds for banIP.

Active feeds

Country blocking

Drop WAN traffic from these countries via banIP.

Blocked countries

Additional rules

Block guest internet at night

Block guest internet from 9 PM to 7 AM. Requires guest network.

Additional packages

Extra packages

Appended to every node's build. Prefix with - to remove an auto-added package.

Performance & misc

Software flow offload

Can increase network throughput.

Hardware flow offload

Higher network throughput where supported. Do not enable if using QoS/SQM.

Enable irqbalance

Recommended for systems with ≥4 CPU cores. Automatically balances IRQs across CPU cores. Some devices may require manual IRQ affinity tuning for the best performance.

Quarterly auto-reboot

Reboot at 3:30 AM once every quarter.

Enable debug log

Trace first-boot script execution to /root/99-asu-defaults.log.