My home network has evolved. I went from Xfinity’s all-in-one hardware (slow, monthly fee, ran hot), through Dynalink WRX-36 on stock firmware, to the same hardware running OpenWrt.

I don’t recall the exact pay-off period, but at the time I calculated that the one-time cost of buying the Dynalink hardware and cable modem would break even in about 2 years, which has now elapsed.

Moving to the Dynalink reduced ping times and variability. However, I put off trying OpenWrt for a long time. I was concerned about downtime for the rest of the household, as well as the potential to brick the hardware. I was motivated to finally try it by a desire to have less-trusted devices on the network, specifically a second-hand printer.

The flashing process took an hour or so, being careful with the steps. Configuring it took a few more hours; I had to build familiarity with the concepts, decide on the all-important funny SSID names, and reconnect all the IoT devices. I used AI (Claude) to build the plan, but didn’t give it direct access to the router.

Multiple Wireless SSIDs

OpenWrt allows you to configure as many SSIDs as your hardware allows. The WRX-36 has two radios, and I set up 3 networks across them:

Regular Network (lan)

Trusted devices go here. This is the only zone that is allowed intra zone forwarding, so it can access hosts on the other zones.

The stock firmware had blocked access to the cable modem’s admin page. Debugging WAN connectivity issues was annoying, because I had to physically connect a machine to the modem directly. This is not an issue with OpenWrt.

Guest Network (guest)

For visitors to use the Internet. Clients can’t communicate with each other, or access the router admin panel. Only the router’s UDP ports 53 and 67 (DNS and DHCP) are accessible to the guest network.

Limited Network (limited)

Clients can’t communicate with each other, or access the Internet. This network is for IoT devices, printers etc. that do not need direct Internet access. Exceptions can be carved out via Firewall rules for specific devices to access the Internet. It’s satisfying to check the logs and see these devices trying to connect to their Cloud backends in vain.

HomeAssistant & Tailscale

I ditched the horrible Kasa IoT app with its layout shifts and ad spam, and moved all IoT devices to a HomeAssistant setup on my Raspberry Pi.

I set up Tailscale on the router so I could access HomeAssistant away from home. Alternatively, I could have set up Tailscale on the Raspberry Pi.

DNS over HTTPS proxy

The router is configured to act as a DNS over HTTPS proxy, and DHCP registers the router as the default DNS resolver for all networks.

I followed the OpenWrt DoH with Dnsmasq and https-dns-proxy guide.

NAS with Cryptsetup

I connected an external USB HDD enclosure to the router, and used Claude to assist me in setting up a cryptsetup & LUKS encrypted volume. The key is in-memory, so every time the router power cycles I need to reconnect over SSH and run a small script to unlock the volume. The router and USB HDD are powered through a UPS, so this is not a concern. The volume is shared over Samba with the LAN and I get around 75MB/s read/write throughput. This is quite slow, but adequate for use as a backup disk. CPU use is very low because it has the native AES extensions.

I was pleasantly surprised to see new submenus show up in the OpenWrt Web UI to configure HDD Idle timeouts and Samba options.

In summary, I highly recommend OpenWrt and will be donating to the project.

---