Alternative router firmware: what are DD-WRT, OpenWrt, Tomato & ASUSwrt Merlin
Alternative router firmware: what are DD-WRT, OpenWrt, Tomato & ASUSwrt Merlin
Learn what open-source router firmware projects are, which are the best ones and why you may want to give them a try. Updating the firmware of your
Just like the operating system on your computer & cell phone, you can change the software running on your router.
I would take these projects over stock firmware on traditional home routers any day. And I have done where I’ve been unable to rig a more permanent solution. They have an honourable mission in a section of hardware filled with absolute junk.
But the trouble is the sheer number of hardware targets and meagre resources on these devices combined with the contempt of third party firmware from most manufacturers make them hard to flash and leave them rarely updated, if you’re lucky enough to have a supported device. Even then they are prone to quirks and bugs. Some devices do receive and are capable of receiving updates but they often cost more than the equivalent low TDP general purpose computer.
Just imagine: the developers of DD-WRT have to target not just each individual router model but every single revision as the manufacturers have a habit of switching major components or even entire chipsets between product revisions. On top of that the documentation for the components used might be sparse or non existent. I’m impressed that these router distributions can make it work at all but that doesn’t make it any more practical or sustainable.
At this point you may as well flip the router into modem mode and run OPNsense or PFSense and get a fully fledged operating system running on far more resources than any of these SoCs. Assuming you have the power budget you’ll get assured updates and far more flexibility with fewer compatibility issues and quirks. My passively cooled N5105 box with 8GB of ram and a 128GB HDD happily routes a 1gb/s WAN while simultaneously hosting a busy home assistant instance. The resources aren’t even maxed out.
Following my experience I will always opt to run dedicated APs. DD-WRT WiFi support is amazing considering what they have to work with, but there are only so many wifi chipsets they can support and because they try to support as much as they can there are always problems with something. I really don’t have time to constantly troubleshoot the wifi following cryptic posts from years ago. Ubiquity stuff isn’t flawless either but it’s stable and a lot less prone to hard to trace issues. YMMV.
DD-WRT and friends I love you, you really saved my ass a few times when all I had was some shitty CPE. You’re still way nicer than Cisco gear. But I find it hard to justify using a gimped out SoC from a couldn’t-care-less manufacturer when I can buy a 5W TDP passively cooled x86 computer for ~100usd.
I will always opt to run dedicated APs
Any recommendations for a dedicated Wi-Fi 6+ AP that supports open firmware?
The short answer is no, because it’s a pain in the ass and offers little tangible benefit. But I can speculate.
If I was going down this path I would look for an x86 box with a wifi card that is supported by OPNsense or PFsense(that’s usually going to be dependant on available *BSD available drivers). I don’t how well they would function but I would expect quirks. You could also check the compatibility lists of the open router distributions to find something that’s well supported. You can check the forums for posts from people with similar goals and check their mileage.
You might even be able to achieve this with an ESP32.
But what are you hoping to achieve? Do you mean open radio firmware or do you mean open drivers? Or an open OS talking to a closed radio? What’s the benefit?
Radios in any device are discrete components running their own show.
Open drivers should be possible. However I have a feeling that open firmware for wifi access points radio hardware is going to be extremely hard to find. The regulatory agencies really don’t want the larger public to have complete control because of the possibility of causing interference and breaking the rules(for good reason - imagine if your neighbour had bad signal so he ignorantly cranks up the power output, not realising that he can’t do the same with his client devices, rendering his change useless).
I seem to remember a change in FCC rules some time back that seemed to disallow manufacturers obtaining certification for devices that permitted end users to modify the firmware, much to the concern of open router users at the time. The rule was aimed at radio firmware but the concern was that the distinction would be lost and the rule applied to the entire router by overzealous manufacturers who hate third party firmware at best.
A fully open radio is basically an SDR. Can you move packets over an SDR? Hell yes, but now you’re in esoteric HAM radio territory. It’s going to be a hell of a fun project and you’re going to learn a lot, but in so far as a practical wifi ap, your results will be limited.
I use FOSS wherever it’s practical but if you want working wifi just stick to the well tested brand names. For what it’s worth you probably won’t gain any security by going open, if there’s any weakness it’ll probably be baked in at the protocol level which open devices would need to follow anyway. At least a discrete AP can be isolated and has no reason to be given internet access.
I think Asus routers are about as close as you can get because the stock Asus firmware itself is based on an opensource firmware, which means 3rd party projects such as asuswrt-merlin has an easier time to develop their 3rd party firmware because the stock firmware's source code is available. They are more expensive than other routers though, which might a be a tough pill to swallow especially when vendors such as TP-Link sells their router for dime a dozen.
The problem with DIY solutions is that you will be missing out on all advanced hardware features available in prosumer and industrial routers. It's always better to just buy top of the line ASUS router than going DIY. DIY won't give you WiFi 7 or even WiFi 6E. DIY won't give advanced antenna array. The list goes on.
Another point for ASUS routers is that Merlin firmware is available for most of them. And new routers are added all the time. Simply because Merlin is based on official firmware from ASUS. And it adds a lot of nice features, plus gives you SSH access so you can do whatever you want.
And last, but not least, ASUS supports old routers for many years, adding new features and fixing bugs. So if you're not comfortable with flashing custom stuff, you are still better off with ASUS product than with a competitor, as some companies tend to drop support after a measly 9 months since release (looking at you, TP-LINK).
Basically, always go with hi end ASUS - the best hardware plus really good software and support.
While I agree in general that turnkey solutions for access points (not routers) are largely preferable I must point out that it is at least possible to achieve 802.11ax with DD-WRT: https://openwrt.org/toh/views/toh_available_16128_ax-wifi for example, as I found out from this excellent post: https://lemmy.ninja/post/224052
That post also does a fantastic job of explaining the inherent issues of dealing with wifi hardware from an open source perspective.
Features like Mu-MIMO/beam forming that call for arrays of antenna are a part of the respective WiFi specifications, and are baked into the closed firmware of the radios. While manufacturers will fight hard to make you believe they are implementing something special, the fact is that they must abide by the WiFi standards and are just rebranding things built into the radios they buy. Hence even FOSS software can implement them. Check out this thread I found which describes what’s going on:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1215880
What troubles me about the ap/router combos from Asus and the like is that they they charge so much for so little, and they have a history of being generally shitty: https://www.pcworld.com/article/447083/netgear-accuses-asus-of-submitting-fraudulent-test-results-to-the-fcc.html
It was these same companies that claimed gigabits of wifi throughput, when they were in fact advertising the combined speed of three antennas over two bands. No one device would ever see the speed they slapped on the package. Heck even if they did, grandma probably can’t appreciate the fact that faster wifi doesn’t mean shit if you have a 20/3 asynchronous dsl connection.
The specialised hardware - ASICS that push packets - are what allow them to include megabytes of RAM and tiny amounts of storage along with extremely anemic CPUs. Very little if any of this is designed in house, they pick components or even an entire SoC, lay out a board, test it and ship it with a nauseating markup. Those ASICS aren’t expensive: they’re in the most basic switches, and the super duper wifi hardware is just a rebadged product from another company. This isn’t really a criticism, it just means that they are efficient and low power but hardly unique. It is though an observation that even the high end router/ap combos are far from bleeding edge tech worthy of the high prices they charge, imho. Why the fuck is 10GbE still so expensive in 2023? There are 10 year old SATA3 drives that can saturate a GigE uplink.
The software side usually consists of a minimised Linux build often running a myriad of the same open source software running on DIY builds. Back in the bad old days it even took some pressure to get them to abide by the respective OSS licenses and give their code back to the communities they were using to make money.
They’re charging a premium for very low spec hardware, and not doing a great deal to earn their keep.
Finally while these companies are now being forced to provide updates, they are still shipping products with security issues:
One of the most relevant examples from that article being: ‘The other critical patch is for an almost five-year-old CVE-2018-1160 bug caused by an out-of-bounds write Netatalk weakness that can also be exploited to gain arbitrary code execution on unpatched devices.’
So while I can agree that a DIY Wifi AP will likely cause a certain amount of avoidable grief, I simply can’t abide by the notion that OPNsense or PFsense is unable to offer feature parity with COTS routers.
As an addendum, if my $100 x86 router can route 1GbE as well as a $300 RGB monstrosity, what are they bringing to the party exactly? Why should we indulge that? Why should we tolerate such gratuitous bullshit?
Great comment. I ran dd-wrt for years, but finally picked up a used Ubiquiti router and purchased the Eero Pros for wifi. Software does the security now.
It's awesome to see these projects are still alive and kicking but they feel like a relic of a past era nowadays. Much like how stock ROMs on Android have improved to the point that rooting isn't really beneficial in most cases anymore, the stock firmware on the majority of routers is perfectly serviceable. I'm sure there are still some corner cases where they are as transformative as ever though.
Permanently Deleted
I installed MerlinWRT on my Asus router and it greatly improved the smart steering between 2.4 and 5ghz. Before installing it the router would steer me back and forth very often no matter what I set it too, and I would often drop connection. After Merlin it is rock solid.
I need it for custom DNS settings that aren't normally exposed. Works great.
I agree. Back in the day I used to run DD-WRT on a cheap $75 router to get features you’d only get on $200+ routers, but now a days I think there’s better options. UniFi for example is great if you don’t mind spending a bit extra. Otherwise I’d rather just use PfSense.
I have worked with a gigabit ISP for a number of years, and personally haven't seen that much improvement in stock firmware. If anything, I feel like it's more a matter of hardware improving to the point that the clunky stock firmware can run ok.
Maybe I should revise my statement to "consumer routers an informed user would consider buying".
I'm using a GL.iNet router which is running off of OpenWrt. The front end looks very modern
Yea I feel like I'd lose features if I tried to do a different firmware on my Amplifi alien
Ever since I found out my old Netgear R7800 didn't have a functional IPv6 firewall, I've been riding happily on the OpenWrt train. Now I absolutely refuse to buy routers that I can't flash with OpenWrt.
I'm a bit surprised OpenWrt is in the same list as the rest. It really is in a league of its own on a technical and functional level. OpenWrt is much closer to a typical server Linux OS. Yes you can use it as a dumb flash-it-and-go firmware replacement on supported hardware, but it can do so much more.
I was actually under the impression that DD-WRT was sort of on-par, but then again I've never tried it.
I've been in the game so long I almost down voted this as anti-propaganda
All of these projects are stable, mature firmware with current, advanced features. You can be your own VPN provider against your home IP for yourself and trusted friends.
You can run Tor ingress, interior and egress nodes
You can run private DNS and DDNS using popular privacy services
Lots to offer among these projects. (Sorry, OP, your headlines e looked sketch)
e: typos
I run Fresh Tomato on my Asus router, and super happy with it. Tons and tons of functionality that didnt exist at all in asus firmware.
It's fast, stable and has a much better user interface than default.
I have run Fresh tomato for years now but I have also run DDWRT before. The original manufacturer gave up security patches long ago for my router and many critical vulnerabilities have been found since, now unpatched on routers with vendor firmware. Tomato is kept up to date and patched and with all the recent features of a much more expensive class of router than what mine came with.
It's superior in features but it's also much more secure. Nowadays I think most should be selecting OpenWRT, it's the biggest project with the most hardware supported and if choosing hardware it's a good idea to select something on their supported list, if nothing else but to get security patches when your vendor stops, typically just a couple of years after you buy it.
I've got some variety of Tomato running on an ancient Netgear thing the previous owner left here. I use it in client mode to be a wifi adapter for my desktop, my server, and my little TV box running Armbian. In years past, we used a DDWRT router to provide a second SSID with always-on VPN.
I ran DD-WRT and Asus-MerlinWRT for a long time before hopping on the unifi train. They worked a treat and extended the lives of the hardware.
I'm using GL.Inet GL-B1300 as my main router which had out-of-the-box OpenWRT-based firmware where the primary control panel is GL.Inet's own design, but from where you can also use advanced login to OpenWrt's own LuCI-interface where it's true potential unleashes. It is also possible to install pure OpenWrt on the router, but I haven't seen no need for that, at least for now, since the router is still supported by GL.Inet itself.
This GL-B1300 is my first OpenWrt based router, but before this I have used few Netgear, Buffalo and Linksys routers since 2009 with DD-WRT, Tomato and FreshTomato firmwares installed on them without any bigger problems. Only minor problems that has occured has been about the wifi speeds vs. original firmwares, which has been about the proprietary hardware wifi drivers being performant than the open source ones.
After all, these third party firmwares has given new or extended life with new features for many old and new routers that has been EoL or otherwise restricted by manufacturers. Not to mention how these 3rd party firmwares has saved money and natural resources preventing me to buy a new one everytime manufacturers dropped the ball about the updates even if the hardware where still valid.
Concerning Asus, I just last week got Asus Blue Cave AC2600 from 2018 on my hands; router which is EoL and it's latest official firmware is from 2021, but I found a ASUSMerlin-WRT based and up-to-date firmware fork for it; fork because there even haven't been any official Merlin support for it. This is probably because ASUS uses not-so standard or otherwise open hardware on some of it's routers instead of well supported Broadcom architecture, in this case this Blue Cave is based on non-usual Intel hardware.
I ran ddwrt for years moved over to a mikrotik hex with router os. Gave me all the features I used in ddwrt and more plus no weird reflashing hardware risks. Rock solid stable and still getting updates years later.
Pfsense/opnsense >
Still have 2 wrt 54 gl
Yes indeed! It's how I got Streetpass connections from all over the world in the 3DS days! Sure beats going to McDonald's!
I lost all respect for the DD-WRT devs a little over a year ago when I hit some problems with my routers rekeying wireless clients. I used to update weekly and so it was pretty easy to narrow down the exact build that broke it and flash back and forth to confirm. Rather than even admit there might be a problem they started making ridiculous claims that my neighbor must be attacking my network. I've seen posts as recent as ~two weeks ago where people are still trying to get them to acknowledge a problem even exists let alone do something about it.
I started using pfsense for my router and stock firmware on wifi routers in ap mode behind it. I've filed a few bugs against pfsense. They've all been addressed, so while it wasn't the cheapest switch ever I've been satisfied thus far.
If curious https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=334737 is a newer thread someone started about the issue.
Run a packet capture on the WAN side of any cheap Chinese router. See if you can keep track of all the weird IPs it tries to contact.