OpenWRT is pretty great at offering features and security for consumer devices. Glad to see a release!
I used it for a while, but after I've had it for a few months, and want to improve/diagnose something, I can't easily tell which config I've changed from defaults, and so can't easily diagnose how I might have screwed it up, or predict how changes will impact the rest of the system.
I moved my router to NixOS, where I can now see the ~250 config that covers the custom setup needed for my ISP/LAN.
If asked, I'd still recommend OpenWRT for most techies, since it's easier to get started.
As an Arch user I've always been a bit confused by the joke. I have more shit go wrong on my Macbook. Sure, on Arch I might get a bad Nvidia driver update and either have to roll back the driver, kernel, or both[0] but these are at least easily fixable. You can easily determine the problem, fix it, and you've learned how to avoid it or resolve it in 5 minutes if it happens again (thanks Nvidia ;). Other than that, the only breaking things are when I'm fucking around, and well... that seems like my own damn fault lol. But several Macbooks I've had will go to sleep and if I try too fast to wake it up I'll have a black screen that can't be recovered until I reboot. And I could go on about how weird and infuriating some shit is and how I can't even implement a fix myself and I just give up because I don't want to waste time fighting Apple and play that cat and mouse game with no good documentation. I've just come to understand that "just works" means "not as buggy as Winblows".
AFAIAA the joke comes from Arch's purported superiority (rolling release, close to upstream, bleeding edge, KISS) as compared to "bloated/slow" e.g. Ubuntu. It's kinda old now and existed even before the controversial switch to systemd from SysVinit/rc.conf.
Tbh I thought that it was because people are scared of the terminal, this even somehow includes people who have used Linux for a decade. That and that basically you're forced to use the terminal for Arch and read the instructions.
So kinda like how people joke about Ikea furniture being difficult to build. I mean... it's not, it's quite intuitive. But even if it wasn't then it's purely an exercise in ability to read instructions
On virtual routers there is no content in /rom. What you can easily do is install another copy of the same image on another VM or container and run it through firstboot. Make a backup and compare it with a backup from your running system. Even better is to make a backup just after firstboot, then use the system and compare your current backup with the first one.
Do keep in mind that the OpenWRT backup does not contain information about which extra packages were installed after firstboot. I solved this adding a cron job which runs opkg list-installed > /etc/opkg_installed.txt and adding that last filepath to /etc/sysupgrade.conf so it gets added to backups.
> OpenWRT is pretty great at offering features and security for consumer devices
That's a misconception. Nobody actually cares about security for packages that are not in the default install. For example, the initscript for sstp-client disables certificate validation unconditionally, see https://github.com/openwrt/packages/issues/25212
It at least offers more security than the usual alternative on a consumer router of the manufacturer's OS (i.e. something updated once a decade running linux 2.6 with GPL-violating unreleased patches so you can't update it yourself, all written in C by the contractor that bid the lowest).
cd /etc
git init
git add .
git commit -m 'default config'
git remote add ...
git push
# modify your configs
git diff HEAD
git commit -m 'yay i changed stuff and i know what i did'
git push
Will have to look at kea and corerad. What hardware do you use for the wireless links? Intel has been very hit or miss in my experience. And the misses suuuck, like after enough hosts connect, you get kernel panic on every new client connection, or all but the one device I needed a separate wlan for are compatible with the host. So, NixOS on a router that doesn’t have to be a wifi ap is extremely nice in my experience.
Running a router built with systemd-networkd and kea myself, and I quite like both, even though I have not integrated them with each other. Would you be willing to share some details on how you use these components? Especially corerad as I am not familiar with it and wonder on the why+how, considering networkd does NDP. Thanks
systemd-networkd sets up a LAN interface, which Kea then serves DHCP for.
CoreRAD is about the same thing, but for NDP instead of DHCP.
I could have used systemd-networkd for serving DHCP and NDP, but prefer to use separate modular privilege-separated deamons, especially if I get memory safety too.
To see what was changed, I use the option to download a backup of the configuration, and compare it with an older copy I had downloaded earlier (it's a set of text files, it can be unpacked and compared with recursive diff).
I disabled IPv6 as my little ISP has not yet figured out how they want to bill for or assign/segment it out for static assignment. I have multiple static IPv4 addresses. I only use static IP's but that is a requirement specific to me. The firewall is very simple and just forwards packets and uses a simple IPv4 SNAT. The only time I've had it set up more complicated was when a guest was abusing P2P so I had to block it using string matches on the unencrypted commands.
My setup is honestly simple enough that a write-up would not benefit many. My Unbound setup to block many malicious sites is also fairly well documented by others. The null routing of commonly used DoH servers is straight forward. My Chrony setup would just annoy people as I only use stratum-1 servers and the options would just look like cargo-culting to some.
About the only thing not commonly discussed is the combination of thc_cake and some sysctl options to keep buffer bloat low but OpenWRT has their own take on that topic already.
Yeah, it's awkward that the usecase where I really want to be able to see (or really, commit) all my configuration like that is the place where I can't fit NixOS:( There was nixwrt, but that got discontinued. Actually it looks like Liminix is a thing now; I'll have to look at that.
I used it for a while, but after I've had it for a few months, and want to improve/diagnose something, I can't easily tell which config I've changed from defaults, and so can't easily diagnose how I might have screwed it up, or predict how changes will impact the rest of the system.
I moved my router to NixOS, where I can now see the ~250 config that covers the custom setup needed for my ISP/LAN.
If asked, I'd still recommend OpenWRT for most techies, since it's easier to get started.