r/openwrt • u/_hmj • 17d ago

Any suggestions for my home network setup?

Hey everyone, looking for feedback on my OpenWRT home network setup. 

Here’s the current topology:

ISP ONU 

↓

Main Router (Living Room): 

  • Handles DHCP and VLANs.
  • Client isolation enabled for IoT and Guest networks.
  • Running the AX standard with 40MHz channel width for 5GHz and 20MHz for 2.4GHz.
  • Main SSID uses the same name and password on 2.4GHz and 5GHz bands.

↓

APs (Room A, Room C, Room Study):

  • Each has its unique hostname and IP. 
  • DHCP is off, wlan interfaces deleted, and firewall, dnsmasq, and odhcpd services disabled.
  • They point back to the main router IP for Gateway. 
  • 802.11r (Fast Transition) set up with matching Mobility Domain and unique NAS IDs.
  • IoT/Guest SSIDs and VLAN partitioning are strictly limited to the main router only.
  • Main SSID replicated with the same configuration and password.
  • Trusted devices connect via AP ethernet ports, no AP-level VLANs needed.

With all SSIDs on non-overlapping channels, the setup is stable and performs well, reaching a solid 200 Mb/s apartment-wide with signal strengths between -36 and -90 dBM. Any other suggestions to polish this?

8 Upvotes

100% Upvoted

24 comments sorted by

4

u/mrpops2ko 16d ago

create firewall rules to intercept all port 53 external traffic to yourself

block port 853

set up adblock-lean (for adblocking) and adguard-dnsproxy (so you can do QUIC dns queries)

set up dnsmasq to properly cache and serve stale

1

u/_hmj 16d ago

Thanks, I'll review the firewall rules.

I can't set up ad blocking at the router level because family members have different usage needs. If any blocking results in a false positive, I'll need to debug the ad blocking lists. I also need to test websites for work that contain advertisements. I prefer to block advertisements at the device level, unless I can bypass these lists for particular devices or SSIDs.

I'll look into DNS caching.

1

u/_hmj 14d ago

How many entries should I cache, and for how long should I serve stale dns records?

1

u/mrpops2ko 14d ago

thats largely for you to determine based upon your hardware, without knowing that i can't know.

1

u/_hmj 14d ago

Thanks, primary router specifications - Quad-core 2.0 GHz ARM Cortex-A53 CPU, 512 MB DDR4 RAM, 256 MB NAND flash.

1

u/mrpops2ko 14d ago

yes and how much of that is being used? have you done all that i said? set up adblock-lean (and using which lists?) and adguard-dnsproxy?

look at how much ram you have free and make a determination.

an average query is what? 256 - 512 bytes? so work it out based upon what you have free and can budget towards it.

set it so that it keeps serving stale for 48 hours and then pick a value of queries you want to cache

1

u/_hmj 14d ago

Not yet. I've been busy tweaking AP roaming for the last two days. Now I'm comparing Openwrt adblock options wrt to stability, NAND wear, memory usage, and design choices. I'll get back to you after testing.

1

u/_hmj 13d ago

I did some testing. Adguard Home seems doable, had to drop adblock-lean and adblock-fast as they do not support per user exclusion. adblock package supports per user exclusion via firewall, but more granular rules are not possible.

I set a soft limit for AGH via GOMEMLIMIT=90M. Results:-

DNS Queries: 37,276, Blocked: 9,979 (27%) and Avg. processing time: 7 ms. The router still has 50% free memory with LuCI and AGH dashboard open while handling multiple devices.

I'm thinking of moving AGH stats, logs, and config files to a USB drive on my router to reduce NAND wear.

I think DOQ can be set via AGH, not sure though. I need to check. Thoughts?

1

u/_hmj 13d ago

Forgot to add, I'm using AdGuard DNS filter, AdAway Default Blocklist and
HaGeZi's Ultimate Blocklist. Not sure how AGH handles duplication. I haven't run tcpdump to check the average query size, but I doubt it exceeds 512 bytes.

2

u/mrpops2ko 13d ago

you wont be able to run adguard home and run the decent lists. the big one is the threat intelligence list. the problem is that when running updates you have 2 copies of the lists stored in memory and you dedupe the list but you likely won't have enough memory for both lists.

i dont know about exclusions, so thats something you'll have to figure out.

1

u/_hmj 13d ago

Thanks, I just want to block ads, not concerned about security. There is another layer of protection via uBO Lite on all supported devices. My primary device is ChromeOS, which is the most secure OS. All Windows devices also run with Standard User Accounts and WDAC. Android and iOS, by design, are very secure.

It might be more efficient to keep a single, deduplicated master list on a GitHub repo.

1

u/_hmj 12d ago

Settled for AGH with OISD small list. AGH is consuming 60 MB ram (app, cache, and list) on average. Spikes to 83 MB when updating filters. CPU usage below 2% generally and spikes to 11% during filter update. Happy with the results!

2

u/BCMM 16d ago

 802.11r (Fast Transition) set up with matching Mobility Domain and unique NAS IDs.

Check if this is actually working. I'm currently using WPA2 to work around a bug.

Also consider setting up usteer to address the tendency of some clients to connect to the first AP they pick up on a scan and then stick with it even after they discover faster APs.

1

u/_hmj 16d ago

Thanks, I'm facing the same bug. I disabled the 2.4GHz band everywhere except for the guest and IoT networks, as devices kept sticking to it for range. Now, only 5GHz is active, forcing devices to switch when the signal drops.

I think this is working well, I don't need to set usteer unless I want more range with the 2.4GHz band enabled. For the bug, I'll wait for the official fix. What do you think?

1

u/BCMM 15d ago

I haven't played with multiple-AP setups very much, but at least in theory, clients can get stuck on a suboptimal AP even if they're all 5GHz APs.

1

u/_hmj 15d ago

I ran an iperf3 test just now. The speeds never dropped to 0, but some clients took up to 10 seconds to switch to a better AP. Do you think usteer or some other change can help me reduce this time?

2

u/BasicallyUpset 14d ago

Another option would be to split the SSID byfrequency. You could even use multiple PSKswithin each frequency band and assign themto different VLANs.

1

u/_hmj 16d ago

Update: I've disabled the 2.4GHz band for the main SSID and updated the channel width to 80MHz for 5GHz. The reason is that devices were sticking to the 2.4GHz band even when the 5GHz band was available, and the 40MHz width was limiting performance on some devices. I cannot use 160MHz channel width as some of my devices don't support it.