wrt

Open Wireless Router (OpenWrt) & IoT

I watched a couple of YouTube videos by David Bombal. In the first video, OTW (Occupy the Web) said that many Internet-of-Things (IoT) devices were based on OpenWrt, and they had very little security [1].

In the second YouTube video David Bombal takes control of an IoT light (brand Yeelight) with Wireshark and Python [2].

Thus, I decided to get started learning about OpenWrt. However, I had no idea how hard it would be to a Raspberry Pi Zero with OpenWrt.

References

OpenWrt - The Big Picture

Images - OpenWrt has two types of Images:
- Factory - The factory image is the first image you install onto host. It contains some header that may not be in the sysupgrade image.
- Sysupgrade - The sysupgrade image is used to upgrade a system where the configuration files and other changes have been made. OpenWrt allows live in place updates to be made with the command line program owut: OpenWrt Upgrade Tool (which is not installed by default) or with the web browser interface tool.
Filesystems - OpenWrt lets the user select one of two filesystems:
- Squashfs - The squash file system is optimized for SD cards. It contains a hidden partition.
  
  Because the squishfs filesystem has a hidden partition, tools such as the Raspberry Pi Imager Erase SD FAT32, will not restore the SD to its original image. Use the SD Association's Formatter. It is free and available for Microsoft Windows and Apple MacOS.
- Ext4 - The standard Linux (Unix) filesystem.
After an image has been installed, the filesystem must be expanded to occupy all the SD card. This depends on the type of filesystem.
Downloading Images - Because OpenWrt has two image types and a choice of two file systems, there are four download images:
1. squash-factory
2. squash-sysupgrade
3. ext4-factory
4. ext4-sysupgrade
Configuration
- OpenWrt has 9 configuration files located at /etc/config/:
  1. dhcp - Dynamic Host Configuration Protocol
  2. dropbear - a lightweight SSH server and client
  3. firewall
  4. luci - web browser user interface
  5. network
  6. rpcd
  7. system
  8. uhttpd
  9. wireless
- There are three ways to edit the configuration files:
  1. Directly with a text editor.
  2. Using the command line tool uci (Universal Config Interface).
  3. Using the web browser interface (LuCI). You will probably have to use uci to get enough of the system up to use LuCI.
Package Managers
- opkg is the current package manager for OpenWrt version 24.10.4.
- apk will be next package manager for OpenWrt. Apk is the package manager for alpine linux (an embeded Linux distro).
Networks - OpenWrt for some reason uses network-bridges.
Firewall - Altough OpenWrt appears to use nftables, it actually uses two smaller packages and one of them has iptables roots.

OpenWrt Images

Factory Image vs Sysupgrade Image
- Always start with the factory image because the sysupgrade image may not include headers that are in the factory image.
- The sysupgrade image is for live upgrading the system. This can be done via the command line tool owut (which is not installed by default) or with web brower interface tool, LuCI. Do not use an imager program to install a sysupgrade image i.e. Balena Ether or Raspberry Pi Imager.
Filesystem Images
- ext4. The standard Linux filesystem.
- squashfs - The squashfs prevents fash memory wear. However, it has a hidden partition which cause problems when erasing an SD card and writing a new clean image to an SD card. If you insist on using this, then use the SD Card Association's Formatter to restore the SD Card.
Where to find OpenWrt Images:
- By Name or Model: https://firmware-selector.openwrt.org/. This is the most flexible. It will allow you add packages, and it will built a custom image for you!
- By Processor Type: https://downloads.openwrt.org/. This is the best place to find released archive.

OpenWrt Defaults

The defaults for a stock openWrt Image are:

IPv4 address: 192.168.1.1
Wireless radios: in AP Mode, but radio disabled
DHCP servers: disabled

The wireless interface starts off with the legacy name wlan0, but as soon as it is enabled, it changes to the predictable naming scheme - either phy0-ap0 for Access Mode or phy0-sta0 for Station Mode.

OpenWrt has two default firewall zones lan and wan. The defaults are:

zone	Input	Output	Masquerading
lan	accept	accept	off
wan	reject	accept	on

First Connection to an OpenWrt Host

To to configure an openWrt host, you have to able to connect to it.

If your openWrt host has an ethernet connector, then all you need is an ethernet cable directly connected between the openWrt host and another computer with a web browser. In address bar of the web browser type: 192.168.1.1, and you will be connected to openWrt's web interface, LuCi.

If your openWrt host does not have an ethernet connector, you will have to connect a monitor and keyboard to it and enable the wireless radio. You can NOT just connect a usb-to-ethernet adapter and expect it to work. OpenWrt's stock images do not include any usb-to-ethernet drivers. However, you can add drivers. You might even be able compile an image with a driver.

Once connected to the openWrt host, you can replace the 192.168.1.1 address to an unused static IPv4 address on your network and remove the direct connection. You can log in via the web interface, LuCI or SSH.

To get the direct ethernet cable method to work with my Raspberry Pi 5, I had to:

In Network Manager, change my static IPv4 address to one in the subnet 192.168.1.xxx.
In Nordvpn, add the whitelist subnet 192.168.1.0/24.
In /etc/nftables.conf, comment out the include file with my custom lockdown nft rules.

OpenWrt on the Raspberry Pi 5

Since the Raspberry Pi B-series' 3,4, and 5 have only one Ethernet port and a Wireless network, the only way to build a wireless router, "without adding hardware", is to set the Ethernet Port as the wan (wide area network) port and the Wireless Network as the lan (local area network) port.

Unfortunately, that is not what OpenWrt.org assumes. They assume:

an external usb-to-ethernet adapter will be added,
and that the external ethernet adapter will be connected to Internet (wan) and that the internal ethernet & the wireless adapter will be the lan.

Almost all tutorials make this same assumption [ ].

This bias that the internal ethernet port will be part of the lan is baked into the OpenWrt image files.

One reputable author stops his tutorial short of making a real router. When the tutorial ends, the internal ethernet adapter is the lan and the wireless adapter has the name wwan. How can this be a tutorial, when everything appears to be ass-backwards! In the end he says that he is just teaching you the basics and that you add an external usb-to-ethernet adapter and isolate the ports. All of which he leaves up to reader.

I have yet to find a tutorial that does this:

Reference 1 is far too brief, and it assumes you are adding and a usb-to-ethernet adapter.
Reference 2 does not even mention a wan.

The default for the Raspberry Pi's 3,4 and 5 is for the DHCP client to be disabled and the IP address of eth0 to be set as static 192.168.1.1, and for the wireless network to be disabled. The default network configuration makes it hard to connect to the Raspberry-Pi / OpenWrt-host for the first time.

Connecting via Ethernet

On 2025/11/9, I flashed OpenWrt version 24.10.4 for a Raspberry Pi 5 onto a SD micro card using the Raspberry Pi Imager.

After flashing and logging in with a monitor and screen, the output of:

the output of:

cat /etc/config/network

was:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd95:ec8a:ef04::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

Configuration File Terminology

Configuration files have sections. In the network file above, there are four sections. There are different types of Sections i.e. interface, globals, device, switch etc. Sections may or may not have names (loopback, globals, unnamed, lan). Sections have options and/or lists and options and list have values.

A pictorial view of what we want:

                  Internet
                     |
              ----------------
             | 104.97.193.169 |
             |   ISP Router   |
             |  192.168.3.1   |
              ----------------                                   
                     |                                         
              ---------------                                  
              | Ether Switch |                                    
               --------------                                
                    |
                    | wan                OpenWrt Router     
             ----------------------------------------------
            |      eth0                                   |
            |  192.168.3.60 (eth0)                        |
            |                               DHCP Server   |
            |                               Wireless AP   |
            |                               192.168.4.1   |
            |                               AP (phy0-ap0  | 
             ---------------------------------------------
                                   |
                                \     /
                                 wifi
                                                         
                                 lan
                ----------------     ----------------
               | 192.168.4.100 |     | 192.168.4.101 |
                  ----------------     ----------------

My home network is on subnet 192.168.3.0/24 and 192.168.3.60 is a reserved unused static IP address. I arbitrary chose 192.168.4.0/24 as the subnet of the OpenWrt router. OpenWrt DHCP server's default is to assign IP addresses starting at 100 and ending at 250. You may need to change these values in your configuration.

Method 1 - Using the Web Interface - LucI

Establish a Direct Ethernet Connection
- Connect an Ethernet cable directly between the two hosts.
Log into the Web Interface - LuCI:
- Open a web browser
- In address bar type: 192.168.1.1
Change the Firewall to prevent getting locked out when eth0 is moved from "zone lan" to "zone wan":
- Network -> Firewall
  - wan zone / input: Accept ↓
  - Save & Apply
Delete LAN Interface & Create WAN Interface:
- Network -> Interfaces
  - Interfaces
    - lan
      - Delete
    - Add New Interface
      - Name: wan
      - Protocol: Static address ↓
      - Device: Ethernet Adpater eth0 ↓
      - Create Interface
        
        General Settings
        
        IPv4 address: 192.168.3.60
        
        IPv4 netmask: 255.255.255.0
        
        IPv4 gateway: 192.168.3.1
        
        Save
        
        wan -> Edit -> Firewall Settings
        
        Create / Assign firewall-zone: wan ↓
        
        Save
  Save & Apply
Log back into the web browser interface - LuCI:
- Disconnect the direct ethernet cable between the two hosts.
- Connect the OpenWrt ethernet port to the Internet (Router or Switch).
- Open a new web browser tab
- Type into the address bar: 192.168.3.60
Delete Unused Bridge:
- Network > Interfaces
  - Devices
    - Br-lan
      - Unconfigure
      - Save & Apply
Create Wireless Access Point Network:
- Network -> Wireless
  - SSID: OpenWrt | Mode: Master: Enable
  - Edit
    - Interface Configuration / Wireless Security
      - General Setup
        
        Mode: Access Point ↓
        
        ESSID: Ray's AP
        
        Network: lan: ↓
        
        Save
      - Wireless Security
        
        Encryption: WPA2-PSK (strong security) ↓
        
        Key: redacked
        
        Save
  Save & Apply
Create New LAN Interface and Place the Wireless AP in it:
- Network -> Interfaces
  - Interfaces
    - Add New Interface
      - Name: lan
      - Protocol: Static address ↓
      - Device: Wireless Network Master "Ray's AP" ↓
      - Create Interface
        
        General Settings
        
        Device: Wireless Network Master "Ray's AP" (lan) ↓
        
        IPv4 address: 192.168.4.1
        
        IPv4 netmask: 255.255.255.0 ↓
        
        IPv4 gateway: 192.168.3.1 - must type in!
        
        IPv4 broadcast: 192.168.4.255 - must type in!
        
        Save
        
        lan -> Edit -> Firewall Settings
        
        Create / Assign firewall-zone: lan (empty) ↓
        
        Save
        
        lan -> Edit -> DHCP Server
        
        Set up DHCP Server
        
        Save
  Save & Apply
Tests:
- Log into Ray's AP and Access the Internet
- Log into LuCI via 192.168.4.1
- SSH into root@192.168.4.1
Modify LAN Firewall to Reject Input - as it was originally:
- Network -> Firewall
  - Zones
    - wan / input: reject ↓
    - Save & Apply

Method 2 - The Command Line Tool uci

Although you can edit the configuration files with a text editor, the preferred method is to use the Universal Configuration Interface (uci) tool, which checks syntax.

UCI Commands:
- You create a named section with:
  - uci set config.section=section-type
- You delete everything in a named section with:
  - uci delete config.section
- You create a unnamed sectiion with:
  - uci add config section-type
- Unamed sections are accessed by their array index. To get the index:
  - uci show config[.section[.option]]
- You delete everything in a un named section:
  - uci delete config.@section-type[index]
- To add an option and value to a section:
  - uci set config.section.option=value
- To delete an option and value:
  - uci delete config.section.option
- To add and delete lists use add_list and del_list.
  - uci add_list config.section.option=value

With the uci tool, we can edit the configuration files to make our Raspberry Pi 4/5 a router:

Establish a Direct Ethernet Connection:
- Connect an Ethernet cable directly between the two hosts.
SSH into the OpenWrt host:
- ssh root@192.168.1.1
Change the firewall wan rule to accept input so you will not get locked out when eth0 is moved from lan to wan.
- uci set firewall.@zone[1].input=ACCEPT
  uci commit
Delete the LAN Section and Create the WAN Section and set its options & values:
- uci delete network.lan
  
  uci set network.wan=interface
  uci set network.wan.device=eth0
  uci set network.wan.proto=static
  uci set network.wan.ipaddr=192.168.3.60
  uci set network.wan.netmask=255.255.255.0
  uci set network.wan.gateway=192.168.3.1
  uci set network.wan.broadcast=192.168.3.255
  uci set network.wan.ip6assign=60
  uci commit
Connect the WAN to your Network and SSH into it:
- Disconnect the direct ethernet cablee between the two host.
- Connect the OpenWrt ethernet port to your Network (Router or Switch).
- ssh root@192.168.3.60
Delete the Unused Bridge Section:
- uci delete network.@device[0]
  uci commit
Enable the wireless radio and set it up as an access point:
- uci set wireless.radio0.country=US
  uci set wireless.radio0.disabled=0
  
  uci set wireless.default_radio0.device=radio0
  uci set wireless.default_radio0.network=lan
  uci set wireless.default_radio0.mode=ap
  uci set wireless.default_radio0.ssid=RaysAP
  uci set wireless.default_radio0.encryption=psk2
  uci set wireless.default_radio0.key=redacked
  uci commit
Create a lan Section that Includes the Access Point:
- uci set network.lan=interface
  uci set network.lan.device=phy0-ap0
  t uci set network.lan.proto=dhcp
  uci set network.lan.ipaddr=192.168.4.1
  uci set network.lan.netmask=255.255.255.0
  uci set network.lan.gateway=192.168.3.1
  uci set network.lan.broadcast=192.168.4.255
  uci set network.lan.ip6assign=60
  uci commit
Test:
- Log into Ray's AP and Access the Internet
- Log into LuCI via 192.168.4.1
- SSH into root@192.168.4.1
Restore the LAN Firewall to Reject Input:
- uci set firewall.@zone[1].input=REJECT
  uci commit

References

Openwrt on the Raspberry Pi Zero 2W

The openWrt image for the Raspberry Pi 2W. is actually the the image for the Raspberry Pi 3B. The Pi 3B has an ethernet port so I decided to add an external usb-to-ethernet adapter. However, the stock image does not have drivers for usb-to-ethernet.

I wasted a lot of time, getting the wireless inteface up and downloading a usb-to-ethernet driver, before I discovered that you can use OpenWrt's firmware selector and add a driver and build a custom image with the driver online. Wiki

To determine the driver your adapter needs. Plug the adapter into another host and execute:

lsusb

Adapter	Chip Set	Driver
Plugable 2.5GH	Realteck rtl8152	kmod-usb-net-rtl8152
Benfei	Asix ax88179	kmod-usb-net-asix-ax88179 kmod-usb-net-cdc-mbim

* The Benfei adapter has problems with the Raspberry Pi and needs two drivers: reference.

With an external usb-to-ethernet adapter and driver, the configuration procedure is the same as the Raspberry Pi 5.

Resizre the Filesystem

There are a lot of rarticles on the Internet on this subject. Some said, that the method depends on the hardware, x86, arm, etc. Some of them require you to remove the SD card and use a second computer to resize the SD card. All of them require you to install additional software.

After searching the Internet, I did find an easy way to resize the SD Card. I largely followed reference [1].

From a ternminal on another PC, ssh into the openwrt device.
ssh root@192.168.xxx.xxx
Install the required packages:

opkg update
opkg install cfdisk resize2fs
Resize the partition

cfdisk /dev/mmcblk0
- To unlock the Resize option for the last (/dev/mmcblk0p2) partition:
  - Create a New - primary partition in the large free space after the last (/dev/mmcblk0p2) partition (leave default values)
  - Delete this partition you just created
- Resize the /dev/mmcblk0p2 partition (leave the default values which will use all the unallocated space)
- Write the changes - confirm with yes
- Quit
reboot
Resize the f2fs file-system
resize2fs /dev/loop0

Wait for it to finish and:

df -hT

root@OpenWrt:~# df -hT
Filesystem           Type            Size      Used Available Use% Mounted on
/dev/root            squashfs        5.5M      5.5M         0 100% /rom
tmpfs                tmpfs         213.1M    188.0K    213.0M   0% /tmp
/dev/loop0           ext4          112.2G      1.9M    107.5G   0% /overlay
overlayfs:/overlay   overlay       112.2G      1.9M    107.5G   0% /
/dev/mmcblk0p1       vfat           63.9M     20.2M     43.6M  32% /boot
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev

I first tried the approach in reference [2] below.

It did not work for me. Both commands in Step 7 gave me the error:

/dev/mmcblk0p2 contains a squashfs file system.

There is a lot of interest in the OpenWrt forum on Friendly Elec's Nano Pi's, which have two or more ethernet ports.

References

OpenWrt (BusyBox) does not have the following commands:

lshw
lsblk
lsusb
fdisk -l

Open Wireless Router (openWrt)

Disk Free

df [options]
-h	human readable
-T	print file system type
-k	1024-byte blocks
-m	1M-byte blocks

I believe df only works on mounted drives.

OpenWrt does not have the "shutdown" instead use "poweroff".

OpenWrt - does use nftables

OpenWrt - does use ip a

References

Upgrading

System -> Backup / Flash Firmware

Upgrading via the Web Interface, LuCi

Clicking on the blue button under "Flash new firmware image" brings up a dialog box that prompts you for a sysupgrade file:

After selecting a file:

Clicking on Continue:

2025-11-9: This Does NOT Work for the Pi Zero 2W

In my case for the Raspberry Pi Zero 2W, I have yet to get this to work properly. Afterwards, the following files are missing from /etc/config/:

network
system
wireless

dhcp	dhcp
dropbear	dropbear
firewall	firewall
luci	luci
network
rpcd	rpcd
system
uhttpd	uhttpd
wireless

In addition, the ethernet interface "eth0" is gone:

ip addr

shows only the "lo" (LoopBack) interface and wireless interface, "wlan0".

References

Enabling WiFi

References

OpenWrt Filesystem

Once an OpenWrt image has been made on an SD card, the Raspberry Pi Imager will NOT properly erase all of the SD card and format it as a Fat 32.

The best that I can determine, openWrt uses a filesystem with a hidden partition [1].

The SD Card Association says that best way to restore an SD Card to its factory settings is to use their SD Formatter [3] with overwrite. It is available for free for Microsoft Windows and Apple MacOS. Unfortunately, there is not a Linux version.

Size GB	Time Min.
32	6.5
128	21

References

Router

References

OpenWrt Images

You can find current and archived OpenWrt images at Downloads.Openwrt.org [2]. These include both the squashfs images and the ext4 images. The images are listed via processors. For example, the bmc27xx family is for Broadcom processors, which the Raspberry Pi uses, and bmc2712 is for the Pi 5B.

Processor	Platform
2709	Pi 2
2710	Pi 3 / Zero 2
2711	Pi 4
2712	Pi 5

References

Vim

OpenWrt has three varants of vim:

vim
vim-full
vim-fuller

The bug in Reference[1] has been present since at least March 30, 2024. Vim-fuller does not have the bug.

Hence on 2025/10/28 the factory image was using the opkg package manager and the sysupgrade image was using the apk package manger. Note that the sysupgrade image did not include a version number in its name. There is also a huge warning on the "opkg-to-apk CheatSheet page, "DO NOT USE apk upgrade to update your packages [2]. This may be the reason that two days later the sysupgrade image had resorted back to using the opkg package manager.

Raspberry Pi

The OpenWrt Images are at Reference [1].

For the Raspberry Pi Zero 2W, I downloaded:

Date	Image	Version	Size MB	Package Manager	sha256sum
2025/10/28	Factory	24.10.2	15.7	opkg	6cc4...
2025/10/28	Sysupgrade		17.6	apk
2025/10/31	Sysupgrade	24.10.2	15.7	opkg	a7a4...
2025/11/7	Factory	24.10.4	15.7	opkg	0cbd...
2025/11/7	Sysupgrade	24.10.4	15.7	opkg	e76d...

I have yet to succeed in copying a sysupgrade image over a factory image. Could this be due to the Raspberry Pi Imagers, or could it be because I installed a driver for the usb-to-ethernet adapter? In my case, it wipes out the /etc/config/wireless and /etc/config/network files. Also, I cannot execute uci commands. However, I can start with the sysupgrade image, and everything works as it should.

Although there is a lot of detailed documentation on OpenWrt, there is little overview documentation that explains the concepts.

I now believe that the sysupdate image, is not intended to be flashed over the factory image with a program such as the Raspberry Pi Imager or Balena Etcher. It is to be used with the LuCI web interface or the command line program owut: OpenWrt Upgrade Tool (which is not installed by default.

I have got this to work with a Raspberry Pi 5B, but the same proceedure fails with the Pi Zero 2W.

When starting over, it is best to reformat your SD card with the SD Association Formatter before installing an image on it. See the next section.

References

Pi 2W

Compared to the Raspberry Pi OS, OpenWrt is extremely small (26M Bytes) and runs on very limited resources. Thus, I thought the Pi Zero 2W would be ideal.

However, the Pi Zero 2W does not have an ethernet port, and by default OpenWrt expects one.

I tried connecting a USB-to-Ethernet adapter to the OGI port. Later, I found out that you must manually install a driver for these types of adapters, but to install a driver requires a connection to the Internet (catch 22).

The solution is to get the WiFi interface up and running so you have a connection to the internet. Thankfully, contrary to the documentation [ ], the wireless drivers are included in the OpenWrt image files, or else we would have a deadlock catch 22.

This turned out to be a lot more involved and complicated than I anticipated. It was a bad choice on my part to start with Pi Zero 2W, but I learned a lot on the way.

Before beginning, I saved the output of:

df -hT

Filesystem           Type            Size      Used Available Use% Mounted on
/dev/root            squashfs        5.5M      5.5M         0 100% /rom
tmpfs                tmpfs         213.1M    116.0K    213.0M   0% /tmp
/dev/loop0           ext4           86.9M     64.0K     80.0M   0% /overlay
overlayfs:/overlay   overlay        86.9M     64.0K     80.0M   0% /
/dev/mmcblk0p1       vfat           63.9M     20.2M     43.6M  32% /boot
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev

and the output of:

ip addr

1: lo:  mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: wlan0:  mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 88:a2:9e:14:13:74 brd ff:ff:ff:ff:ff:ff

and the output of:

cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd8a:8c65:7a6a::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

Observe that "wlan0" doesn't appear, but "eth0" does. This is because the OpenWrt image for the Raspberry Pi 2W is the image for the Raspberry 3.

and the output of:

cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/3f300000.mmcnr/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
	option band '2g'
	option channel '1'
	option htmode 'HT20'
	option disabled '1'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'OpenWrt'
	option encryption 'none'

Observe that the wireless interface is disablled, but it is in the Access Point (AP) mode.

I largely followed reference [1]. My steps are below:

Connect a keyboard and monitor to the Pi Zero 2W

Enable the wireless interface (WiFi) in OpenWrt via the command line:

Get the radio number by executing uci show wireless:
uci show wireless

uci stands for Unified Configuration Interface.

For the Pi Zero 2W, your radio will be 'radio0'.
Set the wireless country code (All Caps):
uci set wireless.radio0.country='US"
Enable the radio:
uci set wireless.radio0.disabled='0'
Make the changes to the configuration file:
uci commit wireless
Reload the WiFi interfaces:
wifi reload

Verify the changes:

ip addr

1: lo:  mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: phy0-ap0:  mtu 1500 qdisc fq_codel master br-lan state UP qlen 1000
    link/ether 8a:a2:9e:14:13:75 brd ff:ff:ff:ff:ff:ff
4: br-lan:  mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 8a:a2:9e:14:13:75 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 fd85:c4c3:50e0::1/60 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::88a2:9eff:fe14:1375/64 scope link 
       valid_lft forever preferred_lft forever

With the wireless radio enabled, the name is changed from wlan0 to phy0-ap0:

Phy0 : physical location 0
ap0 : access (mode) point # 0

Also for some reason the mac address has been incremented by 1.

Note that a bridge has been added. The mac address of the wireless radio is inclued in the bridge. The ip address of the bridge is 192.168.1.1.

cat /etc/config/network is:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd8a:8c65:7a6a::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

cat /etc/config/wireless is:

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/3f300000.mmcnr/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
	option band '2g'
	option channel '1'
	option htmode 'HT20'
        option disabled '0'
        option country 'US'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'OpenWrt'
	option encryption 'none'

Use the LuCI web interface to connect the wireless interface to your LAN:
- Use a second computer to wirelessly connect to the Access Point "OpenWrt".
- Use the same second computer and a web browser to log into the LuCI interface. That is, type 192.168.1.1 into the address bar of a web browser and hit return. A dialog box will appear with the user as root and a blank password. Leave the password bank and hit the green Log-in button.
- Now, use the LuCI interface to scan for available networks with Internet access. That is:
  Network > Wireless > raidio0 (Cypress CYW43455) > Scan
  
  Join your network:
  - Check the box, 'Replace wireless configuration'
  - Leave the default 'Name of the new network' as 'wwan'
  - Enter the WPA passphrase for your network
  - Leave the box for 'Lock to BSSID' blank
  - Leave the 'Create / Assign firewall-zone' as 'wan (empty)'
  - Hit the green 'Submit' button
  - The Device Configuration Page will appear. Hit the green button Save.
  - The Wireless Overview Page will appear. Hit the blue button 'Save & Apply'.
  - This applies the new settings, and starts a 90 second timer. During the 90 second timer, you are supposed to confirm that you want to kept the new setting. However, you will not receive the confirmation message because the wireless settings you changed modified the device so that it is no longer an AP, and you are not connected to it.
    At the end of the 90 second timer, your screen will say confirmation not received settings restored to what they were before. The device will again be an AP, and you will be automatically reconnected to it. However, this time, you will be presented with dialog box with three buttons. Hit the red button, "Apply Unchecked". Another 90 second timer will start. At the end of the 90 seconds, you will receive a message that says Device Unreachable. This is what you want. This is letting you know that the new settings are applied permanently. You can now close the browser.
- Verify the changes:
  - ip addr
```
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: phy0-sta0:  mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether 88:a2:9e:14:13:74 brd ff:ff:ff:ff:ff:ff
    inet 192.168.37.132/24 brd 192.168.37.255 scope global phy0-sta0
       valid_lft forever preferred_lft forever
    inet6 fe80::8aa2:9eff:fe14:1374/64 scope link 
       valid_lft forever preferred_lft forever
                                      
```
    Observe the following:
    - The wireless interface has been renamed (again) from "phy0-ap0' to 'phy0-sta0'.
      - phy0 : physical location 0
      - sta0 : station mode # 0
    - The mac address of the wirelesss adapter is back to its original valve (last hex pair is 74).
    - The wireless interface has been assigned an address by the LAN's DHCP server, and the address is in the address space of your LAN.
    - The network bridge has been removed.
    cat /etc/config/network is:
```
config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd8a:8c65:7a6a::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wwan'
	option proto 'dhcp'
                                 
```
    cat /etc/config/wireless is:
```
config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/3f300000.mmcnr/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
	option band '2g'
	option channel '6'
	option htmode 'HT20'
	option disabled '0'
	option country 'US'
	option cell_density '0'

config wifi-iface 'wifinet1'
	option device 'radio0'
	option mode 'sta'
	option network 'wwan'
	option ssid 'Shop_2.4GHz'
	option encryption 'psk2'
	option key 'Redacked'
                                 
```

Install the Driver for your USB-to-Ethernet Adapter:

You need to do an Internet search to find the correct driver. For my Plugable 2.5GHz USB-to-Ethernet Adapter, I installed:
opkg update
opkg install kmod-usb-net-rtl8152

Verfiy the changes:

ip addr

1: lo:  mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: phy0-sta0:  mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether 88:a2:9e:14:13:74 brd ff:ff:ff:ff:ff:ff
    inet 192.168.37.132/24 brd 192.168.37.255 scope global phy0-sta0
       valid_lft forever preferred_lft forever
    inet6 fe80::8aa2:9eff:fe14:1374/64 scope link 
       valid_lft forever preferred_lft forever
10: eth0:  mtu 1500 qdisc fq_codel master br-lan state UP qlen 1000
    link/ether 8c:ae:4c:dd:de:ec brd ff:ff:ff:ff:ff:ff
12: br-lan:  mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether 8c:ae:4c:dd:de:ec brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
       valid_lft forever preferred_lft forever
    inet6 fd85:c4c3:50e0::1/60 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::8eae:4cff:fedd:deec/64 scope link 
       valid_lft forever preferred_lft forever

Observe that there is now an 'eth0' interface and that it is bridged to 192.168.1.1.

cat /etc/config/network is:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd8a:8c65:7a6a::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wwan'
    option proto 'dhcp'

cat /etc/config/wireless is:

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/3f300000.mmcnr/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
	option band '2g'
    option channel '6'
	option htmode 'HT20'
	option disabled '0'
	option country 'US'
	option cell_density '0'

config wifi-iface 'wifinet1'
	option device 'radio0'
    option mode 'sta'
	option network 'wwan'
	option ssid 'Shop_2.4GHz'
	option encryption 'psk2'
    option key 'Redacked'

Connect the USB-to-Ethernet Adapter to your LAN:

Change the ip address of eth0:

uci set network.lan.ipaddr='192.168.3.25'
uci commit
where 192.168.3.25 is an unassigned static address on your LAN.
Restart the network:
/etc/init.d/network restart

Verify the Changes:

ip addr

1: lo:  mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
4: eth0:  mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether 8c:ae:4c:dd:de:ec brd ff:ff:ff:ff:ff:ff
    inet 192.168.3.25/24 brd 192.168.3.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fd85:c4c3:50e0::1/60 scope global noprefixroute 
       valid_lft forever preferred_lft forever
    inet6 fe80::8eae:4cff:fedd:deec/64 scope link 
       valid_lft forever preferred_lft forever
5: phy0-sta0:  mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether 88:a2:9e:14:13:74 brd ff:ff:ff:ff:ff:ff
    inet 192.168.3.121/24 brd 192.168.3.255 scope global phy0-sta0
       valid_lft forever preferred_lft forever
    inet6 fe80::8aa2:9eff:fe14:1374/64 scope link
       valid_lft forever preferred_lft forever

cat /etc/config/network is:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fd8a:8c65:7a6a::/48'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'eth0'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.3.25'
	option netmask '255.255.255.0'
	option ip6assign '60'

config interface 'wwan'
	option proto 'dhcp'

cat /etc/config/wireless is:

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/3f300000.mmcnr/mmc_host/mmc1/mmc1:0001/mmc1:0001:1'
	option band '2g'
	option channel '6'
	option htmode 'HT20'
	option disabled '0'
	option country 'US'
	option cell_density '0'

config wifi-iface 'wifinet1'
	option device 'radio0'
	option mode 'sta'
	option network 'wwan'
	option ssid 'Shop_2.4GHz'
	option encryption 'psk2'
	option key 'Redacked'

Now from your LAN, you should be able to log into LuCI by putting the new address you assigned to eth0 into the address bar of a web browser. You should also be able to SSH into the device. That is:

ssh root@192.168.3.25

where 192.168.3.25 is the new address, you assigned to 'eth0'.

However, there is further setup work to do. At this point, the file system is only using a very small section of the SD card, and you need to resize it. See the next section, Resize the SD Card.

After making these changes, I saved the output of:

df -hT

Filesystem           Type            Size      Used Available Use% Mounted on
/dev/root            squashfs        5.5M      5.5M         0 100% /rom
tmpfs                tmpfs         213.1M    192.0K    213.0M   0% /tmp
/dev/loop0           ext4           86.9M    329.0K     79.7M   0% /overlay
overlayfs:/overlay   overlay        86.9M    329.0K     79.7M   0% /
/dev/mmcblk0p1       vfat           63.9M     20.2M     43.6M  32% /boot
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev

There is a slight increased because I saved the outputs of some commands on the SD card, but the Use% is the same. My SD Card has a capacity of 128 G Bytes.

Open Wireless Router (OpenWrt) & IoT

References

OpenWrt - The Big Picture

OpenWrt Images

OpenWrt Defaults

First Connection to an OpenWrt Host

OpenWrt on the Raspberry Pi 5

Connecting via Ethernet

Configuration File Terminology

A pictorial view of what we want:

Method 1 - Using the Web Interface - LucI

Method 2 - The Command Line Tool uci

References

Openwrt on the Raspberry Pi Zero 2W

Resizre the Filesystem

References

Open Wireless Router (openWrt)

References

Upgrading

Upgrading via the Web Interface, LuCi

2025-11-9: This Does NOT Work for the Pi Zero 2W

References

Enabling WiFi

References

OpenWrt Filesystem

References

References

Router

References

OpenWrt Images

References

Vim

Raspberry Pi

References

References

Pi 2W

References

Factory v Sysupgrade

LuCi References

uci references

Raspberry Pi References

Flash SD Card - Expand File System

Misc

Configuration uci

Wireless Wi-Fi

Package Manager