The previous two parts, Part 0 and Part 0.5, were intentionally numbered that way because they were mostly theoretical. They weren't directly about OpenWrt, but they provide the foundation needed to understand what comes next.
By now, I hope it's clear what a router actually is, what it isn't, and that you won't confuse it with a modem or an ONT anymore. If your ISP supplied you with a single all-in-one gateway, you should also understand what is that device. This is important because, before start using your own OpenWrt router, you first need to understand where it fits into your home network.
I also covered NAT and Carrier-Grade NAT (CGNAT). CGNAT is useful to know about because it may limit what you can do with your connection, for example if you want to host services at home. NAT, however, is fundamental Understanding how it works will make the rest of this series much easier to follow.
Now it's finally time to start using OpenWrt. In this part I'll show how to introduce an OpenWrt router into an existing home network in the two ways:
- Replacing the ISP's router.
- Connecting your OpenWrt router behind the ISP's router, keeping the ISP's devices in place while adding your own router as another node in the network.
By the end of this part, your OpenWrt router will be physically connected and ready for configuration in the following chapter.
I have a GL.iNet router model Flint (GL-AX1800).
It's a bit old (currently the newest model is Flint 4), but gold router (still). It comes with GL.iNet's fancy user-friendly web interface and of course OpenWrt OS with its configuration interface LuCI.
Little recap:
OpenWrt is a Linux operating system targeting embedded devices. Instead of trying to create a single, static firmware, OpenWrt provides a fully writable filesystem with package management. This frees you from the application selection and configuration provided by the vendor and allows you to customize the device through the use of packages to suit any application (OpenWrt GitHub Repo)
GL.iNet's devices already come with OpenWrt installed, so there is no need to flash the firmware yourself. GL.iNet base their router's firmware on a specific OpenWrt release (or release branch), backport fixes as needed, and then add their own packages and interface. They also provide a clean and beginner-friendly web interface that exposes most of the features home users need.
If you need more advanced functionality, you're not locked into that interface. You can always access the standard OpenWrt tools, either through LuCI, OpenWrt's own web interface, or by connecting to the router over SSH.
I've been very happy with my GL.iNet devices, but they are by no means the only routers capable of running OpenWrt.
For that reason, whenever possible I'll show both approaches: how to perform a task using the GL.iNet interface and how to do the same thing using standard OpenWrt (LuCI or the command line). That way, the guide remains useful even if you're using a different router.
1. Connecting your OpenWrt router
Before connecting your router, it's important to understand what its different ports are used for and where each one should be connected in your home network.
1.1 LAN and WAN ports
LAN stands for Local Area Network, while WAN stands for Wide Area Network.
My GL.iNet Flint router has 4 LAN ports and 1 WAN port.
Having 4 LAN ports simply means I can connect up to four wired Ethernet devices directly to the router. Those devices don't have to be only PCs or laptops. They could just as well be another router or NAS or any other Ethernet-capable device.
So what makes the WAN port different?
The WAN port is used to connect the router to an upstream network device. In my case, an Ethernet cable runs from the WAN port to the ONT. The ONT converts the optical signal from the fiber into Ethernet frames, allowing my router to communicate with my ISP.
On many home routers there is only one WAN port. Manufacturers often place it slightly apart from the LAN ports or give it a different color, commonly blue, to make it easier to identify.
At first glance, the WAN and LAN ports appear to be completely different. But a WAN port and a LAN port are, in most cases, physically identical Ethernet ports.
The real difference lies in how the router's operating system configures them. The port itself is just a physical connector. Behind it is exposed to the operating system as one or more network interfaces.
On my router, all 4 LAN ports belong to one logical network interface (a bridge called br-lan in OpenWrt), while the WAN port is assigned to a separate interface - wan. Because they are separated, OpenWrt allows to configure and manage them differently.
The LAN interface is configured to allow connected devices to communicate with each other.
The WAN interface, on the other hand, is configured to communicate with the upstream network and it belongs to a separate firewall zone considered untrusted.
The firewall, routing table, NAT and many other networking rules depend on this distinction.
This is why you generally can't plug your ONT into a LAN port or connect your PC to the WAN port and expect everything to work automatically. The hardware itself is usually capable of doing either job, but the software has been configured with a very specific role for each interface.
One of the strengths of OpenWrt is that these roles are not fixed. If your hardware supports it, you can reassign ports, create additional interfaces, use VLANs, or even turn a LAN port into a WAN port. The labels printed on the router's case are simply the manufacturer's default configuration, they are not permanent hardware limitations.
1.2 Setup 1: Connecting router behind the ISP's router
The ISP router stays exactly where it is, while your OpenWrt router is connected to one of its LAN ports. By default, your OpenWrt router simply receives a private IP address from the ISP router via its DHCP and creates ANOTHER network behind it. In this case you can connect devices to both - to your ISP's router and you your OpenWrt router.
Pros:
- Usually plug-and-play. No ISP configuration is required.
- Little risk of accidentally breaking your Internet connection.
- If your ISP router provides IPTV or VoIP, those services continue working without any additional configuration.
- ....mmm that's all
Cons:
Two routers performing routing (Double NAT)
Additional re-routing of packages step from your devices and the Internet.Limited control over the ISP's router
The ISP router remains the gateway to the Internet. Most ISP routers run proprietary firmware with only a few settings exposed to the user. If something doesn't work as you would prefer, there is often very little you can inspect or change.
You're essentially dealing with a black box: no access to detailed logs, no advanced firewall configuration, no any extra feature and usually all you have is 254 addresses for your home devices being the part of a unique LAN.
- Vendor-specific quirks
Some routers implement unusual firewall rules that can impede a lot using your home network at maximum. These rules can impede sometimes even streaming of stuff from your phone to TV even though they are both connected to the same network. Or you can have troubles with playing online together with someone located elsewhere.
My experience with my ISP - Fastweb:
The first surprise was that their router administration happens through a mobile app. Personally, I wasn't comfortable with that. I prefer managing my networking equipment locally.
The Wi-Fi performance also wasn't great in my home. Signal strength dropped significantly in the rooms farthest from the router, and the throughput was noticeably lower than what I later achieved with my GL.iNet Flint.
My phone would randomly disconnect and re-connect from Wi-Fi every few hours. I never discovered the exact cause.
With this setup there is one concern:
Private IP conflicts. If both the ISP router and your OpenWrt router use the same private subnet (for example, 192.168.1.0/24), routing won't work correctly.
No conflict:
Internet
│
ONT
│
ISP Router: 192.168.1.1/24
│
OpenWrt WAN: 192.168.1.100
│
OpenWrt Router: 192.168.8.1/24
│
Devices: 192.168.8.x
Conflict:
ISP Router LAN: 192.168.1.0/24
OpenWrt WAN: 192.168.1.100
OpenWrt LAN: 192.168.1.1/24 ❌
Fortunately, OpenWrt usually detect this situation during the initial setup and automatically choose a different LAN subnet.
1.3 Setup 2: Connecting router in place of the ISP's router
Instead of connecting your OpenWrt router behind the ISP's router, you remove the ISP router entirely and connect your router directly to the ONT (or whatever device terminates your ISP's connection).
If you live in the European Union, this is your right under the Router Freedom / Modem Libero regulations discussed in Part 0 of this series.
The challenge is usually getting the connection parameters right. Depending on your ISP, you may need to configure DHCP, PPPoE, VLANs or settle the MAC address.
MAC address
A MAC (Media Access Control) address is a hardware identifier assigned to a network interface.
Unlike an IP address, which depends on the network a device is connected to and may change over time, a MAC address is normally programmed into the network interface by the manufacturer and remains the same throughout the device's lifetime.
A MAC address consists of 48 bits and is usually written as six hexadecimal numbers separated by colons.
40:A5:EF:12:34:56
Although MAC addresses are designed to uniquely identify network interfaces, they are only used for communication within a single local network. Ethernet switches use MAC addresses to decide which physical port a frame should be forwarded to. Routers, on the other hand, use IP addresses to move packets between different networks.
Suppose your laptop wants to send data to another computer connected to the same switch. It creates an Ethernet frame whose destination is the other computer's MAC address.
But what if the destination is somewhere on the Internet?
Your laptop sends the frame to your router's MAC address. The router removes the Ethernet frame, examines the IP packet inside it, decides where it should go next, and then creates a brand-new Ethernet frame with different source and destination MAC addresses for the next network segment.
The MAC address ensures your device is recognized on the local network, while the IP address helps your device communicate effectively on the broader internet.
MAC addresses never travel across the Internet. They are only used for communication between devices that share the same local network.
NB! A MAC address identifies a network interface, not an entire device.
Then why does the ISP care about router's MAC address?
Some ISPs associate your connection with the MAC address of the device connected to their network. If a different MAC address suddenly appears, the ISP may refuse to provide Internet access until the new device is registered or authenticated.
This is why replacing the ISP router sometimes results in an apparently correct configuration that still has no Internet connectivity.
If this is the case how you ISP handles connectivity, then you sign the contract with ISP for Internet service -> your contract = 1 registered MAC address of the router they provided to you. When you replace the ISP router with your own, the ISP sees a completely different MAC address and refuse to provide Internet access until the new device's MAC address is registered.
You have two options: communicate to the ISP your router's MAC address or make your router present itself with registered MAC address of router provided by ISP that is indicated on the sticker on the back part of ISP's router.
OpenWrt makes this easy. You can configure the WAN interface to use any MAC address you choose, including the MAC address of the original ISP's router. This process is known as MAC cloning. Despite the name, nothing is actually copied to the hardware. OpenWrt simply instructs the network interface to present a different MAC address whenever it communicates with the ISP.
In my case, replacing the Fastweb router was almost straightforward. DHCP worked, the router obtained an IP address, and all the settings appeared to be correct. However, there was still no Internet connectivity. After cloning the WAN MAC address of the original Fastweb router, the connection immediately started working.
Alllright! You can follow either of the two setups presented earlier.
In the next part I will demonstrate Setup 2, where the ISP router is removed and replaced with my OpenWrt router. Firstly, I connect the WAN port of my GL.iNet Flint directly to the Ethernet port of my ONT....
Top comments (0)