WrtNova Firmware Builder

Firmware target

OpenWrt version

Device

Mode

Main router Access point

System

Hostname

Root password

Used for SSH login and AdGuard Home admin.

SSH public keys

One key per line.

Timezone

Network

Default IP prefix

Default subnet

Networks & addressing

On	Network	IP prefix	VLAN ID	Subnet	Router IP
	LAN				—
	Guest				—
	IoT				—
	WireGuard VPN				—

WireGuard VPN network is a dedicated network with its own WiFi SSID; all its traffic is routed through the WireGuard VPN client.

Additional trunk VLANs

Extra VLAN IDs to trunk (tagged) through every port on this device. Space-separated; ranges as low-high.

WireGuard VPN client

Don't have a WireGuard config? Use Cloudflare's free WARP.

Private key

Peer public key

Endpoint

Endpoint port

Preshared key

Client IPv4

Client IPv6

Allowed IPs

You can change to a different WireGuard config later via LuCI → Network → Interfaces → vpn → Edit → Load configuration. After importing a config, remember to enable Route Allowed IPs in the Peers settings.

WiFi

Country code

Dense environment Tighten roaming/steering thresholds

Wireless mesh

Enable 5GHz 802.11s mesh backhaul

Note: Wired backhaul is always better when feasible

Network SSIDs

LAN

Leave password blank to use the default: 12345678

SSID and password must match between nodes for seamless roaming to work.

Advanced channels & logging

802.11k/v/r Enable fast roaming and band-steering

2.4 GHz channel

5 GHz channel

6 GHz channel

WiFi log level

WAN

Connection type

DHCP PPPoE

WAN MAC address

Advanced WAN options

Tagged WAN VLAN (required by some ISPs)

WAN VLAN ID 802.1Q VLAN tag for the WAN interface.

Enable secondary WAN (WAN-B)

WAN-B VLAN ID 802.1Q VLAN tag for WAN-B.

Bridge WAN port

Add WAN port to br-vlan bridge, useful for IPTV, VoIP, and multi-PPPoE setups.

IPv4 port forwarding

Hostname	Last octet	Ports (space-separated)

Each row create a static DHCPv4 lease and add port forwarding from WAN. Ports must be unique.

IPv6 server exposure

Hostname	Last octet	Ports (empty = all)

Each row create a static hostid (IPv6 Token) in DHCP leases, IPv6 firewall forward rule, and Cloudflare DDNS entry. After boot, go to Network -> DHCP Leases and update the DUID for each host to match the actual client DUID.

DDNS (Cloudflare)

Enable DDNS

Lookup hostname

Cloudflare API token

DDNS entries for IPv6-exposed hosts are derived from the IPv6 server exposure table.

Failover

USB tethering

Enable USB tethering (Android / iPhone, device usb0)

Cellular modem (MBIM)

Enable MBIM modem failover

Encrypted DNS & ad blocking

AdGuard Home

Ad blocking + DoH/DoQ upstream. Requires ≥32 MB flash / ≥230 MB RAM.

dnsproxy

Lightweight ad blocking + DoH/DoQ upstream. For ≥16 MB flash / <230 MB RAM.

None

Plain dnsmasq only. For severely constrained devices (8 MB flash).

AdGuard Home as main DNS resolver

Bind AdGuard Home to port 53, use as the primary DNS resolver.

Block DoT and DoQ

Enforce ad blocking on stubborn client devices.

Additional packages

Final packages

Extra packages

Appended to the final list. Prefix with - to remove an auto-added package.

Performance & misc

Software flow offload

Can increases network throughput.

Hardware flow offload

Higher network throughput where supported. Do not enable if using QoS/SQM.

Block guest at night

Block guest internet from 9 PM to 7 AM. Requires guest network.

Quarterly auto-reboot

Reboot at 3:30 AM once every quarter.

Enable debug log

Trace first-boot script execution to /root/99-asu-defaults.log.

WrtNova firmware builder