OpenWrt releases "Barrier Breaker"

Continuing its tradition of releases named after cocktails, the OpenWrt project released the latest version of its firmware for home routers and other devices, "Barrier Breaker" (14.07), on October 2. As one might guess, it comes with plenty of new features, especially in the networking area (improved IPv6 support, in particular). OpenWrt has long been used by many of the technically savvy, but it is reaching a point where it "just works" and provides such an upgrade from the factory firmware that it may well make sense for some regular users as well.

OpenWrt began in 2003 by starting with the code grudgingly released by Linksys to comply with the GPL for its WRT54G wireless home router. Support for other routers and devices soon followed and the current Table of Hardware that documents the hardware supported by the distribution is truly impressive. We last looked at OpenWrt in 2011, shortly before the "Backfire" maintenance release (10.03.1). Since then, there was also the 12.09 "Attitude Adjustment" release in April 2013.

Though it is getting a little long in the tooth now, the Netgear WNDR3800 is a nice router for testing (and running) OpenWrt. Used devices appear to be plentiful and fairly inexpensive (less than $75 on eBay) or new ones can be purchased for a bit more than double that. The WNDR3800 is certainly one of the easier routers to install OpenWrt on; it is simply a matter of grabbing the right firmware (the factory image for WNDR3800 from this directory) and uploading it to the device using the factory firmware's web interface. Upgrading from an earlier OpenWrt release uses the sysupgrade image, instead; uploading that file into the OpenWrt interface will upgrade the device while preserving the existing configuration (though not any extra packages that may have been installed).

Once installed, there are several things that OpenWrt does (or, perhaps, doesn't do) to improve the security of newly installed devices. To start with, WiFi and ssh are disabled, while telnet is enabled. Turning off ssh and telnet on might seem like poor choices, but the idea is to force the user to set a root password. Users can either telnet or browse to 192.168.1.1 (after connecting some system to one of the device's ethernet ports) to set the password. Once a password has been set (and the same root password works for logging in as root to both the ssh command line and the web interface), the telnet service is terminated and Dropbear SSH is started instead.

From then on, most of the administration or monitoring that needs to be done can either use the command-line interface (CLI) or the LuCI Lua-based web interface. It uses the Unified Configuration Interface (UCI), which provides the CLI tool for the configuration of OpenWrt devices. For example, one of the first tasks is likely to be turning on the WiFi, which is easily done from LuCI, though it can also be done using UCI or by editing /etc/config/wireless directly.

Using LuCI is quite straightforward. It has hierarchical menus that govern most of the tasks an administrator might need to do. There are, naturally, realtime traffic graphs of various sorts, along with log file output, diagnostic tools (e.g. ping, traceroute), and other troubleshooting and monitoring aids available. Configuring various services, such as DHCP or DNS, is easy to do. LuCI restarts the services or network interfaces as needed to effect whatever changes were made.

Beyond that, there are some fairly complicated configuration options that one normally would not see in a router's web interface. The firewall configuration and monitoring (listing all of the different tables) is top-notch. Port forwarding, quality of service (QoS), VLAN, and other configuration are all quite accessible.

On the negative side, though, is the documentation, which suffers from a few flaws. It is disorganized, with information scattered on the Documentation page, wiki, and in the forum. You can often find what you are looking for in one of those places, but it is easiest to consult a search engine. After finding the topic you are looking for, though, you may encounter another problem: the information may be out of date—sometimes long out of date. This is not really meant as a knock on the project, as the versatility of the distribution means that there is an incredible amount of information to maintain. But it can be frustrating to new users.

Some of that versatility and complexity may be part of the reason there are several derivative distributions based on OpenWrt. We have looked at CeroWrt and the EFF's Open Wireless Router project (which is based on CeroWrt) in the last few years. Both of those focus on a single router (the WNDR3800) to try to cut down the complexity of the multi-platform problem. Documenting the base functionality of those routers is a much simpler task.

OpenWrt has, thankfully, taken a much larger bite; its work can be picked up—and simplified—by others. Development flows in both directions, though, as OpenWrt has adopted most of the anti-bufferbloat work that CeroWrt has done.

Beyond just the multi-platform support, OpenWrt's complexity comes from the sheer number of packages it supports. Numbers are hard to come by, but Attitude Adjustment came with nearly 3,500 packages, so one would guess that Barrier Breaker has at least that many. Certainly scanning through the package list in LuCI is eye-opening. One of the features for the release was a reorganization of the package feed into a single GitHub repository. For now, the older repository is still available, but it must be manually enabled.

The opkg package management system works just as one would expect. Packages can be installed from the command line or LuCI and, as with any modern package manager, dependencies are automatically resolved. One of the features that will be coming is the ability to sign and verify packages, which is a welcome feature.

Security updates are somewhat problematic for OpenWrt, however. Kernel fixes require installing a new image. User-space vulnerabilities can be fixed by updating packages, but the distribution isn't really set up to handle the kind of advisory and update process that is normal for desktop and server distributions. Package signing seems like a step along the way toward a solution to some of these problems.

Barrier Breaker is based on the 3.10 kernel, which moves things along a good ways from the 3.3 kernel (with some backports from 3.5) that was used in Attitude Adjustment, but is still more than a year old at this point. The release notes for Barrier Breaker say that the next release (named "Chaos Calmer") will be based on 3.14 or some more recent kernel that has long-term support. Given that the project is aiming for a release of Chaos Calmer this year, it would seem that 3.14 is a good bet.

While it has been around 18 months between releases, OpenWrt certainly gives the appearance of being a highly active project. Another release before the end of the year would seem pretty aggressive, however. In any case, it is a distribution worth checking out for a wide variety of embedded Linux needs. As they say: Friends don't let friends run factory firmware. Perhaps that overstates things, but there are many things that can be done with an OpenWrt device—well beyond the manufacturer's vision.