Why OpenWRT + alternatives

Your router is the gateway to your whole network — and the manufacturer's stock firmware is usually abandoned, closed and badly configured. Open firmware hands control back to you. Here's why OpenWRT, and how it compares to the alternatives.

1. The problem with stock firmware

› Abandoned without updates — the vendor drops support after 1-2 years, yet the router runs 5-10 years with unpatched holes.
› Telemetry and closed code — you don't know what the router phones home.
› Weak defaults, a limited panel, no real control.

2. Why OpenWRT

› Open source — visible code, no vendor lock-in, no hidden telemetry.
› Updates and longevity — old hardware lives for years, security patches independent of the vendor.
› Full control — configurable firewall (nftables), hundreds of packages, your own rules.

3. What you gain (features)

› Built-in VPN — WireGuard/OpenVPN: the whole network in a tunnel, or a server for remote access to home.
› Ad and tracker blocking network-wide (adblock / AdGuard Home) — protects TVs and IoT too.
› VLANs and a guest network — isolate IoT / guests from trusted devices.
› QoS / SQM — no more lag on a busy link.
› Your own DNS (DoH/DoT), traffic monitoring, a real firewall.

4. Hardware

Well-supported examples: GL.iNet (e.g. Flint 2 / MT6000 — OpenWRT out of the box, the easiest start), selected Linksys/Belkin, some TP-Link, and x86 (a mini-PC = the most power). Before buying, check the OpenWRT Table of Hardware — not every model and hardware revision is supported.

5. Honest limitations

› Configuration is more involved than "click-click" (though LuCI + an LLM help).
› Occasional Wi-Fi driver quirks (radios can be proprietary) — usually fine on supported hardware.
› You need to know what you're doing — a misconfigured firewall is a hole, not protection.

6. Alternatives — when to use what

Solution	For whom / notes
OPNsense / pfSense	x86 firewalls (Free/HardenedBSD). Far more power (Suricata IDS/IPS, advanced routing, VPN). Needs a mini-PC; won't replace a Wi-Fi AP (add a separate access point).
AsusWRT-Merlin	Semi-open, on Asus routers. The easiest entry, lots of features (WireGuard, adblock). Less "pure" than OpenWRT (some closed code).
DD-WRT / FreshTomato / Gargoyle	Other home-router firmwares. FreshTomato is light, Gargoyle has QoS. Smaller communities/hardware support than OpenWRT.
VyOS / MikroTik RouterOS	Advanced/enterprise, strong CLI. VyOS is open-source; RouterOS is not open-source but very capable. Learning curve.
OpenBSD (pf) / Linux + nftables	A DIY router on your own hardware — maximum control and transparency, the most work.

In short: home/small office → OpenWRT (or Merlin for convenience). Demanding network / IDS-IPS / many VLANs → OPNsense on a mini-PC + a separate AP. Enterprise/CLI → MikroTik/VyOS.

7. Three levels

BASIC

A router with OpenWRT out of the box (GL.iNet). Change default passwords, enable automatic patches, turn on ad-blocking, set up a guest network. Result: a safer, cleaner network right away.

ADVANCED

VLANs (IoT / guests / trusted separated), WireGuard (client for the whole network or a server for home access), DNS over DoH/DoT, SQM to kill lag, AdGuard Home.

EXPERT

OPNsense on a mini-PC (Suricata IDS/IPS, granular firewall, multi-WAN) + a separate Wi-Fi AP. Segmentation and monitoring (ntopng), your own resolver (unbound), per-VLAN rules, alerts.

8. PivLab — setup

We'll pick and configure a router for privacy: OpenWRT (or OPNsense for bigger needs) with WireGuard, ad-blocking, VLANs and a sane firewall — without the usual mistakes that turn a router into a hole.

⚡ TL;DR

Stock firmware = abandoned, closed, weak. Open = control + updates.
OpenWRT: WireGuard, adblock, VLANs, QoS, your own DNS — for the long run.
Buy hardware from the Table of Hardware (e.g. GL.iNet, factory OpenWRT).
Alternatives: OPNsense/pfSense (more power, x86 + separate AP), Merlin (easy), MikroTik/VyOS (enterprise).
A misconfigured firewall is a hole — worth setting up properly.

PivLab informational material. The right solution depends on your network and threat model — if in doubt, get it reviewed individually.

An OpenWRT router — and the alternatives