A significant new release of the OpenWrt 21.02.0 distribution has been introduced, aimed at deployment in various network devices such as routers, switches, and access points. OpenWrt supports numerous platforms and architectures and features a build system that allows for seamless cross-compilation, including various components in the build, making it easy to create customized firmware or disk images with the desired set of pre-installed packages. Builds have been prepared for 36 target platforms. <\/p>\n
Notable changes in OpenWrt 21.02.0 include: <\/p>\n
\n
The minimum hardware requirements have been raised. The default build now requires a device with 8 MB Flash and 64 MB RAM due to the inclusion of additional Linux kernel subsystems for OpenWrt. However, it is still possible to create a custom trimmed-down build that can run on devices with 4 MB Flash and 32 MB RAM, though such a build will have limited functionality and stability is not guaranteed.\n
The base installation includes packages for support of the WPA3 wireless network security technology, which is now available by default both in client mode and when creating an access point. WPA3 offers protection against password guessing attacks (preventing offline password cracking) and utilizes the SAE authentication protocol. WPA3 support is available in most drivers for wireless devices.\n
The basic package by default includes support for TLS and HTTPS, allowing access to the LuCI web interface over HTTPS and using utilities like wget and opkg to retrieve information over encrypted channels. The servers from which packages downloaded via opkg are distributed are also by default configured to provide information over HTTPS. The library used for encryption, mbedTLS, has been replaced with wolfSSL (if necessary, mbedTLS and OpenSSL libraries can still be manually installed, as they continue to be provided as options). An option for automatic redirection to HTTPS in the web interface has been proposed: «uhttpd.main.redirect_https=1».\n
Initial support for the DSA (Distributed Switch Architecture) kernel subsystem has been implemented, providing tools for configuring and managing cascaded Ethernet switches using mechanisms typically applied for configuring standard network interfaces (iproute2, ifconfig). DSA can be used to set up ports and VLANs instead of the previously offered swconfig tool, although not all switch drivers currently support DSA. In this release, DSA is utilized for drivers such as ath79 (TP-Link TL-WR941ND), bcm4908, gemini, kirkwood, mediatek, mvebu, octeon, ramips (mt7621), and realtek.\n
Changes have been made to the syntax of configuration files located in \/etc\/config\/network. In the «config interface» block, the «ifname» option has been renamed to «device», and in the «config device» block, the «bridge» and «ifname» options have been renamed to «ports». For new installations, separate files with settings for devices (layer 2, «config device» block) and network interfaces (layer 3, «config interface» block) are now generated. To maintain backward compatibility, support for the old syntax has been preserved, meaning that previously created settings will not require changes. However, in the web interface, when old syntax is detected, a prompt will be displayed for migration to the new syntax, which is necessary for editing settings via the web interface.\n
Example of the new syntax: config device \toption name ‘br-lan’ \toption type ‘bridge’ \toption macaddr ’00:01:02:XX:XX:XX’ \tlist ports ‘lan1’ \tlist ports ‘lan2’ \tlist ports ‘lan3’ \tlist ports ‘lan4’ config interface ‘lan’ \toption device ‘br-lan’ \toption proto ‘static’ \toption ipaddr ‘192.168.1.1’ \toption netmask ‘255.255.255.0’ \toption ip6assign ’60’ config device \toption name ‘eth1′ \toption macaddr ’00:01:02:YY:YY:YY’ config interface ‘wan’ \toption device ‘eth1’ \toption proto ‘dhcp’ config interface ‘wan6’ \toption device ‘eth1’ \toption proto ‘dhcpv6’ <\/p>\n
Similar to the configuration files in \/etc\/config\/network, the field names in board.json have been changed from «ifname» to «device». <\/p>\n
A new platform «realtek» has been added, allowing the use of OpenWrt on devices with a large number of Ethernet ports, such as Ethernet switches from D-Link, ZyXEL, ALLNET, INABA, and NETGEAR.\n
New bcm4908 and rockchip platforms have been added for devices based on the Broadcom BCM4908 and Rockchip RK33xx SoCs. Improvements have been made to previously supported platforms to enhance device support.\n
Support for the ar71xx platform has been discontinued, and the ath79 platform should be used instead (for devices tied to ar71xx, it is recommended to perform a clean reinstall of OpenWrt). Support for the cns3xxx (Cavium Networks CNS3xxx), rb532 (MikroTik RB532), and samsung (Samsung TQ210) platforms has also been discontinued.\n
Executable files of applications involved in processing network connections are compiled in PIE (Position-Independent Executables) mode with full support for Address Space Layout Randomization (ASLR) to complicate the exploitation of vulnerabilities in such applications.\n
By default, options for supporting container isolation technologies are enabled when building the Linux kernel, allowing most platforms to utilize the LXC toolkit and procd-ujail mode in OpenWrt.\n
The ability to build with support for the SELinux mandatory access control system has been provided (disabled by default).\n
Package versions have been updated, including releases of musl libc 1.1.24, glibc 2.33, gcc 8.4.0, binutils 2.34, hostapd 2020-06-08, dnsmasq 2.85, dropbear 2020.81, busybox 1.33.1. The Linux kernel has been updated to version 5.4.143, with the wireless stack cfg80211\/mac80211 ported from kernel 5.10.42 and support transferred. VPN<\/a> Wireguard. <\/ul>\n