StartWRT Documentation

StartWRT is a router operating system designed specifically for home-based self-hosting. Built on OpenWrt, it pairs a hardened networking backend with a modern web interface that makes advanced features — VPN chaining, per-device security profiles, scheduled Wi-Fi and per-profile Internet blackouts, dynamic DNS, automatic port forwarding for StartOS servers and other UPnP/PCP devices — accessible to everyone. Firmware updates are delivered over the air, directly in the app, and the interface is available in English, Spanish, German, French, and Polish.

Getting Started

• Installing StartWRT
• Initial Setup
• Trusting Your Root CA
• Updating

Core Concepts

• Security Profiles
• Points of Entry

Internet

• WAN Settings
• Dynamic DNS
• Published Ports
• Outbound VPNs

Network

• LAN Settings
• Devices

Points of Entry

• Ethernet
• Wi-Fi
• Wi-Fi Blackout
• Inbound VPNs

System

• Settings
• SSH Access
• Backups
• Factory Reset

Reference

• CGNAT
• Architecture
• Hardware
• FAQ

Installing StartWRT

StartWRT comes pre-installed on Start9 routers. If you need to reinstall or flash a new device, follow the instructions below to create a bootable microSD card and flash the firmware.

Note

StartWRT builds are currently available for RISC-V (riscv64) only — specifically the SpaceMiT K1 SoC used in the BananaPi BPI-F3. Builds for other CPU architectures are not yet available.

Requirements

• A Start9 router (BananaPi BPI-F3)
• A microSD card (4 GB or larger)
• A computer to write the image

Download the Image

1. Download the latest StartWRT firmware image from the Start9 releases page (StartWRT releases are the ones tagged start-wrt/v…). For a fresh install, download the sdcard image — it is named startwrt-<version>-<git hash>_spacemit-k1-sdcard.img.gz (the …-sysupgrade.img.gz file is the update payload). There is no need to decompress it — balenaEtcher flashes the .img.gz directly. The commands below use startwrt.img.gz as a placeholder for the downloaded filename.

2. Verify the SHA256 checksum against the one listed on GitHub (optional but recommended).

   • Mac. Open a terminal and run:

     openssl dgst -sha256 startwrt.img.gz
     

   • Linux. Open a terminal and run:

     sha256sum startwrt.img.gz
     

   • Windows. Open PowerShell and run:

     Get-FileHash startwrt.img.gz
     

Write the Image to microSD

1. Download and install balenaEtcher onto your Linux, Mac, or Windows computer.

2. Insert the microSD card into your computer.

3. Open balenaEtcher, click “Select Image”, and select the StartWRT image you just downloaded.

4. Click “Select Target” and select your microSD card.

   Warning

   BE ABSOLUTELY CERTAIN you have selected the correct target drive. Whatever target you select will be COMPLETELY ERASED!!

5. Click “Flash!”. You may be asked to approve the unusually large disk target and/or enter your password. Both are normal.

Flash the Firmware

1. Power off the router.

2. Insert the microSD card into the router.

3. Power on the router. It will boot from the microSD card automatically.

4. Connect to the StartWRT Wi-Fi network using the Wi-Fi password printed on the sticker on the bottom of the router.

5. A captive portal will open automatically. If it does not, open a browser and navigate to router.lan.

6. The setup wizard will guide you through the rest. If the router already has firmware installed, you can choose Keep settings or Fresh Start (full wipe). On a new device with no existing firmware, the welcome screen still appears, but Fresh Start is the only option offered. See Factory Reset for a full walkthrough of the reflash wizard.

7. When the wizard completes, power off the router, remove the microSD card, and power it back on. The router now boots StartWRT from its internal storage — the wizard installs everything needed for that, including the low-level boot firmware, so this works on any BananaPi BPI-F3 regardless of what (if anything) the factory installed.

DIY and Unprogrammed Boards

Flashing a bare BananaPi BPI-F3 works with the exact steps above: the setup wizard provisions the board’s internal boot firmware (the eMMC boot partitions) as part of the flash, so the router boots from internal storage after the microSD card is removed even if the board arrived with no firmware at all.

Wi-Fi Card

The BPI-F3 has no onboard Wi-Fi — the radio comes from a mini PCIe module, and the firmware image only carries drivers for the MediaTek MT7915/MT7916 family:

• MT7916-based modules — the AsiaRF AW7916-NPD, as shipped in Start9 routers — are fully supported: 2.4 GHz and 5 GHz broadcast concurrently.
• MT7915-based modules (e.g. the AsiaRF AW7915-NP1) initialize, but band-selectable cards operate one band at a time: with the stock configuration only the 2.4 GHz network comes up, and selecting 5 GHz alone in Wi-Fi settings leaves no working radio.
• Modules based on any other chipset have no driver in the image and will not work.

There is one more difference on unprogrammed boards — the Wi-Fi password:

Start9 routers ship with a unique Wi-Fi password programmed into the device’s EEPROM and printed on a sticker on the bottom. A vendor-programmed board “just works”: flash the image, boot, and connect to the StartWRT network with the sticker password.

If you are flashing a bare BananaPi BPI-F3 that was never programmed with a Wi-Fi password, the Wi-Fi access point will not come up after boot. To bring it online:

1. Connect a computer to one of the router’s LAN ports with an Ethernet cable.

2. Complete initial setup: a captive portal opens automatically (if it does not, navigate to router.lan) and prompts you to create your admin password. When it finishes, you are logged in to the web interface.

3. Navigate to Points of Entry > Wi-Fi > Passwords and click “Add”.

4. Configure the password:

   • Label — A descriptive name (e.g. “Default”).
   • Password — Click “Generate” to create a strong random password, or enter your own (8–63 characters).
   • Security Profile — Select Admin. Adding the first Admin password switches the Wi-Fi radios on automatically. A first password mapped to another profile is also valid — the radios just aren’t switched on for you; enable them under Points of Entry > Wi-Fi > Settings with the “Enable Wi-Fi” toggle.

5. Click “Save”. The StartWRT Wi-Fi network comes up — connect to it with your new password, and record the password somewhere safe.

The password lives in the router’s configuration, not the EEPROM. A soft factory reset re-reads the (empty) EEPROM, so on an unprogrammed board Wi-Fi is down again after a reset — repeat the steps above over Ethernet to bring it back.

Next Steps

• Initial Setup — Set up your admin password and configure the router

Initial Setup

After unboxing your Start9 router or completing a fresh install, follow these steps to get up and running. The entire process takes just a few minutes.

Connect to Wi-Fi

1. Power on the router.

2. On your phone or computer, connect to the StartWRT Wi-Fi network using the password printed on the sticker on the bottom of the device.

Create Your Admin Password

1. A captive portal will open automatically. If it does not, open a browser and navigate to router.lan.

2. Create an admin password (minimum 12 characters). This password protects the web interface and is separate from the Wi-Fi password.

3. Confirm the password and click “Set Password”.

4. The page will confirm “Setup complete. You can close this window.” Normal Internet access will resume, and you can open the StartWRT web interface at router.lan — you are already logged in.

Important

All Internet access is blocked until you set an admin password. If you dismiss the captive portal popup, open any browser and navigate to router.lan.

Note

Your timezone is auto-detected from your browser during setup. You can change it later under Settings.

Trust Your Root CA

To access the web interface securely over HTTPS, download and trust your router’s Root Certificate Authority (Root CA).

1. Navigate to System > Settings > General and click “Download Root CA”.

2. Follow the instructions for Trusting Your Root CA on each device you want to connect to the router’s web interface.

Explore the Web Interface

The StartWRT web interface is organized into five sections:

• Internet — WAN settings, published ports, outbound VPNs
• Network — LAN settings, connected devices
• Security Profiles — Create and manage access control profiles
• Points of Entry — Ethernet ports, Wi-Fi passwords, inbound VPN servers
• System — General settings, SSH keys, backups, logs

Tip

Toggle Help Mode from the header to get a plain-language explanation of everything on the current page, including links to external resources.

Next Steps

• Security Profiles — Understand the core concept behind StartWRT
• Wi-Fi — Set up additional Wi-Fi passwords for different profiles
• Settings — Configure timezone, language, and other preferences

Trusting Your Root CA

In order to establish a secure (HTTPS) connection with your router on the local network, it is necessary to download and trust your router’s Root Certificate Authority (Root CA).

Note

You must repeat this guide for each device you want to connect to the router’s web interface over HTTPS.

Step 1 - Download

Navigate to System > Settings > General and click “Download Root CA”. This saves the certificate as startwrt-ca.crt. When you inspect or install it, the certificate is named “StartWRT Local Root CA” followed by a short random identifier (e.g. “StartWRT Local Root CA 3f8a1b2c”) — each router generates a unique one so a reflashed device’s new CA won’t collide with one you already trust.

Step 2 - Trust

Select your platform:

cd ~/Downloads

3. Mozilla Apps (Firefox, Thunderbird, Librewolf)

Mozilla apps use their own certificate store and need extra configuration to trust your Root CA. Complete the steps above for your OS first, then follow the steps below.

For more background, see Mozilla’s blog post on why they maintain their own root certificate store.

Updating

StartWRT never updates automatically — updating always requires explicit action. There are two ways to update: an in-app update from the web interface (recommended), or a microSD reflash (a fallback if an in-app update ever fails). We highly recommend keeping StartWRT up to date for the latest security and performance patches, as well as to take advantage of new features.

In-App Update (Recommended)

1. Navigate to System > Settings > General.

2. When a newer signed release is available, a “vX.Y.Z released!” accordion appears. Expand it to read the release notes.

3. Click “Update now” and confirm.

4. The download and apply progress is shown live. When it finishes, the router reboots. Once it is back online, the page reloads to the new interface automatically and takes you to the login page — updating signs everyone out, so simply log back in with your admin password. After you log in, an “Updated to vX.Y.Z” confirmation appears.

   Warning

   Do not unplug your router during the update or reboot. The update can take several minutes to apply. All network traffic — Wi-Fi, Ethernet, VPN connections, and port forwarding — will be interrupted until the router finishes restarting.

Firmware integrity is enforced cryptographically (a Blake3 commitment plus ed25519 release signatures), so only properly signed StartWRT releases will install. A tampered or unsigned image is rejected.

Pages Open During an Update

Only the page that started the update reloads itself. If the interface was open anywhere else while the update was applied — another browser tab, another device — that page will show a “Refresh Needed” dialog once it notices the router is running newer firmware (within seconds of its next request, or about half a minute for an idle page). Click Reload to load the new interface; nothing is reloaded out from under you automatically.

Updates also keep the router’s low-level boot firmware (the eMMC boot partitions) in sync with the release — verified during the update and again on every boot — so every part of the boot chain ships and updates together. This is automatic; if it is already current, nothing is rewritten.

Update by Reflashing (Fallback)

If an in-app update ever fails, you can update StartWRT by reflashing from a microSD card. Use the Keep settings path in the reflash wizard, which replaces the firmware while preserving your settings. See Installing StartWRT for how to create a bootable microSD card, and Factory Reset for a walkthrough of the reflash wizard.

Security Profiles

Security Profiles are the core concept in StartWRT. Every device on the network is assigned a Security Profile that governs what it can access — LAN devices, the Internet, DNS servers, VPN tunnels, and time-of-day restrictions. Profiles replace the need to manually configure VLANs, firewall zones, subnets, and routing tables.

How Profiles Work

Behind the scenes, each Security Profile creates an isolated network environment:

• VLAN — Layer 2 isolation so devices on different profiles cannot see each other’s traffic
• Subnet — A dedicated /24 IP range with its own DHCP server and gateway
• Firewall zone — Rules controlling what the profile can access (LAN, Internet, specific devices)
• DNS — Inherited from the system, the outbound VPN, or overridden with custom servers
• Outbound routing — Which gateway or VPN chain handles the profile’s Internet traffic
• WAN Blackout — Optional time-of-day restrictions on Internet access

You do not need to configure any of these individually. When you create a profile, StartWRT sets up all the underlying networking automatically.

How Devices Get Profiles

A device’s Security Profile is determined by its point of entry — how it connects to the network:

• Ethernet — The physical port a device plugs into. Each port maps to a profile. See Ethernet.
• Wi-Fi — The password a device uses to join the Wi-Fi network. Each password maps to a profile. See Wi-Fi.
• Inbound VPN — The WireGuard server a device connects to remotely. Each VPN server maps to a profile. See Inbound VPNs.

One SSID, multiple passwords. One router, multiple isolated networks. The profile abstraction keeps it simple.

Creating a Profile

1. Navigate to Security Profiles and click “Add”.

2. Enter a Name at the top of the dialog (e.g. “Admin”, “Guest”, “Children”, “Smart Devices”). The Name field sits above three tabs — LAN, WAN / Internet, and DNS.

3. On the LAN tab, configure local-network settings:

   • Subnet — Set the third octet of the profile’s /24 subnet. The first two octets are shown but locked; for example, a value of 2 creates the subnet 192.168.2.0/24. They are locked because every profile must stay within the primary LAN network block’s /16 for cross-subnet routing to work — changing the LAN network block moves all profiles with it. Each profile must have a unique subnet. The gateway address is always .1 within the subnet (e.g. 192.168.2.1).

   • Access — Controls which other profiles this profile can communicate with on the local network:

     • All — Full access to devices on all profiles.
     • Same profile — Only communicate with devices on this same profile. A published port on another profile stays reachable at the router’s public address if this profile has Internet access to that address.
     • Whitelist — Select specific profiles from a list.

   • Auto whitelist new profiles — A checkbox shown in Whitelist mode. When checked, newly created profiles are automatically added to this profile’s whitelist. Useful for admin profiles that should maintain access to all network segments.

4. On the WAN / Internet tab, configure Internet access:

   • Outbound Routing — Choose how traffic from this profile reaches the Internet. Select Direct for direct Internet access, or VPN to route all traffic through an outbound VPN. The VPN option cannot be selected if you have no enabled Outbound VPN clients; choosing VPN reveals a picker listing your enabled VPNs (a disabled VPN’s tunnel is down, so routing a profile through it would cut that profile off).

   • WAN Access — Controls Internet access for devices on this profile:

     • All — Unrestricted Internet access.
     • None — No Internet access. Devices can only reach LAN resources permitted by the LAN access setting.
     • Whitelist — Allow connections only to specific destination IPs or CIDR ranges (e.g. 1.1.1.1, 8.8.8.0/24). Include the router’s public address to let the profile reach published ports on other profiles.
     • Blacklist — Block connections to specific destination IPs or CIDR ranges, allow everything else. Blocking the router’s public address keeps the profile away from published ports on other profiles.

   • Blackout Schedule — A button that opens a schedule dialog for time-of-day Internet restrictions (see WAN Blackout below). It is disabled when WAN Access is None; any existing windows are retained.

5. On the DNS tab, choose Inherit from system or Custom. Custom lets you specify up to three DNS servers, each with an optional DoH (DNS-over-HTTPS) toggle. When inheriting, the profile uses the outbound VPN’s DNS (if routing through a VPN) or the system DNS from WAN Settings.

6. Click “Save”.

Editing a Profile

1. Navigate to Security Profiles and select the profile.

2. Modify any settings and click “Save”.

Warning

Changing a profile’s settings takes effect immediately for all devices currently assigned to that profile.

Deleting a Profile

1. Navigate to Security Profiles and select the profile.

2. Click “Delete”.

Warning

Deleting a profile disconnects all devices assigned to it. Associated points of entry (Wi-Fi passwords, Ethernet port assignments, VPN servers) are automatically removed.

Note

The primary LAN profile cannot be deleted.

WAN Blackout

Each profile can optionally restrict Internet access during specific time periods. WAN Blackout defines block windows — periods when WAN access is removed for devices on the profile. Wi-Fi connectivity and LAN access are unaffected. Outside of these windows, the profile’s normal WAN access rules apply.

WAN Blackout is edited in its own dialog, opened with the Blackout Schedule button on the WAN / Internet tab of the profile create/edit dialog (see Creating a Profile). The dialog has its own Cancel and Save buttons — save it to keep your windows, then save the profile to apply them.

1. The schedule is displayed as a 7-day visual timeline grid, with one column per day of the week (Monday through Sunday).

2. Click “Add” to create a block window:

   • Set the start and end times. Times use a 12-hour HH:MM AM/PM format, with a 15-minute quick-pick dropdown. A window may cross midnight (e.g. 10:00 PM to 6:00 AM). Setting the start time equal to the end time creates a full 24-hour window.
   • Select which days of the week the window applies to.
   • Click “Save”.

3. Multiple block windows per day are supported.

Overlapping windows are rejected when you save. A schedule that covers the entire week with no gap is also rejected — the system needs at least one boundary to toggle WAN access on and off.

Tip

Click a window once to edit it. Removing a window does not ask for confirmation.

Note

WAN Blackout blocks Internet access, not LAN access. Devices can still reach LAN resources during blocked periods according to the profile’s LAN access setting. For disabling the Wi-Fi radio itself on a schedule (affecting all Wi-Fi devices), use Wi-Fi Blackout.

Example Profiles

Here is an example of how a household might use Security Profiles:

Points of Entry

A point of entry is how a device connects to the StartWRT network and receives its Security Profile. There are three types of entry points, each mapping to a profile.

Ethernet

Each physical Ethernet port on the router maps to a Security Profile. The port a device plugs into determines its profile. See Ethernet.

Wi-Fi

StartWRT uses one Wi-Fi network (one SSID) with multiple passwords. Each password maps to a different Security Profile. The password a device uses to join the network determines its profile. See Wi-Fi.

Inbound VPN

Each WireGuard VPN server on the router maps to a Security Profile. Remote devices connect to a VPN server and receive the corresponding profile, as if they were physically present on the network. See Inbound VPNs.

Why Entry Points Matter

Traditional routers require you to think in terms of VLANs, firewall rules, and subnets. StartWRT replaces all of that with a simple mental model: how you connect determines what you can access. Whether a device plugs into a specific Ethernet port, uses a specific Wi-Fi password, or connects through a specific VPN server, the result is the same — it gets assigned a profile that governs its network access.

WAN Settings

The WAN (Wide Area Network) page configures how the router connects to the Internet through your ISP. Most users will not need to change these settings — StartWRT auto-detects your Internet connection on first boot. Navigate to Internet > WAN Settings.

IPv4

Configure the router’s IPv4 Internet connection. The default is DHCP, which works for most ISPs.

• DHCP — The router obtains an IP address automatically from your ISP. This is the default and most common setting.

• Static — Manually configure a fixed IP address assigned by your ISP:

  • WAN IP — The static IPv4 address.
  • Subnet Prefix — The subnet prefix (e.g. /24). The equivalent subnet mask is displayed alongside (e.g. 255.255.255.0).
  • Gateway IP — The default gateway provided by your ISP.

• PPPoE — Used by some DSL providers. Enter the credentials provided by your ISP:

  • Username — Your ISP account username.
  • Password — Your ISP account password.
  • Device — (Optional) Select a specific network interface for the PPPoE connection.

IPv6

Configure IPv6 if your ISP supports it.

• SLAAC (default) — Automatic IPv6 configuration. The most common option if your ISP supports IPv6.
• DHCPv6 — The ISP assigns an IPv6 address via DHCP. Use if SLAAC does not work with your ISP.
• Static — Manually configure a fixed IPv6 address, prefix length, and gateway. A LAN Prefix field sets the IPv6 prefix delegated to your LAN.
• 6RD — Tunnels IPv6 over an IPv4 connection. Required by some ISPs that do not provide native IPv6. Configuration fields: IPv6 Prefix, IPv6 Prefix Length, IPv4 Prefix Length, and Border Relay IP (the IPv4 address of the ISP’s relay server).
• Disabled — No IPv6 on the WAN interface.

For SLAAC and DHCPv6, an optional IPv6 Prefix field lets you request a specific prefix length from your ISP for prefix delegation (e.g. /48, /56, /64). Leave empty to let your ISP decide automatically.

Note

IPv6 cannot be set to Disabled while any enabled Published Ports rules use IPv6 — the option is grayed out with a hint. Remove or disable those rules first.

Tip

A 6in4 tunnel is another way to reach IPv6 on an ISP that provides none. Unlike 6RD, which your ISP has to offer, a 6in4 tunnel comes from a third-party broker such as Hurricane Electric and works on any connection with a public IPv4 address — but not behind CGNAT, which blocks the protocol the tunnel uses. There is no UI for it; the 6in4 package ships in the image and is configured over SSH by adding an interface to /etc/config/network. The web interface does not manage such an interface — the WAN page and its summary read it back as IPv6 Disabled — so keep managing it over SSH rather than from the IPv6 settings here.

The WAN summary shows an IPv6 status badge indicating whether IPv6 is Enabled or Disabled, along with its mode (SLAAC, DHCPv6, Static, or 6RD).

DNS

Configure which DNS servers the router uses to resolve domain names.

• Get from ISP (default) — Use DNS servers provided automatically by your ISP via DHCP.
• Custom — Specify your own DNS servers. Up to three servers are supported (Primary required, Secondary and Tertiary optional). Each server has a Secure (DoH) toggle to enable DNS-over-HTTPS encryption for that server.

Note

Not all DNS servers support DoH. Common servers that do include Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 (9.9.9.9).

Tip

Using privacy-focused DNS providers can improve both privacy and performance compared to your ISP’s default DNS servers. Individual Security Profiles can override these DNS settings with their own Custom DNS configuration.

MAC Address

Some ISPs bind your Internet connection to a specific MAC address. If you are replacing an existing router, you may need to clone the old router’s MAC address.

• Router (default) — Use the router’s built-in MAC address.
• Custom — Enter the MAC address of your previous router or modem.

Note

If you do not know whether your ISP requires a specific MAC address, leave this setting at its default. You only need to change it if your Internet connection does not work after switching routers.

Dynamic DNS

See Dynamic DNS for full details on configuring DDNS from this tab.

Dynamic DNS

Dynamic DNS (DDNS) maps a stable domain name to your home IP address, even when your ISP changes it. This is essential for remote access features like Inbound VPNs and Published Ports, which require external devices to find your router on the Internet.

Why You Need DDNS

Most home Internet connections have a dynamic IP address that can change without warning. When your IP changes, any remote VPN clients or port forwarding rules pointing to the old IP stop working. DDNS automatically updates a domain name to point to your current IP, so remote connections keep working.

Setting Up DDNS

StartWRT supports the following DDNS providers:

• Cloudflare
• DuckDNS
• DynDNS
• FreeDNS
• No-IP

To set up DDNS:

1. Navigate to Internet > WAN Settings > Dynamic DNS.

2. Toggle Enable Dynamic DNS on and select your provider.

3. Fill in the fields your provider requires: DynDNS and No-IP need a username and password; DuckDNS and FreeDNS need an API token; Cloudflare needs an API token and the zone — the domain registered with Cloudflare, e.g. example.com. Every provider also needs the hostname you have registered with it; for Cloudflare, the hostname must be the zone itself or a name under it, such as router.example.com.

4. Click “Save”.

Note

For Cloudflare, the DNS record must already exist in your zone — StartWRT updates it but does not create it, so add the A record in the Cloudflare dashboard first. The API token needs Zone → Read and DNS → Edit permissions for the zone. Proxied (orange-cloud) records work: the router reads the registered address through the Cloudflare API rather than through DNS, which would only ever show the proxy’s address.

Checking Your DDNS Status

The Dynamic DNS tab on the WAN Settings page shows the current status of your dynamic DNS configuration: whether it is enabled, the provider, and the hostname. The router updates the record whenever the WAN connection comes up — after a modem reboot or a PPPoE reconnect — and on a periodic check in between, so a changed address is registered within minutes.

Published Ports

Published ports (port forwarding) allow devices on the Internet to reach specific devices on your LAN. Each rule maps a port on the router’s public IP address to a port on a device behind the router.

When to Use Port Forwarding

• Self-hosting — Expose a web server, email server, or other service running on a LAN device.
• Remote access — Allow external access to a specific device or application.
• Gaming — Open ports required by game servers or peer-to-peer connections.

Important

Port forwarding exposes devices directly to the Internet. Only forward ports for services you intend to be publicly accessible. For private remote access, use Inbound VPNs instead.

Creating a Rule

1. Navigate to Internet > Published Ports and click “Add”.

2. Configure the rule:

   • Label — A descriptive name (e.g. “Home Assistant”, “Minecraft Server”, “Bitcoin P2P”).
   • Device — Select the target device from the list. The device is identified by name and IP address. If the device does not already have a reserved IPv4 address, one will be assigned automatically to ensure the rule always reaches the correct device.
   • Port — The port or port range on the device to expose. Enter a single port (e.g. 443) or a range (e.g. 27015-27030).
   • Protocol — TCP, UDP, or TCP + UDP.
   • Source — Who can connect. Select Any to allow connections from anywhere on the Internet, or Custom to restrict access to a specific IP address or CIDR range (e.g. 203.0.113.0/24).
   • IP Version — IPv4, IPv6, or IPv4 + IPv6. If the selected device lacks an address for the chosen version, or WAN IPv6 is not configured, an error appears below the options and the rule cannot be saved until a compatible version is selected. Unlike IPv4, a device’s IPv6 address cannot be reserved — each device chooses its own IPv6 address (via SLAAC) — so an IPv6 rule follows the device’s current address automatically: the router watches the network for address changes and retargets the rule whenever the device picks a new address or your ISP rotates the delegated prefix. Where a device holds several IPv6 addresses at once, the rule targets its long-lived (stable) address rather than the short-lived privacy addresses that rotate daily.
   • External Port (IPv4 only) — Same as device keeps the external port identical to the internal port. Select Other to specify a different external port (e.g. forward WAN port 9090 to device port 8080).

3. Click “Save”.

Note

If the device’s Security Profile routes its traffic through an Outbound VPN, creating or re-enabling a rule prompts for confirmation: published ports are reached over your public WAN address, not through the VPN, so the port is exposed on your real public IP.

Warning

Some ports the router answers on itself. If Remote Access is on — including the default “When behind NAT” mode while the router sits behind another router — the router serves its own web interface, and optionally SSH, on WAN ports 80, 443, and 22; an Inbound VPN listens on its configured port. Publishing one of these ports sends that traffic to your device instead, cutting the router’s own service off from outside your network (access from your LAN is unaffected). Saving such a rule therefore prompts for confirmation first — you can override it deliberately, e.g. to run your own web server on 443 when you don’t use remote access to the router. You are asked once per rule; changing which port that rule publishes, or its protocol, asks again. When the port’s actual holder is a device’s hostname routes rather than a router service, the prompt says so instead, naming the routed hostnames and the device they belong to.

Editing a Rule

1. Navigate to Internet > Published Ports and select “Edit” from the rule’s actions menu.

2. Modify any settings and click “Save”.

Enabling and Disabling Rules

Each rule can be toggled on and off without deleting it. Use the “Enable” or “Disable” option in the rule’s actions menu.

Deleting a Rule

1. Navigate to Internet > Published Ports and select “Delete” from the rule’s actions menu.

Status Indicators

Each published port rule shows a status indicator in the table:

• Active (green) — The rule is enabled and the target device is online with the addresses the rule needs.
• Partial (yellow) — Only one of the rule’s IP versions is currently usable. For example, the device is missing its IPv4 or IPv6 address, or its IPv6 address is out of date after your ISP rotated the delegated prefix.
• Paused (orange) — The target device is offline or not found.
• Error (red) — No usable address is available for the rule — the device lacks an address for the selected IP version(s), or its IPv6 address is out of date.
• Disabled (grey) — The rule has been toggled off.

The status reflects the rule and the device’s addresses on your LAN — it does not test whether traffic actually arrives from the Internet.

Reaching a Published Port from Your Own Network

A device on your own network can reach a published port at the router’s public address — or at a domain name that points there — instead of at the target device’s LAN address. The router recognizes those connections and sends them on to the published device, so one address works from both sides of your Internet connection. This matters for anything configured with a single address, such as a phone app or a bookmarked domain name. (This is commonly called NAT loopback, or hairpinning.) It applies to addresses actually on the router’s WAN interface — behind CGNAT or another upstream router, your public IP is not one of them, and connections to it from inside your network will not loop back.

A published port is a public resource, so this works from every Security Profile that could reach it from the Internet, and from every profile whose Access setting already includes the target device’s profile. A profile could reach it from the Internet when its WAN Access is All, or Blacklist without the router’s public address among the blocked entries, or Whitelist with the router’s public address (or a range holding it) among the allowed entries — in each case outside any blackout window. A profile with neither ground — for instance WAN Access set to None, and no Access to the device — is not given this route: for its connections to the router’s public address, the router answers instead of the device. The device’s global IPv6 address is its public address, and is reachable on the published port from the same profiles; for it, a Whitelist or Blacklist entry counts when it holds the device’s address rather than the router’s. Ports opened through automatic port forwarding are served the same way.

Only the published port is opened this way. A profile without Access to the device still cannot reach it at its LAN IPv4 address, or on any other port.

Note

A rule whose Source is restricted to specific addresses is never served this way. That route cannot distinguish one local device from another, so serving the rule over it would let any device on your network past the restriction. Reach a restricted rule from inside your network at the device’s own LAN address instead.

Automatic Port Forwarding

Some devices can configure port forwarding for themselves using the standard UPnP and PCP protocols instead of you creating rules by hand — StartOS servers do this automatically, and game consoles and torrent clients commonly support it too.

This is off by default for every device. To allow it, open the device’s detail page and turn on Allow automatic port forwarding. From then on, that device — and only that device — can ask the router to forward ports, and only to itself: a device can never open a port that routes traffic to another device.

Port uses created this way appear in the Automatic section of the Published Ports page. Each row shows the Device (linked to its detail page), the Port on the device, the Public port, the Hostname for a hostname route, the Kind (PCP, UPnP, or SNI), and Expires — the minutes left before the router removes the entry unless the device renews it. They are read-only:

• The device itself creates, renews, and removes its forwards.
• A forward the device stops renewing expires and is removed automatically once the lifetime the device asked for runs out — about an hour for typical clients, and never longer than a week even for a device that asks to keep the port indefinitely.
• A forward is also removed once the device no longer holds the address it points at — if the device leaves the network long enough for its DHCP lease to lapse, or comes back on a different address. This keeps a forward from quietly delivering Internet traffic to whichever device is given that address next. Devices with a reserved address are unaffected.
• To stop a device from creating forwards, turn its toggle back off on the device page — or forget the device entirely. Either way its existing forwards and hostname routes are closed immediately, and it can no longer open new ones.

Automatic forwards survive router reboots, so a self-configured device stays reachable while the router restarts. They can never take over a port that one of your manual rules already uses — the device’s request is refused instead. The reverse also holds: if you publish a port manually that an automatic forward is currently using, your manual rule wins and the automatic forward is removed.

Ports the router answers on itself are protected the same way. If you have Remote Access turned on, or an inbound VPN reachable from the Internet, a device cannot take those ports over — requests for them are refused, so automatic forwarding can never cost you access to your own router. (Publishing such a port manually asks you to confirm instead — a device can’t be asked, but you can.)

Hostname routes (shared ports)

A device can also ask for a hostname route instead of a whole port: the router inspects each incoming TLS connection’s requested hostname (SNI) and delivers it to whichever device registered that hostname, so several devices — or several services on one StartOS server — can share a single external port such as 443. StartOS servers use this automatically when you give services on a shared port their own domains.

Hostname routes appear in the same Automatic section with SNI in the Kind column and the hostname shown alongside. They follow the same rules as other automatic forwards — per-device permission, the device renews them, they expire on their own — with two differences: a shared port is claimed whole (an ordinary forward on that port is refused while hostname routes hold it, and publishing it manually asks you to confirm), and hostname routes do not survive a router restart — the device simply re-registers them within a few minutes, so no action is needed.

A routed hostname also works from inside your own network, not only from the Internet: a laptop on your LAN can open the same public address and reach the device, with the router turning the connection around. The device sees those connections as coming from the router itself rather than from the laptop, so its own access logs and any per-client rules it applies won’t tell one local device from another. Connections from a different Security Profile, and from the Internet, still arrive with the original address intact.

Hostname routes and Remote Access can share port 443. While routes hold the port, a connection naming a routed hostname reaches its device, and everything else — including browsing the router by its IP address — still reaches the router’s own interface, accepted from exactly the sources your Remote Access setting allows. Enabling one feature never disables the other. (Router SSH and an inbound VPN’s port still refuse hostname routes outright — those protocols can’t share a port this way.)

A note on trust. The PCP protocol runs over plain UDP, which carries no proof of who sent a request. The router verifies that each request actually arrives from the network the requesting device is on, so a device on one network can never open forwards on behalf of a device on another. Within a single network, though, automatic forwarding trusts the devices sharing it — exactly as UPnP and PCP do on every router, which is why it is off by default. If you run devices you don’t fully trust, keep them on their own Security Profile so they cannot act for the devices you do. A profile governs which devices can reach one another directly; a hostname route is served by the router itself, so it stays reachable from every profile — the same exposure the service already has on the Internet.

Endpoints

The Endpoints column in the table shows the public addresses where each forwarded port can be reached. IPv4 endpoints display the router’s public IP (or DDNS domain) with the external port. IPv6 endpoints display the device’s IPv6 address with the port directly. These are useful for configuring external services or sharing access details.

Note

Port forwarding requires a public IP address. If your ISP uses CGNAT, IPv4 forwarding will not work — and because the router has no way to detect CGNAT, the rule still shows an “Active” status even though inbound IPv4 traffic never arrives. The same goes for forwards a device opens through automatic port forwarding. IPv6 forwarding may still work, since many CGNAT ISPs provide globally routable IPv6.

Note

IPv6 forwarding requires the target device to have a globally routable address. If the device only has a local-only ULA address (one that starts with fc or fd), an error explains that a global address — from your ISP’s prefix delegation — is required, and the rule cannot be saved until its IP Version is set to IPv4.

Outbound VPNs

Route your network’s Internet traffic through one or more WireGuard VPN providers for privacy. Outbound VPNs hide your home IP address from the services your devices connect to and prevent your ISP from monitoring traffic.

Adding a VPN Client

1. Navigate to Internet > Outbound VPNs and click “Add”.

2. Configure the VPN:

   • Label — A descriptive name (e.g. “Mullvad Sweden”, “Proton US”).
   • Config File — Upload a WireGuard .conf file from your VPN provider — drop it into the dialog or click to browse. Most providers (Mullvad, ProtonVPN, IVPN, etc.) offer WireGuard config file downloads from their account dashboard.
   • Target — Where this VPN’s traffic should be routed. The dropdown lists Internet along with your existing VPNs. Select Internet to exit directly to the Internet through this VPN, or select another VPN to chain through it first for additional privacy.

3. Click “Add VPN”.

Tip

Download a config file for a VPN server location near you for best performance.

VPN Chaining

VPN chaining routes traffic through multiple VPN providers in sequence, so no single provider sees both your identity and your destination. This achieves multi-jurisdictional resilience — the providers would need to collaborate across different legal jurisdictions to correlate your activity.

Chaining is configured through the Target field. When you set a VPN’s target to another VPN instead of “Internet”, traffic flows through both:

Your device → StartWRT → First VPN → Second VPN → Internet

For example, if “Mullvad” targets “Proton” and “Proton” targets “Internet”:

• Mullvad knows your home IP but not your destination.
• Proton knows your destination but sees Mullvad’s IP, not yours.

Note

VPN chaining adds latency since traffic passes through multiple servers. For most users, a single VPN provider is sufficient.

IPv6 and Kill Switch

How IPv6 traffic is handled depends on whether the VPN’s WireGuard tunnel supports it:

• IPv6-capable VPN — If the imported config includes an IPv6 address for the tunnel interface, profiles routed through the VPN send their IPv6 traffic (::/0) through the tunnel, just like IPv4.
• IPv4-only VPN — If the tunnel has no IPv6 address, no IPv6 flows through it: IPv6 internet traffic is blocked (it “fails closed”) so it cannot leak around the tunnel and out your WAN. Non-admin profiles routed through the VPN get no IPv6 addressing at all; the Admin profile’s LAN IPv6 setting stays under your control, so its devices still receive IPv6 addresses — just without IPv6 internet.

A kill switch protects every VPN-routed profile: both IPv4 and IPv6 fail closed. If the tunnel goes down, traffic is blocked rather than leaking out the WAN.

Note

Routing IPv6 through a VPN requires the VPN’s tunnel config to include an IPv6 address on the tunnel interface. Without one, the VPN carries IPv4 only and IPv6 is blocked for routed profiles.

VPN Detail Page

Click a VPN label in the table to open its detail page, which shows:

• Status — Whether the VPN is connected or disabled.
• Connection Path — The full route traffic takes from this VPN to the Internet (e.g. “Mullvad → Proton → Internet”).
• Used by — Which Security Profiles currently route their traffic through this VPN. Check this before making changes to understand the impact.
• Label — Edit the display name.
• Connects to — Change the target (Internet or another VPN). Only targets that would not create a circular chain are offered.
• MTU — The tunnel’s packet size limit. Leave blank to use the default (~1420). Lower it — down to a minimum of 1280 — if the VPN connects but requests time out.

To delete a VPN, click “Delete” on its detail page. If any Security Profiles route through the VPN, you will be asked to confirm — those profiles will switch to the regular WAN connection.

Note

You cannot delete a VPN if other VPNs use it as a target. Change their target first.

Enabling and Disabling

Each VPN has an enable/disable toggle in the table view. When a VPN is disabled, profiles that route through it will fall back to the WAN (direct Internet). A disabled VPN is not offered when choosing a Security Profile’s outbound routing, nor as another VPN’s Connects to target — re-enable it first.

Note

You cannot disable a VPN if other VPNs use it as a target. Change their target first.

Assigning VPNs to Profiles

By default, all Security Profiles use the router’s default gateway (your ISP) for Internet traffic. You can override this per profile:

1. Navigate to Security Profiles and select a profile.

2. Under Outbound Routing, select a VPN client.

3. Click “Save”.

This lets you route different profiles through different VPNs. For example:

• Admin profile routes through Mullvad
• Children profile routes through a DNS-filtering VPN
• Guest profile routes through Proton
• Smart Devices profile uses the default gateway (no VPN)

LAN Settings

The LAN (Local Area Network) page configures the router’s internal network addressing. Most users will not need to change these settings — the defaults work for typical home networks. Navigate to Network > LAN Settings.

IPv4

Configure the router’s LAN IPv4 addressing.

• Network Block — Select the private IP block for your network. The first octet determines the RFC 1918 block: 192.168.x.x, 172.16.x.x, or 10.0.x.x. The second octet selects which /16 within that block, and the editable range depends on the block:

  • 192.168.0.0/16 — the second octet is locked to 168.
  • 172.16.0.0/12 — the second octet is editable, 16–31.
  • 10.0.0.0/8 — the second octet is editable, 0–255.

  The default is 192.168, so existing networks are unaffected. Only RFC 1918 private ranges are accepted; out-of-range values are flagged inline (e.g. “Second octet must be 16–31”) and block saving rather than being auto-corrected. Each Security Profile receives its own /24 subnet within this block, allowing up to 255 separate subnets with 254 devices each.

• Router address — The router’s LAN IP is the gateway (.1) of the primary Admin Security Profile’s subnet. The first two octets come from the Network Block above; the third octet is set by the Admin profile’s Subnet field, not on this page. For example, with the 192.168.x.x block and an Admin subnet of 1, the router is reachable at 192.168.1.1. This is the address you use to access the web interface (or simply router.lan).

Note

DHCP is managed automatically for each Security Profile. You do not need to configure DHCP ranges or lease times.

Warning

Changing the Network Block changes the router’s LAN address. If you are connected to the gateway IP address (opposed to router.lan), you will need to navigate to the new address to access the web interface. If any inbound VPN servers exist, they will be deleted because their client configurations become invalid with the new addressing.

Note

Changing the second octet counts as a subnet change. Like other subnet changes, it is blocked while any device has a static IP reservation. Remove those reservations first.

IPv6

Configure IPv6 addressing on the LAN.

• Enable — Toggle to enable or disable IPv6 on the LAN. IPv6 addressing uses Stateless Address Autoconfiguration (SLAAC): devices generate their own IPv6 addresses from the router’s advertised prefix.

• Prefix Length — Shown when IPv6 is enabled. The LAN IPv6 prefix length must be larger (a higher number) than your WAN prefix to create a valid subnet. For example, if your ISP assigns you a /48 prefix, you can use /56, /60, or /64 for the LAN. A /64 is recommended for most home networks.

Note

While any enabled Published Ports rule forwards over IPv6, IPv6 cannot be disabled — devices would lose the addresses those rules depend on. Disable or delete those rules first.

Note

If you are updating from an older version, this page may have read Disabled while some Security Profiles were still handing out IPv6 addresses. That is corrected on the first start after the update: IPv6 is turned off for those profiles too, and the correction is recorded in Activity. Enable IPv6 here to turn it back on — it now applies to the LAN and every profile together.

Note

Because devices choose their own IPv6 addresses, disabling IPv6 asks them to drop the ones they hold rather than taking the addresses away directly. Devices that are connected at the time drop them immediately. A device that is asleep, off the network, or misses the notice keeps its address until it expires on its own — up to about 90 minutes — and reconnecting or rebooting it clears the address right away.

Note

If the Admin profile routes through an IPv4-only Outbound VPN, LAN devices still receive their IPv6 addresses, but IPv6 internet traffic is blocked by the kill switch so it cannot leak around the tunnel. IPv6 connectivity resumes when the profile routes through an IPv6-capable VPN or directly to the Internet.

Devices

The Devices page shows all devices that have connected to your router, organized into Online (currently connected) and Offline (previously seen) groups. Each device is associated with a Security Profile based on its point of entry.

Devices appear here even without an active DHCP lease: devices with static IPs, IPv6-only devices, and devices connected through an external switch (learned from the bridge forwarding table) are all listed. Names are resolved on the router from the device’s hostname, with mDNS/Bonjour used as a fallback to recover a friendly name. Some devices never share a name at all — Chromebooks deliberately withhold theirs, and many IoT gadgets can’t send one; these are labeled by their operating system (recognized from how they request a network address), e.g. Windows device (3af2b1), or by their hardware vendor, e.g. Apple device (3af2b1), falling back to a generic device-3af2b1 only when nothing identifies them. Assigning your own name always overrides any of these.

Viewing Devices

Navigate to Network > Devices to see the device list. A search box above the list filters it as you type. Each entry shows:

• Name — The device’s hostname or a custom name you have assigned. Click to open the device detail page.
• Connection — How the device connects: Ethernet, Wi-Fi 2.4GHz, Wi-Fi 5GHz, or VPN.
• Security Profile — The Security Profile the device is assigned to.
• MAC address — The device’s unique hardware identifier.
• IP address — The device’s IPv4 and IPv6 addresses. A lock icon indicates a reserved (static) IPv4 address. The IPv6 address is shown only while the device is confirmed to still be using it, so the field is empty for a device that has dropped its IPv6 address or has none.
• Data and Speed — Cumulative data usage and real-time upload/download speed for online devices.

Device Detail Page

Click a device name to open its detail page:

• Summary — Displays the device’s current status (online/offline), connection type, Security Profile, IPv4 and IPv6 addresses, and real-time upload/download speed.

• Data Usage — A chart showing historical upload and download over time. Use the dropdown to select a time period: Last Week (7 days), Last 30 Days, or Last 3 Months (90 days). Usage history survives firmware updates.

• Name — Edit the custom display name for this device. If left empty, the device’s hostname is used. Saving shows a brief spinner and a confirmation, then refreshes from the router so the displayed name always matches the saved state.

• Reserve — Toggle on to assign a fixed IPv4 address that persists across reboots. Enter the desired address within the device’s profile subnet. Useful for servers, printers, NAS devices, or any device that needs a consistent address. If you change the reserved address, the device picks up the new one the next time it requests an address from the router — reconnecting or rebooting the device usually applies it right away; otherwise it can take up to 12 hours, and the interface reminds you of this when you save. While an enabled Published Ports rule uses the device’s IPv4 address, the Reserve toggle is locked. IPv6 addresses cannot be reserved: each device chooses its own IPv6 address (via SLAAC), so the router has no say in it — the IPv6 field is shown for reference only, and IPv6 published-port rules follow the device’s current address instead.

• Allow automatic port forwarding — Under Permissions. Off by default. Toggle on to let this device open and renew its own port forwards using the standard UPnP and PCP protocols. Used by StartOS servers (which configure themselves automatically), game consoles, and similar devices. See Automatic port forwarding.

• Forget — Remove an offline device from the list. Custom name, reserved IP settings, and the device’s cached name are lost, and any automatic port forwards it holds are closed. If the device reconnects, it will appear as a new entry.

Tip

Reserve an IPv4 address for any device you plan to use with Published Ports. IPv4 port forwarding rules require a stable address to ensure traffic always reaches the correct device (publishing a port reserves one automatically).

Note

Forgetting a device only removes it from the list. If the device reconnects, it will reappear. To prevent a device from accessing the network, delete the Wi-Fi password or Inbound VPN client it uses to connect.

Ethernet

Each physical Ethernet port on the StartWRT router maps to a Security Profile. The port a device plugs into determines its profile — no manual configuration is needed on the device itself.

How It Works

When a device is plugged into an Ethernet port, the router assigns it to the profile mapped to that port. The device receives an IP address on that profile’s subnet and is subject to that profile’s firewall rules, VPN routing, and schedule restrictions.

Behind the scenes, StartWRT uses bridge VLAN filtering to isolate traffic between ports. Each port tags traffic with a different VLAN ID, ensuring devices on different profiles cannot communicate at Layer 2 unless explicitly allowed.

WAN Port

One Ethernet port is designated as the WAN port, which connects to your ISP modem or upstream network. The WAN port is shown with a “WAN” badge in the port list and cannot be assigned a Security Profile.

Assigning Profiles to Ports

1. Navigate to Points of Entry > Ethernet.

2. For each non-WAN port, select the desired Security Profile from the dropdown. There is no separate save step — the change is applied as soon as you select a profile.

3. If reassigning the port would break any Published Ports rules (the devices on that port move to a new subnet), a confirmation dialog lists the affected rules first. Nothing is applied until you confirm; canceling leaves the port unchanged.

Note

Changes take effect immediately. A device currently plugged into a port will be reassigned to the new profile without needing to unplug and replug.

Note

If you connect a network switch to an Ethernet port, all devices on that switch share the same Security Profile. StartWRT cannot differentiate between devices beyond its onboard Ethernet ports. Those devices still appear individually in the Devices list — including hosts with static IPs or only IPv6 addresses — because the router learns them from the bridge forwarding table even without a DHCP lease.

Changing the WAN Port

If you need to use a different physical port for your ISP connection:

1. Navigate to Points of Entry > Ethernet.

2. Click “Change WAN Port”.

3. Select the new port.

4. Confirm the change.

Warning

Changing the WAN port restarts the network and may briefly interrupt your Internet connection. Ensure your modem cable is connected to the new port before confirming.

Example

Wi-Fi

StartWRT uses a single Wi-Fi network (one SSID) with multiple passwords. Each password maps to a different Security Profile. The password a device uses to connect determines its profile — no manual network selection or VLAN configuration required.

How It Works

Traditional routers create separate Wi-Fi networks (separate SSIDs) for different access levels. StartWRT takes a different approach: one SSID with multiple WPA2 passwords. When a device connects, the router identifies which password was used and assigns the corresponding Security Profile. This is powered by WPA2’s identity PSK feature with dynamic VLAN assignment.

From the user’s perspective, everyone connects to the same network name — the password is what determines their access level.

The Default Password

The Wi-Fi password printed on the sticker on the bottom of your router is the default password. It maps to the default Security Profile (typically “Admin” with full access). This password is set during manufacturing and stored in the router’s EEPROM. The EEPROM value is only authoritative on a factory reset, when it is re-read to restore the default password. During normal operation the active password is whatever is in the router’s running configuration: you can delete the Default entry and create a new one, and that new password is respected regardless of the EEPROM value. It also appears on the Points of Entry > Wi-Fi > Passwords page as the Default entry (mapped to the Admin profile), where you can reveal or copy it.

Note

Keep the sticker password safe. On a DIY or unprogrammed board with no EEPROM Wi-Fi password, connect via Ethernet and set one in the web interface. See Installing StartWRT.

Adding a Wi-Fi Password

1. Navigate to Points of Entry > Wi-Fi > Passwords.

2. Click “Add”.

3. Configure the password:

   • Label — A descriptive name for this password (e.g. “Home”, “Guest Network”, “Kids”).
   • Password — Enter a password (8–63 characters) or click “Generate” to create a strong random password.
   • Security Profile — Select the Security Profile this password should map to.

4. Click “Save”.

Share this password with the people or devices that should receive that profile. They connect to the same network — the router handles the rest.

Editing a Wi-Fi Password

Select “Edit” from a password’s actions menu to change its label or move it to a different Security Profile. If moving the password to another profile would delete any Published Ports rules (its devices move to a new subnet), a confirmation dialog lists them first.

Removing a Wi-Fi Password

1. Navigate to Points of Entry > Wi-Fi > Passwords.

2. Select the password from the actions menu and click “Delete”.

Warning

Removing a Wi-Fi password immediately disconnects all devices using it. Those devices will need a different password to reconnect.

Settings

Configure the Wi-Fi radio hardware under Points of Entry > Wi-Fi > Settings:

• Enable Wi-Fi — Global toggle to turn the wireless radio on or off. When disabled, no devices can connect via Wi-Fi.

• SSID — The network name that devices see when scanning for Wi-Fi (default: StartWRT). All passwords share this single SSID.

• Broadcast — Toggle SSID visibility. When off, the network is hidden from device scans and users must manually enter the network name to connect.

• Frequency Band — 2.4 GHz, 5 GHz, or Both. 2.4 GHz has better range and wall penetration. 5 GHz offers higher speeds but shorter range. Both enables dual-band operation.

• Broadcast Separately — Shown only when Band is “Both”. When enabled, the 5 GHz band gets a separate SSID with a -5G suffix (e.g. StartWRT and StartWRT-5G). Useful if you want to control which band a device connects to.

• Channel — Separate dropdowns for each band. Auto (recommended) lets the router select a channel automatically. You can also select a specific channel: 1–11 for 2.4 GHz, or 36–165 for 5 GHz.

Warning

Changing the SSID disconnects all Wi-Fi clients. You will be prompted to confirm before the change is applied.

Tip

For 2.4 GHz, channels 1, 6, and 11 are the only non-overlapping channels. If you experience interference, try one of these.

Example

Wi-Fi Blackout

Wi-Fi Blackout lets you disable the Wi-Fi radio on a recurring timetable. During a blackout window, the radio is powered off entirely — all Wi-Fi devices disconnect regardless of their profile, while Ethernet-connected devices are unaffected.

Use Cases

• Limit late-night usage — Disable Wi-Fi from 10 PM to 7 AM so household members are not online at night.
• Reduce RF exposure — Power off the radio during sleeping hours to minimize radiofrequency EMF in the home.
• Energy savings — Turn off Wi-Fi when nobody is home during the day.

Note

Wi-Fi Blackout affects the radio hardware itself, not individual devices or profiles. When Wi-Fi is off, all Wi-Fi-connected devices are disconnected regardless of their profile. Ethernet-connected devices are unaffected. For per-profile time restrictions on Internet access (not Wi-Fi connectivity), use WAN Blackout in Security Profiles.

Setting a Schedule

The schedule is displayed as a 7-day visual timeline grid, with one column per day of the week (Monday through Sunday). Blackout windows appear as shaded blocks on the timeline.

1. Navigate to Points of Entry > Wi-Fi > Blackout Schedule.

2. Click “Add” to create a blackout window.

3. Set the start and end times for the blackout period. Times use a 12-hour HH:MM AM/PM format, with a 15-minute quick-pick dropdown. A window may cross midnight (e.g. 10:00 PM to 6:00 AM). Setting the start time equal to the end time creates a full 24-hour window.

4. Select which days of the week the window applies to.

5. Click “Save”.

Multiple blackout windows per day are supported. For example, you could disable Wi-Fi from 12:00 AM to 6:00 AM and again from 10:00 PM to 12:00 AM.

Overlapping windows are rejected when you save. A schedule that covers the entire week with no gap is also rejected — the system needs at least one boundary to toggle the radio on and off.

Tip

Click a window once to edit it.

Note

If the router reboots during a blackout window, the schedule is re-evaluated at boot and the radio is powered back off for the remainder of the window. There is a brief interval early in boot, before the controller starts, during which the radio may come up momentarily before the blackout is reasserted.

Removing a Schedule

To remove a blackout window, click it and click “Remove”. Removing all blackout windows effectively disables the schedule — Wi-Fi will remain on at all times.

Inbound VPNs

Create WireGuard VPN servers on your router for secure remote access to your home network. Each VPN server maps to a Security Profile, so remote devices receive the same access controls as if they were connected locally.

How It Works

An inbound VPN server listens for WireGuard connections from the Internet. When a remote device connects, it is assigned the VPN server’s Security Profile — gaining access to the LAN, Internet, or both, according to that profile’s rules. This is like giving someone a key to a specific door in your house rather than handing them the master key.

Important

Inbound VPN requires either a public IP address or Dynamic DNS so remote devices can reach your router. If your ISP uses CGNAT, inbound connections cannot reach your router directly. Consider using StartTunnel as a gateway instead.

Creating a VPN Server

1. Navigate to Points of Entry > Inbound VPNs and click “Add”.

2. Configure the server:

   • Label — A descriptive name (e.g. “Home VPN”, “Friends”, “Work”).
   • Endpoint — The address where remote clients will connect. Select from available options: WAN IPv4 address, WAN IPv6 address, or a DDNS domain (if Dynamic DNS is configured). If you have a dynamic IP, use a DDNS domain so clients do not need to update their configuration when your IP changes.
   • Security Profile — The Security Profile to assign to connecting clients.
   • Port — The WireGuard listen port (default: 51820). Must be unique across all VPN servers. If the default is already in use, the next available port is suggested.

3. Click “Add VPN”. An “Add client device” dialog opens automatically so you can add your first client (see Adding a Client).

Note

Each Security Profile can have at most one inbound VPN. Once every profile has one, the “Add” button is disabled.

Note

The router keeps the VPN’s port for itself: publishing it to a device in Published Ports asks for confirmation first, and a device’s automatic port forwarding request for it is refused.

Managing a VPN Server

Each VPN server row has an actions menu:

• Enable / Disable — Toggle the server without deleting it. While disabled, clients cannot connect.
• Manage clients — Open the client management page (see below).
• Edit — Change the label, endpoint, Security Profile, or port, then click “Save VPN”.
• Delete — Remove the server (see Removing a VPN Server).

Managing Clients

Each VPN server has a client management page listing all peers. Navigate to a VPN server and click “Manage clients” from the actions menu to view the client list, which shows each peer’s name, LAN IP address, and routing mode.

Adding a Client

1. Select the VPN server and click “Add”.

2. Configure the client:

   • Label — A name for the client (e.g. “My iPhone”, “Work Laptop”).
   • LAN IP Address — The IP address assigned to this client on the VPN subnet. The next available address is suggested; it must fall within the .200–.253 host range of the subnet.
   • Public Key — (Optional) Enter an existing WireGuard public key if the device already has a keypair configured. Leave empty to auto-generate a keypair.
   • Route all traffic through tunnel — When enabled, all of the client’s Internet traffic routes through the VPN (full tunnel). When disabled (the default), only LAN traffic uses the tunnel and the client uses its own Internet connection for everything else (split tunnel).

   Tip

   “Route all traffic through tunnel” is especially useful when the VPN server’s Security Profile uses an Outbound VPN. Most devices only support one active VPN at a time, so a phone, for example, could either use WireGuard to access your LAN or use Mullvad/Proton directly — but not both. With full tunnel routing, the device connects to your router via WireGuard and its Internet traffic is then routed through the Outbound VPN automatically, giving you both LAN access and VPN protection in a single connection. If that Outbound VPN is IPv6-capable, the client’s IPv6 traffic is tunneled through it as well; with an IPv4-only Outbound VPN, only IPv4 is tunneled and IPv6 is blocked so it cannot leak. This adds some latency since traffic passes through two tunnels.

3. Click “Save”. The client’s WireGuard configuration is generated and displayed.

Viewing Client Configuration

Right after a client is created, its full configuration is displayed in two formats:

• File — Displays the configuration as text. Use the copy button to copy to clipboard, or the download button to save as a .conf file that WireGuard apps can import.
• QR — Displays the configuration as a QR code. Scan with the WireGuard mobile app to configure the client without manual entry.

Important

This is the only time the full configuration is available. The auto-generated private key is never stored on the router, so download or copy the configuration (or scan the QR code) before closing the dialog. The “View Config” action on the client list later shows the configuration with a placeholder where the private key belongs. If you lose the configuration, delete the client and create a new one.

Changing Client Routing

You can switch between routing modes from the actions menu on the client list:

• Switch to all traffic — Full tunnel. All Internet traffic routes through the VPN.
• Switch to LAN only — Split tunnel. Only local network traffic uses the tunnel.

Warning

Changing the routing mode deletes the existing peer and creates a new one. You will need to reconfigure the device with the new configuration.

Renaming a Client

Select “Rename” from the client’s actions menu to change its display name.

Removing a Client

Select “Delete” from the client’s actions menu. The client’s WireGuard configuration is immediately invalidated.

Connecting Remote Devices

Install the WireGuard app on the remote device and import the configuration:

• Phone or tablet: Scan the QR code from the client configuration page using the WireGuard app.
• Laptop or desktop: Download the .conf file and import it into the WireGuard app.

Removing a VPN Server

1. Navigate to Points of Entry > Inbound VPNs and select “Delete” from the server’s actions menu.

Warning

Deleting a VPN server immediately disconnects all clients and invalidates their configuration files. Clients will need new config files if a new server is created.

Example

Settings

The Settings page contains system preferences, account management, and advanced tools. Navigate to System > Settings. The page is organized into tabs: General, Password, SSH Keys, Activity, Logs, Backup, and Advanced.

General

Updates

When a firmware update is available, a “vX.Y.Z released!” panel appears at the top of the General page. Expand it to view release notes before updating. See Updating for the full update procedure.

Preferences

• Theme — System, Dark, or Light. System follows your browser or OS preference.
• Language — A dropdown for the web interface language. Available languages are English, Spanish, German, French, and Polish (English is the fallback). The choice is saved per-router (server-side) — there is no automatic browser-language detection.
• Timezone — A searchable combo box populated from the device, listing hundreds of IANA time zones (e.g. labelled like “(GMT-6) America/Denver”). It’s auto-detected from your browser during initial setup (falling back to UTC if detection fails). Changing the timezone restarts the schedule engine so that WAN Blackout and Wi-Fi Blackout windows fire at the correct local time. It also affects activity timestamps and log timestamps.

Theme and Language changes are previewed immediately when you select them, and saved when you click “Save”. If you leave the page without saving, the preview reverts to your saved settings.

Remote Access

Controls whether the web interface (and SSH) accepts connections arriving on the WAN port — ports 80, 443, and 22. Devices on your local network can always reach the web interface at router.lan, whatever this is set to.

To manage your router when you are away from home, use an Inbound VPN — this works regardless of the Remote Access setting. VPN clients join your network as local devices (with the access granted by their Security Profile), so once connected you browse to the web interface exactly as you would at home. No port forwards or address whitelists on the router are needed. If your router sits behind another router, forward the VPN’s WireGuard port on that upstream router; if your ISP uses CGNAT, inbound connections cannot reach your router at all — consider StartTunnel as a gateway.

The options control direct WAN-side access only:

• When behind NAT (default) — WAN-side connections are accepted only from private source addresses (RFC 1918 for IPv4, ULA for IPv6), and only while the router’s own WAN address is itself private. This is for routers that sit behind another router (e.g. an ISP box): devices on that upstream network can reach the web interface. From the public Internet, the web interface is never reachable in this mode — even if a public, globally routable address later appears on the WAN.
• Never — No WAN-side access at all, even from an upstream private network. The web interface is reachable only from the local network (including through an Inbound VPN).
• Always — WAN-side connections are accepted from any address. With a public IP, the web interface is reachable from anywhere on the Internet via the WAN IP or a Dynamic DNS domain.

Warning

Selecting “Always” exposes your router’s admin interface to the public Internet. Only use this if you understand the security implications and have a strong admin password.

Note

The ports Remote Access uses are protected from Published Ports: publishing 80, 443, or 22 to a device asks for confirmation first, and a device’s automatic port forwarding request for them is refused. Hostname routes are the exception — they share port 443 with Remote Access, each connection going to the device whose hostname it names and everything else to the router.

Security

• Download Root CA — Download the router’s Root CA certificate, saved as startwrt-ca.crt. See Trusting Your Root CA for installation instructions.

About

The General page shows an About block with the firmware Version and a Build identifier — the first 12 characters of the firmware’s git hash (hover to see the full hash). These are useful when filing bug reports.

Password

Change your admin password. The admin password protects the web interface and is separate from the Wi-Fi password.

1. Navigate to System > Settings > Password.

2. Enter your current password.

3. Enter and confirm your new password (minimum 12 characters).

4. Click “Save”.

SSH Keys

Manage the public keys authorized to access your router’s command line over SSH. See SSH Access for adding keys and connecting.

Activity

View a log of administrative actions taken through the web interface. Each entry shows:

• Status icon — Green check for successful actions, red X for failures.
• Timestamp — When the action occurred.
• Summary — A description of the action performed.
• Error details — If the action failed, the error message is shown below the summary.

Individual entries can be deleted, or click “Clear All” to remove the entire log. The list is paginated with 10 entries per page.

Logs

View real-time system logs streamed from the router via WebSocket. Useful for diagnosing network issues, monitoring VPN connections, or verifying firewall behavior.

Navigate to System > Settings > Logs to open the live log viewer. You can download the full log as a text file or scroll to the bottom to follow new entries in real time.

Backup

Download a backup of your router’s configuration, or restore from a previously downloaded one. See Backups for the full procedure.

Advanced

The Advanced tab contains power-user tools:

• Launch LuCI Interface — Opens the underlying OpenWrt LuCI admin panel in a new tab for direct access to low-level configuration.
• Download Support Diagnostics — Generates and downloads a diagnostic bundle for troubleshooting with Start9 support.
• Factory Reset — Erases all settings (excluding the sticker Wi-Fi password) and reboots the router. See Factory Reset for details.

Warning

Factory reset is irreversible. Create a backup first if you want to preserve your configuration.

SSH Access

Access your router’s command line over SSH for advanced troubleshooting, package management, or direct configuration. SSH accepts both password authentication (using your admin password) and public key authentication.

Warning

SSH provides root access to the underlying OpenWrt system. Misconfiguration can break networking, lock you out, or require a factory reset. Only use SSH if you are comfortable with the Linux command line.

Adding an SSH Key

1. Navigate to System > Settings > SSH Keys.

2. Click “Add SSH key”.

3. Paste your public key (the contents of ~/.ssh/id_ed25519.pub or ~/.ssh/id_rsa.pub). The key is labeled automatically from the comment at the end of the public key (e.g. user@hostname).

4. Click “Add Key”.

Tip

If you do not have an SSH key pair, generate one:

ssh-keygen -t ed25519

This creates a private key (~/.ssh/id_ed25519) and a public key (~/.ssh/id_ed25519.pub). Add the public key to StartWRT. Never share the private key.

Connecting

Once your key is added, connect from a terminal:

ssh root@router.lan

Removing an SSH Key

1. Navigate to System > Settings > SSH Keys.

2. Click the trash (Delete) button on the key’s row.

Note

Even with no SSH keys configured, you can still connect using your admin password.

Backups

Back up your router’s configuration so you can restore it after an update, factory reset, or hardware failure. Backups capture your settings — security profiles, Wi-Fi passwords, firewall rules, VPN configurations, SSH keys, and other customizations.

Creating a Backup

1. Navigate to System > Settings > Backup.

2. Click “Download Backup”.

3. A backup file will be downloaded to your computer.

Store the backup file in a safe location, such as a password manager or encrypted drive.

Tip

Create a backup before performing firmware updates. While the “Keep settings” path preserves settings, having a backup provides an extra safety net.

Restoring a Backup

1. Navigate to System > Settings > Backup.

2. Under “Restore Backup”, click “Choose File” and select the backup file from your computer.

3. Click “Restore”.

4. A confirmation dialog explains that all current settings will be overwritten and the router will reboot. Click “Restore & Reboot” to proceed.

The router will apply the configuration and restart.

Warning

Restoring a backup overwrites your current configuration entirely. Any changes made since the backup was created will be lost.

What Is Included

Factory Reset

A factory reset restores StartWRT to its default state at unboxing. There are two ways to reset: from the web interface (soft reset) or from a microSD card (reflash).

Soft Reset (Web Interface)

A soft reset erases the overlay filesystem where all configuration changes are stored, then reboots the router. The base firmware (read-only squashfs) is untouched — only your customizations are removed. The Wi-Fi password survives because it is re-read from the router’s EEPROM on boot.

1. Navigate to System > Settings > Advanced.

2. Click “Factory Reset”.

3. Confirm the action.

The router will reboot. After reboot:

• Wi-Fi works immediately using the original sticker password (re-read from the router’s EEPROM on boot).
• The admin password is cleared — you will be prompted to create a new one via the captive portal.
• All settings (security profiles, VPN configs, firewall rules, SSH keys, etc) are wiped.

Warning

A factory reset cannot be undone. Create a backup first if you want to preserve your settings.

Reflash (microSD)

A microSD reflash boots the router from a StartWRT image and replaces the firmware entirely. The router enters setup mode and brings up the StartWRT Wi-Fi network limited to a single client, with a captive portal that auto-opens the setup wizard.

1. Create a bootable microSD card — see Installing StartWRT.

2. Power off the router, insert the microSD card, and power it back on.

3. Connect to the StartWRT network via ethernet or by using the Wi-Fi password printed on the sticker. The captive portal opens the wizard automatically.

4. Choose a reflash path:

   • Keep settings — Keeps your settings, prompts for a new admin password, and replaces the firmware. Your configuration (including Wi-Fi and profile settings) is preserved. User-installed extra package binaries are wiped, so you will need to reinstall them — but their config files are retained. See also Updating.
   • Fresh Start — Wipes everything and installs a clean copy of StartWRT. You set a new admin password, and the timezone is auto-detected from your browser (you can change it later in Settings). After reboot, Wi-Fi comes back up automatically using the sticker password re-read from the router’s EEPROM — no Wi-Fi credentials are carried over from the old configuration. Equivalent to a factory reset plus a firmware reinstall.

5. When the wizard completes, power off the router, remove the microSD card, and power it back on.

Note

On a DIY or unprogrammed board with no Wi-Fi password in the EEPROM, the wizard is reachable over Ethernet only, and the reflashed router boots with no Wi-Fi until you add a Wi-Fi password in the web interface. See Installing StartWRT.

What Gets Wiped

The Wi-Fi password survives in every case. For Soft Reset and Fresh Start — which wipe the overlay — it is re-read from the router’s EEPROM on boot. With Keep settings, the existing Wi-Fi configuration (including any password you set yourself) is preserved as-is.

Lost Wi-Fi Password

The Wi-Fi password is printed on the sticker on the bottom of your router and stored in the router’s EEPROM. The EEPROM value is the password restored by a factory reset; during normal operation the active password is whatever is in the running configuration, so if you have replaced the Default entry with your own, that password is what’s in effect. If you are still logged in, you can also reveal or copy it on the Points of Entry > Wi-Fi > Passwords page (the Default entry). On a DIY or unprogrammed board that has no EEPROM Wi-Fi password, connect via Ethernet and set one in the web interface. See Installing StartWRT for details.

CGNAT (Carrier-Grade NAT)

CGNAT is a networking technique where your ISP places your home network behind an additional layer of NAT that you do not control. If your ISP uses CGNAT, several StartWRT features will not work.

What Is CGNAT?

Normally, your router is assigned a public IP address by your ISP. This allows devices on the Internet to initiate connections to your router, which can then forward them to devices on your LAN.

With CGNAT, your ISP does not give your router a public IP. Instead, many customers share a single public IP managed by the ISP’s equipment. Your router’s “WAN IP” is actually a private address on the ISP’s internal network. Because you don’t control the ISP’s NAT, no one on the Internet can initiate a connection to your router.

Who Is Affected?

CGNAT is common with:

• Satellite Internet — Starlink, HughesNet, Viasat
• Cellular/fixed wireless — T-Mobile Home Internet, Verizon Home Internet, and similar 4G/5G home broadband services
• Some fiber and cable ISPs — particularly in regions with IPv4 address shortages

Impact on StartWRT

CGNAT blocks all inbound connections to your router. This significantly limits StartWRT’s feature set:

• Inbound VPNs — VPN servers need to accept connections from the Internet. Behind CGNAT, remote devices cannot reach your router.
• Published Ports — IPv4 port forwarding requires a public IP and will not work behind CGNAT, whether you create the rule yourself or a device opens it through automatic port forwarding. The router has no way to detect CGNAT, so rules still show an “Active” status even though inbound IPv4 traffic never arrives. IPv6 forwarding may still work, since many CGNAT ISPs provide globally routable IPv6.
• 6in4 tunnels — The protocol a 6in4 tunnel rides on cannot pass through the ISP’s NAT, so an IPv6 tunnel broker is not a way around CGNAT.
• Dynamic DNS — DDNS maps a domain to your IP, but if that IP is behind CGNAT, the domain still cannot receive inbound connections.

CGNAT does not affect:

• Local network access — Devices on your LAN connect directly, bypassing the ISP entirely.
• Outbound VPNs — Outbound connections are not blocked by CGNAT.
• All other StartWRT features — Security Profiles, Wi-Fi management, Ethernet configuration, WAN Blackout, and backups work normally.

The Solution: StartTunnel

StartTunnel is a virtual private router (VPR) — a minimal, self-hosted router that runs on a VPS with a public IP address. Your devices connect outbound to the VPS, and the VPS accepts inbound connections on their behalf. Because the VPS has a real public IP, CGNAT is completely bypassed.

How to Check

Compare your router’s WAN IP with your actual public IP:

1. In StartWRT, navigate to Internet > WAN Settings and note your WAN IP address.

2. Visit a site like whatismyip.com from a device on the same network.

3. If the two addresses match, you are not behind CGNAT. If they differ, you are likely behind CGNAT.

Tip

Another indicator: if your router’s WAN IP is in the 100.64.0.0/10 range (100.64.x.x through 100.127.x.x), that is the CGNAT address block defined by RFC 6598 and confirms you are behind CGNAT.

Note

Some ISPs offer a way to opt out of CGNAT, either through a support request or by purchasing a static IP add-on. Check with your ISP before assuming CGNAT is permanent.

Architecture

StartWRT is a router operating system built on OpenWrt with a custom Rust backend and Angular web interface. It reimagines the router experience by abstracting raw networking primitives — VLANs, firewall zones, subnets, routing tables — behind the Security Profile model. The result is enterprise-grade network segmentation that anyone can configure in minutes.

What StartWRT Adds to OpenWrt

OpenWrt is a powerful open-source router OS, but it exposes raw networking primitives through its LuCI interface. Configuring VLANs, firewall zones, and multi-password Wi-Fi requires understanding how these systems interact at a low level. StartWRT keeps OpenWrt’s battle-tested networking stack and adds:

• Security Profiles — A single abstraction that replaces manual VLAN, firewall, subnet, and routing configuration. One click creates an isolated network segment with its own DHCP, DNS, firewall rules, and VPN routing.
• Multi-password Wi-Fi — One SSID with multiple passwords, each mapping to a different Security Profile. No separate SSIDs, no manual VLAN tagging.
• VPN chaining — Route traffic through multiple VPN providers in sequence for multi-jurisdictional privacy.
• Automatic port forwarding — Devices you permit open their own port forwards over the standard UPnP and PCP protocols, and several devices or services can share one external port through TLS hostname (SNI) routes. Off by default, granted per device.
• Modern web interface — A purpose-built Angular UI that manages the full router configuration without requiring CLI knowledge. The underlying OpenWrt CLI and LuCI remain available for advanced users.
• OTA updates — Firmware updates delivered through the web interface.

How It Works

StartWRT has three components:

• OpenWrt — The base operating system. Handles kernel-level networking, Wi-Fi drivers, and package management.
• Rust backend — A single binary (startwrt) that runs as the RPC server and CLI. It manages all configuration, service reloads, TLS certificates, authentication, and system operations.
• Angular frontend — A single-page application embedded in the backend binary. Communicates with the backend over JSON-RPC 2.0.

All persistent configuration lives in UCI files under /etc/config/ — the same configuration system used by stock OpenWrt, with no separate configuration database. The backend reads and writes these files atomically, so the CLI, LuCI, and the StartWRT web interface all share a single source of truth. (The activity log and login sessions are stored separately under /etc/startwrt/, outside the UCI config system.)

Security Profile Internals

When you create a Security Profile, the backend orchestrates changes across multiple UCI config files:

This is why the web interface never exposes raw VLANs or firewall rules — the profile abstraction handles all of it consistently. StartWRT’s firewall is built on fw4/nftables, so any custom firewall rules you add must be written as nftables (fw4) rules.

Automatic Port Forwarding Internals

The backend runs a PCP server and a UPnP Internet Gateway Device on the LAN side. A request is honored only from a device whose Allow automatic port forwarding permission is on — stored as a flag on the device’s entry in the dhcp UCI config — and only when it arrives from the network that device is on. Granted forwards are written to the firewall UCI config as tagged redirects, so they survive reboots and never collide with manual Published Ports rules; their leases live in memory and the router removes a forward when its lease runs out or its device gives up the address. Hostname routes are not persisted: the router reads the TLS hostname of each connection on the shared port with an nftables divert and hands the connection to the owning device, and the device re-registers its routes after a restart.

Network Isolation

Device isolation uses bridge VLAN filtering at Layer 2. Each Security Profile is assigned a unique VLAN ID. Traffic is tagged at the entry point (Ethernet port, Wi-Fi password, or VPN server) and can only reach destinations within the same VLAN unless the firewall explicitly allows inter-zone traffic.

Multi-Password Wi-Fi

StartWRT’s multi-password Wi-Fi uses WPA2’s identity PSK feature with dynamic VLAN assignment. Each password in the PSK file is associated with a VLAN ID. When a device authenticates, the router matches the password, looks up the VLAN, and places the device on the correct network segment — all transparently.

Security

• Admin password — Stored as a SHA-512 hash in /etc/shadow
• Wi-Fi password — Printed on the sticker and stored in the router’s EEPROM
• Sessions — Random token with 1-day expiry; HTTP-only SameSite=Strict cookie
• Rate limiting — 3 login attempts per 20 seconds
• SSH — Public key authentication or password auth (Admin password)
• TLS — rustls with a Root CA certificate chain

TLS and Certificates

Certificate generation is delegated to the StartOS SSL primitives. The trust chain uses a root CA whose CN is “StartWRT Local Root CA” followed by a short random hex token — unique to each freshly-minted CA, so a reflashed router gets a distinct trust anchor rather than colliding with a previously trusted one — and an intermediate CA with CN “StartWRT Local Intermediate CA” (both with Organization “Start9” and Organizational Unit “StartWRT”). The issued server certificate carries a default SAN of router.lan. The web server hot-reloads its TLS certificate when the LAN IP changes, so no restart is required. See Trusting Your Root CA for installation steps.

IPv6

Each router generates a unique per-device ULA /48 prefix at first boot. This ensures that chained StartWRT routers never collide on the same ULA range.

Source Code

The StartWRT source code lives in the start-technologies monorepo, alongside the other Start9 products.

To report bugs or request features, open an issue.

Hardware

The Start9 router is built on the SpacemiT K1, an eight-core RISC-V processor. This page publishes the K1 schematic the router’s board descends from, and records where the router you own differs from it.

Specifications

Schematic

SpacemiT K1 reference schematic (PDF, 28 sheets)

This is SpacemiT’s SPACEMIT-K1_LP4XP200_32X1 design, revision V3.0, dated April 2024. It documents the power tree, the clock and GPIO maps, the processor, memory and storage, and the peripheral interfaces the K1 supports. StartWRT boots the k1-x_deb1 device tree, which describes this same design.

Why It Differs From Your Router

A schematic is a design document, not a parts list for the unit on your desk. Two ordinary things put distance between the two.

A reference design carries every option; a product populates a subset. The schematic draws every interface the processor can drive, so that anyone building on the K1 can see how each one is wired. A finished product fits only the parts it uses. Nothing is removed from the drawing — the rest is simply never populated.

Parts get substituted. Regulators, transistors and passives are second-sourced routinely, and a pin-compatible replacement drops into the same footprint without anyone redrawing a sheet. Memory is the most visible case: capacity variants of one package are interchangeable, so the density printed on a schematic is not necessarily the density installed.

Note

Read the schematic as documentation of the platform, not as a bill of materials for your router.

Notable Differences

What the Schematic Does Not Cover

The schematic shows how components connect. It is not the circuit board layout: it does not include the copper artwork or the layer stackup, nor the bill of materials naming the specific parts fitted to a production run.

FAQ

Answers to common questions about StartWRT’s features, security model, and compatibility.

What is StartWRT?

StartWRT is a router operating system built on OpenWrt, designed specifically for home-based self-hosting. It replaces traditional networking concepts (VLANs, firewall rules, routing tables) with Security Profiles — a simple model where how a device connects determines what it can access.

How is StartWRT different from stock OpenWrt?

Stock OpenWrt exposes raw networking primitives through the LuCI interface, requiring users to understand VLANs, firewall zones, and routing tables. StartWRT abstracts all of this behind Security Profiles and provides a modern web interface that makes advanced features accessible without CLI expertise. Under the hood, StartWRT still uses OpenWrt’s networking stack — the difference is entirely in the management layer.

How does multi-password Wi-Fi work?

StartWRT uses WPA2’s identity PSK feature. A single SSID (StartWRT) accepts multiple passwords, each mapped to a different Security Profile. When a device connects, the router identifies which password was used and places the device on the corresponding VLAN and subnet automatically. See Wi-Fi for details.

Is VPN chaining really more private?

Yes, with caveats. VPN chaining routes traffic through multiple providers so that no single provider sees both your identity (home IP) and your destination. However, if the providers collaborate or are compelled by law enforcement across jurisdictions, correlation is still theoretically possible. For most users, the practical benefit is significant — especially when chaining providers in different legal jurisdictions. See Outbound VPNs for setup instructions.

Does StartWRT work with my ISP?

StartWRT supports DHCP, static IP, and PPPoE WAN connections, which covers the vast majority of ISPs. If your ISP uses CGNAT, you can still use all local features, but inbound connections (VPN servers, port forwarding) will not work. See CGNAT to learn more and check if you are affected.

Can I still use the OpenWrt CLI?

Yes. StartWRT is built on OpenWrt, and the full CLI is accessible over SSH. You can use apk to install packages, edit UCI files directly, and run standard Linux networking tools. Changes made via the CLI are respected by the web interface.

What happens if I forget my admin password?

You have two options:

1. Factory reset — Perform a factory reset from the web interface (if you are still logged in). This wipes all settings but preserves the Wi-Fi password.
2. Reflash — Boot from a microSD card and choose “Keep settings” to reinstall the firmware while preserving settings. You will be prompted to create a new admin password. See Installing StartWRT.

What if I lose my Wi-Fi sticker password?

The Wi-Fi password is printed on the sticker on the bottom of the router and stored in the router’s EEPROM — it can also be displayed in the StartWRT GUI on the WiFi tab as the Admin Profile ‘Default’ label. The EEPROM value is only re-read on a factory reset; if you have replaced the Default password with your own, that new password is what’s in effect. On a DIY or unprogrammed board with no EEPROM Wi-Fi password, connect via Ethernet and set one in the web interface. See Installing StartWRT for the full procedure.

Why doesn’t one of my profiles have IPv6 Internet access?

If your ISP delegates only a single IPv6 prefix (for example, a /64), that prefix is assigned to your primary LAN. Non-admin Security Profiles routed Direct to the Internet then receive only a local-only ULA address and have no global IPv6 connectivity — IPv4 still works normally. To give such a profile global IPv6, route it through an IPv6-capable Outbound VPN, or ask your ISP for a larger prefix delegation (such as a /56 or /48).

Does StartWRT phone home or collect telemetry?

No. StartWRT has no telemetry, no analytics, and no phone-home behavior. For full transparency, these are the outbound connections the router itself initiates:

• Time synchronization (NTP) — Enabled by default. The router keeps its clock accurate by querying the openwrt.pool.ntp.org servers.
• Update checks — Whenever you load the web interface while logged in, it checks for newer firmware releases so it can notify you. Installing an update always requires your explicit action — StartWRT never updates automatically, and you can also update entirely offline by reflashing from a microSD card. See Updating.
• Dynamic DNS — Only if you have configured a DDNS provider, the router periodically registers its public IP with that provider.

Can I use StartWRT with StartOS?

Absolutely. StartWRT and StartOS are complementary products. StartOS runs your self-hosted services; StartWRT handles the networking. Together, they provide a complete self-hosting stack with proper network isolation, VPN access, and port forwarding — all without touching the command line. Turn on Allow automatic port forwarding for the server on its device page and StartOS opens and renews the ports its services need by itself, including hostname routes that let several services with their own domains share port 443.

Why can’t my StartOS server or game console open ports on its own?

Automatic port forwarding (UPnP/PCP) is off for every device until you allow it. Open the device’s detail page and turn on Allow automatic port forwarding. A device can only ever forward ports to itself, and the router refuses requests for ports a manual Published Ports rule or the router itself uses — remote access to its web interface, SSH, or an inbound VPN. See Automatic port forwarding.

Where can I report bugs or request features?

Open an issue on the start-technologies GitHub repository — StartWRT lives in the monorepo alongside the other Start9 products.