Set Up OpenWrt Secondary Router with OpenClash & IPv6

A secondary router network architecture lets you run an OpenWrt secondary router alongside your main router. You point specific home devices to this secondary gateway to route internet traffic through custom proxy rules via a dedicated US server.

Incorrect configurations easily create routing loops and expose unencrypted ipv6 DNS leaks. You can fix these issues while maintaining full proxy controls across your local network.

You need to execute four key setup milestones for stability. First, assign a static IP address to your OpenWrt hardware. Next, disable the secondary DHCP server. Then, enable OpenClash in Meta TUN mode for total traffic control through the US server. Finally, configure an NDP proxy to handle dual-stack routing properly. An OpenWrt secondary router handles OpenClash effectively with this approach.

Key Takeaways

• Assign a static IP address to your secondary OpenWrt router within your main network subnet.
• Disable local DHCP servers on the secondary router to prevent network IP address conflicts.
• Enable OpenClash Meta TUN mode to direct all local device traffic through custom proxy rules.
• Configure custom DNS settings to prevent unencrypted DNS request leaks and avoid routing loops.
• Setup NDP proxy or relay mode to process dual-stack IPv6 traffic safely on your network.

Flashing OpenWrt Firmware for Secondary Router

Preparing OpenWrt Firmware Installation

Hardware platforms like mini-PCs or target devices running OpenWrt on Raspberry Pi need a clean system image. Flashing OpenWrt firmware demands absolute file integrity to prevent standard startup failures. You must obtain official factory builds or a customized OpenWrt firmware image compiled specifically for your architecture.

You must verify image files before starting your firmware flashing process. Corrupted installation files cause unrecoverable booting errors during initial setup.

1. Download the correct OpenWrt firmware image for the router model from the official OpenWrt website.
2. Find the MD5 checksum listed on the OpenWrt website for that firmware file.
3. Calculate the MD5 checksum of the downloaded firmware file using a checksum utility.
4. Compare your calculated checksum with the official MD5 checksum.
5. If the checksums match, the firmware file is not corrupted and is safe to flash; if they do not match, do not flash the file.
6. Apply the same verification before flashing a secondary router to prevent corrupted installation.

Write the verified image onto your storage drive before flashing your system using tools like BalenaEtcher. Insert the prepared storage drive into your hardware and power up the system.

Initializing OpenWrt Secondary Router Network

You must reconfigure local network parameters right after bootup. An OpenWrt secondary router requires a static IP address within the primary router subnet. You edit /etc/config/network via SSH to change default network settings. Point your default gateway address directly to the IP of your main router.

You must stop local address distribution to prevent DHCP conflict issues across your network. Edit /etc/config/dhcp to modify service settings. Explicitly set option dhcpv4 'disabled', option dhcpv6 'disabled', and option ra 'disabled' for the LAN interface.

uci set dhcp.lan.dhcpv4='disabled'
uci set dhcp.lan.dhcpv6='disabled'
uci set dhcp.lan.ra='disabled'
uci commit dhcp
/etc/init.d/dnsmasq restart

This step completes the basic background work. Your OpenWrt based firmware now functions safely inside your main network without generating routing errors. Flashing operations finish smoothly, allowing you to move toward proxy configuration.

OpenClash Setup on Secondary Router

OpenClash TUN Mode Configuration

You can deploy OpenClash on your secondary gateway to gain complete control over network traffic. You must prepare all system software dependencies first before you install openclash on your hardware unit. Access your web management interface, open the software management menu, remove the standard dnsmasq package, and install dnsmasq-full. This package replacement provides essential support for custom DNS routing rules. Run the command below inside your shell terminal session to install openclash dependencies without missing any required software libraries.

opkg update && opkg install bash dnsmasq-full curl ca-bundle ip-full ruby ruby-yaml kmod-tun kmod-inet-diag unzip kmod-nft-tproxy luci-compat luci luci-base

Upload the downloaded software package file to your openwrt setup environment. You might see a temporary browser XHR error notification during package upload. You can safely ignore this display error and refresh your browser web page. Open the openclash plugin dashboard inside the services menu. Select the Meta kernel option during initial system configuration. The Meta core delivers complete layer 3 traffic interception across your entire local network.

1. Add your provider subscription URL into the profile management section.
2. Select the Clash agent option and save your subscription profile.
3. Enable the main service toggle switch to initiate the core download process.
4. Monitor the kernel download progress in your live system runtime logs.
5. Switch the download link to a CDN mirror address if the transfer stalls.

The OpenClash Meta core creates a dedicated TUN virtual network interface on your system. TUN mode intercepts all incoming network packets at network layer 3 directly. TUN mode routes network packets smoothly without requiring complex application proxy setups or individual client configuration. This configuration ensures stable processing performance for all connected client devices across your home network.

Custom DNS and Hijacking Prevention

Proper DNS settings prevent unencrypted domain queries from leaking to your internet service provider. OpenClash offers two primary DNS modes for handling client query traffic. You must choose the right operational mode to stop local domain hijacking without breaking internal server network requests.

You should adjust option settings inside the OpenClash DNS configuration menu carefully. Enable the custom DNS server switch to override default system resolvers. Add the local management IP address of your openwrt hardware system into the local DNS server list. This specific configuration stops infinite DNS routing loops between your secondary gateway device and your primary router.

Disable the local DNS hijacking toggle inside fake-IP mode if you maintain active dynamic DNS services on your home network. This specific setting preserves local domain name resolution while proxying external internet requests reliably. Review your live runtime logs after saving your modified settings. Your openclash system will handle all client traffic while preventing unencrypted DNS leaks completely.

IPv6 Configuration for OpenWrt Dual-Stack

Configuring NDP Proxy and Prefix Delegation

You must choose the correct setup for dual-stack operations based on your upstream network. Upstream networks assign address prefixes using different methods. Some internet providers assign a full prefix delegation, while other providers only give a single /64 prefix to your main gateway. You need to adjust your /etc/config/dhcp options to match these upstream network conditions.

Use DHCP relay mode when your main gateway receives prefix delegation and assigns individual addresses across the network. Devices behind your secondary hardware get an official ipv6 address from the delegated prefix in this mode. You configure the upstream interface as master and set all services to relay.

Switch to NDP proxy mode when your provider offers only a single /64 subnet without prefix delegation. NDP proxy passes address discovery packets between local interfaces. This mode lets connected devices share the single subnet while maintaining direct internet access.

Apply these settings inside your /etc/config/dhcp file to enable the relay functionality. You save the file and restart the dnsmasq service to apply your changes.

Routing IPv6 Traffic in OpenClash

You must configure openclash to handle dual-stack packets after setting up your network interfaces. Modern client software requests dual-stack connectivity by default. Your gateway will leak unencrypted DNS requests or bypass proxy rules if you leave dual-stack features disabled inside your proxy kernel.

Open your system browser and navigate to the proxy control panel. Find the main IPv6 switch inside the global configuration panel and toggle the switch to the active state. This step tells the Meta kernel to intercept dual-stack traffic alongside standard network packets.

Enabling IPv6 inside openclash prevents client devices from dropping back to unencrypted direct connections.

Next, open the custom DNS menu to review your active settings inside openclash. Enable the custom IPv6 DNS option and enter secure DNS resolvers into the list. The Meta core resolves dual-stack domain names through encrypted proxy channels with this configuration.

You must also check your TUN mode options inside openclash. Select the native IPv6 TUN mode option to create a virtual adapter for dual-stack routing. This setup intercepts incoming packets at layer 3 and applies your rule set directly.

Finally, verify your rule set definitions inside openclash. Ensure your rules direct dual-stack requests to proxy groups with working external nodes. Save your current configuration and restart the core process to complete the setup. Your openwrt gateway now filters network queries correctly while protecting system privacy across all active connections.

Client Testing and Network Optimization

Assigning Clients to Bypass Gateway

You must configure your target devices to route traffic through the openwrt secondary router. Manually assigning system parameters on individual devices offers the most reliable control over network traffic.

To assign client devices to an OpenWrt bypass gateway, configure each client manually with a static IP address and set its default gateway to the OpenWrt device’s IP. This prevents clients from changing ARP entries and forces their traffic through the bypass gateway. A forum user confirmed that devices can still receive IPs from the main router, and after manually setting the gateway to the GL-MTxxxx IP, all traffic is routed through the GL device.

You can also adjust parameters on your primary hardware or local setup to handle device addresses automatically. You should review your network configuration settings to manage local options cleanly:

• Manual gateway settings: The option gateway and option dns entries inside system configuration files direct local network traffic directly to your chosen hardware address.
• Gateway-IP DNS: Local client devices use the primary gateway address as their DNS destination, which forwards client traffic through proxy rules smoothly.

Verifying Proxy and IPv6 Leak Prevention

You need to test your client connections after completing the basic setup. Open your web browser on a connected target device and visit an online IP checking service. Your browser screen should display the IP address of your active proxy node. Open the dashboard inside openclash to view active client connections in real time. The runtime dashboard confirms that openclash intercepts local traffic properly at network layer 3.

Finally, test your system against unencrypted address leaks. Visit a dedicated address testing website to verify your ipv6 connection security. The online test must show that your personal location remains hidden behind secure rules. Proper openclash core settings stop direct unencrypted DNS queries from reaching outside servers. Your home network now routes data safely through openclash while preserving privacy across all active interfaces.

You successfully integrated OpenClash with dual-stack ipv6 routing on your openwrt secondary router environment. You should audit your local client settings regularly. Verification ensures that device traffic passes through proxy rules without bypassing proxy boundaries. OpenClash processes every DNS request securely.

When an upstream link outage drops your delegated prefix, execute these commands to restore normal connectivity:

1. Restart the interface using ifdown wan6 && ifup wan6.
2. Issue a renewal command using ubus call network.interface.wan6 renew.
3. Create /etc/hotplug.d/iface/99-fix-pd-renew to send SIGUSR1 to odhcp6c when reachability tests fail.

These custom network settings keep your main network safe and reliable.

FAQ

Why you cannot access openwrt web interface after network setup?

You set an IP address outside your main router subnet. Assign a manual static IP address to your computer network adapter within the target subnet. This connection change restores access to your dashboard.

Why openclash fails to start on your gateway device?

Missing system dependencies or core download failures cause startup errors. You must install dnsmasq-full before launching openclash. Check your internet connection or switch kernel download links to a mirror site.

What steps help with troubleshooting common issues like IPv6 DNS leaks?

Enable native IPv6 TUN mode inside your proxy panel. Configure custom IPv6 DNS servers to encrypt dual-stack queries. This setup prevents client devices from sending unencrypted domain queries directly to your internet provider.

Why should you deploy an openwrt secondary router on your network?

An openwrt secondary router handles heavy encryption rules without overloading your primary router. You can direct specific home devices through custom proxy routes while maintaining stable network speeds across your standard connections.