Getting Started with the LuCI Web Interface

Access LuCI for the first time

LuCI runs on the router and is reachable at the router's LAN IP, which defaults to 192.168.1.1. Connect your computer to a LAN port, set your network to DHCP, and open http://192.168.1.1 in a browser.

On a fresh install there is no root password. Log in as root with an empty password, then immediately visit System → Administration to set one.

• Default address: 192.168.1.1
• Default user: root, no password
• Set a password before doing anything else

The Status overview

The Status page shows the router's uptime, load average, memory and flash usage, and the active DHCP leases. It is the first place to check when something feels wrong — high load, a full overlay, or a missing WAN address all show up here.

Status → Routes shows the routing table. Realtime Graphs (traffic, CPU and memory) is part of the default LuCI. The optional `luci-app-statistics` package adds historical Statistics graphs instead.

Network interfaces

Network → Interfaces is where you configure the WAN, LAN and any additional networks. Each interface has a protocol (DHCP, PPPoE, static), a device (physical port or VLAN), and firewall zone assignment.

For most home setups the WAN interface obtains an address from the ISP over DHCP, and the LAN interface serves 192.168.1.1 with a DHCP server for your devices.

• WAN: connects to your ISP (DHCP, PPPoE, or static).
• LAN: your local network, runs a DHCP server.
• Additional interfaces (guest, IoT) are created here and assigned to firewall zones.

Wireless configuration

Network → Wireless lists every radio. OpenWrt disables Wi-Fi by default for security. To enable a network, click Edit on a radio, set the mode to Access Point, choose an SSID, set encryption to WPA2-PSK (or WPA3 if your clients support it), enter a passphrase, and check the "Enable" box.

For dual-band routers, configure the 2.4 GHz and 5 GHz radios separately. The 5 GHz radio often requires you to pick a country code first, since regulatory domains determine allowed channels and power.

uci set wireless.radio0.country='US'
uci set wireless.@wifi-iface[0].encryption='sae-mixed'
uci set wireless.@wifi-iface[0].key='your-passphrase'
uci commit wireless
wifi

Equivalent UCI commands for setting the country, encryption and passphrase. `wifi` reloads the wireless stack.

Firewall and zones

Network → Firewall groups interfaces into zones and defines the rules between them. The default setup has a lan zone (accept everything) and a wan zone (drop incoming, allow outgoing). Traffic from lan to wan is forwarded; traffic from wan to lan is rejected.

When you add a new interface (for example a guest network), create a matching firewall zone and set the forwarding rules. To let guests reach the internet, allow forwarding from the guest zone to the wan zone but not to the lan zone.

• lan → wan: forward allowed (LAN can reach the internet).
• wan → lan: reject (no unsolicited inbound traffic).
• Guest → wan: forward allowed; guest → lan: reject.

Installing packages

System → Software lets you install additional packages from the OpenWrt package feeds. Click "Update lists" to refresh the package database, then search for the package you need.

Common packages include `luci-app-sqm` for traffic shaping, `luci-app-upnp` for UPnP, and `adguardhome` for ad blocking. Packages take space in the flash overlay; on routers with 8 MB or less flash, choose carefully.

apk update
apk add luci-app-sqm

OpenWrt 25.12 and later (apk). On OpenWrt 24.10 and earlier use `opkg update` and `opkg install luci-app-sqm`.

Backup and restore

System → Backup → Generate archive downloads a tarball of your configuration. Keep this file safe; restoring it after a reflash brings back all your settings.

Before upgrading to a new OpenWrt release, generate a backup. After the upgrade, restore the archive and reinstall any extra packages.