added diffutils to the build and saved a backup of .conf. 

Question: We could save the script and add to the /root directory for each build. Do you think it would be best to use uci-defaults to copy the script to the /root directory?

I've put scripts in the uci-defaults directory which execute the first time the system comes up, but wasn't sure about how to handle a script to copy it to a directory without executing it. Maybe zip the script and create a quick script to unzip and copy over to the /root directory on first boot.

(Last edited by davidc502 on 25 Aug 2017, 01:13)

Something like files/usr/sbin/script.sh. Give it correct mode 755 and it will be executable on the running image.

My friend...  I have version 1.9.5.7 with plugins enabled ( from @davidc502 's latest release ) . I've found that , even tough the blacklisting is configured, along with the logging, all of the computers on my network are able to access the blacklisted addresses...

Even weirder , the entry is logged into the blacklist-log as if it was blocked, but it is not... is there a chance I have any kind of "leak" somewhere? I've ran a dnsleak test and it is showing i'm not, just one dns showing up, and is the one I've chosen...

Thanks in advance for any suggestions!

Thanks for adding diffutils! 

I always just put my scripts in the root directory and launch them with "sh nameofscript.sh" and make an entry in Backup and Restore to backup for example /root/nameofscript.sh so it will be saved in the backup when I upgrade/flash to a newer build.

All I ever knew was that /root/.profile script is started once every-time SSH is loaded.

So scripts in the uci-defaults directory only execute the very first time the system is loaded after flashing a new build?  If they only run once on the very first boot after flashing a new image, then your idea of zipping it up and making a small script that unzips it to /root/ would indeed be a good idea.

Edit: The link that @Villeneuve posted seems like an easier way to add custom files/scripts to your build.  Wouldn't have to go through the process of zipping it up and making a script to unzip it to /root/.  From what it sounds like, you would just have to put the script in the <buildroot dir>/files/root/ directory before building.

(Last edited by starcms on 25 Aug 2017, 04:35)

I personally have never used dnscrypt for blacklisting...I use adblock for that.  Sorry I can't be of more help.  But I believe others have, so hopefully someone will jump in and be able to help.

Edit: Just to make sure you don't have a leak, and that everything is passing thru dnscrypt, please check the following settings in LuCi:

Under Network ---> DHCP and DNS:

In the General Settings Tab: In the DNS Forwardings Box(es) make sure you only have the IP(s) of your dnscrypt instances and the entry to allow ntp (auto-time sync) to bypass dnscrypt.  So assuming you have one resolver set up and are using the default port, you should have 127.0.0.1#5353 in the first box and /pool.ntp.org/208.67.222.222 in the second box.  The order of the boxes is important.  The dnscrypt proxy instance(s) should be first and the ntp entry should be last.

In the Resolv and Hosts File Tab: Make sure the Ignore resolve file box is checked.  This is very important.

If all of that is correct, then you definitely don't have a leak meaning that all DNS traffic is passing thru dnscrypt-proxy.  So no idea why the blacklist isn't working, but as I said, I have never used the dnscrypt blacklist, so I can't really help there.  If you are running Windows, open a command prompt and try "ipconfig /flushdns" to flush your DNS cache and then try again.  Maybe it will be blocked now?  If none of the above helps, you could always open an issue on the dnscrypt-proxy github page.

(Last edited by starcms on 25 Aug 2017, 10:09)

Thanks @starcms!! Your tips made me go into the dnsmasq config file and discover that I had manually put in 8.8.8.8 as the  resolver there! I did that one day when dnscrypt was not resolving well ...  My issue is fixed now.

I've read that you recommended having a 2nd dnscryt resolver enabled, i'll do that as a failover too.

Thanks for sharing and collaborating, as always!

That would do it   Glad to be of help!

And I do highly recommend having a second dnscrypt resolver enabled in case the first one goes down. If your first one is on 127.0.0.1#5353 (the default), put the second one on 127.0.0.1#5454.  But be sure the entry for /pool.ntp.org/208.67.222.222 is below both of them in the /etc/config/dhcp (dnsmasq config) file.

Just a heads up though: If you enable a second resolver, sometimes it will use the first and sometimes it will use the second.  It won't only use the second if the first is down.  No way to make it always use the first; if both are up and working, it will sometimes use the first and other times use the second.  But if both resolvers are good, high quality, and support the features you want (such as no-logging and DNSSEC) it doesn't really matter.

I use and recommend soltysiak and dnscrypt.nl-ns0 since they both FULLY support both DNSSEC and IPv6, along with no-logging, and are not located in the US. (soltysiak will most likely one day be renamed to dnscrypt.pl -- pl for poland, nl for netherlands; they are both operated by the same group of people).  They also both have websites for support and last time I checked, each had an uptime of over 99.9%

(Last edited by starcms on 25 Aug 2017, 18:12)

I don't know where to post this and I'm not trying to hijack this thread but this thread is where I learned of this build.  I have, just today, flashed this build to my WRT1900AC.  I am trying to figure out how to setup the OpenVPN so that I can access my router remotely and have access to my home network.  I see custom_config, sample_server and sample_client but have no idea how to set any of this up and what any of this means.  I have easily been able to do this in DD-WRT with username/secret but want to give OpenWRT a try.  All I want to do is access my home network securely.  I was used to using PPTP in DD-WRT but my understanding that it is not secure. Any guidance or article explaining how to use these options with this would be very helpful.  Thank you!

Does anyone else have issues with 40mhz not working on 2.4ghz?

Does me using 80mhz on 5ghz have anything to do with it? Thanks

You have to modify a config file to enable 40mhz on 2.4ghz.  It has nothing to do with 5ghz being at 80mhz.  Let me see if I can find the setting for you...

However, unless you live way out in the country, there will be so much interference on 2.4ghz that you may actually experience slower speeds at 40mhz compared to 20mhz.

Edit: You have to edit your /etc/config/wireless file and add the line:

option noscan '1'

under " config wifi-device 'radio1' " (if you have a mamba, 1900AC V1 model, it may be need to be placed under "config wifi-device 'radio0' " instead.  You'll know you got the right one if the option for channel number is between 1 and 11).  Be sure to place it under " config wifi-device 'radio1' " and not under " config wifi-iface 'default_radio1' ".  Again, it should be placed in the section where you see "option channel 'x' " with x being a number between 1 and 11.

If this still doesn't get it working, there is one more thing you will need to do that is a little more complicated, but not much.  Add that line, reboot your router, and if it still isn't working on 40MHz on 2.4GHz let me know and I'll show you the other step. 

However, what model router do you have?  If you have a 1200AC V2, 1900ACS V2, or 3200ACM and adding the noscan 1 option doesn't work, there is nothing else that can be done.  NEVERMIND, I just saw your signature.  With the 1900AC V1, if the second step is necessary, it can be done pretty easily.  However, since you do have the 1900AC V1, I'm not sure if the noscan 1 option belongs under config wifi-device 'radio1' or 'radio0'.  As I said before, look at the option for the channel number to be able to determine which is the 2.4GHz radio and be sure to put it under that one.

(Last edited by starcms on 26 Aug 2017, 02:49)

Hi, Does anybody else on 1900AC v.1 has local network speed limited to 100Mb and not 1Gb? Can't get more than 12 Mb/s speed transfer over local network (iMac to NAS, ethernet only enabled on iMac).
Using jumbo 9000 doesnt change anything. NAS automatically set ethernet speed to 100Mb. Prevous release didn't have this issue.

Thanks.

I owned the 1900v1 for quite some time, and local LAN speeds are as advertised.  There's a bottleneck on the iMac or NAS. 

What kind of NAS do you own?

*EDIT*
Thinking about this, it seems one of the 2 devices is connecting at a link speed of 100mbps.

(Last edited by davidc502 on 26 Aug 2017, 16:54)

I've got Synology. I haven't had this issue with previous release. No changes were made on imac or NAS. Don't think this related to my devices. I remember that year ago I've had similar issue with one of the releases of Lede/OpenWRT.

Lets take a look and see if one of the ports has negotiated a lower speed.

Please run the following commands, and post the results.

With the command below we just want to verify "switch0"
root@lede:~# swconfig list
Found: switch0 - 10.mvsw61xx

Run the next command to show switch0
root@lede:~# swconfig dev switch0 show

For the 1900ac look for Ports 0 through 3, and check against the ports the imac and NAS are plugged into.

(Last edited by davidc502 on 26 Aug 2017, 19:43)

root@RRouter:~# swconfig list
Found: switch0 - 1000000003.mvsw61xx

root@RRouter:~# swconfig dev switch0 show
Global attributes:
    enable_vlan: 1
Port 0:
    mask: 0x0000: (0)
    qmode: 3
    pvid: 1
    link: port:0 link:up speed:100baseT full-duplex
Port 1:
    mask: 0x0000: (1)
    qmode: 3
    pvid: 1
    link: port:1 link:down
Port 2:
    mask: 0x0000: (2)
    qmode: 3
    pvid: 1
    link: port:2 link:up speed:1000baseT full-duplex
Port 3:
    mask: 0x0000: (3)
    qmode: 3
    pvid: 1
    link: port:3 link:down
Port 4:
    mask: 0x0000: (4)
    qmode: 3
    pvid: 2
    link: port:4 link:up speed:1000baseT full-duplex
Port 5:
    mask: 0x0000: (5)
    qmode: 3
    pvid: 1
    link: port:5 link:up speed:1000baseT full-duplex
Port 6:
    mask: 0x0000: (6)
    qmode: 3
    pvid: 2
    link: port:6 link:up speed:1000baseT full-duplex
VLAN 1:
    port_based: 0
    vid: 1
    ports: 0 1 2 3 5
VLAN 2:
    port_based: 0
    vid: 2
    ports: 4 6

Many thanks, David.

Just plugged NAS' cable to the different router port and its working now. Don't know if this port 0 is broken or smth else.

@Rafkat

We can see the port0  which is furthest to the left, on the 1900ac, has negotiated a 100mbps connection.

Port 0: link: port:0 link:up speed:100baseT full-duplex   <<<<<<<<<<< Problem
Port 1: link: port:1 link:down
Port 2: link: port:2 link:up speed:1000baseT full-duplex 
Port 3: link: port:3 link:down

What device do you have plugged into port 0?  What you can do is unplug the cable, and wait 5 seconds, and plug it back in. Or try and reboot the router and or device. Also, you may consider replacing the cable or trying a different port to see if that helps.

Switch port layout for the 1900ac >  https://wiki.openwrt.org/toh/linksys/wr … tch_layout

*** EDIT ***

I see above you added that you tried a different port, and fixed the issue. I would say it's unlikely, but not impossible port 0 is bad. Sometimes debris can get stuck inside and or cables get loose and are more likely to blame.

(Last edited by davidc502 on 26 Aug 2017, 20:45)

Thanks David. I'll stick to port 2&3 for the moment. Will see how it works with future updates.

@those using dnscrypt

If you are using more than one resolver (which I also highly recommend), I highly recommend adding the line:

option allservers '1'

to the config dnsmasq section of /etc/config/dhcp.

This will ensure that if one of your resolvers goes down, your second will be used transparently and there will be no DNS issues/outages noticed by the user.

Dnsmasq is supposed to do that on it's own (use another available resolver/DNS server if the first is not working) but it doesn't always work properly, and you could be stuck with no DNS if your first resolver goes out even though you have a second as a backup.  Adding that option forces dnsmasq to always try all resolvers and use the first one that responds and fixes the issue of it sometimes not using the second resolver if the first goes down.  It also has the added benefit of using the fastest resolver you have configured.

(Last edited by starcms on 26 Aug 2017, 22:58)

@starcms - he have 1900v1 - see in signature.

@BIOHazard87 - yes, noscan should help. However, i recommend to put this option in BOTH radio interface sections.
Additionally, you can use reghack2 (search for link in this thread) for capping transmitters power to 30db (you can always decrease it later in settings).
But be careful - noscan violates FCC rules, it's not a problem in most countries, but some can complain about it (f.e. don't do it in Singapore).

According to my experience - try other cable and check sockets for consistency - in 99% situations it drops to 100M if something wrong with wiring.
I have latest build (4.4 kernel) for my 1900ACv1, no issues with 1G links.

What's the point of enabling noscan on the 5GHz radio in addition to the 2.4GHz radio (on both radios)?  By definition: "noscan: Do not scan for overlapping BSSs in HT40+/- mode."  Enabling it on the 5GHz radio would most likely do nothing, but it could possibly cause issues.  I wouldn't recommend it.  The 5GHz radio already works properly when set to 20, 40 or 80MHz.

I have tested it myself and enabling noscan only on the 2.4GHz radio allowed 40MHz bandwidth to work on 2.4GHz.  However, you are definitely correct about the FCC. "Turning [noscan] on will violate regulatory requirements!"

source: https://wiki.openwrt.org/doc/uci/wireless

(Last edited by starcms on 27 Aug 2017, 07:50)

Have no idea what is wrong with my Laptop but it does not like LEDE wifi at all.
Chrome always crashes when it cant connect and I loose connectivity until I switch to other wifi access point,
On stock and DD WRT these things never happen.
I prefer LEDE speeds but cant use it.

Have the laptop completely forget the SSID and re-join from scratch.

This should fix it.  But Chrome is crashing?  Sounds like your laptop has some issues of it's own. Chrome (or any browser) shouldn't crash just because it can't access the internet.

(Last edited by starcms on 28 Aug 2017, 00:53)