1 Introduction

My home data center's main router has always been iKuai, whose main advantage is its support for multi-WAN (see the article for a detailed explanation of multi-WAN). Since my home broadband only supports a maximum of 3 WAN connections, it can obtain 3 public IPv4 addresses simultaneously, which is very practical for users like me who need multi-line access. Coupled with iKuai's mature capabilities in multi-link load balancing and traffic management, it has indeed made me feel very stable and reliable for many years.

However, with increasingly stringent operator policies, the possibility of multi-WAN functionality being canceled or public IP addresses being significantly restricted in the future is growing. At that time, iKuai's core advantages at the network level will be greatly diminished. While it has many built-in advanced features, its support for the most commonly used Docker is quite awkward—not only does installing plugins require binding an iKuai Cloud account, but the plugin functionality is also very limited, far from meeting my needs for flexible expansion and customization. Simply put, iKuai's Docker functionality is "not nonexistent," but its practicality is far from adequate (the virtual machine functionality is similar).

For these reasons, I started considering whether it was possible to find an alternative solution that, while ensuring stability and out-of-the-box usability, could also offer good Docker support and a rich software ecosystem should IPv4 public addresses be reclaimed or multiple dial-up connections be restricted in the future. Coincidentally, I recently acquired a mini x86 host with an Intel N150 processor and six gigabit Ethernet ports to upgrade my existing iKuai main router (after all, my original J2900 four-port router was already insufficient, with one LAN port and three WAN ports).

So how can we reuse the replaced J2900? Considering the performance and interface advantages of this hardware, I thought of the X-WRT project. As a custom system based on OpenWrt, it theoretically has the potential to be an ideal alternative in terms of routing stability, plugin richness, and container support. Next, I will use this replaced host to explore the installation and use of X-WRT in depth to see if it can truly achieve the goal of a "stable + flexible + feature-rich" main router.

2 From OpenWrt to X-WRT: A Better Choice for Your Main Router

Regarding what operating system to flash on this retired J2900 four-port mini PC, I didn't really have much trouble deciding. I was pretty sure it would be OpenWrt. However, I carefully compared the original OpenWrt with its modified version, X-WRT, and finally chose the latter.

To put it simply, here's the relationship between the two:X-WRT is a deeply customized version based on OpenWrt.It inherits the underlying architecture and driver compatibility of OpenWrt, but has made many enhancements and optimizations in the web interface, default functions, plugin integration, and user experience. You can think of the original OpenWrt as a "minimalist basic version"—very flexible, but you have to manually configure everything; while X-WRT is more like an "enhanced out-of-the-box version"—common functions are all configured for you, and you can use it as soon as you power it on.

If OpenWrt is "leaving room for expert users to experiment," then X-WRT is more like "pre-setting up 80% of the scenarios for users." Its target users are very clearly defined:For mainstream home users who want stable device operation, can complete configuration directly through a web-based backend, and minimize the need to tinker with command lines.Therefore, it has made many compromises and optimizations in terms of stability and ease of use: the interface is aesthetically pleasing, plugins are pre-installed, and driver adaptation is relatively mature, making it especially suitable for "basic but critical" roles like main routers.

Of course, this design philosophy also means that it makes some compromises regarding certain advanced features. For example, X-WRT does not integrate circumvention tools by default and no longer uses the opkg package manager. Although the new version has switched to an APK system, and mainstream circumvention tools like Sing-box and V2ray can still be installed, the overall range of available software is relatively limited.Not primarily marketed as a VPNThis also reflects its usage approach:For the main router, stability is paramount; it's recommended to delegate the VPN service to a secondary router.After all, if the configuration is incorrect, it could affect normal access to the entire intranet.

For my small PC, which is set to take on the role of main router, there are three key words that I really value:Stable, feature-rich, and easy to deployI don't want to have to manually configure the network port, manually fill in the software sources, and manually set up the Docker environment every time I turn on my computer. X-WRT gives me the feeling that "all of this has been prepared for you".

Especially in the LuCI backend, the core functions of the main router, such as network management, DHCP allocation, firewall rules, and port forwarding, all have clear UI pages, so there is almost no need to enter the terminal to type commands; and common plugins such as Aria2, KSmbd, DDNS, UPnP, and Docker are also built into the full-featured image, which can be used with just a click.

So in the end, I chose the full version of the X-WRT image. After flashing, I completed almost the entire configuration process through the web backend, and the experience was even smoother than with my previous AC86U.For me, X-WRT may not be the "lightest," but it is definitely one of the OpenWrt branches that is currently the "most suitable to be used directly as a main router.".

3. Create X-WRT boot storage

3.1 Overview

Unlike our usual method of creating a bootable disk from an ISO image and booting to install the system, X-WRT uses disk writing software (such as Etcher or dd) to write the img image into the boot storage. In essence, it completely clones the X-WRT system onto the boot storage. After that, you only need to plug the boot storage into the target device's USB port and set it to boot from the boot storage to run X-WRT normally.

3.2 Download the image

The official X-WRT image download address is:https://downloads.x-wrt.com/rom/If the target device's motherboard uses a traditional BIOS boot (MBR), select "x-wrt-25.04-b202506071033-x86-64-generic-ext4-combined.img.gz"; if the target device's motherboard forces UEFI boot, or if you explicitly want to use a GPT partition table (including EFI partitions, suitable for newer UEFI motherboards), select "x-wrt-25.04-b202506071033-x86-64-generic-ext4-combined-efi.img.gz". For ARM architecture devices like the R2S Plus, select "x-wrt-25.04-b202506151427-armsr-armv8-generic-ext4-combined-efi.img.gz".

Note: X-WRT is available in two versions: a simplified version and a full version, depending on system size and feature configuration. The most significant difference lies in whether or not Docker support is included. The full version comes pre-installed with docker-ce and integrates a LuCI interface control panel, making it suitable for small servers, x86 hosts, and other devices with some storage and computing capabilities. The simplified version, on the other hand, is more suitable for lightweight devices such as R2S and MT7621, retaining only basic routing and management functions and excluding Docker.

Since I'm installing on a machine with a J2900 CPU, I chose the full version suitable for x86 architecture UEFI boot: "x-wrt-docker-25.04-b202506151427-x86-64-generic-ext4-combined-efi.img.gz".

3.3 Unzip the image

Use the following command to decompress the image in the CLI interface (or a decompression tool in the GUI interface):

gzip -d x-wrt-docker-25.04-b202506151427-x86-64-generic-ext4-combined-efi.img.gz

The file "x-wrt-docker-25.04-b202506151427-x86-64-generic-ext4-combined-efi.img" was obtained.

3.4 UseEtcherWrite the image file to the boot storage (TF card or USB flash drive).

Download the corresponding installation package from the Etcher GitHub page according to your environment and install it.https://github.com/balena-io/etcher/releases):

After installation, run the program and follow these steps:

4. Initialize x-wrt (x86 devices run using boot storage)

After successfully booting X-WRT using the boot storage, connect the console terminal's network port directly to the X-WRT's eth0 interface. The eth0 interface has DHCP enabled, so the terminal can directly obtain an IP address and access the network.http://192.168.15.1(You can directly connect to eth0 and obtain an address automatically via DHCP. Whether it's actually 192.168.15.1 is uncertain, as some version might change it, so ultimately, the default gateway address used for obtaining the address will prevail.) The default username and password for the web GUI are both "admin".

After logging into the GUI, you can first change the interface language:


Then change the administrator password:


Enable SSH access:

The SSH service has been enabled, so you can directly access the CLI interface via SSH whenever needed.

5. Clone X-WRT from USB drive to local storage (X86 is fine, ARM requires caution)

---

When many people hear "cloning the system to the local hard drive," they might instinctively think it's just a matter of using the dd command—but this only applies to... x86 devicesHowever, for most ARM routers or development boards, things are often not that simple.

The reason is:The x86 platform has a unified BIOS/UEFI boot specification and standardized local storage interface, so there are almost no compatibility issues with system booting.Therefore, you can even clone the entire X-WRT system directly from a USB flash drive to your hard drive, and it will run as soon as you plug it in, which is very "foolproof".

ARM platforms (especially devices like the NanoPi R2S Plus) are different: their boot mechanisms often rely on specific bootloaders, device trees, and partition layouts, and sometimes even require the system to boot from a specific offset address in eMMC/TF.Even if you successfully dd into it, you might not be able to boot at all.Even between devices in the same series (such as R2S and R2S Plus), firmware may be incompatible due to hardware differences, making the probability of encountering problems much higher than with x86.

Therefore, this section mainly uses x86 devices as an example to illustrate how to clone X-WRT from a USB drive to a local hard drive, which is a stable, simple, and recommended approach. If you are using an ARM device, it is recommended to refer to the manufacturer's documentation or community experience first.Don't easily believe claims like "just use dd".You might end up like me, being ruthlessly taught a lesson.

---

For devices that are already running X-WRT using boot storage, if they have local storage (such as the local hard drive of an idle host), the "dd" command can be used to clone the X-WRT system from the USB flash drive directly to the local storage. This eliminates the awkward use case of "running X-WRT using a USB device (or TF card)".

1. After successfully booting from the USB drive and enabling the SSH service in the web UI, you can log in to X-WRT using the default username and password "root/admin".

2. Confirm the name and path of the local disk:

lsblk

Generally, for X-WRT, sda is the local disk and sdb is the USB flash drive. Taking my x86 host as an example:

3. Then run the dd command to clone the X-WRT system to local storage.

Clone the X-WRT system from the USB drive to local storage (if specifies the input source, of specifies the output destination, bs specifies the read/write speed; a good USB drive can be set to 4MB/s), then run the following command in X-WRT:

dd if=/dev/sdb of=/dev/sda bs=4M

Cloning complete:

The final and most important step is the command:

sync

The function of this command is:Force cached data in memory to be written to disk (or other storage device)..

---

Why run this command? Because when running commands like dd, cp, and tar that write large amounts of data, the Linux kernel typically won't...immediatelyInstead of writing data to disk, it first stores it in a memory cache (to improve performance), and this data is then asynchronously and gradually flushed to disk by the kernel later. But if youImmediately restart, power off, or remove the USB drive.This unfinished data may be lost, causing problems such as file system corruption, cloning failure, incomplete partition structure, inability to boot the system, and a black screen at startup. Adding `sync` ensures that the system waits until all data is written to `/dev/sda` before returning a terminal prompt, guaranteeing that the data you wrote is complete.

---

Wait for the cloning to complete, then restart the device and remove the USB drive. Boot from the local hard drive; you should now be able to enter X-WRT normally. Running the `lsblk` command will show that the contents of `sda` and `sdb` are completely identical.

Note 1: Newer versions of GUN dd support the progress bar parameter "status=progress", but x-wrt uses BusyBox dd, which does not support this parameter, so you'll have to wait.

Note 2: If you have a spare USB drive, you can find a new USB drive (FAT32 format is best, NTFS format is also acceptable), copy the previous img file: "x-wrt-docker-25.04-b202506151427-x86-64-generic-ext4-combined-efi.img" directly to the root directory of the USB drive, then plug it into the mini-host and mount it to the "/mnt" directory, for example, "/mnt/d", and then use the dd command:

dd if=/mnt/d/x-wrt-docker-25.04-b202506151427-x86-64-generic-ext4-combined-efi.img of=/dev/sda bs=4M

This eliminates the need to "clone the entire" bootable USB drive to sda; instead, it only requires writing the image file, which takes less than a minute.

6. Network Configuration

6.1 Overview

Under the "Network" tab in X-WRT, users can centrally manage various network functions related to the router, including interface allocation, bridging settings, DHCP service, static routing, firewall zone division, VLAN configuration, and more. This interface basically covers most network scenarios required in home or small to medium-sized network environments, retaining the flexibility of OpenWrt while simplifying the configuration process through a graphical interface. Since there are so many functions, many of which are generally unnecessary for most users, I will only briefly mention a few that I consider important.

6.2 Interface

By default, X-WRT systems typically come pre-configured with at least three basic network interfaces: LAN, WAN, and WAN6.

The LAN interface corresponds to a bridge device called br-lan, which is a Layer 2 bridging interface used to aggregate multiple physical network ports (such as eth0, eth2, eth3, etc.) into a unified broadcast domain to achieve interconnection within the local area network. By default, br-lan usually only contains eth0, that is, only one physical port is in the LAN area, used to provide management access (such as Web UI or SSH).

The WAN and WAN6 interfaces are used for external network connections (IPv4 and IPv6 respectively) and are bound to the eth1 interface by default. The system will configure it as a DHCP client to automatically obtain a public IP address. This port allocation strategy is applicable to most dual-port devices (such as industrial control computers and software routers), where eth0 is used for the internal network and eth1 is used for the external network.

In addition, for certain devices with USB network adapter interfaces, or when using specific customized images, X-WRT may also...Pre-installed additional USB WAN and USB WAN 6 interfacesThese interfaces are designed for compatibility with external USB network adapters, 4G/5G Wi-Fi sticks, and other similar devices. These interfaces are typically bound to usb0 (or a similar name), and even if the user does not actually connect a USB network adapter, the system may retain these two logical interfaces as one of the default configurations for device adaptation.

The default interfaces on my x86 host are as follows:

Click "Edit" in the image above to configure protocols, IP addresses, and other information for each interface.

6.3 DHCP/DNS

X-WRT offers powerful DHCP and DNS server features, supporting advanced capabilities such as custom address pools, static leases, DNS forwarding rules, internal domain name resolution, and ad filtering. These are suitable for users with high network control needs and require in-depth configuration. However, for most ordinary users, the default system settings are sufficient for daily use, offering stability and reliability with minimal need for additional adjustments.

6.4 Firewall

This section is essentially a visualization of iptables rules, and explaining the underlying packet processing logic and forwarding chain is indeed quite complex. Fortunately, for most users, X-WRT's default firewall configuration already covers common use cases in home or small to medium-sized networks, achieving basic intranet isolation, NAT egress, and a certain level of security protection without additional modifications. It's only necessary to delve deeper into this configuration when performing tasks such as transparent proxying, special port mapping, or complex VLAN management.

Note: ForThe most common scenario for transparent proxy routingFor a scenario where the main router is responsible for dialing and the secondary router only acts as a traffic relay device, **selecting "Dynamic IP Masquerade" in LAN → WAN under "Regional Settings" is usually sufficient.

---

IP masquerading is essentially the implementation of NAT (Network Address Translation) in iptables. Its function is to masquerade the source IP address as the router's exit IP address when data packets are forwarded from an internal network (such as a LAN) to an external network (such as a WAN), thereby enabling multiple devices to share a single public IP address to access the Internet.

Two other important system-level parameters are related to NAT behavior and can be found in X-WRT's "System" - "Advanced Options" page:

• Full Cone NAT(Full Cone NAT): also known as NAT Type 1This means that once an internal network host initiates a connection to the outside world, any response packet from that external address and port can be successfully forwarded back. This mode is very friendly to applications such as P2P, games, and remote connections, as it makes connection establishment easier and has stronger penetration, but it is relatively open and has slightly lower security.
• Enable NAT Flow (forwarding acceleration)This feature is based on the kernel's fastpath/flowoffload acceleration mechanism. After a packet matches a rule for the first time, it can speed up the forwarding and processing efficiency of subsequent identical traffic, significantly improve NAT performance, and reduce CPU usage. It is especially suitable for use with software routers in high-traffic scenarios.

In simple terms:

• Masquerading is the core of NAT's basic operations.;
• Full-cone NAT is a type of NAT with a "relaxed policy".It is more open to the outside world;
• NAT Flow is a performance optimization and acceleration mechanism.It is more friendly to high loads.

Using these three together allows your secondary or primary router to achieve a more balanced state in terms of functionality and performance. If it's just for ordinary home use, you can choose to enable all three to improve the experience while maintaining good compatibility.

---

6.5 Other Functions

I won't go into the rest, such as "website filtering," "QoS," and "multi-dialing," as most people don't need them and they're not actually that complicated. Those who need them can research them on their own.

However, regarding multi-WAN (strictly speaking, it should be multi-link management), I'd like to add that compared to iKuai's multi-link management function, no other solution can compete. iKuai's free version completely outclasses all others, including the related functions of various enterprise-level products.

7 services

As I mentioned in the introduction, compared to native OpenWrt,One of the key features of X-WRT is its "enhanced firmware" concept, which is ready to use out of the box.Not only does the system enable the web interface Luci by default,It also includes a large number of well-polished and compatible practical tools and service components.It covers multiple typical home/small and medium-sized network needs, including downloading, sharing, printing, and proxying.

Below are a few representative components:

1. Aria2 download tool

Hailed as an "embedded download marvel," X-WRT is a multi-threaded download tool that supports mainstream protocols such as HTTP, FTP, BitTorrent, and magnet links. It's often paired with web-aria2-ui, providing a visual management interface that allows you to easily manage download tasks and build a lightweight offline download center within your browser.

2、动态DNS

包括阿里云、腾讯云（Dnspod）、Cloudflare、Namecheap、DuckDNS 等主流动态 DNS 服务平台，全部通过 Web 页面可配置，无需繁琐手动安装或编写脚本，适合公网 IP 用户搭建远程访问能力：

3、p910nd 打印服务器

一款经典 USB 打印共享服务，尤其适用于老旧但仍可用的打印机，X-WRT 通过内建支持，让这些传统设备在现代网络中焕发“第二春”：

4、Docker CE 容器

在完整版 X-WRT 中预装的 Docker CE（Community Edition）容器引擎，为高级用户解锁了嵌入式系统的更多可能性。无论是部署内网服务（如 Home Assistant、AdGuard Home、Frp 等），还是运行特定工具镜像（如 Aria2、qBittorrent、OpenWrt 辅助插件等），都可通过熟悉的 Docker 命令快速启动。X-WRT 还集成了 luci-app-dockerman，提供可视化的容器管理界面，适合初学者尝试容器化部署，也满足进阶用户的自动化需求，让路由器成为真正意义上的轻量服务平台：

5、网络共享(轻量 Samba 实现)

由韩国三星贡献的 SMB 实现，性能优化明显，资源占用远低于传统 Samba，非常适合存储性能有限的路由器或嵌入式设备，常用于 U 盘/NAS 文件共享场景：

6、natcap 智能透明代理引擎

是近年来 X-WRT 中颇具特色的一个核心组件，它基于连接捕获（Connection Capture）机制，提供智能分流能力，能实现按协议、按目标域名/IP 的精准代理或直连操作，适用于旁路由等科学上网场景，且支持多种转发后端（如 Clash、Brook、Xray 等），配置灵活但对系统资源友好：

7、tinyproxy 轻量级正向代理服务

占用内存极小，仅用于 HTTP 正向代理用途，适合内网设备临时代理或做为本地透明网关转发模块：

8、UPnP IGD / PCP 协议支持

X-WRT 支持常见的自动端口映射协议，包括 UPnP IGD（Internet Gateway Device）和更现代的 PCP(Port Control Protocol)，可以为内网设备（如 NAS、游戏主机、下载客户端等）动态开放公网端口，免去手动配置端口转发的麻烦。尤其在家庭网络环境中，这种“即插即用”的自动穿透能力显著提升了设备连通性与可用性。X-WRT 提供了 luci-app-upnp 页面，用户可实时查看当前哪些设备和应用正在使用端口映射，并支持自定义策略，避免滥用：

注：如果不需要”Docker CE 容器”功能，就不需要装完整版的X-WRT，只装精简版即可。

除了上述组件之外，X-WRT 通常还会根据固件类型内建：

• 常用诊断工具（如 iperf3, tcpdump, ethtool 等）；
• 常用 Web 管理插件（如 流量统计、端口转发、ARP/邻居表展示）；
• 针对中国大陆网络环境的定制优化（如国内外自动分流、NAT 加速、旁路透明转发预设）等。

从“下载/共享”到“打印/远程访问”，再到“透明代理”，X-WRT 覆盖了多数家庭和中小型办公网络环境的核心需求。它不只是一个路由系统，更像是一个定制化的“小型网络操作系统”。

8 software packages

除了已经内置的这些服务，身为openwrt的魔改版，当然依然可以通过”系统”-“软件包”安装需要的软件：

常用的软件还是不缺的：

其他我就不一一介绍了，OpenWrt系的基本都是大同小异。

9. Afterword

其实，OpenWrt 的魔改版本非常多，X-WRT 只是其中相对主流、兼顾易用性与稳定性的一个代表。除此之外，还有很多同样优秀、但各有特色的分支版本，比如：

• Lede：早期非常活跃的魔改版本，后来与 OpenWrt 合并，但仍有不少爱好者维护类似风格的定制固件；
• ImmortalWrt：基于 OpenWrt 最新代码的衍生版本，社区活跃，默认集成了更多插件和架构支持，尤其在科学和多拨方面很受欢迎；
• OpenWrt-Rockchip / R66S-Plus-OpenWrt 等社区固件：更偏向硬件适配和性能优化，常见于 R4S、R5S、x86 等设备；
• 高集成科学固件（如 F大的固件、P3TERX 编译版）：主打开箱即用的科学体验，常集成 sing-box、Clash、Xray 等，适合做旁路或科学中继设备。

总的来说，每一种 OpenWrt 魔改固件都有它自己的目标用户和设计理念：你没必要非得拘泥于 X-WRT，关键是看你想要在哪些设备上用、需要哪些功能、愿意花多少精力去配置和维护。就像我这次选择 X-WRT，是因为它能让我快速部署一个稳定的主路由系统，但如果你对科学、自动化、极致性能有更高追求，那可能其他定制固件才是你真正需要的答案。

建议大家在选型之前，先明确自己的实际需求，再有针对性地去找最适合自己的那一个版本——这个过程虽然可能要多花些时间，但会让你少走很多弯路。