1 Introduction

In the previous article (see:Home Data Center Series: Renovating Retired Small Hosts with X-WRT: An Alternative Choice for Main Routers), I used an idle J2900 x86 small host to tinker with the soft router. It worked fine, the performance was more than adequate, and the system was stable. But the problem was that it was not my main device for scientific Internet access, it was just a "technical attempt" - that is, this machine was turned on every day, but there was almost nothing to do. And its standby power consumption was stable at more than 20 watts. When I saw the meter jumping, I still felt a little heart-bleeding.

If this machine is really the main router, I would accept such a small amount of power consumption; but now it is just a supporting role. It is idle but used occasionally, and its daily utilization is low. It doesn't seem worthwhile to run it for a long time, and I feel uncomfortable turning it on and off as needed. So I started to think, is there a device that is not too expensive, small in size, and consumes so little power that I can run it 24 hours a day without feeling bad, and at the same time it can run steadily and be played well, enough for me to play around with freely?

After searching the Internet, I found a suitable option:NanoPi R2S/R2S Plus:

The price is less than 300 yuan, and the power consumption is also very friendly: even if some additional services are turned on, the standby power consumption is only 4W ~ 6WCompared with the 20W+ power consumption of J2900, it is completely two orders of magnitude.

A small box can support a lightweight but practical network environment, and it does not consume any electricity when turned on. More importantly, NanoPi has prepared its own firmware for this type of device: FriendlyWrtThis is much less troublesome than the universal system X-WRT I used before (of course, you can flash X-WRT), and it does not require various adaptations, nor does it require drivers and modules. It is ready to use out of the box, and the experience is very complete. To be honest, this is the key to making this small device "easy to use".

2 Friendly NanoPi Series Router Introduction

In the circle of soft routers, the Friendly NanoPi series routers can be said to be a type of device that appears quite frequently. It is a series of miniaturized, open-source ARM platform devices launched by FriendlyElec. Its positioning is a bit like Raspberry Pi, but it focuses more on scenarios such as network forwarding and soft routing. Especially in the OpenWrt / X-WRT communities at home and abroad, multiple models of NanoPi have been highly supported and optimized, and the software and hardware ecosystem is relatively mature. Here is a brief list of the differences and characteristics of this series of mainstream models for reference by friends in need:

Briefly summarize the purchase ideas:

• Limited budget, light use: R2S (or R2S Plus) is stable enough to save you worry;
• I hope to expand my capabilities a little, such as running multiple services: R3S is a balanced choice;
• To run multi-user science, high load bypass, ZeroTier, ad filtering, etc.: It is recommended to go straight to R4S or R4SE;
• High bandwidth requirements, multiple network port requirements, and plans to use transparent proxy or soft router aggregation in the future: Then consider R5S, which is not cheap but can be used for a long time.

After some consideration, I finally chose **R2S Plus, not because of how powerful it is, but because it just happens to be stuck in a very comfortable position. I don’t usually have high requirements for the performance of scientific Internet access. I don’t watch videos or Netflix (Netflix has too few movies and the bit rate is not high, which is useless to me, far inferior to my own collection~). At most, I browse the web, search on Google, and chat with ChatGPT. The actual bandwidth is not more than a few Mbps. So performance monsters like R4S and R5S are a waste of resources for me, and the price has also gone up a level, which is not cost-effective.

In comparison, the R2S Plus is lightweight and "just right" - it can handle mainstream home networks without any pressure, has low power consumption and low heat generation, and can be placed in a corner for a long time without any worries. It uses a Type-C interface for power supply, is compatible with a wide range of cables, is flexible to deploy, and makes the desktop cleaner. The most important thing is that it has built-in eMMC storage, and the system can be booted from eMMC. I really don't have much confidence in the way the system runs with a TF card (of course, the price of less than 300 yuan is the fatal blow~).

Note: All models of the Friendly NanoPi series routers provide a TF card slot to support booting from a TF card. After all, only a portion of the models have built-in eMMC. If you use the TF card boot method, you can also directly deploy X-WRT as described in the previous article. The method of burning X-WRT is the same as burning a USB flash drive in the previous article. Just remember to select the "X-WRT-25.04-b202506151427-armsr-armv8-generic-ext4-combined-efi.img.gz" image under "Generic EFI Boot":

3 Firmware selection

3.1 Overview

---

The firmware selection of the NanoPi series routers is very flexible and suitable for different users.Don't want to mess around, want to use it right out of the box, then directly use the official exclusive firmware—— FriendlyWrt It is the most worry-free choice. It is essentially a customized version based on OpenWrt, combining user-friendly driver adaptation, graphical interface optimization and common plug-in integration. It has complete functions and a user-friendly interface. It almost does not require manual configuration for daily use, and is suitable for users who want "plug and play".

Of course, if youPrefer controllability and customization, or if you are already familiar with the OpenWrt system, you can also flash other community versions of firmware. X-WRT Community,immortalwrt etc. have very good support for the NanoPi series. These third-party firmwares add more extended functions, plug-in platforms or performance optimizations based on OpenWrt, with greater freedom and more room for experimentation. Especially for models with a large user base such as R2S/R4S/R5S, there are a lot of flashing tutorials and usage experiences available online, and the adaptation is also very mature.

In simple terms,If you want stability, use FriendlyWrt. If you want to play around, use the community version (TF card boot), and the NanoPi series happens to be able to take care of both ends, which is one of the important reasons for its popularity.

---

Unlike other universal firmware (such as X-WRT), the firmware officially provided by FriendlyWrt distinguishes hardware models and cannot be mixed, so you need to first download it on the official wiki (https://wiki.friendlyelec.com/wiki/index.php/Main_Page) Find the corresponding model you purchased, for example, I have R2S Plus, click to enter your model:

Then click to enter "Official Firmware":


Finally, you will get the download address of Baidu Cloud Disk and Google Cloud Disk. Choose different methods according to your own situation. After entering, you only need to transfer the "01_System Firmware" directory:

There are 3 subdirectories in the "01_systemfirmware" directory:

3.2 Firmware Introduction

3.2.1 01_SD card firmware

All firmware in this directory are used forStart from SD card (TF)"This scenario, and the name of the firmware explains its purpose (the official also provides ready-made third-party firmware options for NanoPi series routers, such as Debian 12, Ubuntu 24.04, open source NAS openmediavault, etc.), detailed description is as follows:

---

FriendlyWrt full and minimalThe biggest difference is whether the Docker environment is pre-installedThis is consistent with the difference between the "full version" and "lite version" that I mentioned in the X-WRT firmware naming rules. If you only use it for bypass routing or running some basic services, there is actually not much difference in basic functions between the two, and the system experience is not much different. It should be noted that the lite version is smaller in size.Also streamlined some common tools in user spaceAlthough it will not affect the basic functions (such as some command line components, network tools, etc.), users who have certain hands-on needs or need to manually debug the system may encounter missing tools during use and need to install them through opkg.

But I personallyIt is not recommended to run Docker on devices with less than 2GB of memory.: First, Docker itself takes up a lot of memory. Even if you only run some small containers, it is easy to make the system become stuck or even have OOM (memory overflow). Secondly, in terms of storage, if you are running on a TF card, Docker's read and write operations will greatly slow down performance and even accelerate the wear of the card.

So, if you do have Docker needs, I recommend meeting at least one of the following two conditions:

• Either the device has eMMC Storage, random I/O and stability are much better;

• Either mount one USB 3.0 external hard drive or USB flash drive, which can significantly improve the reading and writing bottlenecks;

However, these two conditions have actually exceeded the "positioning" of many low-end NanoPi models. Therefore, for most entry-level users, it is better to choose a simplified version instead of pursuing a full version. The system is clean and runs fast, which is more in line with the best use of this type of device. If you really need the docker function, it is recommended to go directly to the high-end model.

---

3.2.2 02_SD card firmware flashing (SD-to-eMMC)

All firmware in this directory are used forAfter booting from SD card (TF), flash the firmware to eMMC storage"This scenario, and the firmware's naming explains its purpose:

It can be found that the file names here are basically the same as those in the previous section, the only difference is the addition of a keyword - eflasher. So, what is eflasher?

In short, eflasher is an image flashing mechanism officially provided by FriendlyELEC, which is specially used to write the system to the device through the SD card. Its full name is eMMC flasher, also known as "eMMC burner", is used to automatically write the system image from the SD card to the device's built-in eMMC storage. Compared with the general system image, the eflasher version will run a graphical or command line flashing tool after startup to guide the user to perform the installation operation.

This mechanism is mainly used forMass production equipmentorSystem RecoveryIt is suitable for initial installation or resetting the system to factory settings. The file name contains eflasher, which means that this image is a "flashable" version rather than a "directly run" version.

3.2.3 03_USB firmware flash (USB-to-eMMC)

All firmware in this directory are used forFlash the firmware from the computer to the eMMC storage via USB cable"This scenario, and the firmware's naming explains its purpose:

As you can see, compared with the image naming of SD card flashing in the previous section, the only difference is that "eflasher" has changed to "USB", and everything else is the same.

4 Firmware Flashing

4.1 Flash the firmware of TF card startup mode

I am not going to elaborate on this part, because I have already written about it in detail in the previous article about X-WRT. Balena Etcher Use tools like .img to write the downloaded firmware file directly into the TF card. The operation is very simple and no additional settings are required. Most people can complete the whole process with just a few clicks of the mouse. It is not complicated. If you really want to do it yourself, just refer to the previous article.

The only thing I want to remind you of here is:The TF card capacity does not need to be too largeI personally recommend choosing A card between 8G and 32G is enoughThe system image is usually only 200MB ~ 500MB, and the remaining space is basically used as an overlay, which is more than enough even if you install some plug-ins or run a lightweight service. On the contrary, a card that is too large will cause two unnecessary problems:

1. Burning time becomes longer —— Especially for some old cards with slow writing speed, it may take half a day to burn a 64G image, which is not a good experience;

2. Easy to waste resources —— Using a 64G or 128G high-speed card to run a router system is a bit of an overkill. It would be better to save it for NAS cache or media storage.

Another reminder:The quality of TF card is more important than its capacityIt is recommended to choose a reliable brand with faster speed (such as SanDisk's Ultra or higher series), which can effectively reduce problems such as system freezes and service delays caused by poor I/O performance in the later stage.

4.2 Flashing the firmware of eMMC boot mode

4.2.1 Overview

The flashing operation of eMMC is a little more complicated than that of TF card. In addition to flashing through USB OTG + Windows burning tool, Youshan also provides two more convenient flashing methods: one is to use TF card to boot and then flash through the "eMMC flashing assistant" in the web page; the other is to burn the official eFlasher image to the TF card, and then use the TF card to boot and flash into the eMMC through the graphical interface or VNC operation. The overall process of these methods is not complicated, and it is not difficult for users with a little experience.

But no matter which method it is, it is essentially "Write it once and don't keep changing it"The idea is that unlike a TF card, it is very convenient to pull it out and replace it with another one or re-flash the system. eMMC is more like a "fixed disk" that is used to carry a long-term stable system, rather than being used repeatedly.

More importantly, once the system on the eMMC has a problem, even if it is just a boot failure, it cannot be restored by itself, and external devices must be used: either insert a TF card to reboot the system, or connect it to the computer with a USB data cable to enter the maskrom mode, or even in extreme cases, serial port debugging may be required. These operation steps are neither user-friendly nor easy. Once you step into the pit, the processing cost is much higher than re-flashing a TF card.

Therefore, I always recommend treating eMMC as a target disk that can be used for a long time after writing.Once the system is flashed, try not to touch it.Daily testing, system changing, trying out new things and other hassles can be left to the TF card, which is flexible, worry-free and not prone to failure.

Also note thatNot all third-party firmware is fully compatible with eMMC bootThere may be differences in startup mode, driver support, partition layout, etc. Once the wrong flash or improper adaptation occurs, it is easy to cause startup failure, device bricking and other problems, affecting the user experience.

therefore,I recommend using the official FriendlyWrt firmware when booting from eMMC.It is essentially a customized version based on the secondary development of OpenWrt, which is optimized for NanoPi series devices (especially models with eMMC). It has a reasonable image structure, complete driver support, and a stable and mature system. You can basically use it for a long time after flashing it once, which is not only worry-free but also safer.

If you don't plan to use FriendlyWrt, you can also consider several other officially supported firmwares provided by Friendly's official website, such as:

• buildroot: Suitable for users with strong DIY capabilities to build their own systems, which can be highly customized;
• debian-bookworm-core/ubuntu-noble-core：These two are pure Debian and Ubuntu minimal core systems, suitable for use as lightweight servers, bypass routers, edge computing gateways and other scenarios. Compared with FriendlyWrt, this type of system has no web management interface and is more inclined to command line operations, which is more flexible but also more "plain";
• friendlywrt-focal: It is a hybrid firmware based on Ubuntu core + OpenWrt upper layer, taking into account the Ubuntu software ecosystem and OpenWrt's network management interface. It is suitable for users who want to use the apt system but do not want to give up LuCI;
• openmediavault：This is mainly used to run NanoPi as a lightweight NAS. It has been friendly and relatively complete adaptation. The interface and functions are relatively complete, and it is suitable for storage-based usage scenarios.

Of course, if you are an advanced user who is familiar with the OpenWrt architecture and understands the eMMC operation process,It is not impossible to flash other third-party firmware, just make adequate backups, accept the possibility of pitfalls, and be prepared for system recovery.

4.2.2 Start FriendlyWrt from SD card (TF card) and flash the firmware to eMMC on the web page (recommended)

This should be the simplest way to flash the firmware for eMMC: first use any friendlywrt image in the "01_SD card firmware" folder to make a TF card boot card, then boot and run friendlywrt normally, and log in to the GUI page. Find and run "eMMC Flash Assistant" under the "System" menu:

After the burning is completed, please eject the SD card first. The device will automatically restart and boot the system from eMMC. Do not unplug the power directly. I will explain the reason later:

Note: I actually thought that the "eMMC Flash Assistant" feature was removed in the new version at first, because I was using FriendlyWrt started by eMMC, and I couldn't find it on the page. Later I found out thatThis function will only be displayed when booting from TF card, because the system thinks that you are started from the "external environment" at this time, it allows you to operate the eMMC. The design is reasonable, but it is indeed easy to be misunderstood. For example, I almost wronged it.

4.2.3 Boot from SD card (TF card) and use eflasher to flash the firmware into eMMC (SD-to-eMMC)

To flash the eMMC firmware in this way, you need to use the official eFlasher MechanismIn simple terms, it is to write the firmware image with the word "eflasher" into an SD card (TF card), and then use this card to start the device. At this time, the system will automatically run a VNC server and use a graphical interface to guide you to complete the flashing operation.

By default, the device The VNC service is bound to the fixed IP 192.168.1.231, and the DHCP function is not enabled by default. —— In other words, it will not automatically assign an IP address to your computer (this is indeed counterintuitive and a bit "tricky". I struggled with it for a long time and always thought that it did not start successfully at all～～～～).

Therefore, you need to manually set the computer's wired network card IP to any address in the 192.168.1.x network segment (such as 192.168.1.100), and set the subnet mask to 255.255.255.0. The LAN port and WAN port are bridged togetherYou can access it by plugging it into any port, so don’t worry too much.

Then, use a VNC-supported client (RealVNC or UltraVNC is recommended) to connect to 192.168.1.231:5900, and you can see the graphical eFlasher flashing interface. In the interface, you can choose to flash the target system to the eMMC. The operation process is very intuitive, and it is basically a matter of clicking a few buttons. Take the firmware rk3328-eflasher-multiple-os-20250603-30g.img.gz flashed to the TF card as an example:

---

This image is about 3GB in the compressed package, but after decompression it is a large image file of about 30GB (because it contains multiple systems), so when actually burning the TF card,A card with a capacity greater than 32GB must be usedOtherwise, burning tools such as Etcher will directly report an error and cannot write. As for why it is so large, it is because it contains multiple systems～):

In addition, one thing needs to be reminded:The flashing process will completely overwrite the original contents of the eMMC, so it is recommended to confirm that there is no important data before operation. If you are worried about mistakes, you can also use the "Backup eMMC to TF card" function in the graphical interface to save the current system image, just in case:

---

After clicking FriendlyWrt 24.10, the following interface will appear. Keep all options unchecked by default, and then click "Next" in the lower right corner:

---

I would like to emphasize the two options of "start automatically at startup" and "disable overlay filesystem".Especially the latter, which is very important. Many people tend to ignore it when flashing the phone for the first time..

• start automatically at startup：The function of this option is to enable the system to start after inserting the TF card.Automatically enter the flash process or the last state, skip the main interface interaction. It does not re-flash every time, but is more like "recovering to the last stop" - for example, if you stopped at the "Complete Page" after flashing last time, it will jump directly to that page next time you insert the card and start the machine. Therefore, if you just flash manually once, you don't need to check it;It is recommended to enable it only in scenarios such as batch flashing and unattended operation..
• disable overlay filesystem: This option determines whether the Overlay file system is enabled when the system you flash into eMMC is running.When not checked by default, the system will mount the overlay to the eMMC normally, and all configuration changes (such as changing passwords and installing plugins) will be saved permanently, and will be retained after restart. If you check this option, the overlay will be disabled, causing the system to become pure read-only mode, and configuration changes cannot be written to the eMMC. Some firmware (especially the minimal version) will even fail to start directly because it cannot find a writable mount point. In short:If you want to install this system and use it for a long time, do not check this option and keep the default setting..

---

Then start flashing the eMMC, which will be completed quickly. However, pay attention to the prompt in the lower left corner:

Must firstEject TF card, then the device will automatically reboot and boot from eMMC into the flashed FriendlyWrt system. If you follow this process, basically everything will go smoothly and the experience will be smooth.

But if youTo save trouble, unplug the power directly after flashing, and then eject the TF card——Hehe, you will know what it means to doubt life:No matter how you turn it on, it will never boot from eMMC. Even if you unplug the TF card, the device will be stuck in silence before starting.

This is because after eFlasher displays "Flash Successful", the system does not immediately complete all write operations. At this time, the image data on the eMMC may still be partiallyThe cache remains in memory and has not yet been synced to disk., and the flashing tool itselfNo automatic unmounting of eMMC partitions or refresh of boot configurationOnly when you click the "Finish" or "Shutdown" button, or eject the TF card, the system will execute the complete closing process, such as:

• Write the file system changes of eMMC to disk;
• Unmount the mounted partition;
• Clear temporary marker files during the flashing process;
• Refresh U-Boot's startup parameters or set the startup sequence;
• Execute sync to ensure data writing is complete;
• Finally restart or shut down safely.

If you cut off the power and skip these steps,It is equivalent to cutting off the system before it has time to finish.The result is that the system on the eMMC may be only half written, the file structure is incomplete, the status is chaotic, and even the boot partition is not flashed. Naturally, don't expect it to boot smoothly.

This is a bloody lesson.I was stuck here for three hours.The problem was not complicated, but I just relied on my experience to solve it. I didn't read the instructions or the help documents, and I just started working. As a result, I was screwed. Empiricism is really the eternal enemy of technical people.

Note: By the way,eFlasher also supports installing the system on an external M.2 or USB storage deviceYou can select "Boot and install to eMMC (or TF card)" in the graphical interface, and install the system part to the USB hard disk or M.2 SSD at the same time. This is the next step after selecting the system in the eflasher start interface. Take flashing Ubuntu as an example:

Just need to note:The R2S Plus CPU itself does not support direct booting from USB or M.2, so no matter where the system is installed, the boot still has to fall on the eMMC or TF card. Although this method seems quite "advanced", it is not necessary for most users, just understand it.

4.2.4 Use a computer to flash the firmware to eMMC via USB (USB-to-eMMC)

This method uses USB to identify the computer as a USB-to-eMMC device and directly flash the eMMC on the PC.I don't recommend itAlthough it sounds advanced, the actual operation processCumbersome and error-prone, you need to enter the maskrom mode and install a dedicated burning tool. It may also involve issues such as driver compatibility and image format conversion.It is far from being as simple and direct as starting eFlasher with a TF card.

Unless you are very familiar with this process, or the device can no longer boot from the TF card and there is really no other way, it is better to skip this troublesome route, which is worry-free and safe.

4.2.5 Summary

Regarding the eMMC flashing method, you can actually followComplexity and RecommendationIt is roughly divided into three levels:

• Most recommendedThe way is to use After the TF card is booted into FriendlyWrt, use the "eMMC Flash Assistant" in the Web management interface to operate. You only need to upload the image and click confirm, and the flashing will be completed in a few minutes.The whole process has almost zero learning cost, which is both intuitive and stable, is the method I personally recommend most.

• If you are not booting FriendlyWrt, or want to have more options in the graphical interface (such as installing to USB or M.2 devices), you can consider using the official eFlasher Image, after starting up through the TF card, enter the built-in flashing interface,Support local display or remote VNC operation, the function is more flexible, but the process is slightly more complicated.

• As for passing Connect to computer via USB OTG and use burning tool to flash eMMCAlthough it is also an officially supported method, the whole process is rather complicated and not very friendly to novices.Improper operation may cause system damage or failureSo I don't recommend this method.Unless you are familiar with the process, or the first two methods are not feasible.

In conclusion,TF card boot + Web flashIt is currently the safest, simplest and mainstream method; the other methods can be understood as alternative means or emergency plans.

5 Initialization

The DHCP service is enabled by default on the LAN port of R2S Plus. The interface IP is 192.168.2.1. Use the address directly.http://192.168.2.1"Login management, the default account password is root/password:

After entering, you can see the default status page:

The default is English. To change it to Chinese, go to "System"-"system"-"Language and Style":

Modify the router password in "System" - "Administrative Rights" - "Router Password":

Unlike X-WRT, the SSH function is open by default and does not need to be enabled manually:

In "Network" - "Interface", you can set the connection method and address acquisition method of the LAN port and WAN port respectively (note that the WAN port is eth0 and the LAN port is eth1):

At this point, the initialization of FriendlyWrt is completed.

6 Others

The other options are similar for OpenWrt. The only thing I can say more about is the default application provided by FriendlyWrt in the "Service" menu:

There are some more practical ones, and the other missing ones are in "System"-"Software Package":

Or you can install it yourself using the opkg command in the command line:

Other operations for the OpenWrt system are similar, so I won’t go into details.

7 Tip 1: Solve the problem that OpenClash does not work properly after installation

One thing worth mentioning is that when installing OpenClash in FriendlyWRT,Sometimes the system's normal curl will be broken for no apparent reason., which causes errors such as "symbol not found" to be reported when executing curl from the command line, and also causes OpenClash to not work properly.

The essence of this problem is that in some versions of OpenClash, the installation process may pull a set of Dependency packages that are not fully compatible with the current system build environment(For example, libcurl, libmbedtls, etc.). Once these libraries are overwritten by mistake, curl will fail to load the required dynamic symbols correctly, resulting in a relocation error.

What's more troublesome is that if you use OpenClash's Web UI to perform operations such as "repair dependencies" or "update core", this problem is more likely to be triggered. So I personally recommend that for such tools,It is best to manually download the .ipk installation package for deployment to avoid the plugin automatically pulling the wrong dependenciesIf curl reports an error, you usually need to uninstall the relevant components and force clean up, and then reinstall the correct version with opkg to recover. The solution is as follows.

The first step is to forcefully remove curl and associated libraries (OpenClash will also be uninstalled):

opkg remove curl libcurl4 libmbedtls libmbedx509 libmbedcrypto --force-removal-of-dependent-packages

The effect of this command is:
– Uninstall curl and its dependent dynamic libraries;
– Also remove luci-app-openclash which depends on curl (it will not affect other system components);
– Clear out a clean curl space.

The second step is to reinstall a complete set of healthy curl:

opkg update opkg install curl

At this time, curl will automatically pull back its true matching dependencies such as libcurl4 and libmbedtls. Then execute:

curl https://www.baidu.com

If this command is successful, it means that your system-level network capabilities (and the most basic tools that OpenClash relies on) have been repaired.

Step 3: Reinstall OpenClash:

opkg install /tmp/luci-app-openclash*_all.ipk

This problem almost made me doubt my life. When I couldn't find the reason at first, I flashed the eMMC several times for no reason.

If you don't want to do it all over again, then in theory you should install all the dependencies first, so that the system's own curl library is locked and OpenClash will not replace it randomly.

The first step is to install all the basic dependencies of the system:

opkg update opkg install curl libcurl4 libmbedtls ipset ip-full iptables iptables-mod-tproxy kmod-tun kmod-inet-diag

If you need to use TUN (requires Clash.Meta / Premium):

opkg install kmod-tun ip-tiny iptables-mod-tproxy

In this way, all system-level curl/wget dependencies on FriendlyWrt are official libraries and will no longer be overwritten by OpenClash.

The second step is to download and install OpenClash (please modify it to the openclash version you need):

cd /tmp wget https://github.com/vernesong/OpenClash/releases/download/v0.46.086/luci-app-openclash_0.46.086_all.ipk opkg install ./luci-app-openclash_0.46.086_all.ipk

Then go to LuCI, start OpenClash and then download the core online.

8 Tip 2: NAT does not work in some special scenarios

This problem really screwed me up... My main router is iQuick, and the network topology looks reasonable: iQuick's WAN2 is connected to FriendlyWrt's LAN (eth1), and FriendlyWrt's WAN (eth0) is then connected back to iQuick LAN2. In this way, you can do port splitting on iQuick and hand over part of the traffic to FriendlyWrt. The diagram is as follows:

But in actual operation, no matter how many times I flashed FriendlyWrt (both the Lite and Full versions), OpenClash still didn't work properly. Clash could pull configurations smoothly, fake-ip mode seemed to work fine, and there were no errors in the logs, but HTTP/HTTPS all timed out.

After several days of investigation, I finally found that the problem was not with my topology or Clash configuration, but with FriendlyWrt's NAT not working at all. Although option masq '1' (IP dynamic masquerade) was written in /etc/config/firewall, it was not correctly sent to the masquerade rules in nftables, resulting in that the traffic from the WAN exit under this architecture was not SNATed, and the "intranet source IP" was directly thrown out as it was.

In this architecture, although the traffic received by FriendlyWrt physically comes from the LAN (eth1/br-lan) interface and the source IP also looks like 172.17.100.x, since NAT has been done once in iKuai, FriendlyWrt's traffic status tracking may not be able to hit the corresponding NAT rule chain, causing the masquerade to not be executed at all.

In contrast, if the internal network device directly points the default gateway to FriendlyWrt's LAN (eth1), 100% can trigger the normal NAT process of LAN → WAN, and masquerade will definitely take effect.

So this pit is very hidden, and it seems to have nothing to do with my network planning, but in fact it is because the system does not convert the camouflage options in /etc/config/firewall into valid nft rules by default, which makes the traffic unable to do SNAT. If I hadn't stripped the OpenClash verification minimum link step by step and tested NAT separately, I'm afraid I would continue to waste time on fake-ip, redir-host and other upper-level configurations.

If you want to solve the NAT ineffectiveness problem in this special scenario, run the following command to take effect immediately (I use eth0 here because eth0 is the wan port when the R2S Plus is flashed with FriendlyWrt):

nft add table ip nat 2>/dev/null || true nft add chain ip nat prerouting '{ type nat hook prerouting priority 0; }' 2>/dev/null || true nft add chain ip nat postrouting '{ type nat hook postrouting priority 100; }' 2>/dev/null || true nft add rule ip nat postrouting oifname "eth0" masquerade

If you want it to take effect permanently, just restart after doing the following:

cat >> /etc/firewall.user <<'EOF' nft add table ip nat 2>/dev/null || true nft add chain ip nat prerouting '{ type nat hook prerouting priority 0; }' 2>/dev/null || true nft add chain ip nat postrouting '{ type nat hook postrouting priority 100; }' 2>/dev/null || true nft add rule ip nat postrouting oifname "eth0" masquerade EOF

Note: This problem will not occur on mature commercial routers like ASUS, whose firmware has already taken care of various NAT scenarios, and the default policy is also tight. But it is hard to say on OpenWrt soft routers - different distributions, different firewall solutions (iptables/nftables), and even different configuration wizards will affect the generation of NAT rules. Sometimes, just a few masquerades will cause problems and catch you off guard. However, as long as you are not doing multiple NAT, loopback, or extreme transparent proxy experiments, normal home scenarios generally do not require so many magic modifications, so naturally you will not step on this pit.

9. Afterword

In general, you should be prepared to tinker with the NanoPi series of soft routers.It is not a ready-made router that can be used as soon as it is plugged in and can be modified at will.You need to spend some time to understand its flashing method, partition layout, and various pitfalls (such as flashing the eMMC overlay, choosing a boot method that suits you, etc.).

But because of this, it is actually very suitable for users who like to do things by themselves and like to completely control the network. After all, you can get a low-power, compact, and high-performance (much better than the common router MTK chip) mini gateway for a few hundred yuan, and you can also install various OpenWrt derivative systems, custom plug-ins, scientific Internet diversion, or simply other systems (debian, ubuntu, openmediavault) - to be honest, this kind of freedom and playability is something that most commercial routers can never give.

So, if you have a DIY mentality and treat it as a small server or a small gateway, then you will definitely enjoy it; but if you just want a "home router that you can buy and use once and for all", then it is recommended that you directly choose ASUS, Netgear, or a higher-end All in One device, so as to avoid being frustrated by all kinds of weird little problems later.