OpenWrt on N100: Flashing My Router, Splitting My Traffic

My main router used to be the ONT in router mode, and the whole house sat on one flat layer: phones, cameras, the NAS, and guest devices all sharing a single broadcast domain. One day I wanted to isolate the IoT gear, found no VLAN settings anywhere in the ONT's admin page, and the topology started moving. This post is the rebuild as it actually happened — why I touched it, how the switch-over went, and what the first week after looked like.

This wasn't a hobby project for its own sake. The camera firmware popped up update prompts three times a day, and it hit me that all of it sat on the same L2 network as the folder holding the family's documents. That didn't sit right. Before picking any technology, admit where the anxiety comes from: this is about isolation, not showing off.

Before: everyday life on a flat network

Roughly twenty devices. A NAS, a printer, smart plugs, two laptops, the parents' phones, and guests who occasionally hop onto the Wi-Fi. DHCP lived on the ONT and DNS belonged to the ISP. Someone could stumble into someone else's shared folders, and the guest network existed in name only — really, the main network's password was just written on the fridge.

I wanted three specific things:

• VLANs: separate office, IoT, and guest traffic
• Traffic visibility: which device is hammering the uplink
• DNS handed to AdGuard, instead of the ISP's sloppy resolution

The cost was clear up front: if the soft router dies, the whole house loses the internet. A side router is a smaller change, but DHCP and DNS tend to develop a split personality. I went with gateway mode — ONT in bridge mode, an N100 mini PC running OpenWrt, and every bit of traffic flowing through it.

Prep week: hardware and the rollback plan first

The N100 has two NICs (or one NIC plus a USB adapter — USB I treat as temporary only; I don't trust it long-term). eth0 is planned as WAN, eth1 as LAN. The switch has to be able to tag VLANs; the dumb switch in the living room only serves as "more ports on the same VLAN" — don't expect it to understand trunk.

The rollback plan went on paper:

1. Keep screenshots of the old ONT router-mode config, plus the account credentials
2. Export the OpenWrt first-time config and download it to a computer
3. Monitor plus keyboard can plug straight into the N100
4. Schedule the cut-over for a morning when the family is out; budget two hours

For the image, I chose a stable release with luci included — you can get fancy once you're in the web UI. Confirming you can reach the system over serial or a monitor beats trusting SSH alone: if you botch the network config, SSH can simply vanish.

Cut-over day: bridge mode and the first PPPoE dial

That morning I switched the ONT to bridge mode. The living room instantly lost the internet, which was expected. The N100's WAN port goes to the ONT, LAN to the switch, and the laptop first connects wired into the default subnet on br-lan.

Only once WAN picked up a public address — or the PPPoE dial succeeded — did I move on to LAN-side refinement. DNS pointed at a working public resolver first so package updates would go through; AdGuard came the next day, deliberately not tied to the same window as "getting the whole family back online."

The interface plan ended up as:

• eth0: WAN
• eth1: LAN, into br-lan
• VLAN 10: office / trusted devices
• VLAN 20: IoT
• VLAN 30: guests

Wireless uses multiple SSIDs mapped onto VLANs. A single SSID with 802.1X is overkill for a home. Cameras and IoT gear must not share L2 with the NAS management port — that was the whole point of this rebuild, so don't cut over and then shove everything back into VLAN 10 to save yourself the trouble.

The first 48 hours: what the failures looked like

Afternoon of day one: the printer was nowhere to be found. It still had a static IP from the old subnet while the DHCP pool had moved. Moving it into the new VLAN 10 range fixed it. Lesson: static-IP devices need an inventory, not a memory.

That night, an IoT plug joined the guest SSID, and since the rules forbid guests from reaching the internal network, the phone app couldn't control the lights. Family report: "the smart home is broken." I moved the plug back to VLAN 20 and made it explicit — the IoT network can reach the internet but doesn't touch the NAS by default. Comment your rules in plain language; three months from now you'll need them.

WireGuard clients still pointed at the old gateway address, so a phone on the road could build the tunnel but never reach the NAS. Only after I updated the internal routes handed out past the endpoint, and the DNS too, did the loop close. When you rework the network, remote reconnect is an acceptance test, not a post-hoc patch.

The software list: fewer packages is self-preservation

Base packages: luci, nano, htop, iperf3, tcpdump. Everything else on demand. I'll skip the specifics of any circumvention components — comply with local laws and terms of service. The principle layer:

• Domestic traffic goes direct; latency-sensitive gaming goes direct or over an optimized route
• Proxy only what needs it; avoid global proxying that causes weird UDP issues
• Ad filtering can live on AdGuard Home; don't pile everything onto the router's CPU

Every extra package makes sysupgrade more hair-raising. The N100 handles gigabit forwarding easily; watch the CPU only if you turn on heavy traffic auditing and complex queues. Stable forwarding first, observability second.

Upgrades and changes: the second half of the story

Export the OpenWrt config periodically and download it to a computer. Before flashing, back up /etc/config and save the current firmware image. After an upgrade, verify in this order:

1. WAN picked up an address / the PPPoE dial succeeded
2. DNS resolves correctly
3. VLAN interop behaves as expected
4. WireGuard / remote reconnect is still alive

Being able to recover over a wired connection with a monitor attached beats everything else. Write plain-language comments on policy routing rules — in three months you won't understand rule 105.

Try experimental configs on a spare box or a VM first, then roll to production. Keep "playing with routers" and "the house has internet" separate: two hours of downtime while you fix things, and your family's face will teach you more than any new feature ever could.

A month after the rebuild

The ONT is now a pure modem. OpenWrt is the network brain. Guests have their own SSID, IoT can't reach the NAS management port, AdGuard sits on the DNS path, and at traffic peaks the interface graphs show exactly who is transferring what.

There's still debt: the static-IP inventory for some older devices is incomplete, and the switch port-to-VLAN mapping table still deserves a spot on the rack. But the unease from the flat-network era — "anyone could scan anyone" — is gone.

The soft router is the means; isolation and predictability are the point. A home network rebuild isn't successful because it got more complicated. It's successful when, a week after the cut-over, nobody asks "why won't the lights turn on again" — and you know that even if they do, logs and the subnet table will pinpoint it in ten minutes.

That closes this field report. If I touch the network again, it'll be the switch port table going up on the wall, or AdGuard and DHCP responsibilities drawn into a diagram that won't go stale. For now, this network gets to stay stable.