Routers that use OpenWrt or an OpenWrt-based operating system can often be expanded with installable packages. These packages are sometimes called plugins, applications, or add-ons.
A package beginning with luci-app- normally adds a graphical management page to LuCI, OpenWrt’s web interface. It may also install the underlying service automatically. Package availability varies by router, processor, firmware version, and available storage, so readers should confirm compatibility before installing anything.
Here are ten useful router plugins covering security, troubleshooting, performance, monitoring, and convenience.
1. tcpdump: Capture and Examine Network Packets
tcpdump is a command-line packet-capture tool. It can show live packet summaries or save selected traffic in a PCAP file for examination in Wireshark.
It is useful for investigating failed connections, DNS problems, unexpected communication, and unusual traffic patterns. Captures can be limited by device, protocol, interface, port, packet count, or time.
Packet captures may contain addresses, domain requests, session information, and unencrypted data. Capture files should therefore be stored privately and never uploaded to an unknown analysis service.
Official OpenWrt tcpdump information
2. luci-app-sqm: Reduce Bufferbloat and Latency
Smart Queue Management, commonly installed through luci-app-sqm and sqm-scripts, manages how traffic waits to leave the network.
Without effective queue management, a large download or upload can cause substantial delays for gaming, video calls, remote work, and ordinary browsing. This problem is known as bufferbloat.
SQM normally works by shaping the connection slightly below its maximum speed. The measured top speed may decrease, but the connection can feel more responsive while busy. Accurate upload and download values are essential; incorrect settings can unnecessarily limit performance.
3. luci-app-nlbwmon: Track Bandwidth by Device
luci-app-nlbwmon adds a graphical interface for OpenWrt’s network bandwidth monitor. It helps show how much traffic individual network devices have uploaded and downloaded.
This is useful for identifying heavy bandwidth users, investigating unexpected increases in data usage, and establishing a baseline for normal device behavior.
Bandwidth monitoring does not automatically prove that a device is malicious. Software updates, cloud backups, streaming, and game downloads can all generate large amounts of legitimate traffic.
Official nlbwmon package information
4. luci-app-statistics: Create Historical Router Graphs
luci-app-statistics uses tools such as collectd and RRDTool to create graphs showing network utilization, processor load, memory usage, ping results, uptime, disk activity, temperatures, and other measurements.
Historical information is valuable because it allows an administrator to compare current behavior with earlier conditions. It can help identify recurring outages, overloaded interfaces, increasing memory use, or performance changes.
Statistics are commonly stored in temporary memory by default and may disappear after a reboot. Persistent storage must be configured carefully because repeatedly writing data to the router’s internal flash can shorten its life. An external USB drive or another monitoring system may be a better destination.
OpenWrt statistics documentation
5. luci-app-adblock: Add Network-Wide DNS Filtering
luci-app-adblock uses DNS blocklists to prevent devices from resolving known advertising, tracking, or abusive domains. One router-level installation can provide filtering for many devices without requiring a browser extension on each one.
DNS filtering can reduce unwanted connections, but it is not an antivirus product. It cannot examine encrypted webpage contents, repair an infected computer, or guarantee that every malicious destination will be blocked. Devices using their own encrypted DNS service may also bypass the router’s filtering.
Do not run multiple DNS-filtering platforms simultaneously unless their interaction has been planned. For example, a router that already uses AdGuard Home may not need another DNS-blocking package.
6. luci-app-banip: Block Known Unwanted IP Ranges
banIP, managed graphically through luci-app-banip, can load IP-address blocklists into the router’s firewall. Lists may identify addresses associated with abuse, unwanted geographic regions, suspicious networks, or other categories.
This can reduce unwanted connection attempts, but it does not replace a properly configured firewall, secure passwords, firmware updates, or device protection. Large blocklists may consume memory and processing resources. They can also cause false positives by blocking legitimate services that share cloud or hosting infrastructure.
Start with a small, clearly understood list and review the logs before adding more.
7. luci-app-watchcat: Recover from Connection Failures
Watchcat monitors connectivity by periodically contacting a chosen destination. If the test repeatedly fails, it can restart a network interface or reboot the router.
This can be helpful in locations where an unreliable modem or internet connection occasionally stops responding. It can restore service without requiring someone to unplug the equipment.
Watchcat must be configured conservatively. A blocked ping, temporary outage, or poorly selected test destination could cause unnecessary restarts. Automatic recovery should not conceal a recurring problem that requires proper investigation.
Official Watchcat package information
8. luci-app-ddns: Keep a Hostname Updated
Many home internet connections receive a public IP address that can change. Dynamic DNS automatically updates a hostname whenever that address changes.
The luci-app-ddns package provides a graphical interface for supported Dynamic DNS services. This can be helpful when using an authorized VPN server or another securely configured remote-access service.
Dynamic DNS does not secure the router, open a port, or provide a VPN by itself. It only associates a name with the current address. Exposing an administrative page directly to the internet remains dangerous even when Dynamic DNS is used.
OpenWrt Dynamic DNS documentation
9. luci-app-wol: Turn On Compatible Computers Remotely
Wake-on-LAN allows a router to send a special “magic packet” that wakes a compatible computer. luci-app-wol provides a graphical interface for this function.
It can be useful for a computer that does not need to run continuously but occasionally must be accessed for backups, file storage, or authorized remote work.
The computer’s motherboard, network adapter, operating system, and power settings must support Wake-on-LAN. It is usually most reliable over Ethernet. Wake-on-LAN turns the computer on; it does not authenticate a user or provide secure remote access.
OpenWrt Wake-on-LAN documentation
10. luci-app-ksmbd: Share USB Storage on the Local Network
luci-app-ksmbd provides a web interface for configuring KSMBD, a lightweight SMB file server. It can turn a USB drive connected to a compatible router into basic local network storage.
Readers can use it to share documents, transfer files, or create a temporary household storage location. KSMBD generally requires fewer router resources than a complete Samba installation, although it also has fewer features.
File sharing should be restricted to the trusted local network. Use named accounts and strong passwords, disable guest access when it is unnecessary, and never expose SMB directly to the internet. Router storage should not be treated as the only copy of an important file.
Installing Router Plugins Safely
Before installing any package:
- Create a router configuration backup.
- Confirm that the package supports the router’s firmware and processor.
- Check available flash storage and memory.
- Use the router’s official package repository.
- Refresh the package list without blindly upgrading every installed component.
- Install one package at a time.
- Record what was installed and why.
- Test the router after each change.
- Remove packages that are no longer used.
- Keep administrative services inaccessible from the internet.
Vendor firmware may already provide equivalent functionality. Installing a second firewall, DNS service, file server, VPN manager, or monitoring system can create conflicts. Built-in tools should be reviewed before adding replacements.
Final Thoughts
Router plugins can transform a basic gateway into a monitoring, troubleshooting, filtering, storage, and performance-management platform. However, every additional service increases complexity and may introduce new security or maintenance requirements.
The best plugin is not necessarily the one with the most features. It is the one that solves a defined problem, fits within the router’s resources, comes from a trusted source, and can be configured and maintained safely.
Begin with one low-risk tool, document the original configuration, test the results, and only then consider adding another package.