Admin
You
StartWRT
The router software that answers to you. Every device in your home gets a security profile, and all of it runs from a browser that explains every setting. Free, open source, and built on OpenWrt.
Advanced networking for everyone
Keeping the smart TV away from the laptop, sending a guest's traffic through a VPN, letting a server open its own ports: for years each of these meant VLANs, firewall zones and a command line, so most routers were left the way they came. StartWRT is Start9's fork of OpenWrt, the open-source system that has run routers for twenty years, and it turns each of them into a choice in your browser.
No command line
Profiles, Wi-Fi, VPNs and ports are set from a browser. Creating a profile creates the VLAN, the subnet, the DHCP server and the firewall zone underneath it.
Explained in place
Turn on Help and every setting on the screen is described in plain language, with links onward. In English, Spanish, German, French and Polish.
Nothing changes without you
No account, no cloud, and no update installs itself. A new release waits in Settings, signed, with its notes to read first.
Still OpenWrt
The command line and LuCI remain available, and every setting lives in a standard OpenWrt file you can read and change yourself.
Security Profiles
Every device on your network belongs to a profile: Admin, Children, Guest, Smart Devices, or any you create. A profile decides what its devices can reach, which DNS they use, whether they go out directly or through a VPN, and when. Profiles are separated at the network layer, so the thermostat cannot see the laptop.
Password-Based Profiles
Everyone joins the same network name. The password a device connects with decides its profile, so your laptop and a guest's phone share the airwaves and nothing else. The Ethernet port a device plugs into, or the VPN it arrives through, decides it the same way.
Blackout Schedules
Turn the Wi-Fi off on a weekly schedule, for quiet nights or an empty house, and take any one profile offline on a schedule of its own: the children's devices lose the internet at bedtime while yours keep it. Wired devices stay connected through a Wi-Fi blackout.
Inbound VPNs
Reach home from anywhere. Each profile can have a WireGuard server of its own, and a device that connects to it gets that profile, as if it were home: everything for your own phone, or a shared-services profile for a friend who should see the family server and nothing else. Scan a QR code and you are connected.
VPN Chaining
Send any profile through a VPN provider, with no app on any device. Or chain two: the first knows who you are but not where you are going, and the second knows where you are going but not who you are. If a tunnel goes down, its traffic stops rather than leaking out over your home connection.
Published Ports
Open a port to any device, with control over protocol, IP version, source and external port. Or let a device you trust open its own: the permission is off by default, granted per device, and every port it opens expires unless the device renews it. Several services can share one port by hostname.
Built for Self-Hosting
Beside a StartOS server, StartWRT does the networking for you. Grant the server two permissions and it opens the ports its public services need, and publishes the names of its private domains so every device at home finds them.
Dynamic DNS
Most home connections change address without warning. Dynamic DNS keeps a name pointed at yours through Cloudflare, DuckDNS, DynDNS, FreeDNS or No-IP, so your inbound VPNs and published ports keep working when it does.
Help Mode
Turn on Help and every setting on the screen is explained beside it, in plain language, with links onward. The interface is available in English, Spanish, German, French and Polish.
Updates
StartWRT never updates on its own. A new release appears in Settings with its notes, and you choose when to install it. Every release is signed, and the router checks the signature before it installs anything.
In your pocket
Add StartWRT to your phone's Home Screen and it opens like an app: full screen, with its own icon.
Made for a phone Everything you can do from a computer, you can do from your phone.
Nothing in between It talks to your router directly: no app store, no cloud account, no one else's servers.
Home or away On your home network, or from anywhere over your VPN.
Getting StartWRT
Flash it yourself
- DownloadThe image for the BananaPi BPI-F3 with a MediaTek MT7916 Wi-Fi module in its mini PCIe slot. The AsiaRF AW7916-NPD sold with the RISC-V Router is fully supported, and an MT7915 module runs one band at a time.
- Flash and bootWrite the image to a microSD card with balenaEtcher and boot the board from it. The wizard installs the low-level boot firmware itself, so a bare board works the same way.
- Finish in a browserJoin the router over Wi-Fi or a cable, and the setup wizard opens at router.lan. No terminal required.
- Remove the cardFrom then on the router boots from its own storage, and updates arrive in the interface.
Buy the RISC-V Router
- StartWRT, installed and tested.
- A TP-Link 4-port switch, for more wired devices.
- A one-year limited hardware warranty.
- A year of Premium Support.
- A hand in funding the free software itself.
For developers
StartWRT is a fork of OpenWrt, so the underlying system is standard OpenWrt: UCI configuration, fw4 firewall zones, DHCP and WireGuard. On top of it sit a Rust control daemon, an RPC service and CLI built on the same backend as StartOS, and an Angular interface compiled into the binary. The flashable image is assembled from a pinned upstream OpenWrt release plus the Start9 patch and overlay set, so exactly what diverges from upstream is readable in the tree. Issues and pull requests are accepted.