Flint 2 (GL-MT6000) and OpenWrt

Migrating from the Linksys WRT3200ACM isn't as simple given the two routers are different archectiures. Restoring a config backup directly could lead to some weird issues given the differences in ports/switch setup.

Planning the migration

• Vanilla OpenWrt 25.12.6 build (replacing the Stock firmware)
• Take a config backup from the current router - Allows me to have config files available to restore later.
• The preparation of the new router can be done completely offline with a direct LAN ethernet connection to flash and configure before swapping out, despite having no WANs configured.

Dump some information from the current router for preparing the switch:

sysupgrade -b /tmp/backup-linksys-wrt3200acm.tar.gz
sysupgrade -l > /tmp/kept-files.txt     # every file the backup includes
apk audit > /tmp/changed-files.txt      # files changed from package defaults
cat /etc/apk/world > /tmp/world.txt     # explicitly installed packages

This gives me a rough idea of the customised areas I need to restore or be aware of. Download the files locally from the router.

Stock firmware

The stock firmware is a customised build of OpenWrt. Nice. While I didn't really use the stock firmware for longer than around 10 minutes, there are some nice features built-in, and the interface is well designed for those who are less technical, LuCI can be overwhelming initially for someone who's not familiar with OpenWrt. A vanilla OpenWrt build will provide the latest firmware, packages and customisation options to do what we want.

Sysupgrade

Using the /etc/apkworld output, I can use this to generate a new sysupgrade image for the Flint 2 with the core base image and any additional packages required that are currently installed on the Linksys WRT3200ACM. It is important to remove kmod/drivers which are specific to mvebu e.g. mwlwifi as these have no use on a Flint 2. In addition, advanced reboot, given the dual partition layout of the Linksys WRT3200ACM no longer applies here so it can be dropped from the image.

While the sysupgrade process can also directly write config files into the image, many of these are sensitive keys. Using the public image builder web application would be risky for this, running locally would allow for this to be safer, but it is fairly easy to just restore configs from the /etc/config path via SSH later on once the new router is flashed.

Flashing a sysupgrade image is relatively simple, the default stock firmware interface is at 192.168.8.1, go to the upgrade page and use the local file option to upload a sysupgrade file, do not use a factory image. Do not keep settings.

Apply main config areas first onto the new router:

• WAN interfaces
• Global network options (ULA /48 from previous router)
• DNS
• DHCP leases
• SSH keys
• Device name

Restore configs over SSH which can be directly replaced without changes e.g. doesn't rely on switch/network devices, to prepare switching over and reducing downtime.

WAN configuration

The WAN configuration is slightly different compared to the Linksys WRT3200ACM restoring the network devices config directly requires tweaking. The default WAN1/port network device on the Flint 2 is eth1.

This router features a 2.5 Gbps dual port WAN. If you use the stock firmware, this dual WAN setup is handled in a custom way. Under vanilla OpenWrt firmware, it is a single WAN port with the second port being LAN1, however you can use VLANs and repurpose any LAN port as a WAN if you are doing multi-WAN, which I am with mwan3 (nftables port).

LAN1 will become another WAN port just as a 1 Gbps port instead. The second WAN is not gigabit and therefore this doesn't matter.

• Primary WAN: Aquiss Full Fibre Broadband 330 mbps/50 mbps
• Secondary WAN: Virgin Media Hybrid Fibre Coaxial (HFC) 500 mbps/52 mbps

Why is the lower speed WAN the primary? The Aquiss line is Business Broadband with a static IPv4 and IPv6. Virgin Media still doesn't provide IPv6 natively, still rocking a HE.net IPv6 tunnel for that!

Baby jumbo frames

My primary WAN supports this. There is a benefit of reducing packet fragmentation by enabling baby jumbo frames over PPPoE.

Additional network config for setting the baby jumbo frames MTU values:

# /etc/config/network
config device
        option name 'wan'
        option mtu '1500'
        
config device
        option name 'eth1'
        option mtu '1508'

Restart the PPPoE interface after applying the MTU changes. Setting the MTU values above may cause a disconnect or the interface status showing an error, this is normal as the PPPoE connection needs to reconnect with the new MTU settings to establish a working connection again.

Perform a ping test (1472 + 28 = 1500, should succeed without any errors)

ping -M do -s 1472 1.1.1.1

If you get "message too large", check your MTU settings are correct.

Bufferbloat/Smart Queue Management (SQM)

apk add sqm-scripts luci-app-sqm	

Network > SQM QoS

Your mileage may vary here. Use this as general guidance but not necessarily the exact configuration you should copy.

Doing a baseline buffetbloat test without any SQM enabled is recommended first. Using the Waveform tool you can see the current performance without any SQM applied.

My baseline test was scored as C. Upload having noticeable latency spikes under load when testing which is common.

Download latency even when underload generally seemed OK, therefore no ingress limit set. Review your own download test results to determine if you need to apply SQM for ingress traffic.

# /etc/config/sqm
config queue 'eth1'
        option enabled '1'
        option interface 'eth1'
        option download '0'
        option upload '40000'
        option qdisc 'cake'
        option script 'piece_of_cake.qos'
        option linklayer 'none'
        option use_mq '0'
        option debug_logging '0'
        option verbosity '5'

After implementing SQM for upload, scored A on the buffetbloat test, still some latency, but mostly tolerable and an improvement without any management applied.

General rule, set Upload speed (egress) starting at around 85% of the maximum speed of the line, average speed quoted by Aquiss is usually within this percentile range e.g. 85/90%.

Generally maxing out upload will lead to latency/buffetbloat issues, sacrificing a small portion of it, generally provides overall better latency.

Routing/NAT Offloading

Network > Firewall > Routing/NAT Offloading

If using SQM, mwan3 for multi-WAN or any other tool which relies on marking/routing packets, do not enable this setting. While the Flint 2 NAT hardware offloading is fully supported, these tools rely on being able to inspect, mark and route packets with netfilter, which they will not be able to do if hardware offloading is enabled as this bypasses the CPU/netfilter path entirely. Given the quad-core CPU however, even without hardware offloading the performance is pretty good, even in areas like OpenVPN or Wireguard.

You can run something like htop when the router is underload to determine how busy each CPU core is. Chances are that you won't have any problems.

Packet Steering

Network > Interfaces > Global network options > Packet Steering

This can be enabled. It is recommended to set to "Enabled (all CPUs)" to use all 4 cores.

irqbalance

Services > irqbalance

Given my specific WAN speeds and packet steering being enabled, this is not required and could have a negative impact in some cases.

If however you have a higher speed line e.g. 1 Gbps+ or find a CPU being maxed out during a speedtest, you can test it out to see if it helps.

apk add irqbalance luci-app-irqbalance

Wireless

Network > Wireless

This router is WiFi 6 (802.11ax) and supports WPA3, you might need to use mixed mode to allow both WPA2 and WPA3, depends on the clients connecting. There are newer Flint routers which are WiFi 6E/7, but they do not have native OpenWrt support for flashing a vanilla build (officially). I don't really have many WiFi 7 clients connecting on my LAN, so WiFI 7 is not a major benefit at this time.

Radio interface assignments:

• Radio0 - 2.4 GHz (2G band)
• Radio1 - 5.0 GHz (5G band)

Multi SSID works fine, make sure to set the correct Country Code on each SSID.

Unlike the Linksys WRT3200ACM the radio interfaces are reversed, so reapplying wireless config selectively is needed for the SSIDs to match from my original setup.