If you want a router that runs OpenWrt, the label on the box tells you less than you’d expect. GL.iNet ships its own OpenWrt fork on every unit, but only some of its models take a vanilla OpenWrt image. Cudy sells two routers named WR3000 and only one of them is supported, and the much-hyped Flint 4 has no mainline build at all.
So this guide sorts the hardware by one question first: does the current stable OpenWrt release ship an image for it? We checked each pick against the official 25.12.6 image list and the OpenWrt hardware pages, then ran 25.12.6 in a Proxmox VM on October 19, 2026 to capture the new package workflow. No router in this guide was bench-tested by us, and the throughput figures come from the reviewers named beside them.
Mainline support decides the shortlist
A router on mainline OpenWrt gets security releases straight from the project, while a vendor fork waits for the vendor. That gap matters right now, because 25.12.6 landed on October 18, 2026 with fixes for uhttpd flaws reachable without logging in. Here is where each candidate stands in that release:
| Router | 25.12.6 image | Price checked | Where to buy |
|---|---|---|---|
| GL.iNet Flint 2 (GL-MT6000) | Yes | $169.99 | Amazon, GL Technologies |
| OpenWrt One | Yes, ships with it | $145.99 | Amazon (unofficial seller), AliExpress from $125 |
| Banana Pi BPI-R4 (4 GB) | Yes | $399.99 Basic Kit | Amazon, WayPonDEV |
| Cudy WR3000P v1 | Yes | $89.99 | Amazon, Cudy |
| GL.iNet Beryl 7 (GL-MT3600BE) | Yes | $129.99 | Amazon, GL Technologies |
| Protectli VP2430e (x86) | Yes, x86/64 target | $469.00 barebones | Amazon, Protectli |
| GL.iNet Flint 4 (GL-BE14000) | No | $369.99 | GL.iNet store only |
We took the support column from the release’s own image profile list, not from vendor marketing. In practice this means the Flint 4 is a GL.iNet router that happens to be built on an older OpenWrt base, and the other six are machines you can wipe and run the project’s own images on.
OpenWrt 25.12 on a lab VM
For anyone coming from an older router, the biggest change is the package manager. OpenWrt switched from opkg to apk in 25.12.0, and the release notes say the opkg fork is no longer maintained. We booted the official x86-64 image in a one-core, 512 MB Proxmox VM to see what that looks like on a fresh install.
Our lab LAN already has a router at the address OpenWrt claims by default, so before the first boot we dropped a uci-defaults script into the image. It turns the LAN into a DHCP client and stops OpenWrt from serving DHCP or router adverts on a network it doesn’t own:
uci set network.lan.proto='dhcp'
uci -q delete network.lan.ipaddr
uci -q delete network.lan.netmask
uci set dhcp.lan.ignore='1'
uci set dhcp.lan.ra='disabled'
uci set dhcp.lan.dhcpv6='disabled'
uci commit network
uci commit dhcp
exit 0We used the BIOS generic-ext4-combined image, gunzipped it, mounted its second partition on the Proxmox host with a loop device and saved the script as /etc/uci-defaults/99-lab before importing the disk. The squashfs images will not take the file because that partition is read-only. The name matters too: the 15_odhcpd script switches router adverts and DHCPv6 back on during first boot, so the file has to sort after it. On first boot the VM took a lease from the existing router, uci show dhcp.lan confirmed ra and dhcpv6 stayed disabled, and the board report confirmed the release:
ubus call system boardIts JSON reply carries a release block with the exact build:
"distribution": "OpenWrt",
"version": "25.12.6",
"firmware_url": "https://downloads.openwrt.org/",
"revision": "r33311-981c978eff",
"target": "x86/64",
"description": "OpenWrt 25.12.6 r33311-981c978eff",Typing opkg no longer works at all, and the shell answers with ash: opkg: not found. Refreshing the package index is now an apk call:
apk updateEight feeds load, and the kmods feed path carries the exact kernel build, so kernel modules only install against the kernel that shipped with the release:
OK: 11220 distinct packages availableAdding WireGuard with its LuCI page shows how dependencies resolve. We installed it with one command:
apk add luci-proto-wireguardapk pulled 12 packages, including the kernel crypto modules and wireguard-tools, and ended with this line:
OK: 20.0 MiB in 194 packagesThe fresh image had 182 packages and used 22.7 MB of its 98.3 MB root filesystem, and WireGuard took that to 23.5 MB. That is the real constraint on small routers: a 16 MB NOR flash device like the original WR3000 has far less room for extras than a box with eMMC or NAND. Our OpenWrt on Proxmox guide covers the full VM build, and the opkg to apk cheatsheet maps the old commands to the new ones.
The routers we’d shortlist
Each pick below states the job it does best, how hard it is to get onto vanilla OpenWrt, and who should spend their money elsewhere.
GL.iNet Flint 2: best overall for vanilla OpenWrt
We’d buy the Flint 2 for a home that wants mainline OpenWrt without turning it into a project. It has a MediaTek Filogic 830, 1 GB of RAM, 8 GB of eMMC, two 2.5G ports, four 1G ports and 4×4 Wi-Fi 6, and it has had a mainline image since 23.05.3.
- Flashing: upload the official sysupgrade image from the GL web UI with keep settings off. The hardware page warns that a factory image can brick it.
- Throughput: ServeTheHome measured about 4.8 Gbps bi-directional NAT across the two 2.5G ports, on firmware the review does not name.
- Power: the same review saw about 5.6 W idle and never more than 12 W.
Look elsewhere for Wi-Fi 7 or any 10G port. For Wi-Fi 7 hardware, our Wi-Fi 7 router guide covers where mainline support really stands. The Flint 3 at $209.99 is the Wi-Fi 7 model in the same family, but it has no mainline image.
OpenWrt One: best for OpenWrt purists
OpenWrt One is the project’s own hardware, designed with the Software Freedom Conservancy and built by Banana Pi, so it ships with OpenWrt and never needs flashing. It runs a Filogic 820 with 1 GB of RAM, 256 MiB of NAND and a separate 16 MiB NOR chip for recovery, with one 2.5G WAN port that accepts PoE, one 1G LAN port and Wi-Fi 6.
Buy it for that NOR recovery chip: a bad flash is recoverable with a switch, which makes it the safest board to learn on. The Conservancy page lists it from $125 on AliExpress and names the Amazon sellers as unofficial, so the $145.99 Amazon price is a convenience premium. The hardware page also notes that batches from October 2025 shipped with a detached M.2 2230 standoff. Skip it if you need more than two wired ports or whole-home Wi-Fi coverage.
Banana Pi BPI-R4: best 10G board
Pick the BPI-R4 when the WAN or the uplink to your switch is 10G. It pairs a Filogic 880 with 4 GB of RAM, two 10G SFP+ cages, four 1G ports, eMMC, NAND and an M.2 NVMe slot, and the Wi-Fi 7 card is a separate module.
- Throughput: AndroidPIMP measured 8.24 Gbit/s over a 10GBASE-T SFP+ module with iperf at 10 streams, without naming the build it ran.
- RAM variants: stable 25.12 boots the 8 GB board but only uses 4 GB of it, and full 8 GB support is snapshot-only, per the hardware page; the 4 GB version is the better buy.
- Pro models: the R4 Pro 8X and 4E run only on development snapshots for now.
- Wi-Fi module: the board-only listing at $334.99 states that the Wi-Fi 7 module is not included. The $399.99 Basic Kit listing does not spell out its contents, so check the photos before you order.
Installing it means writing an SD card, setting DIP switches and copying the system to NAND or eMMC, and a serial console helps when something goes wrong. We’d reach for it when 10G is the requirement, and pair it with one of the 10GbE managed switches we’ve covered. If you want a finished router in a case, this is the wrong board.
GL.iNet Flint 4: the Wi-Fi 7 flagship on GL’s own fork
The Flint 4 is the most capable hardware GL.iNet sells for the home, and the weakest case for an OpenWrt buyer. It has a Filogic 880, 2 GB of RAM, 64 GB of eMMC, a 10G SFP+ port, a 10G RJ45 port, four 2.5G ports, four 1G ports, tri-band Wi-Fi 7 and a small touchscreen. GL.iNet opened preorders on August 4, 2026 at $299, and its store listed it at $369.99 when we checked, shipped from its China warehouse.
There is no vanilla OpenWrt image for it in 25.12.6 or in the development snapshots. WickedYoda reported the beta firmware as an OpenWrt 21.02 snapshot on kernel 5.4, and found that “the main weak spot right now is QoS.” Oztech Solutions measured about 756 to 799 Mbps of WireGuard downloads to public VPN servers on an early alpha build, so the line, not the router, may have set that ceiling. In a July 2026 first look, before preorders opened, NAS Compares wanted “full review testing before calling it a safe blind buy”, and that still applies.
Buy it if you want GL.iNet’s interface, 10G ports and Wi-Fi 7 in one box today and are happy on the GL firmware. Skip it if the reason you’re shopping is vanilla OpenWrt, current kernels or apk, because it offers none of the three yet.
Cudy WR3000P v1: best budget pick
At $89.99, the WR3000P is the cheapest router here with a mainline image and a 2.5G port. It has a Filogic 820, 512 MB of RAM, 128 MB of NAND, a 2.5G WAN port that takes PoE, four 1G LAN ports and Wi-Fi 6.
Flashing takes two steps: a Cudy-signed intermediate image from the stock web UI, then the official sysupgrade. The hardware page asks for 24.10.5 or newer and a current Cudy intermediate image, because Cudy changed the NAND chip inside v1 without a new version number. PoE-in is untested under OpenWrt. The trap is the name. The plain WR3000 version 2.0 uses a TRIDuctor chip OpenWrt does not support, and Amazon sells it as a WR3000 V2.0, so check that the label says WR3000P before you flash anything. We found no independent throughput test of this model, so we won’t quote one.
GL.iNet Beryl 7: cheapest mainline Wi-Fi 7
The Beryl 7 is a travel router, but at $129.99 it is the cheapest mainline Wi-Fi 7 unit we found on Amazon US. That makes it a cheap way to run current OpenWrt on Wi-Fi 7 for a small flat or a lab, and our travel router guide covers it as a VPN box. Flashing works like the Flint 2: upload the sysupgrade image from the GL web UI with keep settings off, and never use a factory image. The hardware page says Wi-Fi performance and stability on its MT7990 chip still need work, so expect rough edges. Skip it as a whole-home router, because it is built and sized as a travel unit.
Protectli VP2430e: best x86 OpenWrt appliance
An x86 box runs the generic x86/64 image we used in the lab, so every package and kernel update lands the same day as on any other target. The VP2430e has an Intel N150 and four 2.5G ports, and is the VP2430 without its eMMC storage. Protectli now offers Vaults with OpenWrt preinstalled, and it sells the VP2430e direct at $419.
Amazon lists it barebones at $469, $50 more than Protectli’s own store, so add RAM and an SSD, and pair it with a separate access point because it has no Wi-Fi. The UDPTCP N150 barebone at $329.99 is the cheaper white-label option with the same CPU and four 2.5G ports. If you’re weighing OpenWrt against a firewall distro on the same hardware, our pfSense and OPNsense hardware guide covers that side.
The scaling path
Most homes start with one all-in-one router and outgrow it in a predictable order. This is how we’d grow each of these setups:
- One box: a Flint 2 or WR3000P does routing, Wi-Fi and DHCP, and costs $90 to $170.
- Router plus access points: keep the router for routing and add access points running OpenWrt in dumb AP mode when one radio no longer covers the house.
- Wired router plus Wi-Fi: move routing to the BPI-R4 or an x86 box once the WAN or the core switch reaches 10G, and treat Wi-Fi as a separate layer.
At the second step, a PoE switch saves running power to every access point, and our PoE switch guide covers the options. Whatever the layout, stay on a release that ships images for your hardware, because security fixes like 25.12.6 reach mainline routers directly, while forks wait on the vendor.
