How Open-Source Firmware Projects Are Keeping Old Routers Alive

Router manufacturers have a consistent business model: sell hardware cheaply, support it with firmware updates for a few years, then stop. When a router reaches end-of-life, it stops receiving security patches—which for a device that sits between your home network and the internet is not a trivial concern. Known vulnerabilities accumulate, and the manufacturer has no financial incentive to fix them.

Open-source firmware projects—OpenWrt, DD-WRT, Tomato, and their descendants—have been breaking this cycle for over twenty years. By maintaining actively developed Linux-based firmware that runs on consumer router hardware long past manufacturer end-of-life dates, these projects extend the useful life of hardware, improve security and functionality beyond what the original firmware offered, and demonstrate something interesting about what open-source communities can do with consumer electronics.

How Open-Source Router Firmware Works

Consumer routers run embedded Linux (or sometimes RTOS). The hardware itself—a MIPS or ARM processor, flash storage, RAM, wireless radios—is general-purpose computing hardware. The manufacturer’s firmware is software running on this hardware, and in principle, any compatible software can replace it.

OpenWrt, the most actively maintained and widely-supported project, is a full Linux distribution specifically designed for embedded networking hardware. It includes a complete Linux kernel, a package management system (opkg), a web administration interface (LuCI), and a large collection of networking software packages. Where the manufacturer’s firmware might offer twenty configuration options, OpenWrt exposes the full capability of the underlying networking software: complex firewall rules, traffic shaping, VLAN configuration, VPN server functionality, custom DNS, bandwidth monitoring, and hundreds of other capabilities that consumer firmware never exposes.

The OpenWrt project maintains a hardware compatibility table—thousands of router models with documented support status, installation instructions, and known limitations. For supported hardware, installation typically involves downloading the appropriate firmware image (specific to the router model), uploading it through the router’s web interface or via TFTP, and following device-specific instructions. The process varies from straightforward to finicky depending on the device, and some devices require physical modification (JTAG or serial console access) if the normal flash process fails.

DD-WRT is an older alternative that predates OpenWrt and has broader hardware support for some older devices, though its development pace has slowed compared to OpenWrt. Tomato and its forks (FreshTomato, AdvancedTomato) are alternatives popular for their simpler interfaces and strong bandwidth monitoring features, with narrower hardware support. For most new installations, OpenWrt is the recommended starting point due to its active development and extensive package ecosystem.

The Security Case

The security argument for open-source firmware is straightforward: a router with no vendor updates is a router accumulating unpatched CVEs. The list of high-severity vulnerabilities in consumer router firmware—remote code execution, authentication bypass, hardcoded credentials—is long and consistently underappreciated by home users who replace routers infrequently.

OpenWrt addresses this by:

Ongoing security updates. The OpenWrt project releases security patches as vulnerabilities are discovered in the underlying software components. A router running a current OpenWrt version receives security updates regardless of how old the hardware is, as long as the hardware is supported.

Software provenance and transparency. The entire software stack—kernel, networking daemons, configuration tools—is open-source and auditable. Vendor router firmware often contains closed components whose behaviour is unknown and potentially concerning. OpenWrt has no undisclosed remote management, no data collection that the user hasn’t configured, and no proprietary code of unknown provenance.

Reduced attack surface. Consumer router firmware typically runs many services by default. OpenWrt installs minimal packages by default; additional functionality is installed explicitly. This reduces the attack surface compared to firmware that enables services the user doesn’t know about or need.

The counterargument is that open-source firmware may introduce its own vulnerabilities through misconfiguration or through the additional complexity that comes with greater capability. This is a real concern: a user who installs OpenWrt and then misonfigures the firewall, or installs a vulnerable package, may be worse off than they were with vendor firmware. But for users willing to engage with the configuration, the security posture is generally better.

Performance and Capability Improvements

Beyond security, open-source firmware often delivers meaningful performance improvements over vendor firmware on the same hardware. Vendor firmware is written to support marketing-friendly features and to pass certification testing, not to maximise throughput. OpenWrt’s networking stack is tuned for performance, and community-developed improvements to wireless drivers, bufferbloat mitigation (SQM/fq_codel), and packet processing have produced measurable improvements in latency and throughput on hardware where the vendor firmware was mediocre.

SQM (Smart Queue Management) deserves specific mention: it’s an active queue management technique that dramatically reduces bufferbloat—the latency inflation caused by excessive buffering in routers under load. Vendor routers almost universally have terrible bufferbloat characteristics; a few lines of SQM configuration in OpenWrt can reduce ping times under load from hundreds of milliseconds to single-digit milliseconds on the same hardware. For gaming, video calls, and any application sensitive to latency, this improvement alone can justify the firmware change.

The package ecosystem also adds capabilities that vendor firmware doesn’t have. Running a WireGuard VPN server on the router itself (rather than on a separate device), ad-blocking at the DNS level for the entire network, precise traffic monitoring by device, custom DHCP reservations and DNS configurations, and wake-on-LAN management are all achievable through OpenWrt packages that install and configure in minutes.

The Hardware Longevity Effect

Router hardware that would otherwise be e-waste becomes genuinely useful infrastructure when open-source firmware is maintained for it. A router purchased ten years ago, with manufacturer support long ended, running current OpenWrt and receiving security patches is a better security proposition than a new consumer router that will be abandoned by its manufacturer in three years.

The economics are interesting from a right-to-repair and sustainability perspective. A router with good OpenWrt support can be purchased used for £10–30 and, with a few hours of configuration, provide better functionality and security than most consumer alternatives. The TP-Link Archer series, older Netgear routers, and various Linksys models have particularly good OpenWrt support and can be found cheaply on the secondhand market.

The OpenWrt hardware support table’s longevity record is remarkable: devices from 2006 still have active forum support, though kernel updates for very old architectures eventually stop. Current OpenWrt releases support hardware from the early 2010s alongside current devices. This is a stark contrast to vendor firmware practices, which commonly provide two to four years of support for router hardware regardless of the device’s functional capability.

The Limitations and Realistic Scope

Open-source router firmware isn’t without drawbacks and isn’t appropriate for all users.

The installation process ranges from easy (fifteen minutes with a compatible device) to risky (a failed flash can “brick” the router, rendering it non-functional without hardware-level recovery). First-time installations require reading documentation carefully and following device-specific instructions precisely. The OpenWrt forums and wiki are extensive, but troubleshooting a bricked router requires comfort with the underlying hardware.

The default configuration of OpenWrt is minimal—a working router, but with no wireless security configured, no DHCP server on some installations, and a sparse interface compared to consumer-oriented firmware. Setting up a fully configured, well-secured OpenWrt installation requires more configuration work than using vendor firmware. For non-technical users, this overhead may outweigh the benefits.

Hardware support has gaps: not all routers are supported, and the quality of support varies. Some devices have full support with well-maintained wireless drivers; others have partial support with known limitations. Checking the hardware table before purchasing a device for OpenWrt is essential.

For users willing to invest the setup time, the combination of current security patches, improved performance, greater capability, and extended hardware life makes open-source firmware a compelling choice. For anyone running an end-of-life router with no vendor updates, it’s worth taking seriously as the alternative to replacing hardware that is functionally fine but increasingly insecure.