Audit and Manage OpenWrt Base Services

Before installing DNS, DDNS, VPN, or another service, record what is running, which ports are listening, where configuration lives, and how the init script behaves.

1. Record the baseline

ubus call system boardcat /etc/openwrt_releasefree -hdf -huci show systemuci show dhcpls -l /etc/init.d/service list 2>/dev/null || truess -lntup 2>/dev/null || netstat -lntup

Record each port, process, bind address, interface, and service owner.

2. Inspect logs and dependencies

logread | tail -n 100logread -e dnsmasqlogread -e netifdps w

Before replacing DNS, determine whether dnsmasq provides DHCP, DNS forwarding, or both. Do not stop it simply because an external guide says so.

3. Check package feeds and storage

opkg updateopkg list-installeddf -h /overlay /

On releases using apk, use that release’s package tool. Never mix feeds from another release or architecture.

4. Install and test in stages

1. Save the configuration and current port list:

cp -a /etc/config /tmp/config.before-servicess -lntup 2>/dev/null || netstat -lntup

2. Install from the matching feed.
3. Create the minimum configuration and bind to the intended LAN/interface instead of exposing 0.0.0.0 unnecessarily.
4. Run foreground/test mode when supported and read its errors.
5. Confirm that the intended port is free.
6. Enable only after the service responds correctly:

/etc/init.d/SERVICE enable/etc/init.d/SERVICE start/etc/init.d/SERVICE status

Replace SERVICE with the real init script name.

5. Understand init operations

/etc/init.d/SERVICE start/etc/init.d/SERVICE stop/etc/init.d/SERVICE restart/etc/init.d/SERVICE reload/etc/init.d/SERVICE enable/etc/init.d/SERVICE disable/etc/init.d/SERVICE enabled/etc/init.d/SERVICE status

start affects the current boot; enable creates startup links. Test a controlled reboot after enabling.

6. Change ports or DNS safely

Update service configuration, firewall, DHCP/client settings, and the service together. Then verify:

nslookup openwrt.orgnslookup openwrt.org 192.168.1.1dig @192.168.1.1 openwrt.orgss -lntup 2>/dev/null || netstat -lntup

Do not open an administration port on WAN merely for testing. Keep a separate DHCP/recovery path before replacing dnsmasq.

7. Reboot verification and rollback

Before reboot:

uci export > /tmp/uci-before-service.txtlogread > /tmp/log-before-service.txt

After reboot:

uptime/etc/init.d/SERVICE statusss -lntup 2>/dev/null || netstat -lntuplogread -e SERVICE

If it fails:

/etc/init.d/SERVICE disable/etc/init.d/SERVICE stopcp -a /tmp/config.before-service/* /etc/config//etc/init.d/dnsmasq restart/etc/init.d/network restart

Remove packages only after confirming that required data/configuration is backed up.

{{< ads >}}

Source

Source: OpenWrt Base system.