Audit and Manage OpenWrt Base Services

Before installing DNS, DDNS, VPN, or another service, record what is running, which ports are listening, where configuration lives, and how the init script behaves.

1. Record the baseline

ubus call system board
cat /etc/openwrt_release
free -h
df -h
uci show system
uci show dhcp
ls -l /etc/init.d/
service list 2>/dev/null || true
ss -lntup 2>/dev/null || netstat -lntup

Record each port, process, bind address, interface, and service owner.

2. Inspect logs and dependencies

logread | tail -n 100
logread -e dnsmasq
logread -e netifd
ps w

Before replacing DNS, determine whether dnsmasq provides DHCP, DNS forwarding, or both. Do not stop it simply because an external guide says so.

3. Check package feeds and storage

opkg update
opkg list-installed
df -h /overlay /

On releases using apk, use that release’s package tool. Never mix feeds from another release or architecture.

4. Install and test in stages

1. Save the configuration and current port list:

cp -a /etc/config /tmp/config.before-service
ss -lntup 2>/dev/null || netstat -lntup

2. Install from the matching feed.
3. Create the minimum configuration and bind to the intended LAN/interface instead of exposing 0.0.0.0 unnecessarily.
4. Run foreground/test mode when supported and read its errors.
5. Confirm that the intended port is free.
6. Enable only after the service responds correctly:

/etc/init.d/SERVICE enable
/etc/init.d/SERVICE start
/etc/init.d/SERVICE status

Replace SERVICE with the real init script name.

5. Understand init operations

/etc/init.d/SERVICE start
/etc/init.d/SERVICE stop
/etc/init.d/SERVICE restart
/etc/init.d/SERVICE reload
/etc/init.d/SERVICE enable
/etc/init.d/SERVICE disable
/etc/init.d/SERVICE enabled
/etc/init.d/SERVICE status

start affects the current boot; enable creates startup links. Test a controlled reboot after enabling.

6. Change ports or DNS safely

Update service configuration, firewall, DHCP/client settings, and the service together. Then verify:

nslookup openwrt.org
nslookup openwrt.org 192.168.1.1
dig @192.168.1.1 openwrt.org
ss -lntup 2>/dev/null || netstat -lntup

Do not open an administration port on WAN merely for testing. Keep a separate DHCP/recovery path before replacing dnsmasq.

7. Reboot verification and rollback

Before reboot:

uci export > /tmp/uci-before-service.txt
logread > /tmp/log-before-service.txt

After reboot:

uptime
/etc/init.d/SERVICE status
ss -lntup 2>/dev/null || netstat -lntup
logread -e SERVICE

If it fails:

/etc/init.d/SERVICE disable
/etc/init.d/SERVICE stop
cp -a /tmp/config.before-service/* /etc/config/
/etc/init.d/dnsmasq restart
/etc/init.d/network restart

Remove packages only after confirming that required data/configuration is backed up.

Source

Source: OpenWrt Base system .