wifihaven → Set up your router

Set up your router

wifihaven runs as a small agent on an OpenWrt router — that router becomes your household gateway and enforces every profile, schedule, and blocklist at the connection layer. This page gets you from a boxed router to a running agent.

Flash vanilla OpenWrt first — this is the supported path. Every router we recommend must run vanilla OpenWrt before the agent will work. The GL.iNet boxes ship GL.iNet’s own forked OpenWrt-based firmware out of the box, but that stock firmware is not a supported target: the agent can’t install on it and has no way to enforce blocking there. So “it already runs OpenWrt” is not enough — it still needs a clean vanilla-OpenWrt flash, exactly like the mainline Netgear. The per-router guides below walk that flash, the checksum check, and the recovery path if anything goes wrong.

1. Pick your router and flash it

Choose your model for a step-by-step flash guide — image download, checksum verification, the flash method for that vendor, how to turn on Wi-Fi (vanilla OpenWrt ships with it off), and how to recover if a flash goes wrong.

GL.iNet Flint 2 (GL-MT6000)

The reference hardware. Quad-core aarch64, dual-band Wi-Fi 6, 2.5G WAN — headroom for line-rate filtering at gigabit.

Flash guide →

GL.iNet Flint (GL-AX1800)

The smaller, cheaper sibling — Wi-Fi 6, gigabit Ethernet. A solid pick for lighter households.

Flash guide →

Netgear WAX206 (AX3200)

An inexpensive mainline-OpenWrt target (MediaTek MT7622, Wi-Fi 6, 2.5G WAN). Great value if you’re comfortable flashing.

Flash guide →

Running different OpenWrt hardware? Any router on the OpenWrt supported-devices list works — flash vanilla OpenWrt from the OpenWrt Firmware Selector, then jump to step 2.

2. Install the wifihaven agent

Once the router is on vanilla OpenWrt, SSH in as root and run the one-line installer:

sh -c "$(uclient-fetch -qO - https://raw.githubusercontent.com/wifihaven/wifihaven/main/openwrt/install.sh)"

It installs the agent and prompts for the API URL (accept the default cloud API), a one-time enrollment token, and your LAN prefix. The full walkthrough — including verification and troubleshooting — is in the OpenWrt install guide on GitHub.

3. Get your enrollment token

The installer asks for a one-time enrollment token. Create a router on the Routers tab in the app to mint one, then paste it into the installer when prompted.

4. What to expect when you enable blocking

wifihaven blocks at the connection layer, not by faking DNS — so a block you just turned on is not instant. The router learns a site’s addresses when a device looks them up through it, so a new block becomes fully effective only after the policy reaches the router (a few seconds) and the device does a fresh DNS lookup for that site. Until then, cached lookups and connections already open keep working.

Testing a block right away? Flush the device’s DNS cache and reload the site — that forces a fresh lookup through the router and the block takes hold. Give it a minute or two otherwise; it warms up on its own. A blocked http:// site shows the block page; a blocked https:// site shows a certificate warning or simply fails to connect (we don’t intercept encrypted traffic — that’s expected, not a bug).

Some device settings route around any network-level filter by design:

A VPN or Cloudflare WARP sends all traffic (including DNS) off your network through the VPN, where the router can’t see or filter it.
“Secure DNS” / DoH / DoT / iCloud Private Relay bypass the router’s DNS, so it never learns which site a device is visiting. wifihaven has opt-in settings to counter these (strict IP-only mode and an encrypted-DNS block), off by default.

If a block seems ineffective, check for those first. The full, engineering-level explanation is in How enforcement takes effect.

Get an enrollment token → Browse all docs on GitHub