Installing the DawnVPN router program on OpenWrt

There are two ways to install:

A. Automatic. The DawnVPN Windows client installs the program on a router that already runs OpenWrt and checks it for you.
B. Manual. You download the pack for your router and OpenWrt version, check it, copy it over with scp and run the install script.

Supported routers and packs

Router	CPU	OpenWrt	Package manager	Pack
Cudy TR3000 (256 MB, board `cudy,tr3000-256mb-v1`)	aarch64 (MT7981, `mediatek/filogic`)	24.10.5	opkg (`.ipk`)	`quicvpn-tr3000-openwrt-24.10.5-20261028-ffd8045b.tar.gz`
Cudy TR3000	aarch64	25.12.6 (kernel 6.12.112)	apk (`.apk`)	`quicvpn-tr3000-openwrt-25.12.6-20261028-ffd8045b.tar.gz`
Xiaomi Redmi AC2100	mipsel 24kc soft-float (`ramips/mt7621`)	23.05.5	opkg	`quicvpn-ac2100-openwrt-23.05.5-20261028-ffd8045b.tar.gz`

Never install one router's pack on the other: the install script stops if uname -m doesn't match.

A. Automatic install (Windows client)

The Windows screens aren't final, so the steps below are kept general.

A1. Router already runs OpenWrt (one-click install)

Connect the PC to the router over a network cable (preferred) or its Wi-Fi.
In the DawnVPN Windows client, open the router installer. It looks for the router at the gateway address or at the usual ones: 192.168.8.1, 192.168.1.1 and 192.168.2.1 (AC2100).
It signs in over SSH as root and reads /tmp/sysinfo/board_name, uname -m and the OpenWrt version. From those it picks the right pack: TR3000 on 24.10, TR3000 on 25.12, or AC2100.
It uploads the files and checks every SHA256 against SHA256SUMS.json.
It runs the install script and waits for INSTALL_TR3000_DONE (or INSTALL_AC2100_DONE).
It checks http://127.0.0.1/api/discover on the router, then opens the router's admin page.

A2. Router not on OpenWrt yet (flashing)

Flashing methods differ by device. To get OpenWrt onto your router, follow your device's manual or the official OpenWrt documentation (https://openwrt.org/docs/). Then install our program with the one-click installer (A1) or by hand (B).

Optional resources for the Cudy TR3000 (Cudy 2.5.21 → OpenWrt 24.10.5). Each file has a .sha256 file next to it; the full list is at https://client.tinystone.us/downloads/manifest.json:

File	URL	SHA256
`recovery.bin`	https://www.tinystone.us/downloads/router/tr3000/cudy-2.5.21_openwrt-24.10.5/recovery.bin	`8762df3d172107ea0fd4f5efd348df91f9581ab73d970062344a31f546d34637`
`sysupgrade-intermediate.bin`	https://www.tinystone.us/downloads/router/tr3000/cudy-2.5.21_openwrt-24.10.5/sysupgrade-intermediate.bin	`702d8a0019f50d81565bf2b7d0eecd1ca4e1720937b1f8340bd4be77c79a2552`
`openwrt-sysupgrade.bin`	https://www.tinystone.us/downloads/router/tr3000/cudy-2.5.21_openwrt-24.10.5/openwrt-sysupgrade.bin	`0cffd428f472f3800c1aa1a1a08910d0630ae04c36247c7e6c98a5fc22cdf9d9`

B. Manual install on an existing OpenWrt

B1. What you need

A Cudy TR3000 on OpenWrt 24.10.x or 25.12.x, or a Redmi AC2100 on OpenWrt 23.05.5.
The router's LAN address. Usually it's 192.168.8.1 or 192.168.1.1 for the TR3000 and 192.168.2.1 for the AC2100.
SSH access as root. On a new OpenWrt, set the root password first with passwd.
A computer with ssh, scp and tar. Windows 10/11 has all three built in.
Internet connection: only DHCP WAN is supported; PPPoE dial-up is not. Put the router behind a modem or upstream router that hands out addresses by DHCP. After install, LuCI is turned off; all management goes through our admin page on port 80.
To check the router: sh ssh [email protected] 'uname -m; uname -r; cat /tmp/sysinfo/board_name; . /etc/openwrt_release; echo $DISTRIB_RELEASE' You should see aarch64, a board name containing tr3000, and 24.10.x or 25.12.x. On 25.12 the bundled kernel modules only fit kernel 6.12.112. With any other 25.12 kernel, the router needs internet access while you install.

B2. Download and check

Proposed (not yet on the website): see "Website download entries" at the end. Until the files are uploaded, the links below don't work yet.

https://www.tinystone.us/download/router/tr3000/pack/20261028-ffd8045b/quicvpn-tr3000-openwrt-24.10.5-20261028-ffd8045b.tar.gz
https://www.tinystone.us/download/router/tr3000/pack/20261028-ffd8045b/quicvpn-tr3000-openwrt-25.12.6-20261028-ffd8045b.tar.gz
https://www.tinystone.us/download/router/ac2100/pack/20261028-ffd8045b/quicvpn-ac2100-openwrt-23.05.5-20261028-ffd8045b.tar.gz

Each file has a .sha256 file with the same name. The expected values are:

Pack	Bytes	SHA256
tr3000 24.10.5	11,790,613	`abd881f3b529c924fe0a504e2f78d5af9d21860d6586fee3f636a27da7ba74ae`
tr3000 25.12.6	11,643,601	`7821c6ddd36e54d867eae7a5901f6e4df304e3949c2af109652dba3432325a7f`
ac2100 23.05.5	7,479,187	`f65bf0ed245c25282b2ca29f2a84b2301e192562abd7530e30b43aabc65e4fb3`

Check the download:

Windows (PowerShell): Get-FileHash .\quicvpn-tr3000-openwrt-25.12.6-20261028-ffd8045b.tar.gz -Algorithm SHA256
Windows (cmd): certutil -hashfile quicvpn-tr3000-openwrt-25.12.6-20261028-ffd8045b.tar.gz SHA256
macOS / Linux: shasum -a 256 -c quicvpn-tr3000-openwrt-25.12.6-20261028-ffd8045b.tar.gz.sha256

Unpack it with tar xzf <file>.tar.gz. Inside you'll find MANIFEST.json and SHA256SUMS.json, which list every file's size and SHA256.

B3. Copy the files to the router

OpenWrt's SSH server (dropbear) has no SFTP, so use scp -O:

# example: TR3000 on 25.12.6
scp -O -r quicvpn-tr3000-openwrt-25.12.6-20261028-ffd8045b [email protected]:/tmp/qvpack
ssh [email protected]

Then, on the router, put each file where MANIFEST.json expects it.

TR3000, both versions:

cd /tmp/qvpack
cp bin/quicvpn-linux-gw bin/quicvpn-sni-filter www/index.html /tmp/
cp hotplug/98-quicvpn-uplink hotplug/99-quicvpn-usb-wan /tmp/
cp install.sh /tmp/install_quicvpn.sh

Extra for TR3000 on 24.10.5 (opkg):

cp kmods/kmod-tun.ipk kmods/kmod-tcp-bbr.ipk /tmp/
mkdir -p /tmp/quicvpn-usb-ipks /tmp/dnsmasq-ipks
cp kmods/*.ipk /tmp/quicvpn-usb-ipks/
cp deps/dnsmasq/*.ipk /tmp/dnsmasq-ipks/

Extra for TR3000 on 25.12.6 (apk):

mkdir -p /tmp/quicvpn-apk-kmods
cp kmods-25.12/*.apk /tmp/quicvpn-apk-kmods/

AC2100 on 23.05.5:

cd /tmp/qvpack
cp bin/quicvpn-linux-gw bin/quicvpn-sni-filter www/index.html hotplug/98-quicvpn-uplink /tmp/
cp kmods/kmod-tun.ipk kmods/kmod-tcp-bbr.ipk /tmp/
mkdir -p /tmp/sni-iptables /tmp/dnsmasq-ipks
cp deps/sni-iptables/*.ipk /tmp/sni-iptables/
cp deps/dnsmasq/*.ipk /tmp/dnsmasq-ipks/
cp install.sh /tmp/install_quicvpn.sh

B4. Run the installer

chmod +x /tmp/install_quicvpn.sh /tmp/quicvpn-linux-gw /tmp/quicvpn-sni-filter
sh /tmp/install_quicvpn.sh

The last line should be INSTALL_TR3000_DONE (or INSTALL_AC2100_DONE).

On the TR3000, the script checks which package manager the router uses:

24.10 (opkg): it installs the bundled .ipk files.
25.12 (apk): it first installs the bundled .apk kernel modules that match uname -r. Anything still missing comes from the official online OpenWrt feed (apk update and apk add kmod-tun kmod-tcp-bbr kmod-nft-queue). It installs dnsmasq only if it's missing; dnsmasq-full isn't used.

In both cases it then installs the program to /opt/quicvpn, creates and starts the quicvpn-gw and quicvpn-sni services, and turns off uhttpd.

B5. Check the install

wget -qO- http://127.0.0.1/api/discover

The reply should include "ok":true, board should contain tr3000 or ac2100, and caps should include access_schedule and lan_access. After that, open http://<router LAN IP>/ in a browser.

C. Setting up after install

C1. Admin page address and port

The admin page is served by the program itself at http://<router LAN IP>/ on port 80. The address it listens on is stored in /opt/quicvpn/etc/web_listen (default 0.0.0.0:80). If that file is empty or damaged, the program falls back to 0.0.0.0:80.
The installer stops and disables uhttpd, so LuCI (OpenWrt's standard admin page) is turned off after install and isn't kept on any port. All management goes through our admin page on port 80. Old LuCI links (/cgi-bin/luci) open our admin page.
WAN: only DHCP WAN is supported; PPPoE is not. Connect the router's WAN port to a modem or upstream router that hands out DHCP.
The LAN address can change. If the router's LAN subnet overlaps the upstream network (for example both are 192.168.1.x), the program moves the LAN to a free 192.168.X.1/24 and updates DHCP. If the page stops loading, reconnect and open the gateway address your computer gets.

C2. First sign-in

The first time you open the admin page, it asks you to set an admin password. Choose a new password; don't reuse the Wi-Fi password.
Admin sessions end after 5 minutes without activity.
Sign in with your DawnVPN account (the account section of the admin page) and choose a server or leave it on automatic.
Choose the routing mode:
China split mode (smart split): traffic to Chinese destinations goes out directly; everything else goes through the VPN.
Global VPN: all traffic goes through the VPN.

Changing the mode takes effect right away. 5. You can also link the router to your account on router.tinystone.us by scanning a QR code. 6. You can also set up access rules: Internet-only, Games, Social/Video blocked, or Study mode. Study mode needs kmod-nft-queue.

C3. Wi-Fi

The program manages Wi-Fi itself (QUICVPN_WIFI_OWN=1). It turns off OpenWrt's default access points (wireless.default_radio0/1.disabled=1) and runs its own hotspots. Change the Wi-Fi name and password on the admin page's Wi-Fi screen, not in /etc/config/wireless.
The same screen can also connect the router to another Wi-Fi as its internet uplink. When a wired WAN is working, the wired connection is always used first.

C4. What's automatic and what you do yourself

Area	Automatic (install.sh or the program)	Manual
Kernel modules (`tun`, `tcp_bbr`, `nft_queue`)	install.sh installs them: offline `.ipk` on 24.10/23.05; on 25.12, offline `.apk` for kernel 6.12.112, otherwise from the online feed	25.12 with another kernel: the router must reach the internet
TUN interface `quicvpn0`	Created by the program	—
Firewall zone	The program adds a `quicvpn` zone (holding `quicvpn0`, masquerade and MSS clamping), forwarding `lan → quicvpn`, and adds `wwan` to the WAN zone	—
DNS	The program sets dnsmasq to `noresolv=1`, `localuse=1`, `filter_aaaa=1`, `cachesize=1000` and `confdir=/tmp/dnsmasq.d`, and adds redirect rules `qv_dns_udp`/`qv_dns_tcp` that send all LAN DNS to the router	—
Routing and split	The program creates its own `inet quicvpn_*` nft tables (split, kill switch, UDP, study and so on) and policy routes	—
WAN	If `network.wan` is missing, the program creates it (DHCP on a suitable port). A wired WAN always comes before a Wi-Fi uplink	Only DHCP WAN is supported; PPPoE is not. Put the router behind a modem or upstream router that hands out DHCP
LAN address	Moved automatically on a subnet clash (C1)	—
IPv6	Turned off on purpose: `ipv6=0` on lan/wan/wwan, `wan6` disabled, no RA or DHCPv6 on the LAN	—
Wi-Fi	Default APs turned off; the program runs its own	Name and password on the admin page
Web server	uhttpd stopped and disabled; the admin page is on port 80	—
Services	`quicvpn-gw` (web, wifi and route-guard parts) and `quicvpn-sni`, started at boot and restarted if they crash	—
Admin password and DawnVPN account	—	Set on the admin page (C2)

The program and install script are the same for every model and version. What changes per version:

TR3000 24.10.5: offline .ipk files (kernel 6.6.119).
TR3000 25.12.6: apk, offline .apk files (kernel 6.12.112).
AC2100 23.05.5: offline .ipk files (kernel 5.15.167), plus offline iptables/xt_string packages for SNI filtering.

D. Troubleshooting

What you see	What to do
`ERROR: arch=… not aarch64`	Wrong pack: you used the TR3000 pack on the AC2100 or the other way round.
`WARN: offline apk kmods are not for kernel …`	You're on 25.12 with a kernel other than 6.12.112. Make sure the router can reach the internet, then run the installer again.
`WARN: kmod-nft-queue missing`	Study mode won't work. Connect the router to the internet and run `apk add kmod-nft-queue` (25.12) or `opkg update && opkg install kmod-nft-queue` (24.10).
`tun missing`	The VPN can't start. Install `kmod-tun` the same way and run the installer again.
Admin page doesn't open	Run `ps w \\| grep quicvpn` and `logread \\| grep quicvpn`. Make sure nothing else is using port 80 (`uhttpd`, `nginx`). The install script stops `uhttpd`, and the program also tries to stop `uhttpd`, `nginx` and `lighttpd`.
SSH times out	Check that you're on the router's network, and that your computer has no wrong static route (don't point the gateway at a phone hotspot).
`scp: … sftp-server not found`	Use `scp -O`.
Lost access after install	The LAN address may have changed (C1). Check the gateway address your computer got.

Removing the program

To remove the program, reflash the stock firmware or official OpenWrt.

Website download entries (proposal, needs approval to upload)

Proposed paths, next to the existing flash images:

router/tr3000/pack/20261028-ffd8045b/quicvpn-tr3000-openwrt-24.10.5-20261028-ffd8045b.tar.gz (+ .sha256)
router/tr3000/pack/20261028-ffd8045b/quicvpn-tr3000-openwrt-25.12.6-20261028-ffd8045b.tar.gz (+ .sha256)
router/ac2100/pack/20261028-ffd8045b/quicvpn-ac2100-openwrt-23.05.5-20261028-ffd8045b.tar.gz (+ .sha256)

The suggested manifest.json products[] entries are in manifest-products.proposed.json (same folder). Nothing has been uploaded yet; uploading needs the user's approval.