Full survey of telep-router — the Asus RT-AX89X running OpenWrt 24.10.0 that serves the Telephely site LAN. Covers hardware, firmware, network/firewall config, WiFi, Tailscale, and the known footguns to be aware of before making changes.
For Agents
Access:/usr/bin/ssh root@telep-router (reachable over Tailscale MagicDNS, no port-forward needed).
Config system: OpenWrt UCI — change via uci set ... + uci commit <pkg> + reload the relevant init script. Never hand-edit /etc/config/* if a UCI path exists.
Blast radius: this is the only gateway for the site LAN. A bad network or firewall commit locks you out of everything except the physical console.
Before inbound/port-forward work, read Double-NAT — the router does not hold a public IP.
Hardware & Firmware
Property
Value
Device
Asus RT-AX89X
Target
qualcommax/ipq807x
Arch
aarch64_cortex-a53
Firmware
OpenWrt 24.10.0
Build
r28427-6df0e3d02a
Kernel
6.6.73
Resources
Comfortable headroom — this router is nowhere near its limits.
Resource
Total
Used / Free
RAM
887 MB
~594 MB available
Overlay (/dev/ubi0_5)
206 MB
20 MB used (10%)
/rom
—
100% full
/rom at 100% is normal
/rom is the read-only squashfs base image. It is supposed to report full — it is not a disk-space problem and needs no action. The number that actually matters is the overlay, and that is at 10%. There is plenty of room to install packages.
br-lan = 192.168.1.1/24 — the gateway address for the site.
Bridge members: lan1–lan8, 10g-sfp, 10g-copper, and both WiFi APs.
Only 10g-copper currently has a link. Every other physical port is idle.
WAN
DHCP client, leased 192.168.254.2/24 from upstream gateway 192.168.254.1.
Double-NAT
The router sits behind another router
The WAN address (192.168.254.2) is an RFC1918 private address, not a public one. Traffic is NATed twice: once by telep-router (masquerade), once by the upstream box at 192.168.254.1.
Consequences:
A port-forward configured here is not reachable from the internet — it also needs a matching forward on the upstream router (which we may not control).
Anything that needs inbound reachability should go over Tailscale instead of port-forwarding. That is the path of least resistance and already works today.
Protocols that dislike double-NAT (some VoIP/SIP, strict-NAT gaming, UPnP/NAT-PMP chains) may misbehave.
DHCP (dnsmasq)
Setting
Value
Pool start
.100
Limit
150 addresses
Lease time
12h
Domain
lan
Firewall
Zone
Input
Output
Forward
Notes
lan
ACCEPT
ACCEPT
ACCEPT
wan
REJECT
ACCEPT
REJECT
masq=1, mtu_fix=1
cams
—
—
—
isolated camera VLAN, see
Forwardings: lan → wan and lan → cams. There is deliberately no cams → wan rule. One DNAT rule (NTP), added for the cameras.
Camera VLAN (telep-cc)
Added 2026-07-14 to isolate the site’s IP cameras from everything else. Consumed by telep-mainframe, which pulls RTSP from it.
Property
Value
Subnet
192.168.30.0/24
SSID
hidden, WPA2-PSK
Client isolation
on
Occupant
Tapo TC47 @ 192.168.30.119
Rules:
cams → wan REJECTED — the cameras have no internet at all. No cloud, no phone-home, no firmware calling out.
lan → cams ALLOWED — this is the only path in, and it is how Frigate reaches RTSP.
NTP is DNAT’d back to the router, so a camera with no internet still keeps its clock.
WPA2, not WPA3 — and that is forced
The camera VLAN runs WPA2-PSK because Tapo hardware does not support WPA3-SAE. The isolation (no internet, no lateral path, hidden SSID, client isolation) is what carries the security here, not the WiFi crypto.
The Tapo app can no longer reach the camera
Consequence of the above: no cloud path, and a phone on the LAN is a different subnet with client isolation on. Changing a camera setting now requires temporarily reopening the VLAN. See Camera network.
Hidden-SSID rejoin was tested — the camera was deauthed and re-associated cleanly, keeping its lease.
WiFi
Radio
Band
Channel
Mode
radio0
5 GHz
36
HE80
radio1
2.4 GHz
1
HE20
SSID telep1 on both radios (single roaming SSID).
Encryption: WPA3-SAE (encryption='sae').
The PSK is only 8 characters
SAE’s dragonfly handshake means an attacker cannot capture a handshake and crack it offline — each guess costs an online interaction, so a short passphrase is far less catastrophic than it would be under WPA2. But 8 chars is still short, and it removes any margin if a downgrade/transition-mode path or a future SAE weakness ever appears. Worth lengthening when convenient.
This is what makes the router reachable at all despite the Double-NAT — SSH to it via MagicDNS from any tailnet device.
Packages
174 installed — essentially stock. The only things added beyond the base image:
tailscale
luci-app-firewall
luci-app-package-manager
Notably absent (i.e. available as future improvements): adblock, SQM / QoS, DNS-over-HTTPS, wireguard.
Changes Made (2026-07-13)
Hostname was still OpenWrt
The name telep-router existed only as a Tailscale MagicDNS name. The device itself did not know it:
kernel hostname → OpenWrt
uname -n → OpenWrt
uci get system.@system[0].hostname → OpenWrt
Fixed so all three agree:
uci set system.@system[0].hostname='telep-router'uci commit system/etc/init.d/system reload
The shell prompt, syslog entries, and DHCP-advertised hostname now all say telep-router.
Gotchas
1. WiFi ifaces declare network='lan wan'
Both wifi-iface sections list network='lan wan', and network.wan carries type='bridge'.
Currently inert — the APs only ever land in br-lan, because wan is not actually instantiated as a bridge device. So nothing is broken today.
But it is a live footgun. It is one config change away from bridging the wireless APs directly onto the WAN side, which would put WiFi clients outside the firewall. Should be cleaned up to network='lan' on both ifaces.
2. 8-character WiFi PSK
See WiFi. SAE mitigates offline cracking; the passphrase is still short.
3. Double-NAT
See Double-NAT. Know this before attempting any port-forward or inbound work.
macOS: bare ssh is broken by a shell wrapper
On the Mac, a shell wrapper/alias shadows ssh and breaks the connection. Invoke the absolute path:
/usr/bin/ssh root@telep-router
This applies to any script or agent automating against the router from macOS.
Security Gaps
Known and unresolved as of 2026-07-14. None are actively exploited; all are worth closing.
Gap
Why it matters
8-char WPA3 PSK on telep1
See — SAE blunts offline cracking, but there is no margin left.
dropbear password auth enabled
SSH accepts passwords. Should be keys-only.
LuCI on plain HTTP (port 80)
The admin UI credentials cross the LAN in cleartext.
Plaintext DNS
All lookups are visible to the upstream network. DoH/DoT is available and unused.
OpenWrt 24.10.0 not patched
Not on the latest point release.
Open Items
Clean up network='lan wan' → network='lan' on both wifi-iface sections.
Lengthen the WiFi PSK beyond 8 characters.
Close the Security Gaps: dropbear keys-only, LuCI behind HTTPS, DoH, patch to the latest 24.10.x.
Consider adblock / DoH / SQM — plenty of overlay space (10% used) and RAM (594 MB free) to support them.