Flash OpenWrt on
TP-Link ER605 v2

i Overview

Firmware Compatibility

The hardware revision (V2.0, V2.20, etc.) does NOT matter. Only the firmware version matters.

Password Generator

Generates root and debug passwords locally in your browser. Nothing is sent to any server. Only works with firmware ≤ 2.2.5.

Flash Guide

Estimated time: 30–45 minutes. Requirements: a Linux PC, an ethernet cable, ssh, curl, python3, md5sum.

mkdir -p ~/er605_flash
cd ~/er605_flash
curl -o er605v2_write_initramfs.sh https://raw.githubusercontent.com/chill1Penguin/er605v2_openwrt_install/main/er605v2_write_initramfs.sh
curl -o openwrt-initramfs-compact.bin https://raw.githubusercontent.com/chill1Penguin/er605v2_openwrt_install/main/openwrt-initramfs-compact.bin

# Sysupgrade 25.12.2 (latest stable):
curl -o openwrt-25.12.2-sysupgrade.bin https://downloads.openwrt.org/releases/25.12.2/targets/ramips/mt7621/openwrt-25.12.2-ramips-mt7621-tplink_er605-v2-squashfs-sysupgrade.bin

ls -la ~/er605_flash/

ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa -c aes128-ctr [email protected]

enable
debug

ip -4 addr show | grep "192.168.0"

#!/bin/bash
# receive_backup.sh — Run on your PC
# Receives all MTD partitions from the ER605 via netcat

DIR=~/er605_backup
mkdir -p "$DIR"

PARTITIONS="0:Bootloader 1:Config 2:Factory 3:firmware 4:panic-oops 5:partition-table 6:support-list 7:device-info 8:device-info.b 9:tddp 10:tddp.b 11:bootloader 12:kernel 13:rootfs 14:firmware-info 15:extra-para 16:log 17:rootfs_data 18:bootloader.b 19:kernel.b 20:rootfs.b 21:firmware-info.b 22:extra-para.b 23:log.b 24:rootfs_data.b 25:log_recovery 26:database"

for PART in $PARTITIONS; do
    NUM="${PART%%:*}"
    NAME="${PART##*:}"
    FILE="$DIR/mtd${NUM}_${NAME}.bin"
    echo ""
    echo "=== Waiting for mtd${NUM} (${NAME})... ==="
    nc -l -p 9090 > "$FILE"
    SIZE=$(stat -c%s "$FILE" 2>/dev/null || echo 0)
    echo "    Received: $FILE ($SIZE bytes)"
done

echo ""
echo "=== Backup complete ==="
ls -lh "$DIR"

#!/bin/ash
# send_backup.sh — Run on the ER605 router (ash/BusyBox)
# Usage: ash send_backup.sh YOUR_PC_IP

PC_IP="$1"

if [ -z "$PC_IP" ]; then
    echo "Usage: ash send_backup.sh YOUR_PC_IP"
    exit 1
fi

i=0
while [ -e "/dev/mtd${i}ro" ]; do
    NAME=$(grep "mtd${i}:" /proc/mtd | cut -d'"' -f2)
    echo ""
    echo "=== Sending mtd${i} (${NAME})... ==="
    dd if="/dev/mtd${i}ro" | nc "$PC_IP" 9090
    echo "    mtd${i} sent."
    sleep 2
    i=$((i + 1))
done

echo ""
echo "=== All partitions sent ==="

cat << "EOF" > /tmp/backup.sh
#!/bin/sh

BACKUP_HOST="192.168.0.100"  # Your PC's IP address
BACKUP_PORT="9999"            # Port to use for transfer
echo "Backup host ${BACKUP_HOST}"

echo -n > /tmp/md5sums

cat /proc/mtd | tail -n+2 | while read; do
  MTD_DEV=$(echo ${REPLY} | cut -f1 -d:)
  MTD_NAME=$(echo ${REPLY} | cut -f2 -d\")
  FILENAME="${MTD_DEV}_${MTD_NAME}.backup"

  echo "Backing up ${MTD_DEV} (${MTD_NAME})"
  # First send filename
  echo "$FILENAME" | busybox nc ${BACKUP_HOST} ${BACKUP_PORT}
  sleep 1
  # Then send the data
  dd if=/dev/${MTD_DEV}ro | busybox nc ${BACKUP_HOST} ${BACKUP_PORT}
  SUM=$(dd if=/dev/${MTD_DEV}ro | md5sum | cut -f1 -d" ")
  echo -e "$SUM\t$FILENAME" >> /tmp/md5sums
  sleep 1
done

echo md5sums | busybox nc ${BACKUP_HOST} ${BACKUP_PORT}
dd if=/tmp/md5sums | busybox nc ${BACKUP_HOST} ${BACKUP_PORT}

EOF

chmod +x /tmp/backup.sh

#!/bin/bash
# receive.sh — Run on your PC
# Receives MTD backups sent by backup.sh from the router

PORT=9999
DIR=~/er605_backup
mkdir -p "$DIR"
cd "$DIR"

while true; do
  # Receive filename
  FILENAME=$(nc -l -p $PORT)
  FILENAME=$(echo "$FILENAME" | tr -d '\r\n')
  if [ -z "$FILENAME" ]; then continue; fi
  echo "Receiving ${FILENAME}..."
  # Receive file data
  nc -l -p $PORT > "$FILENAME"
done

i=0; while [ -e "/dev/mtd${i}ro" ]; do
    NAME=$(grep "mtd${i}:" /proc/mtd | cut -d'"' -f2)
    echo "Backing up mtd${i} (${NAME})..."
    dd if="/dev/mtd${i}ro" of="/mnt/usb/mtd${i}_${NAME}.bin"
    i=$((i + 1))
done
cp /proc/mtd /mnt/usb/proc_mtd.txt
sync && umount /mnt/usb

cd ~/er605_flash
python3 -m http.server 8080

cd /tmp
curl -o er605v2_write_initramfs.sh http://YOUR_PC_IP:8080/er605v2_write_initramfs.sh
curl -o openwrt-initramfs-compact.bin http://YOUR_PC_IP:8080/openwrt-initramfs-compact.bin
chmod +x er605v2_write_initramfs.sh

md5sum openwrt-initramfs-compact.bin

./er605v2_write_initramfs.sh openwrt-initramfs-compact.bin

reboot

# Monitor from your PC:
while ! ping -c1 -W1 192.168.1.1 &>/dev/null; do echo "Waiting..."; sleep 2; done; echo "Router is up!"

Post-Install Configuration

uci set system.@system[0].timezone='YOUR_TZ_STRING'
uci set system.@system[0].zonename='Your/Timezone'
uci commit system

ssh [email protected]
apk update
apk add luci-app-sqm           # Smart QoS
apk add luci-proto-wireguard   # Fast VPN
apk add luci-app-statistics collectd-mod-cpu collectd-mod-memory # Stats

Encrypted DNS (dnscrypt-proxy2)

All DNS queries from your network will be encrypted via DNSCrypt/DoH before reaching the internet. dnsmasq stays as local DNS, forwarding to dnscrypt-proxy on port 5353.

apk update
apk add dnscrypt-proxy2

# Listen on port 5353 (not 53, that's dnsmasq)
listen_addresses = ['127.0.0.1:5353']

# Quad9 DoH with DNSSEC + malware filter + ECS
server_names = ['quad9-doh-ip4-port443-filter-ecs-pri']

# Don't require nofilter — we WANT Quad9's malware filtering
require_nofilter = false

# Allow expired certs on startup (no battery-backed clock on ER605)
cert_ignore_timestamp = true

# Cache (recommended for 128MB RAM)
cache = true
cache_size = 1024
cache_min_ttl = 600
cache_max_ttl = 86400

# Block IPv6 if not used
block_ipv6 = true

uci delete dhcp.@dnsmasq[0].server 2>/dev/null
uci add_list dhcp.@dnsmasq[0].server='127.0.0.1#5353'
uci set dhcp.@dnsmasq[0].noresolv='1'
uci set dhcp.@dnsmasq[0].logqueries='0'
uci commit dhcp
service dnsmasq restart

uci set network.wan.peerdns='0'
uci set network.wan.dns='127.0.0.1'
uci commit network
service network restart

service dnscrypt-proxy start
service dnscrypt-proxy enable
netstat -tlnup | grep 5353       # Should show dnscrypt-proxy
apk add bind-dig
dig @127.0.0.1 -p 5353 example.com  # Should resolve

Network-wide Ad Blocking

Direct dnsmasq-based blocking using the Hagezi Pro++ blocklist (~240,000 domains). No extra packages needed — dnsmasq loads the blocklist from a config directory in /tmp (RAM) because the blocklist is too large for the router's limited flash storage (~7MB free). Since /tmp is cleared on every reboot, an init script recreates the directory and a hotplug script re-downloads the list when WAN comes up. Blocks ads, tracking, malware, and phishing for every device on the network.

mkdir -p /tmp/dnsmasq.d
# delete first to avoid duplicates if you run this more than once
uci delete dhcp.@dnsmasq[0].confdir 2>/dev/null
uci add_list dhcp.@dnsmasq[0].confdir='/tmp/dnsmasq.d'
uci commit dhcp

cat > /etc/init.d/mkdir-dnsmasq-confdir << 'EOF'
#!/bin/sh /etc/rc.common
START=18
start() {
    mkdir -p /tmp/dnsmasq.d
}
EOF
chmod +x /etc/init.d/mkdir-dnsmasq-confdir
/etc/init.d/mkdir-dnsmasq-confdir enable

cat > /usr/sbin/update-blocklist.sh << 'EOF'
#!/bin/sh
curl -s -o /tmp/dnsmasq.d/blocklist.conf \
  https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/dnsmasq/pro.plus.txt && \
/etc/init.d/dnsmasq restart
EOF
chmod +x /usr/sbin/update-blocklist.sh

/usr/sbin/update-blocklist.sh
wc -l /tmp/dnsmasq.d/blocklist.conf  # Should show ~240k lines
nslookup ads.google.com              # Should return NXDOMAIN
nslookup google.com                  # Should resolve normally

sed -i 's|/dnsmasq/.*\.txt|/dnsmasq/LIST_NAME.txt|' /usr/sbin/update-blocklist.sh
/usr/sbin/update-blocklist.sh
wc -l /tmp/dnsmasq.d/blocklist.conf  # Verify the new domain count

echo '0 4 * * * /usr/sbin/update-blocklist.sh' >> /etc/crontabs/root
/etc/init.d/cron restart

cat > /etc/hotplug.d/iface/99-blocklist << 'EOF'
#!/bin/sh
[ "$ACTION" = ifup ] && [ "$INTERFACE" = wan ] && {
  sleep 5
  /usr/sbin/update-blocklist.sh
}
EOF
chmod +x /etc/hotplug.d/iface/99-blocklist

sed -i '/example\.com/d' /tmp/dnsmasq.d/blocklist.conf
/etc/init.d/dnsmasq restart

# Add to a persistent allowlist that survives updates
mkdir -p /etc/dnsmasq.d
echo 'server=/example.com/#' > /etc/dnsmasq.d/allowlist.conf
uci add_list dhcp.@dnsmasq[0].confdir='/etc/dnsmasq.d'
uci commit dhcp
/etc/init.d/dnsmasq restart

NTP + NTS (Chrony)

Secure time synchronization with Cloudflare via Network Time Security (NTS). Prevents time-based attacks and serves NTP to all LAN devices.

apk update
apk del chrony
apk add chrony-nts ca-certificates
rm -f /etc/config/chrony-opkg

# Remove default pool and server entries (pool overrides NTS)
while uci -q get chrony.@pool[0]; do uci delete chrony.@pool[0]; done
while uci -q get chrony.@server[0]; do uci delete chrony.@server[0]; done

# Add Cloudflare NTS server
uci add chrony server
uci set chrony.@server[-1].hostname='time.cloudflare.com'
uci set chrony.@server[-1].iburst='yes'
uci set chrony.@server[-1].nts='yes'
uci commit chrony
/etc/init.d/chronyd restart

# Disable the built-in NTP server (busybox sysntpd) — chrony replaces it
/etc/init.d/sysntpd stop
/etc/init.d/sysntpd disable

# Enable NTP server on port 123 and allow LAN clients
# We use conf.d because chrony defaults to port 0 (NTP disabled)
# and the UCI 'allow' option ignores the 'subnet' field.
mkdir -p /etc/chrony/conf.d
cat > /etc/chrony/conf.d/ntp-server.conf << 'EOF'
port 123
allow 192.168.1.0/24
EOF
/etc/init.d/chronyd restart

# Check NTS sync with Cloudflare
chronyc sources -a     # Should show time.cloudflare.com with ^*
chronyc -N authdata    # Mode should be NTS, Cook > 0
chronyc tracking       # Leap status should be Normal

# Check the router is serving NTP to the LAN
chronyc serverstats    # NTP packets received > 0 means clients are connecting
netstat -ulnp | grep 123  # Should show chronyd on 0.0.0.0:123 (all interfaces)

# Find your chrony config (varies by distro)
# Fedora/RHEL/Arch: /etc/chrony.conf
# Debian/Ubuntu:    /etc/chrony/chrony.conf
CONF=/etc/chrony.conf
[ -f /etc/chrony/chrony.conf ] && CONF=/etc/chrony/chrony.conf

# Comment out existing pool/server lines (skip if already correct)
sudo sed -i '/^server 192\.168\.1\.1 iburst$/!{ s/^pool .*/#&/; s/^server .*/#&/; }' "$CONF"

# Add the router line only if not already present (idempotent)
grep -qx 'server 192.168.1.1 iburst' "$CONF" || \
  echo -e '\nserver 192.168.1.1 iburst' | sudo tee -a "$CONF"

# Restart chrony and verify
sudo systemctl restart chronyd
chronyc sources -a     # Should show 192.168.1.1 with ^*
chronyc tracking       # Ref ID should point to 192.168.1.1

# Check which NTP client is active
timedatectl timesync-status 2>/dev/null && echo "Using systemd-timesyncd" || echo "Not using timesyncd"

# Configure timesyncd to use the router
sudo mkdir -p /etc/systemd/timesyncd.conf.d
printf '[Time]\nNTP=192.168.1.1\nFallbackNTP=\n' | sudo tee /etc/systemd/timesyncd.conf.d/router.conf

# Restart and verify
sudo systemctl restart systemd-timesyncd
timedatectl timesync-status   # Server should show 192.168.1.1

Firewall Hardening

OpenWrt's default config is already solid. These two tweaks improve security and performance with no risk.

Performance

Tweaks to improve throughput, DNS response times, and reduce resource usage on the ER605's dual-core MT7621 with 128MB of RAM. All of these are reversible.

uci set network.globals.packet_steering='1'
uci commit network
service network restart

uci set firewall.@defaults[0].flow_offloading='1'
uci commit firewall
service firewall restart

uci set dhcp.@dnsmasq[0].cachesize='1000'
uci commit dhcp
service dnsmasq restart

ip -6 addr show scope global

service odhcpd stop
service odhcpd disable

uci set system.@system[0].log_size='32'
uci commit system
/etc/init.d/log restart

free -m

Quick Reference

Post-Reboot Verification

All configuration set via uci commit persists across reboots (stored in /etc/config/ on flash). Services enabled with service <name> enable start automatically on boot. Run these commands after a reboot to confirm everything is working:

# dnsmasq → dnscrypt-proxy forwarding
uci get dhcp.@dnsmasq[0].server       # → 127.0.0.1#5353
uci get dhcp.@dnsmasq[0].noresolv     # → 1
uci get dhcp.@dnsmasq[0].logqueries   # → 0

# Router's own DNS (not leaking to ISP)
uci get network.wan.peerdns            # → 0
uci get network.wan.dns                # → 127.0.0.1
cat /etc/resolv.conf                   # → search lan + nameserver 127.0.0.1 (no ISP IPs)

# dnscrypt-proxy listening
netstat -tlnup | grep 5353            # → dnscrypt-proxy on TCP+UDP

# Ad blocking active (blocklist loaded)
wc -l /tmp/dnsmasq.d/blocklist.conf   # → ~240k lines

# NTP with NTS + LAN server
chronyc sources -a                     # → time.cloudflare.com with ^*
chronyc -N authdata                    # → NTS mode, cookies > 0
chronyc serverstats                    # → NTP packets received > 0

# DNS resolves correctly
dig @127.0.0.1 -p 5353 example.com    # → NOERROR + IP address
nslookup ads.google.com               # → NXDOMAIN (blocked)

# Performance tweaks
uci get network.globals.packet_steering   # → 1
uci get firewall.@defaults[0].flow_offloading  # → 1
uci get dhcp.@dnsmasq[0].cachesize       # → 1000

Troubleshooting

ssh-keygen -R 192.168.0.1
ssh-keygen -R 192.168.1.1

ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa -c aes128-ctr [email protected]

Revert to Stock Firmware

Rollback DNS changes

uci delete dhcp.@dnsmasq[0].server
uci set dhcp.@dnsmasq[0].noresolv='0'
uci delete dhcp.@dnsmasq[0].logqueries 2>/dev/null
uci commit dhcp
uci set network.wan.peerdns='1'
uci delete network.wan.dns 2>/dev/null
uci commit network
service dnsmasq restart
service network restart

Rollback NTP/NTS changes

apk del chrony-nts
apk add chrony
rm -f /etc/chrony/conf.d/ntp-server.conf
uci delete chrony.@server[0]
uci add chrony pool
uci set chrony.@pool[-1].hostname='2.openwrt.pool.ntp.org'
uci set chrony.@pool[-1].maxpoll='12'
uci set chrony.@pool[-1].iburst='yes'
uci commit chrony
/etc/init.d/chronyd restart
/etc/init.d/sysntpd enable
/etc/init.d/sysntpd start

Usage Guide

Common day-to-day tasks for managing your OpenWrt-powered ER605 v2 via the command line (SSH).

Assign a Static IP (DHCP Static Lease)

Each uci add dhcp host creates a new "host" entry inside the DHCP configuration. Each host entry is a static lease — it binds a device's MAC address to a fixed IP so it always gets the same address.

Add a single static lease

# Replace the values with your device's info
uci add dhcp host
uci set dhcp.@host[-1].name='MyDevice'
uci set dhcp.@host[-1].mac='AA:BB:CC:DD:EE:FF'
uci set dhcp.@host[-1].ip='192.168.1.100'
uci commit dhcp
/etc/init.d/dnsmasq restart

Example: multiple devices

# Access Point 1
uci add dhcp host
uci set dhcp.@host[-1].name='AP-Living-Room'
uci set dhcp.@host[-1].mac='2C:3B:70:AA:11:22'
uci set dhcp.@host[-1].ip='192.168.1.2'

# Access Point 2
uci add dhcp host
uci set dhcp.@host[-1].name='AP-Office'
uci set dhcp.@host[-1].mac='2C:3B:70:BB:33:44'
uci set dhcp.@host[-1].ip='192.168.1.3'

# NAS
uci add dhcp host
uci set dhcp.@host[-1].name='NAS'
uci set dhcp.@host[-1].mac='00:11:32:CC:55:66'
uci set dhcp.@host[-1].ip='192.168.1.10'

# Apply all at once
uci commit dhcp
/etc/init.d/dnsmasq restart

List all static leases

uci show dhcp | grep host

Remove a static lease

# First find the index of the host you want to remove
uci show dhcp | grep host

# Then delete it (replace [0] with the correct index)
uci delete dhcp.@host[0]
uci commit dhcp
/etc/init.d/dnsmasq restart

View Connected Devices

Active DHCP leases

cat /tmp/dhcp.leases

ARP table (all devices seen on the network)

ip neigh

Port Forwarding

# Example: forward external port 8080 to internal 192.168.1.100:80
uci add firewall redirect
uci set firewall.@redirect[-1].name='Web-Server'
uci set firewall.@redirect[-1].src='wan'
uci set firewall.@redirect[-1].src_dport='8080'
uci set firewall.@redirect[-1].dest='lan'
uci set firewall.@redirect[-1].dest_ip='192.168.1.100'
uci set firewall.@redirect[-1].dest_port='80'
uci set firewall.@redirect[-1].proto='tcp'
uci set firewall.@redirect[-1].target='DNAT'
uci commit firewall
/etc/init.d/firewall restart

Change LAN IP / Subnet

uci set network.lan.ipaddr='192.168.10.1'
uci set network.lan.netmask='255.255.255.0'
uci commit network
/etc/init.d/network restart

System Info & Reboot

# Check uptime
uptime

# Check OpenWrt version
cat /etc/openwrt_release

# Reboot the router
reboot

Useful UCI Tips

Sysupgrade Guide

How to upgrade OpenWrt to a newer release on your already-flashed ER605 v2. This example covers upgrading to 25.12.2 (latest stable as of April 2026).

cd /tmp
curl -o openwrt-25.12.2-sysupgrade.bin \
  https://downloads.openwrt.org/releases/25.12.2/targets/ramips/mt7621/openwrt-25.12.2-ramips-mt7621-tplink_er605-v2-squashfs-sysupgrade.bin

sha256sum openwrt-25.12.2-ramips-mt7621-tplink_er605-v2-squashfs-sysupgrade.bin

# From your PC — transfer the image to the router:
scp openwrt-25.12.2-ramips-mt7621-tplink_er605-v2-squashfs-sysupgrade.bin [email protected]:/tmp/

# On the router via SSH:
cd /tmp
sysupgrade -n -v openwrt-25.12.2-ramips-mt7621-tplink_er605-v2-squashfs-sysupgrade.bin

uci set attendedsysupgrade.client.login_check_for_upgrades='0'
uci commit attendedsysupgrade

Links & Resources