# Openwrt Dns Mesh Setup

> OpenWrt encrypted DNS and mesh configuration patterns. Use when setting up https-dns-proxy, configuring WDS WiFi backhaul, or implementing DNS encryption on OpenWrt.

- Skill: `krmorehead/openwrt-dns-mesh-setup` (Agent Skill)
- Install (CLI): `npx skillmds@latest add krmorehead/openwrt-dns-mesh-setup`
- Raw SKILL.md: https://api.skillmd.com/api/skills/krmorehead/openwrt-dns-mesh-setup/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: krmorehead (https://skillmd.com/u/krmorehead)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/krmorehead/openwrt-dns-mesh-setup

---


# OpenWrt DNS and Mesh Setup Rules

## Encrypted DNS Integration

1. `https-dns-proxy` on OpenWrt auto-configures dnsmasq on install: it adds itself as upstream DNS server and restarts dnsmasq. No manual dnsmasq configuration needed for basic DoH setup.

2. The configure task only needs to:
   - Install `https-dns-proxy` (with retries per network restart rules)
   - Optionally configure specific DoH providers via UCI
   - Verify DNS resolution works through the proxy

## Mesh Networking Setup

3. Mesh satellite nodes use WDS AP/STA for wireless backhaul without requiring PCIe passthrough.

4. The `iw` package must be pre-installed in custom image for namespace-aware WiFi detection via netlink.

## Container Networking Pattern

5. Container networking follows host topology:
   - LAN hosts (`router_nodes`, `lan_hosts`) → OpenWrt LAN subnet (10.10.10.x), LAN bridge
   - WAN hosts → private NAT bridge (`vmbr_ct`), 10.99.{host_id}.{offset}/24, DNS `8.8.8.8`
   - WAN containers are isolated on per-host /24 subnets — no IP collision risk