OpenWrt: Firewall and Router Ledger 2026 Scorecard

Part of the Firewall and Router Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: community project
Owner: OpenWrt project, a member project of the Software Freedom Conservancy (secondary source); no company, no paid edition; LEDE fork re-merged in 18.06 (2018-07)
Engine: Linux kernel with musl, netifd, firewall4 on nftables, dnsmasq and odhcpd; FRR, BIRD, WireGuard, OpenVPN and strongSwan as packages
Licence: GPL-2.0 base system with per-package licences (not re-verified from a licence file); free, no subscription and no support contract from the project; the OpenWrt One router (Banana Pi, launched 2024-11-29, 89 USD) sends 10 USD per unit to the project fund
Latest release: 25.12.5 (2026-07-01); 24.10.8 service release (2026-07-26); stable series 25.12.0 (2026-03-05)
Support lifecycle: Only 25.12 listed as supported; 24.10 receives no security updates after September 2026; a stable series every 6 to 18 months (22.03 in 2022-09, 23.05 in 2023-10, 24.10 in 2025-02, 25.12 in 2026-03); sysupgrade from the previous series, not from two series back; no LTS
Next milestone: None published
Security record: 0 entries on the CISA KEV catalogue for 2023 to 2026 (feed of 2026-10-15); no deduction. 25.12.5 (2026-07-01) fixed odhcpd CVE-2026-53921 (critical, DHCPv6 stack overflow) with CVE-2026-53918, 53920, 53922 and 55606, uhttpd request smuggling CVE-2026-55612 to 55614 and a command injection in luci-app-tailscale-community (CVSS 9.9); the project keeps an advisory page
Hypervisors: Documented on QEMU and KVM, Xen DomU, VirtualBox, VMware Workstation and Fusion, UTM, Docker, Podman and LXC; no Proxmox VE, Hyper-V, XCP-ng or cloud image page; x86-64 images plus ARM, RISC-V and loongarch64 targets and more than 1,790 embedded devices
Tier: Open-source platform
Archetype: Dependable builder
Evidence grade: B. The release notes for 15.05, 17.01.0, 18.06.0, 19.07.0, 21.02.0, 22.03.0, 23.05.0, 24.10.0, 25.12.0 and 25.12.5, the security page, the virtualisation and x86 pages and the GitHub release feed were read from project sources; the CISA KEV feed was queried on 2026-10-15. Governance (Software Freedom Conservancy membership) and the OpenWrt One launch come from search summaries, the GPL-2.0 licence was not read from a licence file, and routing and VPN capability rests on the package index rather than release notes.

Scope of the scores: OpenWrt is scored here as a firewall and router platform in its own right because it ships x86-64 and virtual images and passes the feature test with packages. It is also the base of other firewall products, among them NethSecurity (out of scope this edition for lack of dynamic routing); those products are scored on their own terms, not through this entry. The project sells nothing, so its risk rows measure sustainability.

Scorecard

Dimension	Score	Direction
Capability today	56.6 / 100	higher is better
Momentum since end of 2022	+1.0 points (2015 to 2022: +8.6)	higher is better
Credibility	15.0 / 25	higher is better
Sustainability risk	7.5 / 25	lower is better
Technical lock-in	2.5 / 25	lower is better
Integrator fit	6.0 / 20	higher is better
AI leverage	1.5 / 20	higher is better
Ledger Index	51.8 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Routing and WAN (12)	2.5	3	3	3
Firewall and NAT core (12)	3	3	3.5	3.5
VPN and remote access (12)	2.5	3	3	3
Threat protection (12)	1	1	1.5	1.5
Network services (8)	3.5	3.5	3.5	3.5
Platform and hypervisor freedom (10)	3	3	3	3.5
High availability and performance (8)	1.5	2	2	2
Management, API and automation (10)	2	2.5	3	3
Observability (6)	2	2	2	2
Platform security and lifecycle (10)	2.5	2.5	3	3
Total / 100	47.0	51.2	55.6	56.6

Year by year: 2015: 47.0 · 2016: 47.0 · 2017: 47.8 · 2018: 51.2 · 2019: 51.2 · 2020: 52.2 · 2021: 53.2 · 2022: 55.6 · 2023: 55.6 · 2024: 55.6 · 2025: 56.6 · 2026: 56.6

What moved the score

Year	Domain	Change	Points	Trigger
2017	High availability and performance	1.5 → 2	+0.8	17.01.0: cake and fq_codel in SQM; hardware flow offload on some SoCs; no failover with state sync
2018	Management, API and automation	2 → 2.5	+1.0	18.06.0: automatic rollback of configuration changes
2018	Routing and WAN	2.5 → 3	+1.2	18.06.0: GRE, VETH, VTI and VXLAN configuration in UCI; FRR and BIRD 2 packages carry BGP and OSPF without LuCI integration; no VRF, no SD-WAN path selection
2018	VPN and remote access	2.5 → 3	+1.2	18.06.0: WireGuard packages with LuCI protocol support; all three VPNs available, no certificate manager, MFA or vendor client
2020	Management, API and automation	2.5 → 3	+1.0	19.07.0: client-side rendered LuCI; ubus and rpcd JSON-RPC cover the main objects; 25.12.0 apk and ucode scripts change packaging, not the API; no central management or vendor IaC
2021	Platform security and lifecycle	2.5 → 3	+1.0	21.02.0: HTTPS by default, PIE and ASLR; stack protection and RELRO since 17.01; reproducible build checks; 0 CISA KEV entries 2023 to 2026, so no deduction; no LTS, no Secure Boot, 24.10 ends six months after 25.12 shipped
2022	Firewall and NAT core	3 → 3.5	+1.2	22.03.0: firewall4 on nftables with the same UCI syntax; no layer 7 identification, no user-based rules
2022	Threat protection	1 → 1.5	+1.2	22.03: adblock and banIP packages with LuCI apps on nftables; Snort 3 package (package dates not read; grade C for the year)
2025	Platform and hypervisor freedom	3 → 3.5	+1.0	24.10.0: RISC-V and loongarch64 targets; 23.05 added 200 devices; still no Proxmox VE, Hyper-V, XCP-ng or cloud page and no DPDK or SR-IOV

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-10	23.05.0: 200 new devices, mbedtls default, Rust in the build	Platform	C
2024-01	Community vote to endorse the OpenWrt One hardware	Platform	V
2024-11	OpenWrt One launched with Banana Pi at 89 USD, 10 USD per unit to the project fund	Packaging	V
2025-02	24.10.0: kernel 6.6, mbedtls 3.6 with TLS 1.3, initial Wi-Fi 7, RISC-V and loongarch64 targets	Platform	U
2026-03	25.12.0: apk replaces opkg	Management and API	C
2026-03	25.12.0: network and Wi-Fi scripts rewritten in ucode; attended sysupgrade in LuCI	Management and API	C
2026-03	25.12.0 notes: 24.10 gets no security updates after September 2026	Security and lifecycle	C
2026-07	25.12.5: odhcpd CVE-2026-53921 and a large security batch (uhttpd, LuCI apps, OpenSSL 3.5.7)	Security and lifecycle	C
2026-07	24.10.8 service release for the outgoing series	Security and lifecycle	C

Centre of gravity: Platform (3), Security and lifecycle (3), Management and API (2)
Blind spots (no items): Routing, Firewall core, VPN, Threat protection, Network services, High availability, Observability, Licensing, AI
Driver mix: Vision 22%, Customer need 67%, Market window 0%, Upstream 11%, Portfolio 0%
Idea-to-need index: 0.25 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 15.0 / 25

Criterion	Score	Basis
Cadence	3	A stable series every 6 to 18 months with no published schedule; service releases monthly to quarterly
Roadmap transparency	3	Open trackers, mailing lists and release notes; no written roadmap and no next-milestone page
Say-do	3	The apk transition and the OpenWrt One shipped; little is announced ahead, so there is little to miss
Velocity	3	Steady device and kernel work each series; firewall4, apk and ucode are the platform changes of the decade
Lifecycle stability	3	Two series supported at a time with sysupgrade between neighbours; some upgrades need a configuration wipe (swconfig to DSA); the apk change breaks opkg habits

Sustainability risk: 7.5 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	2.5	Broad contributor base across many targets; the number of release maintainers is not published; no company employs the core team
Backer health	2	Member project of the Software Freedom Conservancy funded by donations and the OpenWrt One levy; hardware vendors ship it under their own terms without funding obligations
Licence-change risk	0.5	GPL-2.0 with thousands of copyright holders and no contributor agreement; a relicensing is impractical
Abandonment signs	0.5	25.12.0 in March 2026, five service releases by July and a 24.10 service release the same month
Security response	2	Advisory page and fast service releases, but a series loses security updates about six months after its successor ships, and the July 2026 batch fixed a critical odhcpd flaw

Technical lock-in: 2.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	0.5	UCI text files under /etc/config with sysupgrade -b backup; fully scriptable
Export path	0.5	Plain text configuration; nothing proprietary to convert
Stack coupling	0	No storage or management stack
Hardware / cloud coupling	0.5	Any supported device or x86-64 machine; device support varies by target and a series upgrade can drop devices
Skills and tooling coupling	1	Embedded Linux skills; LuCI and UCI are specific to OpenWrt

Integrator fit: 6.0 / 20

Criterion	Score	Basis
Partner programme openness	1	No partner programme; anyone may build on it, nobody is supported by the project
Multi-tenancy and self-service	0.5	None in the project; third-party controllers not verified
API and infrastructure-as-code	2.5	ubus and rpcd JSON-RPC, UCI; Ansible and Terraform modules are community work not verified here
Skills and certification	2	Large wiki and forum; no certification

AI leverage: 1.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI in threat detection	0	0	0	2015: None
AI platform stack	0	0	0	2015: None
AI-assisted operations	0	0	0	2015: None
Agent openness	1.5	1.5	1.5	2015: ubus JSON-RPC and UCI that scripts and agents can drive; no official MCP server or agent interface

Year by year: 2015: 1.5 · 2016: 1.5 · 2017: 1.5 · 2018: 1.5 · 2019: 1.5 · 2020: 1.5 · 2021: 1.5 · 2022: 1.5 · 2023: 1.5 · 2024: 1.5 · 2025: 1.5 · 2026: 1.5

AI say-do, 2023 to 2026: 0 AI items announced; 0 GA, 0 still preview, 0 pending, 0 dropped. No AI item appears in any release note from 2023 to 2026.

OpenWrt has no AI in any form and announces none. Its JSON-RPC interface is open enough for agents to configure a device, which is the whole of its agent story.

Reading

OpenWrt scores as a solid router and firewall for one site: nftables firewall, all three VPNs, dnsmasq and odhcpd, and a platform reach no other entry matches across SoCs, x86, ARM and RISC-V. It scores low where a business firewall is judged, with no failover with state sync, no IDS integration, no central management and support windows shorter than a year and a half. The sustainability rows are the real read: the licence cannot move and the releases keep coming, but the project depends on donations and unpaid maintainers, and the July 2026 security batch shows how much code a volunteer team now carries. A buyer should plan a series upgrade every year and check that each device survives it.

Open questions and items to re-score

The 15.05 Chaos Calmer release date is not shown on its notes page.
Software Freedom Conservancy membership and the OpenWrt One launch facts come from search summaries, not a fetched project page.
The GPL-2.0 licence was not read from a licence file.
Package dates for FRR, BIRD, WireGuard, adblock, banIP, nlbwmon and softflowd were not read; the steps that cite them are dated by the release that made them usable.
Proxmox VE and Hyper-V guides exist only in community form, not on the project's virtualisation page.
Whether any commercial vendor offers paid support for stock OpenWrt.

	’17	’18	’20	’21	’22	’25
Routing and WAN		1
Firewall and NAT core					1
VPN and remote access		2
Threat protection					2
Network services
Platform and hypervisor freedom						1
High availability and performance	1
Management, API and automation		3	1
Observability
Platform security and lifecycle				1