--- title: "OpenWrt to the rescue" description: "Why a three-node Eero Pro 6E mesh lasted a few days in our house, and how OpenWrt 25.12.2 on a Flint 2 and two Cudy M3000s became the stable setup." url: "https://michael.zazon.us/notes/openwrt-to-the-rescue" published: "2026-04-14T12:00:00-04:00" kind: "build-log" subject: "homelab" tags: ["openwrt","wifi"] series: "Home networking" part: 1 --- Our home Wi-Fi is back on OpenWrt, with a [GL.iNet Flint 2](https://www.gl-inet.com/products/gl-mt6000/) as the router and two [Cudy M3000](https://openwrt.org/toh/cudy/m3000) access points, all three running the official [OpenWrt 25.12](https://openwrt.org/releases/25.12/start) release (25.12.2). For a few days in early April it was running on a three-node Eero Pro 6E mesh, and the Eeros were supposed to be the stable option… The two weeks prior to that were rough on OpenWrt though, between a bridge loop at home, Apple TVs breaking with sae-mixed and 802.11r turned on, a Sonos outage, and a day of debugging a couple Phyn water sensor that kept failing TLS through the M3000 bridge. I had heard great things about the Eero devices and they often run great deals. I was also keen on keeping this simple.. coming from almost 7 years of using a bulletproof Orbi mesh, simplicity and "it just works" seemed like a no brainer. So it seemed fitting to try. I was very bullish on them given what I heard. I chose the Pro 6E 3-pack variant for our 3,200 sq ft, 3-story home built in 1900. Eero out of the box seemed like a slam dunk. Easy setup, short of manually migrating all DHCP leases over for 50+ devices. I subscribed to the Eero Plus subscription. It had immediate great performance, seemingly great Wi-Fi coverage, and an "it just works" posture I was hoping for. All three nodes were on wired backhaul. Unfortunately, the honeymoon period quickly subsided with frequent dropouts on devices, vague issues with their adblock in the Plus tier, roaming issues, and most of all speed issues that seemed to hit after an auto update introduced a confirmed bug (which has since been fixed by Eero). The auto update functionality for me is a deal breaker. Not being able to pin to a specific version was very frustrating. Even on a good day I had given things up. Eero has no VLANs, so our IoT VLAN went away. It's managed from the app only, and it bugged me that I couldn't provision the Eero devices with code. Adding all of that configuration by hand seemed daunting, and I'd rather spend my time elsewhere. DNS filtering went from AdGuard Home down to the basic filtering in Eero Secure, and presence detection (a tracker in LuCI, OpenWrt's web interface) was gone. The VPN moved to a container on our server, and from the LAN it hairpinned through the Eeros at about 50 Mbps, where I got about 80 Mbps connecting over cell. The fix came from OpenWrt itself. On April 6, OpenWrt 25.12.2 turned out to fix the M3000's problem: its mt76 driver fixed a bridge TX bug on the MediaTek mt7981 chip, the same bug behind the Phyn sensor failures. With 25.12.2 on the AP, the Phyn sensors worked through it right away. I used that as the push to put all three OpenWrt devices on the official 25.12.2 build, with [AdGuard Home](https://github.com/AdguardTeam/AdGuardHome) back in front using DNS over HTTPS upstream and [DAWN](https://github.com/berlin-open-wireless-lab/DAWN) steering clients between the access points. HE160 (160 MHz channels) works now too. Returned the Eeros. 25.12.2 fixed all issues. FiOS comes into the Flint 2, which is doing DHCP, AdGuard Home and the VPN, and a switch feeds the two M3000s. I have an IoT VLAN again for all the IoT devices. [Diagram: Network diagram: FiOS into the Flint 2 router running DHCP, AdGuard Home and the VPN, then a switch feeding two Cudy M3000 access points that carry the main LAN and a separate IoT VLAN](https://michael.zazon.us/notes/openwrt-to-the-rescue) The cutover back on April 7 still had some gotchas, mostly DNS and IPv6: - With their WAN unplugged, the Eeros kept sending IPv6 router advertisements. Pulling their power fixed it. - odhcpd wasn't advertising an RDNSS option ([RFC 8106](https://www.rfc-editor.org/rfc/rfc8106)), so iPhones got no IPv6 DNS server at all. - The Global nameserver in the Tailscale admin console still pointed at the dead Eero gateway. - AdGuard Home's upstream for PTR lookups was hanging, which hung DNS queries along with it. Before the swap, a power-cycle test of the Flint and one M3000 had shown zero config drift. The stability I wanted came from trusting open source, lots of debugging, and a lot of trial and error. Rock solid performance and stability is now real with this setup, which costs less than the Eero setup (but definitely not in terms of my time!) This is the first part of a series of posts about our home network. I'll talk about some walk tests I did around the house to tune 802.11r fast roaming, how I use Ansible to manage the config of all of these devices, and then a post about AdGuard Home.