I have a setup at home as follow:

DHCP clients  -----> (wifi)(nat) Openwrt -----> (eth)Main Router

DHCP clients get ip from subnet.

The device I'm using is TPlink MR3020 with Barrier Breaker. I'm using an older version because after installing newer version I cannot install packages that'll enable to use USB HDD - device space shortage.

The configuration is like this:


# specify each IP on an individual filterip line.
filterip =
# the port that DansGuardian listens to.
filterport = 8888
# the ip of the proxy (default is the loopback - i.e. this server)
proxyip =
# the port DansGuardian connects to proxy on
proxyport = 3128


confdir /etc/privoxy
logdir /var/log
filterfile default.filter
logfile privoxy
actionsfile match-all.action # Actions that are applied to all sites and maybe overruled later on.
actionsfile default.action   # Main actions file
#actionsfile user.action      # User customizations
toggle  1
enable-remote-toggle  1
enable-remote-http-toggle  0
enable-edit-actions 1
enforce-blocks 0
buffer-limit 4096
forwarded-connect-retries  0
accept-intercepted-requests 0
allow-cgi-request-crunching 0
split-large-forms 0
keep-alive-timeout 300
socket-timeout 300
debug   1    # show each GET/POST/CONNECT request
debug   4096 # Startup banner and warnings
debug   8192 # Errors - *we highly recommended enabling this*


config redirect
    option _name 'dansguardian'
    option proto 'tcp'
    option src 'lan'
    option dest_port '8888'
    option src_dport '80'
    option src_dip '!'
    option dest_ip ''

I need couple of advices regarding my internet speed and DG performance:

  1. The performance and speed is generally good. With a few setbacks though, especially when DG is actively filters more than one clients, I experience small delays.
  2. When someone texts the clients via iPhone iMessages, the message doesn't show up. If I connect to a wifi other than OpenWRT, it works.
  3. I know for the fact there is not a %100 solution to this but I want to know whether there any OpenWRT-specific solution to HTTPS filtering using DG? I'm using url and ip filtering for famous websites (like Facebook), but it is static.

Any suggestions?

  • for #2, you double nat as i see it ? your main router cant have a separate wifi vlan to prevent that ? – yagmoth555 Mar 7 '16 at 11:56
  • It has a separate wifi, but how does it prevent the message from being arrived? – 0xmtn Mar 7 '16 at 12:08
  • double nat kill a lot of app communication, like skype too. search imessage & double nat on google.. – yagmoth555 Mar 7 '16 at 12:23
  • most modern router have 'guest wifi' feature to prevent that btw – yagmoth555 Mar 7 '16 at 12:24
  • In my case, the clients connect directly to Openwrt router. And the router connects to the main router via ethernet. How will guest wifi solve this since clients do not connect to it directly? I'm thinking of deleting double nat structure and creating an arp spoofing middleware to get all the traffic onto OpenWRT and then filter. Is there any other way to accomplish this without arp spoof? – 0xmtn Mar 7 '16 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.