Skip to content
Router.Homes

OpenClash basics: compatibility, DNS conflicts and clean disable

Scope: this page covers compatibility, DNS conflicts, start/stop and recovery in a lawful environment. It does not provide proxy servers, subscription links, rule sets, or steps to bypass network controls or service/region restrictions. Check local law, ISP terms and the terms of the service you access before use.

Outcome

Section titled “Outcome”
  • Decide whether your firmware/architecture/package format matches an OpenClash release.
  • Check whether it will conflict with dnsmasq or AdGuard Home on port 53.
  • Verify process/log/port state instead of trusting the LuCI page alone.
  • Restore DNS and basic connectivity after disabling it.
  • Know what this page intentionally does not cover.

Applicable environment and assumptions

Section titled “Applicable environment and assumptions”
  • OpenWrt 25.12.6 (apk) or 24.10 (opkg); x86/ARM must match the release package.
  • OpenClash is a third-party LuCI app and usually needs a matching Mihomo/Meta core; frontend, core and firmware must be compatible.
  • apk on 25.12 and ipk on 24.10 are different formats. Do not rename an .ipk to .apk, and do not force another architecture’s package.
  • On vendor firmware/ImmortalWrt/iStoreOS, identify the source and package manager first (see the firmware identification page).

Pre-install checks

Section titled “Pre-install checks”
Router shellCheck firmware, architecture and free space
Terminal window
ubus call system board
cat /etc/openwrt_release
uname -m
command -v apk
command -v opkg
df -h /
free -h

Record release.target, DISTRIB_ARCH, the package manager and free space. OpenClash plus core and rule data can take tens of MB; do not force it on a full rootfs.

ExpectedYou know the package format, CPU architecture and available space.

Router shellFind a matching release package

Use only the official OpenClash release page and verify:

  • firmware major version (25.12 / 24.10);
  • package format (apk / ipk);
  • CPU architecture (x86_64, aarch64, etc.);
  • dependencies (kernel modules, bash/curl, per release notes);
  • SHA-256/checksum from the release page.

If there is no matching package, stop. Do not force a “universal” package or someone else’s build.

ExpectedYou can find an apk/ipk for the exact firmware and architecture.

Router shellRecord the DNS/port baseline
Terminal window
netstat -lnp | grep -E ':53|:5353|:7874|:9090'
cat /tmp/resolv.conf.d/resolv.conf.auto
nslookup openwrt.org 127.0.0.1

If AdGuard Home owns 53 and dnsmasq is on 5353, OpenClash must not also take 53. Decide who owns DNS before starting it.

ExpectedYou know who owns 53 and what restore means.

Minimal setup (no proxy endpoints)

Section titled “Minimal setup (no proxy endpoints)”
LuCIStart the frontend and core first, without DNS takeover

In Services → OpenClash:

  1. Select a core matching the architecture.
  2. Leave DNS takeover/hijack disabled for now.
  3. Save and start.
  4. Open the log page and confirm there is no “core mismatch / port in use / missing dependency”.

This page does not provide proxy servers, subscriptions or rules. If you do not have a lawful configuration, stop here; do not paste an unknown subscription just to “make it run”.

ExpectedThe service starts and LuCI shows status.

Router shellConfirm process, ports and logs
Terminal window
ps w | grep -Ei 'openclash|mihomo|clash' | grep -v grep
netstat -lnp | grep -E ':7874|:9090|:53'
logread | grep -i openclash | tail -30

Ports depend on your configuration; the key rule is: never let two processes bind 53. If the log reports a DNS bind failure, disable OpenClash instead of restarting it repeatedly.

ExpectedOpenClash/core is running without a port-53 conflict.

Disable and recover

Section titled “Disable and recover”
Router shellDisable and confirm basic connectivity
Terminal window
/etc/init.d/openclash stop
/etc/init.d/openclash disable
uci show openclash
/etc/init.d/dnsmasq restart
nslookup openwrt.org 127.0.0.1

If you changed the dnsmasq port or DHCP option 6 earlier, restore it per the DNS/AGH pages; make sure clients no longer point at a stopped OpenClash DNS.

ExpectedResolution and internet work without OpenClash.

Failure branches and recovery

Section titled “Failure branches and recovery”

No internet after enabling OpenClash

Section titled “No internet after enabling OpenClash”
  1. Reach the device over LAN/console.
  2. Stop OpenClash.
  3. Restore dnsmasq port 53 and DHCP DNS.
  4. Check whether firewall/DNS hijack rules remain.
  5. Reboot if needed; restore basic connectivity before debugging further.

LuCI is unreachable

Section titled “LuCI is unreachable”

Do not keep clicking “restart”. Use SSH/console to stop the service:

Terminal window
/etc/init.d/openclash stop
/etc/init.d/openclash disable
logread | tail -50

If a firewall rule blocks management, recover from the console; do not factory-reset blindly.

Package format/architecture mismatch

Section titled “Package format/architecture mismatch”
  • 25.12 uses apk; 24.10 uses ipk; they are not interchangeable.
  • x86_64 and aarch64 packages are not interchangeable.
  • If frontend and core versions do not match, return to the combination listed on the release page.
  • Do not disable all signature/verification checks just to install it.

DNS conflict/loop

Section titled “DNS conflict/loop”
  • Only one main DNS entry point should own 53.
  • AdGuard Home, dnsmasq and OpenClash DNS must not point at each other in a loop.
  • Stop OpenClash, restore dnsmasq/AGH, then add components back one at a time.
  • Test 127.0.0.1, the LAN address and the upstream separately with nslookup.

Compliance and version boundaries

Section titled “Compliance and version boundaries”
  • Use only on networks and under service terms that permit it. This page does not provide circumvention, region/access-control evasion, or shared account/subscription content.
  • OpenClash/Mihomo are third-party projects with fast-moving versions/dependencies; read release notes and keep a rollback package.
  • This is not legal advice; resolve compliance questions before deployment.

E2 lab run (2026-10-20)

Section titled “E2 lab run (2026-10-20)”
  • Environment: OpenWrt 25.12.6 x86 VM 200; official luci-app-openclash 0.48.002 .apk.
  • apk add --allow-untrusted installed 43 packages (including luci-compat, Ruby, unzip); /etc/init.d/openclash and the LuCI controller exist.
  • With no proxy config/endpoint, start reported inactive; this page does not claim “proxy works”.
  • After stop + disable, nslookup openwrt.org 127.0.0.1 returned connection refused; /etc/init.d/dnsmasq restart restored DNS, and public ping worked.
  • Not tested: real proxy endpoint/subscription, routing/DNS hits, Mihomo core, TUN/firewall rules, performance/stability.
  • Recipe: tests/recipes/openclash-25.12.md.

E2 status and sources

Section titled “E2 status and sources”
  • This is E2 partial: 25.12 .apk install, no-config start, disable and DNS recovery were tested; actual proxy/routing remains E1/E3.
  • Without a lawful endpoint/config, do not turn “installed” into “proxy works”.
  • Do not expand this page into a proxy subscription/bypass tutorial; that is out of scope.

Sources

Router.Homes

Independent OpenWrt notes. Every page states the firmware, device, package manager and way back.

Icons: Solar by 480 Design, CC BY 4.0