OpenWrt

This guide covers routers and access points running OpenWrt.

OpenWrt

Prepare the account. OpenWrt is a single-user system by default: management is done as root, and the BusyBox userland does not ship the tooling for practical multi-user administration. Set a strong root password, which also secures SSH:

passwd

If your build includes shadow utilities and sudo, you can create a dedicated netwatch-backup user and grant it read access to /etc/config, but on stock images using root is the supported approach. QUARK only reads configuration and never applies changes.

Enable SSH. The Dropbear SSH server is enabled by default on LAN. Ensure it listens on the interface the Netwatch collector reaches, and restrict it to that interface:

uci set dropbear.@dropbear[0].Interface='lan'
uci commit dropbear
/etc/init.d/dropbear restart

To limit access to the collector's IP address, add a firewall rule (in /etc/config/firewall or via LuCI under Network > Firewall > Traffic Rules) permitting TCP port 22 only from the collector.

Platform notes.

• QUARK collects the UCI configuration from /etc/config, giving clean text diffs between versions.
• Key-based authentication is recommended: add the collector's public key to /etc/dropbear/authorized_keys.
• Heavily customized or vendor-forked OpenWrt builds may relocate configuration; stock OpenWrt and standard forks work without changes.

Enable backup in Netwatch

Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.