vernesong/OpenClash

OpenClash is a LuCI web-UI plugin that installs and manages the Mihomo (Clash Meta) proxy core on an OpenWrt router. Rather than putting a proxy client on each device, you configure the router once, and traffic from the whole network is routed through it according to rules. It supports mainstream proxy protocols and splits traffic between proxied and direct paths.

What it does

The plugin bundles Mihomo and a Smart core, using them in redir-host or fake-ip mode, with a mixed mode and TUN mode, and works with either iptables or nftables firewall backends OpenClash README. Configuration is managed from the LuCI interface: multiple subscription lists, online subscription conversion via Subconverter, custom headers, multiple config profiles with one-click switching, online YAML editing, backup/restore, and an Age-encrypted backup option. Access control covers allow/deny lists and custom firewall rules, and a streaming section can automatically select lines for services such as Netflix, Disney+ and HBO function list.

How a typical setup works

You download the architecture-matched package (*.ipk for opkg systems, *.apk for apk systems) from Releases and install it through LuCI's software package page, then go to Services → OpenClash, import a subscription or upload a config, and start it quick start. Command-line installation with the required dependency set is also documented for both the iptables and nftables firewall cases; the plugin does not ship the core pre-downloaded, so the first use needs a working network to download the kernel.

Requirements and constraints

• Platform: OpenWrt only, 18.06+ per the badge; the dependency table states LuCI ≥ 19.07 plus luci-compat dependencies.
• Runtime packages: bash, curl, ca-bundle, ruby, ruby-yaml, dnsmasq-full, ipset, ip-full and unzip are required; TUN mode needs kmod-tun, IPv6 needs ip6tables-mod-nat, and PROCESS-NAME matching needs kmod-inet-diag dependencies.
• Firewall split: iptables users install iptables-mod-tproxy/extra; nftables (Firewall4) users install kmod-nft-tproxy instead. Mixing the wrong set for your firewall is the documented source of breakage.
• Proxy reliance: it is infrastructure for proxying — subscriptions, rules and upstream servers come from you.
• Scope: the README is documentation, not an independent security or performance evaluation; no benchmark figures are provided.

Licence

MIT licence.