Step 0.1 Set Template (OS) to OpenWrt #

Figure: Example of selecting template in creation screen (1 = OS template / 2 = hostname).

Step 0.2 Verify Public IP Allocation Settings and Create #

Figure: Network settings example (1 = set IPv4 Pool to Public IP / 2 = number of IPs (normally 1) / 3 = create button).

Step 4.1 Set root Password (Required) #

If the script initially detects an unset root password, passwd will start. Follow the instructions to set a new password.

This password is required for LuCI (HTTPS GUI) login.

Step 4.2 Input WAN Settings #

The prerequisite of this guide is that eth0 is WAN, so even if the prompt shows WAN device [eth1]:, enter eth0.

Figure: Example inputs for firstboot.sh (1 = set WAN device to eth0 / 2 = input WAN IPv4, netmask, gateway, DNS).

Items to input (example):

• WAN device: eth0
• WAN IPv4 address: IP from portal (example: 203.0.113.2)
• WAN netmask: Netmask from portal (example: 255.255.255.224)
• WAN gateway: Gateway from portal (example: 203.0.113.1)
• DNS servers: If not specified, 1.1.1.1 8.8.8.8 is fine
• Admin source IP / CIDR: Your management IP (example: 203.0.113.10/32)

Step 4.3 Confirm Application #

At the end, your settings are displayed. If everything looks correct, enter y at Apply these settings? [y/N]:.

After application, the script will configure OpenWrt-side network settings and HTTPS access permission (FW) with management IP restriction.

Step 7.1 Register SSH Public Key in LuCI #

LuCI menu example (notation may differ slightly by environment):

System → Administration → SSH-Keys

Figure: Example of opening System menu and selecting Administration in LuCI (1 = System / 2 = Administration).

Figure: Example of SSH-Keys registration screen (1 = paste public key / 2 = Add key).※ Public key is the “non-private key” (example: ~/.ssh/id_ed25519.pub).

Paste the public key (ssh-ed25519 AAAA... on one line) and save.

Step 7.2 Run SSH Enable Script #

Execute the following in the console:

./enable_ssh.sh

If this does not run properly, execute with path specification:

sh /root/enable_ssh.sh

Figure: Example of starting enable_ssh.sh and inputting the permitted source IP for SSH (22) (1 = execution location).

You will be asked for the management IP. If it is the same management IP you used for HTTPS, pressing Enter with the default is fine.

This script typically performs the following:

• Start dropbear (SSH)
• Configure key authentication only (disable password authentication)
• Add a rule to the OpenWrt firewall to permit port 22 from management IP only

Step 7.3 Open Port 22 on Cloud-side FW / SG as Well (Limited to Management IP) #

• Permit: TCP 22
• Source: Management IP (example: 203.0.113.10/32)
• Destination: This OpenWrt instance (WAN side)

Step 7.4 Verify Connection (From Your Device) #

ssh -i ~/.ssh/id_ed25519 root@<WAN_IP>

SSH login with a password is expected to fail (keys only).

Step 8.1 Cannot Access HTTPS (Timeout) #

Troubleshooting order:

1. Confirm TCP 443 is permitted from management IP in cloud-side FW / SG
2. Verify your management IP is correct (has your line changed?)
3. Verify WAN settings are configured in the console

Console verification:

uci show network.wan
ip -o -4 addr show
ip route

Verify packets are reaching (example):

tcpdump -ni eth0 tcp port 443

Step 8.2 Management IP Changed and Cannot Access #

You can rewrite the permitted IP in the console (if management IP has changed).

Rewrite permitted source for HTTPS:

uci set firewall.allow_https_from_admin.src_ip='<NEW_IP/32>'
uci commit firewall
/etc/init.d/firewall restart

If using SSH:

uci set firewall.allow_ssh_from_admin.src_ip='<NEW_IP/32>'
uci commit firewall
/etc/init.d/firewall restart

Step 8.3 Wrong WAN Device (eth0 / eth1) #

Configuring WAN on the wrong interface makes the instance inaccessible. You can recover via console. Verify that network.wan.device is eth0.

uci show network.wan.device
uci show network.wan.ifname  # Depending on environment, this key may be used instead