What this LuCI guide solves
Forum threads devolve into YAML dumps precisely because newcomers cannot separate three concurrent concerns: picking an outbound inside selector-type proxy groups, choosing how aggressively the gateway intercepts flows via transparent hooks, and rotating the high-level proxy mode knob that decides whether GEOIP-driven splitting stays engaged. When those layers blur, LuCI edits feel random—especially under memory pressure or after subscription rotations silently reshuffle node names.
This guide sequences the mental model the way operators rehearse incidents: confirm process health, mutate selectors deliberately, flip modes only when isolating rule regressions, apply merged configuration without stranding DNS redirection, then corroborate outcomes from an ordinary LAN browser tab rather than SSH folklore. We speak generically about tab labels because community translations rename drawers; treat synonyms such as “Servers”, “Proxies”, or “Policy” as skin-deep wrappers over the same proxy-groups vocabulary Mihomo-class cores expose everywhere.
Responsible use remains your jurisdiction’s obligation—proxies alter transport paths but do not confer permission to bypass lawful restrictions. Maintain subscription hygiene identical to API secrets: rotate leaked URLs, avoid paste dumps in chats, and document mode toggles when household members share the gateway so accidental Global sessions do not surprise auditors.
Deliberately out of scope: fresh installs
If you still lack ipk feeds, Meta-compatible cores, or remote profiles, pause here and finish provisioning using the gateway-focused installation narrative referenced above. Attempting node swaps against an idle daemon yields placebo clicks; LuCI may happily persist selections while iptables or DNS assets remain detached, producing “everything saved yet nothing moves” confusion that belongs in provisioning—not steering—checklists.
Enter OpenClash from LuCI
Browse to your router’s LAN management IP over HTTPS when available, authenticate with an account capable of altering network services, then open Services → OpenClash. Some firmware forks relocate plugins beneath “VPN” or custom menus; if paths diverge, search the LuCI applications screen for the English branding “OpenClash” because package identifiers remain consistent across translations.
Pin this tab during experiments: repeatedly bouncing through unrelated firewall pages risks missing confirmation banners after partial saves. Modern LuCI employs asynchronous commits; wait for success toasts before issuing contradictory reload commands from SSH shells running parallel service restarts.
Verify running state before touching selectors
Start on whatever overview or dashboard surface surfaces daemon uptime, current profile name, last subscription refresh timestamps, and transparent-proxy mode indicators. If subscriptions failed—often due to WAN DNS glitches, captive portals, or exhausted RAM—fix ingestion before debating node quality; gorgeous selectors cannot route traffic through proxies that never materialized in YAML.
Scan lightweight logs for recurring DNS loops or permission errors writing runtime directories on overlay mounts nearing capacity. Storage starvation manifests as mysteriously reverting picks because temporary merges abort mid-write.
Household tip: coordinate subscription refreshes during off-peak hours so flashing dozens of nodes simultaneously does not coincide with remote provider API throttles that mimic dead latency rows.
Understanding policy groups in plain language
YAML authors compose proxy-groups as modular brains: selector groups expose explicit manual choices (Hong Kong edge versus Tokyo relay versus DIRECT), url-test cohorts automate latency comparisons on timers, and fallback chains escalate through ordered backups when health probes fail. LuCI surfaces whichever branches survived parsing; malformed indentation may omit entire subtrees while leaving sibling lists misleadingly healthy.
Nested selectors mirror everyday intuition—GLOBAL might chain into REGION buckets before reaching leaf nodes—yet rules still terminate at whichever alias your maintainer wired into MATCH clauses. Changing “Streaming-JP” produces zero effect if FINAL currently forwards into a different selector whose manual override still pins Singapore transit.
Treat DIRECT as a first-class egress rather than an emergency eject: domestic CDNs routinely outperform tunnel RTT even when offshore nodes ping deceptively well on ICMP-heavy dashboards.
1Switch nodes inside LuCI selectors
Navigate to the pane enumerating servers or proxy groups—often tabbed beside rules or configuration uploads. Expand each selector relevant to your workload rather than spamming every collapsed folder blindly; bandwidth-conscious households might prioritize interactive VoIP selectors separately from bulk download cohorts referencing CDNs insensitive to jitter.
Click the active outbound row, choose a concrete proxy entry whose naming convention you recognize from subscription manifests, then confirm the UI highlights your selection persistently across refreshes. If the row snaps back immediately, suspect remote profile automation—maintainers sometimes enforce scripted picks—or local yaml merges layering mixin overrides you forgot existed.
Where latency badges exist, interpret them comparatively inside the same session rather than obsessing over absolute milliseconds; router CPUs probe differently than beefy desktops, and QUIC-shaped carriers distort ICMP narratives. Cross-check stubborn outliers using real browser sessions targeting the domains you actually care about.
Rule mode, Global mode, and Direct at the gateway
Rule mode is the default sane posture: domain rules, GEOIP buckets, and occasional PROCESS-style matchers steer flows toward policy groups before MATCH catches stragglers. Manual selector edits remain influential because rules ultimately delegate to whichever proxy-group alias appears at the decision leaf—not directly to opaque magic inside LuCI buttons.
Global mode intentionally blunt-forces discretionary sessions through your GLOBAL-oriented selector stack, bypassing split artistry so operators can dichotomize “rule regression versus dead transit.” Reserve it for short diagnostic windows: forgetting to revert strands banking portals or IoT cloud dashboards inside unexpected ASNs, awakening fraud heuristics family members only notice days later.
Direct mode (sometimes labeled bypass) sheds interception semantics so clients interact with ISP routing closer to stock OpenWrt behavior while leaving daemons available for quick re-enablement—ideal when isolating whether buffering stems from tunnels versus last-mile congestion.
2Rotate proxy modes deliberately
Locate the operating-mode control—commonly adjacent to overview widgets toggling Rule versus Global versus Direct. Flip modes slowly: rapid oscillations while transparent redirection scripts rerun may transiently blackhole DNS if watchdog timers overlap.
Document mode transitions when debugging collaboratively; screenshots dated alongside WAN weather conditions prevent imaginary regressions when remote peers altered selectors independently via mobile browsers logged into the same LuCI session.
3Apply configuration without wedging runtime hooks
After selector or mode edits, commit using the plugin’s save-and-apply ritual rather than assuming instantaneous kernel adoption. Many workflows regenerate merged runtime YAML under /etc/openclash analog paths before signaling the Meta-compatible core to reload; skipping commits yields UI ghosts contradicting active iptables chains.
When LuCI prompts for service restart versus soft reload, prefer soft reload during iterative tweaks to minimize DHCP churn on fragile IoT VLANs. Reserve hard restarts for upgrades or corruption recoveries where log snippets mention stale file descriptors.
DNS caution: mode experiments interplay with DNS redirection policies documented in DNS leak prevention guidance; if only some domains mis-resolve, suspect DNS before rewriting proxy chains wholesale.
4Validate outcomes from a LAN client
Connect a laptop or phone exclusively through the router’s LAN bridge—disable conflicting VPN apps skewing routes—and reload HTTPS IP or DNS leak summaries that tolerate refresh spam responsibly. Compare observations against OpenClash logs sliced around the same timestamps to confirm selectors triggered as expected rather than falling through MATCH surprises.
CLI enthusiasts may additionally spot-check traceroutes or curl timings; remember wireless jitter masquerades as proxy faults when household members saturate airtime with concurrent video uploads.
Router OpenClash versus desktop Mihomo Party
Readers crossing our Mihomo Party Windows tutorial should notice mirrored vocabulary yet divergent blast radius. Router workflows centralize steering for every DHCP client—including consoles and TVs lacking native Clash binaries—while desktop stacks proxy local sockets until administrators escalate into TUN overlays mirroring gateway semantics more faithfully.
LuCI latency widgets often feel conservative compared with plush Electron dashboards; temper expectations and prioritize stability metrics meaningful for whole-home throughput rather than RGB-infused ping theater.
Where LuCI stops and YAML maintainers continue
Everyday steering handles selectors and modes comfortably inside LuCI. Automated failover thresholds, relay chains, mixin merges, or rewriting remote provider endpoints remain YAML territory explored in focused Meta articles—attempting to emulate complex url-test tolerances purely through frantic clicking invites disappointment when upstream timers overwrite manual binds predictably per design.
Symptom ↔ lever cheat sheet
Selectors revert instantly: remote profiles may enforce scripted selections or automation timers; clone configs locally if household policy demands sticky manual picks resistant to upstream churn.
Rule mode fails while Global works: revisit GEOIP datasets, stale rule providers, or contradictory DNS modes before blaming individual nodes.
LuCI saves yet LAN ignores changes: confirm transparent-proxy hooks remain enabled, verify clients actually use the router as gateway, and inspect VLAN-specific DHCP options diverting DNS sideways.
Uniform timeouts across nodes: escalate WAN diagnostics—OpenClash cannot salvage upstream outages caused by carrier faults or misconfigured PPP credentials unrelated to proxy artistry.
FAQ highlights
Does switching nodes affect UDP gaming? Yes when profiles route gaming domains through tunneled paths; validate OpenClash UDP handling alongside transparent modes because some firmware builds emphasize TCP-centric redirection unless administrators tuned divergent paths intentionally.
Should families maintain separate guest SSIDs? Guest networks isolating untrusted devices reduce accidental LuCI exposure and prevent visitors inheriting experimental Global sessions without informed consent.
Are renamed subscription nodes harmful? Sudden renames invalidate pinned selectors until LuCI reloads lists—refresh subscriptions after provider maintenance windows to remap aliases proactively.
Hands-on takeaway
OpenClash on OpenWrt excels when operators treat LuCI as an operations console rather than a mystical black box: subscribe health precedes selector artistry, modes rotate with explicit hypotheses, commits synchronize kernels with UI truth, and LAN verification closes the loop without SSH archaeology. Router-centric stacks nevertheless compete with a fragmented ecosystem of desktop forks whose documentation quality fluctuates wildly—patchwork installers, uneven translation coverage, and unpredictable release cadences still strand newcomers who simply wanted dependable selector hygiene across laptops during travel. Clash addresses that fragmentation with consolidated installers, multilingual guidance, and disciplined release hygiene so failover drills on the gateway align with what graphical clients do off-router. When you want the same vocabulary without juggling orphaned community builds every quarter, compare our maintained binaries and routing docs against piecemeal forks, then download Clash from our hub to pair trustworthy desktop tooling with the LuCI workflows you already mastered on the gateway.