01Why I built it

Consumer routers hit a ceiling fast. The moment you want real VLANs, a proper firewall, per-device bandwidth limits, or a self-hosted VPN, you're either flashing third-party firmware or paying for enterprise gear that comes with a subscription and a steep learning curve. I wanted UniFi-class capability on hardware I already had — a spare mini PC with two network cards — without the lock-in or the cost.

RouterUI is a web interface that turns a plain Linux box into that router. It installs a working router first — DHCP, DNS, NAT, and a stateful firewall with safe defaults where the WAN can't reach the router — and everything else stays off until you ask for it: VPN, ad-blocking, intrusion detection, deep packet inspection, containers. It's built for prosumers and homelabbers who've outgrown their ISP box, not as a Cisco or Juniper replacement.

02How it's built (for the curious)

The decisions that matter:

One Rust binary, no runtime. The backend is Rust (axum, tokio, SQLite) compiled to a single static binary; the frontend is a SvelteKit single-page app the backend serves itself. No Python, no heavyweight runtime — nothing to keep patched but the one binary.

It drives the real Linux stack, not a black box. Instead of reinventing networking, RouterUI configures the standard tools directly — dnsmasq, iptables/ipset, tc, WireGuard — so it's fast, transparent, and debuggable with the tools you already know.

Router core, add-ons on demand. The core covers the router itself: DHCP & DNS, a stateful firewall on by default, 802.1Q VLANs with per-network isolation, an isolated guest network, port forwarding with validation and auto-rollback, CAKE smart-queue QoS to kill bufferbloat, per-device Traffic Insight, dynamic DNS, dual-WAN failover, and a full diagnostics kit. Add-ons install only when you enable them — AdGuard Home, WireGuard, Tailscale, CrowdSec, ntopng DPI, Docker, Pi-hole, Jellyfin.

It runs as root, so security got real attention. Session auth gates every protected route and locks the setup once an admin exists; anything that reaches iptables, dnsmasq, or tc is validated to block command injection; and the systemd unit is sandboxed (ProtectHome, PrivateTmp, RestrictSUIDSGID). Traffic Insight can see every domain a device resolves, so it ships off by default with a retention cap.