> **This Marketplace version has been retired.**
>
> The DD-WRT binding is included in the official openHAB distribution beginning
> with openHAB 5.2. Remove the Marketplace/KAR version before installing the
> official binding from Settings → Add-ons → Bindings.
Monitors and manages DD-WRT, OpenWrt, Tomato, Raspberry Pi and pretty much anything on a network via SSH. Provides device telemetry, wireless client tracking, syslog event monitoring, firewall rule control, and auto-discovery — all over a single SSH connection per device.
Changelog
Version 5.2.0 — Official openHAB Distribution
The DD-WRT binding was accepted upstream in openHAB/openhab-addons#20505
and is included with openHAB 5.2.0 and later.
Changes since 5.1.5.202605291529
- Moved WAN IP, WAN traffic, DHCP lease, and DHCP event channels from
individual device Things to the network bridge. - Prevented dnsmasq “possible DNS-rebind attack” messages from being
incorrectly reported as DHCP events. - Improved client identity handling for devices using randomized MAC addresses;
hostname is the stable client identity and MAC is optional. - Added/standardized client wireless channel metadata, including channel,
signal strength, and transfer-rate units. - Improved syslog timestamp handling and bridge configuration validation.
- Incorporated final upstream review and documentation changes.
Upgrade
Remove the Marketplace KAR before upgrading. Install the official binding from:
Settings → Add-ons → Bindings → DD-WRT Binding
Version 5.1.5.202605291529
Bug Fixes
- EdDSA/Ed25519 SSH Failure - Fixed EdDSA security provider registration to resolve Ed25519 key loading issues in OSGi environments (#68)
- Reverse DNS Lookups - Fixed reverse DNS resolution failures (#74)
- CPU Temperature Parsing - Fixed ambiguous CPU temperature parsing by probing and caching the source (DMU vs thermal_zone) to prevent incorrect readings (e.g., Broadcom DMU reporting 680 decidegrees was incorrectly parsed as 680°C) (#70)
- AP Association Not Clearing - Fixed AP association state not clearing when devices leave the network; added syslog follower health channel (#63)
- Device Online Channel - Fixed device online channel not updating when reboot is triggered (#69)
Enhancements
- Improved Client Counting - Added ARP-based total client counts, wireless/wired split, and DHCP lease channels; refactored DHCP event handling to network bridge (#67)
- Strict Host Key Checking - Added configuration option for strict host key checking
Version 5.1.5.202605032144
-
Client Abstraction Refactor
- Rename
wireless-clientthing type toclientto support wireless, wired, and VPN endpoints - Add
connection-typechannel (wireless / wired / vpn) to client things - Clients in radio assoclists or syslog wireless events are classified as
wireless - Clients in DHCP/ARP cache with no AP association are classified as
wired
- Rename
-
Fix reverse DNS hostname extraction —
InetAddress.getHostName()returning the IP itself was truncated to first octet -
Added static hostname mapping support and local ARP cache reading on openhab server to support wireless client without hostname when no DHCP server is present.
-
ARP cache improvements and wireless client inbox deduplication.
-
Disabled ARP scan on non-gateway dump APs to reduce load
Version 5.1.3.20260416
- SSH Backoff & Lockout Prevention
- Two-tier backoff strategy with independent counters for auth failures vs network failures
- Auth failures: 30s, 60s backoff, then suspend after 3 attempts — stays under Dropbear’s 5-attempt block threshold so users have time to fix config
- Network failures: 10s..300s backoff with no hard stop (host may come back)
- Auth failure resets network counter (proves reachability); network failure does not affect auth counter
- User Configuration Improvements
- New
useSystemUseroption on bridge and device — resolves username from~/.ssh/configor system user - Default user set to
rootfor bridge and device configs - Support
user@host:portsyntax in the hostnames parameter for per-host overrides - Updated config descriptions to document username precedence
- New
- Fixed Ed25519 SSH key support (EdDSA security provider was not registered in OSGi)
Version 5.1.3.20260409
- Replace
AcceptAllServerKeyVerifierwithKnownHostsServerKeyVerifierusing Trust On First Use (TOFU) - Log SSH-style warning with remediation instructions when host key changes
- Register EdDSA security provider in OSGi for Ed25519 SSH key support
- Load SSH keys at client level to support
ProxyJumpauthentication - fixed Bridge channels:
total-clients,wireless-clients,wired-clients - fixed Firewall rule cache listener notifications
-
- Add i18n keys for all channels and thing types
- README: quick start, SSH key setup, key directories, SSH config, host key verification (TOFU), firmware SSH setup links
Version 5.1.3
- fixed: Ed25519 SSH key loading in OSGi (explicit EdDSA security provider registration)
- fixed: Refresh thread crash recovery — catch-all exception handler prevents silent thread death on SSH session loss
- added: Device telemetry (CPU load, temperature, uptime, WAN IP, traffic counters)
- added: Wireless radio monitoring (SSID, channel, mode, associated client list)
- added: Wireless client tracking (online/offline, signal, roaming, MAC randomization)
- added: Real-time syslog monitoring (DHCP, wireless, warning, error events)
- added: Firewall rule control (DD-WRT nvram filter rules)
- added: Auto-discovery of devices, radios, wireless clients, and firewall rules
- added: Support for DD-WRT, OpenWrt, FreshTomato, and generic Linux devices
- added: SSH key auth with Ed25519 support and ~/.ssh/config directives (ProxyJump, User, Port, IdentityFile)
Version 0.1
- initial release
