Install dae or honk on OpenWrt
Install dae or honk, eBPF transparent proxy engines, on OpenWrt 25.12 and later. honk includes the doona web UI. Their LuCI apps manage the services in OpenWrt. This feed provides apk packages.
Supported versions
| Version | Kernel | Status |
|---|---|---|
| 25.12 | 6.12 | Supported on OpenWrt and ImmortalWrt. |
| 24.10 | 6.6 | Unsupported: opkg has no repository tags, so this feed would replace packages with the same name. ImmortalWrt includes dae. honk needs kernel 6.12+. |
| 23.05 and older | ≤ 5.15 | Unsupported: the kernel is too old for dae and honk (dae needs 5.17+). |
As root on the router, check the release, package architecture and target:
. /etc/openwrt_release
echo $DISTRIB_RELEASE $DISTRIB_ARCH $DISTRIB_TARGETAvailable package architectures follow. ImmortalWrt only needs a matching architecture. This feed provides no packages or support for 32-bit ARM or MIPS:
OpenWrt targets and BTF
Official OpenWrt kernels lack BTF, the kernel type information dae and honk need. On official OpenWrt, this feed supports only the targets and releases below, and each needs vmlinux-btf. Kernels with BTF (ImmortalWrt) use the empty vmlinux-btf-builtin package instead.
Releases: 25.12.6
Install
Import the signing key
wget -O /etc/apk/keys/daeuniverse.pem \
https://openwrt.daeuniverse.org/public-key.pemAdd the repositories
. /etc/openwrt_release
FEED=https://openwrt.daeuniverse.org/$(echo "$DISTRIB_RELEASE" | cut -d. -f1-2)
cat > /etc/apk/repositories.d/daeuniverse.list <<EOF
@daeuniverse $FEED/packages/$DISTRIB_ARCH/packages.adb
@daeuniverse $FEED/kmods/$DISTRIB_RELEASE/$DISTRIB_TARGET/packages.adb
EOF
apk update. /etc/openwrt_release
FEED=https://openwrt.daeuniverse.org/$(echo "$DISTRIB_RELEASE" | cut -d. -f1-2)
cat > /etc/apk/repositories.d/daeuniverse.list <<EOF
@daeuniverse $FEED/packages/$DISTRIB_ARCH/packages.adb
EOF
apk updateThe @daeuniverse tag selects packages from this feed. Without it, apk prefers system packages.
Install the packages
apk add dae@daeuniverse luci-app-dae@daeuniverseapk add honk@daeuniverse luci-app-honk@daeuniverseWithout LuCI, leave out the luci- packages.
Enable the service
dae and honk cannot run at the same time. Before switching services from the command line, stop and disable the current service. Edit /etc/dae/config.dae for your network before enabling the service. Then enable it in LuCI under Services → dae, or run these commands on the router:
dae and honk cannot run at the same time. Before switching services from the command line, stop and disable the current service. The default /etc/honk/config.dae uses br-lan as the LAN interface; change it before starting if your LAN device differs. All traffic initially connects directly. After signing in to doona, add proxy nodes or subscriptions and routing rules. Then enable it in LuCI under Services → honk, or run these commands on the router:
uci set dae.config.enabled=1
uci commit dae
/etc/init.d/dae enable
/etc/init.d/dae startuci set honk.config.enabled=1
uci commit honk
/etc/init.d/honk enable
/etc/init.d/honk startFor configuration syntax, see the dae documentation.
For configuration syntax, see the honk documentation. To open doona, visit http://<router LAN IP>:9527/ from a computer on the LAN, for example http://192.168.1.1:9527/. Use the IP address; honk refuses host names such as openwrt.lan. Create the administrator account on the first visit, then sign in to edit the configuration. Like LuCI, the page uses plain HTTP on the LAN; the default OpenWrt firewall keeps the port closed on WAN. See the doona documentation for UI instructions. Report UI problems to doona and engine problems to honk.
Upgrading
Run the commands below on the router, naming only the packages that are installed. In LuCI, you can also use Check for updates and then Upgrade under Services → dae, or the Updates tab under System → Software. The service page lets you select packages, shows live background upgrade output, and reconnects after rpcd reloads. Reopening the page resumes a running job; Close reloads the page after success. Failed repository refreshes are warnings, so available updates remain visible.
Run the commands below on the router, naming only the packages that are installed. In LuCI, you can also use Check for updates and then Upgrade under Services → honk, or the Updates tab under System → Software. The service page lets you select packages, shows live background upgrade output, and reconnects after rpcd reloads. Reopening the page resumes a running job; Close reloads the page after success. Failed repository refreshes are warnings, so available updates remain visible.
apk update
apk upgrade dae luci-app-dae v2ray-geoip v2ray-geositeapk update
apk upgrade honk luci-app-honk v2ray-geoip v2ray-geositeUpgrades retain configuration files. apk saves changed package defaults as .apk-new files beside modified configuration files. If apk reports breaks: world[…] after installation from a downloaded package, or the dialog says a selected package was not upgraded and shows an apk add …@daeuniverse command, see the local package pin note.
Common errors
UNTRUSTED signature
The router needs this feed's public key to verify packages. Complete Import the signing key, then run apk update.
This kernel has no BTF of its own
The OpenWrt router is missing the kmods repository, so apk installed vmlinux-btf-builtin instead of vmlinux-btf. Add both OpenWrt lines from Add the repositories, then run apk update && apk upgrade vmlinux-btf-builtin. If the router's target is missing from the table above, this feed has no vmlinux-btf for it. dae and honk cannot run on that router.
breaks: vmlinux-btf
The selected vmlinux-btf package does not match the installed kernel. For an official OpenWrt release, check that the kmods URL matches DISTRIB_RELEASE and DISTRIB_TARGET. If /sys/kernel/btf/vmlinux exists, remove the line containing kmods from /etc/apk/repositories.d/daeuniverse.list, run apk update, and install again. A custom or snapshot kernel without built-in BTF needs BTF generated for that kernel; removing the repository does not provide it.
breaks: world[honk><Q1…]
honk (or dae) was installed from a downloaded .apk file, which pins it to that file, so every apk add fails once this feed carries another version, even for unrelated tools. Run apk add honk@daeuniverse (or dae@daeuniverse) to follow this feed, listing any other packages in the same command.
Source: openwrt-packages feed site.