Monitoring OpenWRT Routers with Vigilmon

OpenWRT is the leading open-source Linux-based router and firewall firmware, running on millions of embedded devices from home routers to enterprise access points. Unlike managed cloud routers, OpenWRT gives you complete control — but that control means you're responsible for knowing when the device becomes unreachable, when WAN connectivity drops, or when the admin interface stops responding. Vigilmon closes that gap, giving you continuous uptime monitoring for your LuCI web UI, WAN health checks, SSL certificate alerts, and heartbeat confirmation for scheduled cron tasks.

What You'll Set Up

• HTTP uptime monitor for the LuCI web admin interface (port 80/443)
• WAN connectivity health check via keyword matching
• SSL certificate expiry alerts for HTTPS-enabled OpenWRT setups
• Cron heartbeat monitoring for scheduled tasks (opkg updates, log rotation)
• TCP port monitors to detect when the router stops accepting connections

Prerequisites

• OpenWRT 21.02+ running on your router or embedded device
• LuCI web interface enabled and accessible from your monitoring network
• A free Vigilmon account

Step 1: Monitor the LuCI Web Admin Interface

The LuCI interface is your primary indicator that the OpenWRT system is healthy and reachable. If LuCI stops responding, it could mean the device has crashed, the web server (uhttpd) has died, or the network path is down.

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the LuCI URL: http://192.168.1.1 (or https://192.168.1.1 if you've enabled HTTPS).
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

If your OpenWRT device is monitored from outside the LAN (e.g., over a VPN or from a VPS), use the device's WAN IP or hostname. For LAN-internal monitoring, Vigilmon's agent or a relay host on the same network segment can reach the router directly.

For a more precise health check, use the LuCI RPC system endpoint:

http://192.168.1.1/cgi-bin/luci/rpc/sys

This endpoint confirms that the uhttpd web server and the LuCI RPC subsystem are both operational, not just that the HTTP port is open.

Step 2: WAN Connectivity Status via Keyword Check

A router can be up and LuCI can be responding, but WAN connectivity may still be broken. OpenWRT's LuCI status page exposes connection state information you can probe with a keyword monitor.

1. In Vigilmon, click Add Monitor → HTTP / HTTPS.
2. Set the URL to: http://192.168.1.1/cgi-bin/luci/
3. Enable Keyword check.
4. Enter Connected or a known string from your LuCI dashboard that indicates WAN is up (inspect the page source on your device to confirm the exact text).
5. Set the monitor to alert when the keyword is absent.
6. Click Save.

For a more programmatic approach, OpenWRT exposes network status via its ubus JSON-RPC API. If you have a monitoring relay host on the same LAN, you can query it directly:

# Query WAN interface status via ubus
curl -s http://192.168.1.1/ubus \
  -d '{"jsonrpc":"2.0","id":1,"method":"call","params":["00000000000000000000000000000000","network.interface.wan","status",{}]}'

A healthy response includes "up": true in the returned JSON. You can wrap this in a small script that returns HTTP 200 on success and 503 on failure, then monitor that script's endpoint with Vigilmon.

Step 3: TCP Port Monitoring for Connectivity Verification

TCP port checks are the fastest way to confirm that your router is accepting connections — they succeed even when the full HTTP stack has a problem, and fail immediately when the device is unreachable.

Add TCP monitors for each critical port:

1. In Vigilmon, click Add Monitor → TCP Port.
2. Set Host to your router's IP or hostname.
3. Set Port to 80 (HTTP) or 443 (HTTPS).
4. Set Check interval to 1 minute.
5. Click Save.

Repeat for port 22 (SSH) if you want to detect when SSH access is lost independently of the web interface. A TCP check on port 22 failing while port 80 is up indicates the SSH daemon (dropbear) has crashed — a different failure mode from a full device crash.

If you've configured OpenWRT as a VPN server, add a TCP monitor for the VPN port (e.g., 1194 for OpenVPN, 51820 for WireGuard).

Step 4: SSL Certificate Alerts for HTTPS-Enabled OpenWRT

If you've configured HTTPS on your LuCI interface (using uhttpd with a self-signed certificate or an ACME-issued certificate via the acme or luci-app-acme package), Vigilmon can alert you before the certificate expires.

1. Open the HTTPS monitor created in Step 1.
2. Enable Monitor SSL certificate under the SSL section.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

For ACME-managed certificates on OpenWRT, check that the renewal cron job is correctly configured:

# On OpenWRT, view crontab
crontab -l

# Example ACME renewal entry (added by luci-app-acme)
0 3 * * * /etc/acme/acme.sh --cron --home /etc/acme

If ACME renewal fails silently, your certificate will expire without warning. The 21-day Vigilmon alert window gives you enough time to SSH in and manually trigger renewal:

# Manual ACME renewal on OpenWRT
/etc/acme/acme.sh --cron --home /etc/acme --log

For self-signed certificates, Vigilmon will still alert on expiry — set a longer window (e.g., 60 days) to give yourself time to regenerate and redeploy the certificate before LuCI becomes inaccessible over HTTPS.

Step 5: Heartbeat Monitoring for Scheduled Cron Jobs

OpenWRT runs several recurring maintenance tasks via cron: opkg update checks, log rotation, DDNS updates, and backup jobs. If the cron daemon (crond) stops or a script fails silently, these tasks are skipped without any visible indicator.

Use Vigilmon's cron heartbeat to confirm each critical scheduled task completes successfully.

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected ping interval to match your cron schedule (e.g., 1440 minutes for a daily job).
3. Copy the heartbeat URL (e.g., https://vigilmon.online/heartbeat/abc123).
4. Add a curl call at the end of your cron script on OpenWRT:

# /etc/cron.d/opkg-update or your custom script
#!/bin/sh
opkg update && opkg list-upgradable > /tmp/upgradable.txt
# Signal success to Vigilmon
curl -s https://vigilmon.online/heartbeat/abc123

5. Add this script to OpenWRT's crontab:

# Edit crontab on OpenWRT
crontab -e

# Run daily at 2 AM
0 2 * * * /bin/sh /root/opkg-update.sh

If the cron job crashes before the curl line runs, or if crond stops entirely, Vigilmon alerts after the expected interval passes. This is especially valuable for DDNS update scripts — a failed DDNS update means your domain stops resolving to your router's WAN IP, and you won't know until you lose remote access.

Repeat for other critical jobs:

• Log rotation scripts
• Scheduled configuration backups (sysupgrade -b)
• Network watchdog scripts

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, email, or a webhook.
2. Set Consecutive failures before alert to 2 on the LuCI HTTP monitor — temporary uhttpd restarts during OpenWRT package operations can cause a single probe to fail.
3. For TCP port monitors, set Consecutive failures to 3 to avoid alerts from brief network hiccups.

For a router that's your only path to the internet from a remote location, consider adding a phone/SMS alert channel for the WAN connectivity check. A Slack alert is useless if Slack itself requires internet connectivity through the same router.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP uptime | http://192.168.1.1 | uhttpd crash, device unreachable | | RPC health check | /cgi-bin/luci/rpc/sys | LuCI subsystem failure | | Keyword check | LuCI dashboard | WAN connectivity loss | | TCP port | :80, :443, :22 | Port-specific service failures | | SSL certificate | HTTPS LuCI domain | ACME renewal failure, cert expiry | | Cron heartbeat | Heartbeat URL | Cron job failure, crond stopped |

OpenWRT gives you the full Linux networking stack on your own hardware — but that power means you're the on-call engineer when anything goes wrong. With Vigilmon watching your LuCI interface, WAN connectivity, SSL certificates, and scheduled tasks, you get instant alerts rather than discovering an outage when you try to SSH in from a coffee shop.