LineSafer CactusOS Install
Firmware for the GL.iNet Flint 2 · OpenWrt 25.12

Home network security, kept local.

LineSafer turns your router into a filter for the whole family: ads, dangerous sites and unwanted content blocked on every device, even the ones that can't run an app. One panel for Wi-Fi, network, stats and remote access. No cloud, no subscription.

How to install See the panel
Runs entirely on the router, zero cloud Covers TVs, consoles and smart devices too Wi-Fi 6 and a 2.5 Gbit/s Internet port at full speed Free of charge, no account needed
LineSafer dashboard: Internet status, devices online, bandwidth, traffic and DNS request charts for the last 24 hours, Wi-Fi network and filter cards
The panel on a phone
Why on the router

One layer of protection for everything connected at home

Apps and extensions protect one device at a time, leaving the smart TV and the console exposed. The router sees everything, which makes it the right place to filter.

What you do online stays at home

Filters and stats work on the router. No outside service sees which sites you visit, and the DNS requests that go out to the Internet are encrypted.

Set it up once, it covers everyone

A guided setup on first boot, family-ready filters out of the box, separate networks for guests and smart devices. Then it just runs.

No extra hardware

It runs on the router you'd use anyway: no always-on Raspberry Pi, no extra box, no yearly subscription.

Features

Everything you need, in one panel

Protection, visibility, networking and remote access, designed together instead of three services you have to make get along.

Protection

DNS filtering and firewall on the router

  • Ads and trackers blocked at two levels, standard and aggressive.
  • Dangerous sites (malware, phishing, scams) always blocked, along with a list of dangerous IP addresses.
  • Parental controls: adult sites, gambling, and SafeSearch enforced on Google, Bing and YouTube.
  • Per-person profiles: their own filters, schedules (no internet at night, no games or social media at set hours) and pause.
  • Over 35 services you can block one by one: social, chat, streaming, online games, file sharing, P2P.
  • Online games: a dedicated filter category, on all the time or only at set hours.
  • Bypass protection: the "secure DNS" in browsers and phones can't sidestep the filters.
  • Custom lists to block or allow sites by hand or from a CSV file.
  • Rules for smart things: a camera or a plug connects only to the sites it needs, and risky ports stay closed.

Visibility

What's happening on your network, device by device

  • Devices with live status, editable name and type, vendor detection, search and filters.
  • Link quality for every device: signal, link speed, Wi-Fi generation and rough distance.
  • Traffic per device in GB and live: who is using the Internet now and which sites they are talking to.
  • 30 days of stats: requests, blocks, threats and bandwidth, by period and by device.
  • The sites each device asks for, with one-click block and allow.
  • «Why isn't it online?»: the router checks a device and tells you the cause and what to do.
  • Open ports on your devices checked every week, with a warning if a risky one appears.
  • Speed test checked against what the router measures, plus diagnostics that verify the protections really in force.

Network and Wi-Fi

A complete router, not just a filter

  • Three Wi-Fi 6 networks: Home, Smart (isolated, for connected things) and Guests, with a separate name per band if you like.
  • Timed guest network that switches itself off, with a new password each time and a QR code to join.
  • Per-band security: WPA2/WPA3 on 5 GHz, WPA2 only on 2.4 GHz for older printers and smart devices.
  • Wi-Fi schedules and adjustable signal strength within the allowed limits.
  • Fiber-ready: VLAN ID, MAC cloning, selectable WAN port, static IP.
  • Fair bandwidth: when someone downloads, video calls and games stay smooth.
  • Encrypted DNS (if the network blocks it, the router falls back by itself), IP reservations, port forwarding and UPnP, bandwidth limits.

Remote access and maintenance

Reach home from anywhere, update safely

  • Built-in Tailscale: reach the panel and your home network from outside, without opening ports.
  • Filters away from home: your phone can use your home filters through Tailscale.
  • Updates from the panel, with a check of the file and an automatic backup before installing.
  • Backup and restore with a preview of what changes, factory reset and scheduled restart.
  • Sensitive actions protected: installing the system, restoring or creating access asks for the password again, and every change stays in the log.
  • Documented API for apps and automation, with access you can revoke at any time.
  • Panel in English and Italian, with light and dark themes.
The panel

Clear at a glance, on desktop and phone

Light and dark themes, readable charts, every action one click away. The screenshots show the real panel with sample data.

Statistics

Thirty days of history stored on the router: how much traffic, how many requests, what was blocked and who uses the most.

  • Today, 24 hours, 7 or 30 days
  • Filter by device
  • Click a device to see all of its traffic
  • Every chart also has a table view
Statistics page: DNS requests, blocks, Internet traffic, hourly traffic chart and a ranking of the devices using the most data
Access points

Wi-Fi in the whole home, with the same rules

An extra GL.iNet router becomes a LineSafer access point: it extends the Wi-Fi where the signal doesn't reach and brings networks, filters and profiles along.

The same networks

on every access point

  • Home, Smart and Guests on the access points too, kept apart as on the router, over a single cable.
  • Every device stays recognisable: filters, profiles and statistics apply there too.
  • Assisted roaming: phones and tablets move to the access point with the best signal.

Managed by the router

no extra panel

  • Wi-Fi name and password are set once, on the router, for all of them.
  • Status and connected devices of every access point in the panel and in the app, with an alert if one stops answering.
  • Models: GL.iNet GL-AR750S and GL-B1300, with the LineSafer AP firmware.

How to add an access point

  1. Install LineSafer AP

    On the chosen GL.iNet (GL-AR750S or GL-B1300) install the firmware from the download page: it has the steps for each model.

  2. Connect it with a cable

    From a LAN port of the Flint to the access point's WAN port. The three networks travel over the same cable, each kept apart (VLAN): nothing else is needed.

  3. Link it to LineSafer

    In the router's panel: Wi-Fi → Access points → Connect an access point. Paste the key into the access point's panel: from then on names, passwords and networks are decided by the router.

Full guide, with pictures →

New

LineSafer on ZimaBoard 232 too

Instead of the Flint, as the main router: everything LineSafer does, on a board with two network ports. The Wi-Fi comes from LineSafer access points.

Main router

two network ports

  • eth1 for the Internet, eth0 for the home: a switch and the access points behind eth0.
  • Same panel and same app, with filters, profiles and statistics.

Wi-Fi from the access points

the ZimaBoard has no radios

  • Home, Smart and Guest networks broadcast by the connected LineSafer access points.
  • Updates from the panel, as on the Flint. Tested on one ZimaBoard 232.

Download for ZimaBoard →

Smart home

Smart things kept apart, but controlled by the hub

Bulbs, plugs, cameras and sensors live on the Smart network: they can't see computers and phones, and a faulty or hacked device can't reach the rest of the home. The home hub (Homey, Home Assistant and the like) still has to control them: LineSafer opens only the way it needs.

  1. Choose the hub

    In Devices open the hub, which sits on the home network, and turn on Smart-home hub. It gets a fixed address by itself.

  2. The hub controls everything

    From then on it can reach every device on the Smart network. The rest of the home stays closed to smart things.

  3. You choose what they may answer

    Smart things can reach the hub only on the ports you allow. When one tries, LineSafer shows it with an Allow button: you open only what is really needed.

The app

Your home network, on your phone too

The LineSafer app for Android shows how the network is doing and does the everyday things with one tap, at home and away.

For parents

It connects to the router by scanning a code from the panel. It talks only to your router: no account, no cloud.

  • Internet, devices, traffic and blocks at a glance
  • Pause, or home network only, for every device
  • Kids' requests and new devices to approve
  • Event log, Wi-Fi networks and access points
  • Away from home with Tailscale · English and Italian
Get it on Google Play Needs LineSafer 4.1.20 or later. App privacy
The app's home: Internet status, devices, blocked sites and threats, requests to decide
The Devices page: search, filters and, for each device, connection, signal and traffic
A device's page: connection, last 24 hours and actions
Privacy

What stays at home, and what doesn't

Spelled out plainly, no fine print.

Stays on the router

  • DNS requests from every device: full detail for 7 days, in the router's storage.
  • Stats and traffic per device: 30 days, in the router's storage.
  • Device names, settings, passwords: never sent anywhere.
  • No telemetry to the project, no account to create.
  • The phone app talks only to the router: no account and no LineSafer servers (app privacy).

Leaves the router

  • DNS requests to the Internet, encrypted (DNS-over-TLS), to the DNS service you choose.
  • Blocklist downloads, once a night: sites from GitHub, dangerous IP addresses from Spamhaus, abuse.ch and Emerging Threats.
  • A line check: a ping to 1.1.1.1 every 2 minutes, and once an hour a request to api.ipify.org for your public IP.
  • The exact time: the router looks up the time servers without encryption, because encrypted DNS only works once the clock is right.
  • Tailscale, only if you turn it on: connections are set up through Tailscale's servers, which also receive its diagnostic data; traffic stays encrypted end to end.
  • The speed test, only when you start it, to Cloudflare.
An honest comparison

Where LineSafer wins, and where it doesn't

LineSafer isn't "a better ad blocker": it's a complete router, built for families, that doesn't depend on anyone's cloud.

Comparison between LineSafer and alternatives
LineSaferAdGuard HomePi-holeNextDNSFirewallaStock GL.iNet
Network-wide ad blocking✓✓✓✓✓✓✓✓
Parental controls✓partialpartial✓✓✓✓partial
Per-device stats and traffic✓DNS onlyDNS onlyDNS only✓✓partial
Complete router (Wi-Fi, networks, firewall, bandwidth control)✓✓✗✗✗✓✓✓
No cloud dependency✓✓✓✓✓✓✗partial✓
No extra hardware✓✓✗✗✓✓✗✓✓
Built-in remote access✓partialpartial—✓✓✓
Ease of installationmanual install✓✓✓✓✓✓preinstalled
Maturity and supportyoung project✓✓✓✓✓✓✓✓✓✓
Costfreefreefreefreemiumdedicated hardwarefree
Installation

From stock firmware to LineSafer in ten minutes

All you need is a GL.iNet Flint 2 (GL-MT6000) and a computer. You can go back to the stock firmware whenever you want.

  1. Upload the firmware from the GL.iNet panel

    In the stock panel, open System → Upgrade → Local Upgrade, upload linesafer-<version>-gl-mt6000-sysupgrade.bin and uncheck "Keep Settings". The router restarts in about three minutes.

  2. Install LineSafer from the router

    Plug a cable into a LAN port or join the LineSafer Wi-Fi network (password linesafer) and open http://10.0.5.1. Sign in with the password linesafer and choose a new one, then Download and install and Restart now: the router downloads the latest version by itself.

  3. Follow the setup wizard

    Choose the new panel password (required), the protection level (Family, Ads only or no filtering), the encrypted DNS service and, if you like, the Wi-Fi name and password.

  4. Connect to the Internet and pick your filters

    For fiber, you can set the VLAN ID and WAN port under Network → Internet. Blocklists download on their own, and dangerous sites are already blocked.

Download the firmware

The firmware for the Flint 2, free of charge, with its SHA-256 fingerprint to check it and the warnings to read first.

Go to the download
Updates from the panelUnder System → Updates the router downloads new LineSafer versions and activates them at the next restart, after an automatic backup of your settings. If something goes wrong, it goes back to the previous version by itself.
Before you startThe first installation replaces the GL.iNet firmware and wipes its settings: write down your connection settings first (for example, your fiber VLAN).
Requirements and platform
Router
GL.iNet Flint 2 (GL-MT6000)
System
OpenWrt 25.12
Hardware
MediaTek Filogic MT7986, Wi-Fi 6, 2.5 GbE
Going back
GL.iNet emergency recovery (U-Boot), with the stock firmware
Coming next

What's coming

What is planned next and what we are evaluating. These are not promises with a date: they ship when they are ready and tested.

Planned

  • Notifications on your phone: a request for extra time, a new device, the line going down.
  • iPhone app, next to the Android one.
  • App for kids: they see what is blocked and how much time is left, and ask for more from their phone.
  • Isolate a device: a suspicious device reaches neither the Internet nor the rest of the home.
  • Line quality over time: delays and drop-outs recorded, for the backup line too.
  • Panel installable on the phone like an app.

Under evaluation

  • Other routers, after the ZimaBoard: for example the GL.iNet GL-MT3000, the OpenWrt One or a Cudy WR3000P.
  • A single firmware for router and access point: at first start you choose main router or extender.
  • Backup line from your phone through USB tethering, with the backup line's data use under control.
  • Automatic blocking of attackers (CrowdSec), useful if you open ports to the Internet.
  • Full IPv6, on the backup line too.
  • Outbound WireGuard VPN and time limits per single service (for example YouTube only).
FAQ

Frequently asked questions

Does it slow down my connection?

No. Filtering works at the DNS level, only on the first request of each connection; the rest of the traffic goes through the router's hardware acceleration. The 2.5 Gbit/s Internet port runs at full speed, and the panel includes a speed test so you can check. The one exception is bandwidth limits: while one is active, hardware acceleration is turned off.

Will it work with my fiber connection?

Yes, as long as the Flint 2 is your main router. From the panel you can set the VLAN your ISP requires (for example 835), the WAN port, a static IP and, if needed, clone your old router's MAC address.

Do the filters work away from home?

Yes, with Tailscale: your phone connects to the router from anywhere and uses the same filters, with your home device names. Tailscale is optional and can be turned on from the panel.

Can a device get around the filter?

Plain DNS requests always go through the router, and bypass protection blocks the encrypted DNS that browsers and phones would use to get around it. A VPN on a device, however, takes its traffic off the network: no network filter can see inside it.

What can't parental control prevent?

Whatever goes outside your home network: mobile data and the phone's hotspot, a VPN or Tor on the device. Also, schedules and limits follow the device's address (MAC): if a phone uses a private address that changes, it falls back to the home rules until you reassign it (the panel explains how to make it fixed). And anyone who can reach the router can factory-reset it: keep it somewhere out of reach.

Can I open ports to a video recorder (NVR) or a server?

Yes, from "Ports & UPnP". Keep in mind that many fiber lines don't have a public IP of their own (CGNAT), and in that case no port is reachable from the Internet. The panel tells you, and Tailscale remains the way to get in from outside.

What about IPv6?

For now the home network uses IPv4. Blocks apply to IPv6 requests too, so no device can slip past the filter that way.

Does it work on other routers?

For now, only on the GL.iNet Flint 2. LineSafer is designed to come to other, similar OpenWrt routers too, but each model needs testing first.

Who's behind it? Is there support?

LineSafer is an independent project, made by Raffaele Salutari. Every release is checked with more than 500 automated checks on a virtual copy of the router. For questions, bug reports or requests, use the contact form.

Contact

Get in touch

Questions, ideas, bug reports: we reply by e-mail.