Control your network, your way.
LanClearance lives inside your router's LuCI pages. Each device gets its own speed cap, allowed or blocked sites, admin access and a list of the local devices it may reach. Save a set of those as a settings profile, switch profiles on a schedule, and let a USB drive put the whole router back the way you want it. I use it at home. It runs a shop, a small office or a classroom just as well, in as much detail as you want.
No cloud account, no subscription, no app. It all runs on the router and stays there.
- Every device gets its own speed cap, or no internet at all
- Allow or block sites by domain, with online lists that refresh daily
- Each device sees only the local devices you choose
- Settings switch on a weekly schedule
- Admin pages open to wired and approved devices only
- Wi-Fi names, passwords and rules rotate from USB backups
One rule for everybody was the problem I kept hitting.
Most routers give you one setting for everybody: one filter, one speed, one Wi-Fi password that everyone knows, and every device able to see every other. I spent over a year trying to get around that with standard router settings before I wrote this. It didn't work. So LanClearance puts five controls on each device, lets you bundle them into profiles and schedules, and adds a restore schedule that can change anything a backup can change. It assumes the people on your network are clever (mine are), and that the router has to hold the line even after someone resets it.
Five settings per device
Speed limit, allowlists, blocklists, local access and admin access, set on each device by MAC address, or by IP address or range when you turn that on. A device you haven't listed gets the safe defaults the second it connects.
Profiles, groups and schedules
Save the five settings as a named settings profile and give it to any number of devices. Make device groups such as "Printers" or "Living room TV" so a device reaches exactly those and nothing else. Add a schedule and the switch happens by itself: homework hours, after hours, bedtime.
It puts itself back, and it can rotate
A scheduled restore puts router backups back from a USB drive at the times you pick. Keep a few that differ in Wi-Fi name, password or anything else a backup holds, and the router swaps between them. The drive also keeps copies of the LanClearance settings, so last week's rules are one click away.
A shop, a school and a house run on the same eleven tabs.
What changes is which devices you list, which profiles and groups you make, what the schedules switch and what the restore schedule rotates. That's it. 200 worked examples are at the bottom of the page.
Offices, shops and restaurants
Staff, guests and contractors share one router without seeing each other. The card terminal reaches its payment provider and nothing else. Staff laptops point at the Printers group; management devices point at the file server. After closing, a schedule tightens everything, and the guest Wi-Fi password changes every Monday from a backup on the USB drive.
Schools, libraries, halls and clubs
Lesson modes switch by timetable: Research at nine, Exercises at ten, Exam on Thursday afternoon. Catalogue terminals and donation tablets get a short allowlist. A loaner laptop is one MAC address and a profile choice. Whoever has the key that week opens LuCI from the wired port and changes nothing else.
Parental controls that fit each child
A person profile per child, a Homework settings profile on school afternoons and No internet at bedtime, all by schedule. The tablets can cast to the living-room TV and can't see the NAS or the router pages. Smart plugs talk to their vendor at sensor speed and to nothing in the house.
Everything is a tab in LuCI.
Pick a tab on the left to see the page. Most are screenshots from my test router; the three newest tabs are drawn to match until their screenshots are in.
Set it up once. Let the week run it.
Three tabs turn one-off settings into a routine: settings profiles name a set of rules, device groups name who may be reached, and schedules decide when each applies.
One name for five settings
"Staff", "Guest", "Homework", "Night": each is a speed limit, allowlists, blocklists, local access and admin access under one name. Choose it under Settings for any device or person profile. Change the profile and everything using it changes. Switch a device back to Own settings and the values it had before are still there.
Reach the printer, see nothing else
Local access is None, All, or a group. A device pointed at the "Printers" group reaches the printers, and they reach it back, and that's the whole list. A group can hold devices from your lists, a typed MAC address, or an IP address, range or subnet. Delete a group and its users fall back to None.
Day and night on the same device
Give a device "Day" under Settings, then add a 21:00–07:00 schedule that switches it to "Night" with No internet. Pick the days or leave them empty for every day; a range that ends earlier than it starts runs overnight. When two schedules overlap, the higher one wins. A check every two minutes catches a switch the router missed while it was off.
There's no "for two hours" button, and I'd say that's a good thing. A hand change, such as giving a technician's laptop admin access, stays until you change it back. If a change should end on its own, give it a schedule with fixed days and times.
Change the settings. Watch what each device can do.
A working model of the Devices, Settings Profiles, Schedules and Device Groups tabs, with a small office on it. Edit any device, flip a schedule, move the clock, then use the panel on the right to see what a device can reach and how fast. The rules are the ones the package applies. Nothing here touches a real router.
Devices
| Device | Settings | Speed limit | Allowlist | Blocklist | Local access | Admin |
|---|
Own settings shows five editable fields. A settings profile, or a schedule that's running now, fills them in instead. Devices that aren't in the list follow the defaults. A wired device is anything plugged into a LAN port.
Settings profiles
| Name | Speed limit | Allowlist | Blocklist | Local access | Admin | Used by |
|---|
Schedules
| On | Name | Applies to | Switch to | Days | From–To |
|---|
Outside a schedule's times the device goes back to what its Settings column says. Move the clock at the top to see the switch.
Device groups
| Name | Devices in the group | Pointed at by |
|---|
Try it as a device
Safe before you touch a setting.
The device you install from is approved for admin access automatically, so you can't lock yourself out. Everything else starts restricted.
- ↓Every device is capped. The built-in Standard preset is 1 MB/s down, 0.5 MB/s up. Change it, or make the default Unlimited and cap only the devices you choose. No internet is a choice too.
- ⌂Admin pages are closed to Wi-Fi. Router pages, SSH, the modem and AdGuard Home answer only to wired devices and the devices you approve.
- ◌Devices can't see each other. Internet, DNS and the router still work. Local access is None until you set it to All or to a device group such as "Printers".
- ≡Individual settings beat profiles. Put devices in a person profile, then override one setting on one device without leaving the profile. A schedule for the device itself beats both.
Anything a backup can change, the router can rotate.
Upload a few router backups to a USB drive from the LuCI page. Each one can differ in anything a backup holds: Wi-Fi name and password, guest network, firewall settings, DNS. Pick when restores happen and which backup each one uses, and the router swaps between them on its own. The schedule and the backups live on the drive, so restoring a backup can't switch the schedule off.
- Make a backup in System → Backup / Flash Firmware, once your settings are the way you want them.
- Upload it on the Scheduled Restore tab. The file is checked and saved to the USB drive under the right name.
- Pick times and days. List order, a custom sequence, a random pick, or a fixed backup per weekday. The page shows the next ten restores.
- Keep your device rules through it. "Keep LanClearance settings" is on by default, so a restore changes the router and leaves your devices, profiles and schedules as they are. Turn it off and the rules inside each backup come back too.
- Keep settings copies on the drive. Turn on "Save LanClearance settings to the USB drive" and a copy is saved after every change and before every restore, newest 30 of each kept. Put any copy back without a reboot. A restore cut short by a power failure is repaired at the next boot from the copy saved just before it.
Before every scheduled restore a diagnostics file is saved to the drive, and the health check compares the settings inside each backup with the live ones and names what differs.
Will it run on my router?
LanClearance runs on any router with OpenWrt 21.02 or newer and the LuCI web interface, including GL.iNet routers on their 4.x firmware. Nothing in it is compiled, so the CPU doesn't matter. Pick your router below and you'll get the file name you need.
GL.iNet routers show their model and firmware version at the top of the GL admin panel. The firmware version decides the base: 4.x MediaTek models are on OpenWrt 21.02; "-op24" firmware is OpenWrt 24.10.
Choose a router to see which build to install.
Or let the router answer
If you can open an SSH session, paste this in. It reads the OpenWrt version, firewall type, package manager, LuCI, dnsmasq-full, free flash space and flow offloading, then prints the exact file to install. It changes nothing.
Paste into an SSH session on the router
Download check.sh for the fuller report shown on the right.
What it prints
| Router | Firmware | OpenWrt base | Install this file | Notes |
|---|
GL.iNet bases come from GL.iNet's published firmware table (September 2026). Flow offloading (GL calls it "Network Acceleration") has to be off for limits and lists to apply, and the health check tells you if it's on.
Three clicks in LuCI. No SSH on most routers.
Update lists
LuCI → System → Software → Update lists…, so the router can fetch the firewall modules LanClearance needs.
Upload the package
Upload Package…, choose the file the checker gave you, Install. Dependencies download automatically.
Open Services → LanClearance
Limits, admin protection and local network privacy are already on. The device you installed from is approved. Add devices, profiles, groups and schedules on their tabs.
.apk build goes in with one SSH command instead: apk add --allow-untrusted /tmp/LanClearance_<version>_fw4.apk. After that it shows up in LuCI like any other package and you can remove it from System → Software.dnsmasq-full, the DNS variant that can tag addresses by domain. GL.iNet firmware ships it. On plain OpenWrt the Status tab tells you whether it's there. Speed limits, blocklists, admin protection, local access, schedules and scheduled restores work without it.Three OpenWrt generations, the same test set.
I installed every build on a virtual router running that OpenWrt release, opened and used every LuCI page, checked the firewall rules after a reload and a reboot, ran the scripted cases below and ran the built-in health check to the end. The compatibility command on this page ran on the same three routers.
Things people ask me.
Is this only for parents?
Can a device see just the printer and nothing else?
Can settings change by themselves at certain times?
Can I use published blocklists?
Does it replace my router's own parental controls or AdGuard Home?
What happens to a brand-new device that joins the Wi-Fi?
What about phones with private Wi-Fi addresses?
Will it slow my router down?
Does it survive a factory reset or firmware upgrade?
Is my data sent anywhere?
Can I remove it cleanly?
My router isn't in the table.
200 situations, and how to set each one up.
Every entry names the situation and the LanClearance controls that handle it. Business and organization use comes first, home and family after. Search for your own, or filter by the control you're curious about.
One purchase. Every build.
- fw3 build for GL.iNet 4.x and OpenWrt 21.02
- fw4 build for OpenWrt 22.03–24.10 and GL op24
- apk build for OpenWrt 25.12 and newer
- Install and uninstall scripts for SSH users
- Full written guide, version-free
- Built-in Smart Devices allowlist (109 domains)
Run the compatibility check before you buy. If it says "not compatible", don't buy it. The install would fail on a missing package and change nothing.