Safely Recovering SSH and LuCI on an OpenWrt E8450

by

If SSH, LuCI, and internet access all disappear after upgrading OpenWrt on a Linksys E8450, do not conclude that three services failed at once. The management computer may no longer receive an address on the expected LAN, or an older /etc/config/network may have been restored over a new default layout.

Recovery should begin with checks that do not erase data. Separate an image or boot failure from a changed LAN address, stopped Dropbear or uHTTPd services, and incompatible preserved settings. Factory reset belongs at the end. This guide assumes that the E8450 UBI installation completed and that the power supply and flash hardware are not physically damaged.

Split the outage into four branches

Observation Likely scope First action
No wired link or DHCP response, and LEDs differ from a normal boot Boot, image, or flash path Verify the E8450 UBI profile and device-specific serial or recovery procedure
The computer receives an address, but the previous management address is closed LAN address or VLAN change Compare the assigned gateway with the old and default subnets
LAN and internet work, but SSH or LuCI does not Dropbear, uHTTPd, or binding Inspect service status and logs
A clean reset works, but restoring the backup breaks access again Preserved configuration conflict Stop restoring the archive and compare files individually

A power LED alone does not prove that boot completed. Successful failsafe access also does not mean that the normal configuration is repaired. Failsafe starts a minimal environment that bypasses parts of the active configuration, so its address can differ from a normal boot.

Move recovery evidence off the router while access exists

If the old release is still accessible, or the router boots successfully even once, preserve the following data. sysupgrade -b creates a settings archive; it does not flash firmware.

First compare the bootloader and partition layout with the target image using the E8450 recovery guide and the applicable UBI installer instructions. Stop before flashing if the layout is unknown. Configuration recovery does not replace bootloader or flash recovery. Configuration, logs, and diffs may contain passwords, keys, and internal addresses; keep them private and redact before sharing. No real E8450 recovery was tested here.

umask 077
DIAG_DIR=$(mktemp -d /tmp/e8450-diag.XXXXXX) || exit 1
ubus call system board >"$DIAG_DIR/board.json" || exit 1
sysupgrade -b "$DIAG_DIR/e8450-backup.tar.gz" >"$DIAG_DIR/backup.log" 2>&1 || exit 1
tar -tzf "$DIAG_DIR/e8450-backup.tar.gz" >"$DIAG_DIR/archive-list.txt" || exit 1
for config in network dhcp firewall dropbear uhttpd; do
  uci export "$config" >"$DIAG_DIR/$config.uci" 2>&1 || exit 1
done

Record the E8450 UBI board, mediatek/mt7622 target, and release from ubus call system board. Copy the archive out of /tmp to a computer or NAS, and keep the sysupgrade image name and checksum with it.

OpenWrt device data identifies the Linksys E8450 as a MediaTek MT7622 UBI target. Do not interchange an initial-install image and the sysupgrade image used after OpenWrt is already installed. The official upgrade guide makes the same distinction.

Recovery level 1: Find the real management address over Ethernet

  1. Remove Wi-Fi and WAN from the diagnostic path and connect one computer directly to LAN.
  2. Record the address, default gateway, and DNS received by DHCP.
  3. Do not configure the old subnet and the OpenWrt default 192.168.1.1 at the same time without knowing which subnet is active.
  4. If DHCP is absent, a temporary static address can be used for testing, but restore the computer’s original network settings afterward.

A changed management address does not require factory reset. Log in at the discovered address and inspect network.lan, the bridge, and DHCP first.

Recovery level 2: Read before writing in failsafe

If normal boot cannot be reached, consult the OpenWrt failsafe procedure and the E8450 device page. Button timing can differ by device and boot layout, so this guide does not invent a fixed number of seconds. Once the failsafe shell is available, mount the overlay and read the current state.

mount_root
uci -q get network.lan.ipaddr
uci -q get network.lan.device
uci -q get dhcp.lan.ignore
/etc/init.d/dropbear status
/etc/init.d/uhttpd status
logread | grep -iE 'netifd|br-lan|dropbear|uhttpd|firewall'

If Dropbear and uHTTPd are running but remain unreachable, inspect the LAN address, br-lan, and DHCP before reinstalling services. Do not erase the evidence with a broad command such as nft flush ruleset.

Before comparison, set BACKUP_FILE to the path of your own trusted backup preserved off-router. A new shell does not inherit earlier variables, and /tmp is lost on reboot. Inspect archive entries first; never extract an untrusted archive as root.

Recovery level 3: Compare the backup instead of restoring it

When clean defaults work and restoring the archive breaks access, the archive is reproduction evidence rather than a recovery tool. Extract it to a temporary directory and compare it with the new configuration.

umask 077
RESTORE_DIR=$(mktemp -d /tmp/e8450-restore.XXXXXX) || exit 1
tar -xzf "$BACKUP_FILE" -C "$RESTORE_DIR"
diff -u /etc/config/network "$RESTORE_DIR"/etc/config/network
diff -u /etc/config/dhcp "$RESTORE_DIR"/etc/config/dhcp

Move the management address, bridge device, VLAN, and DHCP settings one item at a time, reconnecting after each change. Apply firewall, Dropbear, uHTTPd, and additional package settings only after the network is stable. Record which file immediately reintroduced the outage.

Recovery level 4: Reset only as the last step

An OpenWrt factory reset removes installed packages and settings. Consider it only after the backup is stored outside the router, the correct E8450 sysupgrade image and recovery path are known, and selective repair in failsafe did not work. A sysupgrade that discards settings uses -n and is destructive.

sysupgrade -n /tmp/firmware-sysupgrade.itb

firmware-sysupgrade.itb is a placeholder filename. Before running it, verify that the file is an E8450 UBI sysupgrade image, that the download is complete, and that its checksum matches. Do not substitute a factory image or perform this remotely without physical recovery access.

Definition of a successful recovery

  • After a normal boot, DHCP, SSH, and LuCI work independently at the expected LAN address.
  • The board, target, and release from ubus call system board match the image that was installed.
  • The management address and bridge layout survive another reboot.
  • Every preserved setting that was applied has an application record and rollback method.
  • For the next major release change, consider a clean boot and selective migration before automatic Keep settings.

Official documentation

Related guides for the next troubleshooting step