FELIXXRT
日本語English

Logging in to the web UI

You configure the router in a browser on a PC or smartphone connected to the LAN. The web UI is served over HTTPS.

1. Open the web UI

  1. Connect the PC to a LAN port. It gets an address by DHCP (by default 192.168.1.100–192.168.1.199).
  2. Open https://192.168.1.1/ in a browser. If you changed the LAN address, use that address.

You can also use a name. The default name is https://felixxrt.home.arpa/ (<hostname>.<local domain>). The device must use the router as its DNS server (devices that got their address by DHCP already do).

If you open http://, you are moved to https:// automatically.

By default the web UI can only be opened from the LAN. It is available on interfaces whose zone has Input set to Accept, or has Web UI under Allowed services (Firewall and port forwarding).

2. Certificate warning

The first time, the browser shows a certificate warning, because the web UI certificate is issued by a CA (certificate authority) inside the router. Check that the address is correct and continue.

To get rid of the warning, install the router's CA certificate on your device.

  1. Log in and open SYSTEM › General.
  2. Under System information, use Download CA certificate.
  3. Install it on the device (OS or browser) as a trusted root certificate.

The certificate contains the web UI names and the addresses of the interfaces where the web UI is available. When you change a name or address, the certificate is reissued automatically. The same CA also issues the VPN certificates.

3. Log in

  1. Enter your user name at login: and your password at password:, then press [ ENTER ].
  2. If two-factor authentication is set up, enter the 6-digit code from your authenticator app and press [ VERIFY ].

Use 日本語 / English at the bottom to switch the language.

Roles that require two-factor authentication

If your role requires two-factor authentication and you have not set it up yet, a setup screen appears after the password.

  1. Scan the QR code with an authenticator app (such as Google Authenticator). If you cannot scan it, enter the key shown.
  2. Enter the 6-digit code from the app and press [ VERIFY ].

You cannot do anything else until this is done.

Login limits

Item Details
Failed logins After 5 failures from the same source address within 15 minutes, that address cannot log in for 15 minutes
Session timeout You are logged out when idle for longer than your role allows (default 30 minutes)
Session length Even when active, you must log in again after 12 hours
Allowed login sources Each admin user can be limited to certain source addresses (Admin users and roles)

Add names for the web UI

Besides <hostname>.home.arpa, you can add names that are easier to remember.

  1. In SYSTEM › General, enter the names in Admin interface names, separated by commas (e.g. router.example.com).
  2. Press Save. The change goes to the pending changes. Use Review changes at the top to apply it, then press Confirm within 5 minutes (Applying changes).

The router's DNS answers these names with the router's address on the side the device is connected to (upstream DNS servers are not asked). Names ending in .local cannot be used (mDNS uses them between devices). If you use a top-level domain that does not exist, the browser may treat the name as a search term. Type it with a trailing / the first time (e.g. router.lan/).

Account settings

Use Account at the top right to change your own account. Changes here take effect immediately (no apply needed).

Item Details
Password Enter Current password and the New password twice, then press Change. Your sessions on other devices are logged out
Two-factor authentication Set up → scan the QR code with an authenticator app → enter the 6-digit code → Enable. A code is required from the next login. Disable needs your current password. It cannot be disabled when your role requires it
Language The language of the web UI (日本語 / English). Logs are always in English
SSH public keys Keys used instead of the password for SSH. Paste one key into Public key, enter Current password and press Add

Rules for SSH public keys:

  • Types: ed25519, ECDSA, RSA (2048 bits or more)
  • One key at a time, without options (e.g. ssh-ed25519 AAAAC3Nza… user@pc)
  • Up to 20 keys per user
  • The Fingerprint is the same value that ssh-keygen -l -f <key file> shows on your computer. Use it to tell keys apart

With two-factor authentication enabled, the code is asked even when you log in with a key. See Using the CLI for SSH.

Applying changes →