What is liandu2024/Open-Box?

Open-Box bundles the sing-box kernel, a Node runtime and GeoSite/GeoIP data into one OpenWrt package, then exposes subscriptions, routing, DNS and firewall through a browser panel. It is convenient if your router has the resources, and it is not a general-purpose proxy toolkit.

Can I use liandu2024/Open-Box commercially?

Not without permission. GitHub finds no licence file in the repository, and without a licence all rights are reserved by default: you may read the code but not reuse it. Check the README, or ask the authors, before using it.

Is liandu2024/Open-Box still maintained?

Yes. The repository last received commits 2 days ago.

What programming language is liandu2024/Open-Box written in?

Mainly Shell, according to GitHub's language statistics.

Open-Box: install sing-box transparent proxy on OpenWrt

At a glance

What is it?: Open-Box bundles the sing-box kernel, a Node runtime and GeoSite/GeoIP data into one OpenWrt package, then exposes subscriptions, routing, DNS and firewall through a browser panel. It is convenient if your router has the resources, and it is not a general-purpose proxy toolkit.
Who is it for?: Adopt Open-Box if you run x86_64 or aarch64 OpenWrt with at least 512MB of storage and RAM, and you want subscription import, node groups, DNS takeover and entry bypass configured from a browser instead of hand-written sing-box JSON. Skip it on MIPS or other 32-bit routers, on devices below the stated resource floor, and if you need a panel-independent, hand-editable config you own.
Can I use it commercially?: Not without permission. GitHub finds no licence file in the repository, and without a licence all rights are reserved by default: you may read the code but not reuse it. Check the README, or ask the authors, before using it.
Is it still maintained?: Yes. The repository last received commits 2 days ago.
What is it written in?: Mainly Shell, according to GitHub's language statistics.

Answers come from the project's GitHub data, last synced on September 16, 2026, and from our analysis. They are not legal advice.

DEEP OPEN-SOURCE ANALYSIS

Hysen Labs Editorial · September 17, 2026 · liandu2024/Open-Box

The gap Open-Box fills on an OpenWrt router

Running sing-box on OpenWrt normally means assembling several moving parts yourself: the kernel binary for your architecture, a TUN and nftables setup, a dnsmasq handoff, a rule database, and a config file that grows into hundreds of lines of JSON. Open-Box collapses that into a single install package that carries Open-Box itself, the sing-box kernel, a Node runtime and the full GeoSite / GeoIP data. The stated audience is an OpenWrt user who wants subscription import, node selection, split routing, DNS and firewall behaviour configured from a browser, without writing config by hand. The panel is the product here. If you are comfortable maintaining sing-box JSON and a set of init scripts, the value proposition shrinks considerably, because you are trading file-level control for a UI.

How the panel, kernel and rule data fit together

The package ships three component classes: the Open-Box program, the sing-box kernel, and the GeoSite / GeoIP data. Subscriptions come in as Clash YAML, base64 node shares, or common sing-box share links, and the panel turns them into outbound nodes. Nodes are organised into groups: url-test groups that pick automatically, select groups you choose by hand, and dynamic groups that follow subscription updates by keyword while static groups stay manual. Routing is expressed as site sets, which match on domain, domain suffix, keyword, IP range, rule set or rule set URL. Importing a rule set is a two-step flow: you paste the list address, preview the parsed result, then commit the entries locally, after which startup no longer depends on that remote URL. DNS takeover has three modes (dnsmasq forwarding, firewall hijack, disabled), with separate upstreams for domestic and proxied domains; the README states that which upstream answers a name is decided by the site set's current exit rather than by a separate mapping table, and that fixed overrides go through DNS rewrite. Entry bypass is the part worth reading twice: IP sets belonging to currently direct site sets are released at the nftables entry point and never enter the kernel, but when an earlier rule could send the same IP elsewhere, the system switches to a compatible path and writes the reason into the deployment result.

Installing Open-Box over SSH and opening the panel

The README's install path is a single script piped to sh on the router, run as root. The same section states the requirements plainly: OpenWrt, x86_64 or aarch64, at least 512MB of storage and 512MB of memory. The script checks for and tries to add system dependencies with opkg or apk (kmod-tun, kmod-nft-queue, kmod-nft-nat, kmod-veth, ip-full, ca-bundle); if the package feeds are unreachable it warns instead of aborting, and you can skip that step entirely with an environment variable.

bash

curl -fsSL https://raw.githubusercontent.com/liandu2024/Open-Box/main/scripts/install.sh | sh

When raw.githubusercontent.com is hard to reach, the README gives a mirror variant. Note its own caveat: the flag only affects the release package download, so if the outermost raw host is unreachable you still cannot fetch the script this way.

bash

curl -fsSL https://gh-proxy.com/raw.githubusercontent.com/liandu2024/Open-Box/main/scripts/install.sh | sh -s -- --mirror

To skip the dependency step, set OPENBOX_SKIP_DEPS=1 for the install command. After the script finishes, it prints a URL of the form http://<router LAN IP>:2026; open that in a browser and set the admin password on first access. From there the first real task is adding a subscription under subscription management, then checking the proxies and policies page, where each site set is a card showing the current route and node health.

Upgrading, rolling back, and what the rollback actually costs

Updates are available from Settings, Backend Settings in the panel, or over SSH. The README says the upgrade preserves subscriptions, rules and the panel password, and validates the Open-Box, sing-box and GeoSite / GeoIP components, reusing components that are identical and intact and downloading only what changed, is missing or is corrupt.

bash

curl -fsSL https://raw.githubusercontent.com/liandu2024/Open-Box/main/scripts/update.sh | sh

Rollback is the constraint to understand before you need it. The router keeps no local copy of the previous version, so recovering from a bad upgrade requires reaching GitHub or a mirror. The script queries the most recent official release before the current version, downloads that full package, verifies SHA256, and replaces files; a verification or replacement failure leaves the existing installation in place.

bash

curl -fsSL https://raw.githubusercontent.com/liandu2024/Open-Box/main/scripts/update.sh | sh -s -- --rollback --direct

With a mirror, the second form is the same command with --rollback --mirror and a mirror URL. The README also notes that --mirror affects only the package download, while the GitHub API call that lists releases tries a direct connection first and falls back to the mirror. Uninstall keeps data by default, and a purge flag deletes subscriptions and configuration with it.

Where Open-Box is the wrong choice

Architecture and headroom are hard filters. The download section offers x64 and arm64 assets only, and the install section repeats x86_64 or aarch64 with 512MB storage and 512MB memory. A MIPS router, or an aarch64 device with 128MB of RAM, is outside the supported envelope, and the README does not describe a reduced-footprint mode. The dependency step is also a soft failure by design: when opkg or apk cannot reach a feed, the install continues with a warning, which means a router with no working package source can end up with a running panel and a kernel that cannot create the interfaces it needs. The LuCI fallback page exists precisely because the panel can become unreachable; it lets you start or stop the service, restore direct connection, or uninstall from Services, Open-Box. If your operational model requires a config file you can diff and revert from a git repository, the panel-mediated model is a mismatch, even though the README does not document an export path for the generated sing-box config.

How it differs from hand-rolled sing-box or a Clash-based stack

A hand-rolled sing-box deployment keeps the JSON config as the source of truth. You edit a file, reload the service, and every routing decision is visible in that file. Open-Box inverts this: the panel is the source of truth, and the kernel config is generated. The trade is real in both directions. You gain subscription parsing across Clash YAML, base64 shares and sing-box links, automatic url-test groups that reuse a cached result within each policy's check interval, entry-level bypass at nftables so direct IP sets skip the kernel, and a rule debugger that takes a domain, previews the match and issues a real request to show route, DNS and matched rule. You lose the ability to review the whole routing state as one artifact. A Clash-based stack on OpenWrt sits closer to the same panel-driven model, but Open-Box's distinguishing piece is the bundled kernel plus GeoSite / GeoIP data, which removes the first-boot rule download that most sing-box setups require.

Licence and the parts the repository does not cover

The licence section is unusually narrow and worth quoting in substance: the repository publishes the install, upgrade and uninstall scripts, the interface documentation images, and the release assets, while the licences and copyright of the panel and the kernel are provided with the installation package. No licence identifier appears in the repository metadata, so the terms that matter to a redistribution or commercial deployment live inside the package, not in the repository. Read them there before shipping a router image with Open-Box baked in. Two other gaps are visible from the repository layout, which contains only README.md, docs/ and scripts/: there is no source tree for the panel or the kernel, and the README does not document a supported way to export or hand-edit the generated sing-box configuration. If auditability of the routing config matters to you, that absence is the deciding fact.

Editorial conclusion

Adopt Open-Box if you run x86_64 or aarch64 OpenWrt with at least 512MB of storage and RAM, and you want subscription import, node groups, DNS takeover and entry bypass configured from a browser instead of hand-written sing-box JSON. Skip it on MIPS or other 32-bit routers, on devices below the stated resource floor, and if you need a panel-independent, hand-editable config you own. Before installing, confirm your architecture matches the x64 or arm64 release asset, verify the SHA256 file published next to that asset, and read the rollback section of the README, because rollback re-downloads the previous release from GitHub and no old package is kept on the router.

Frequently asked questions

How do I install Open-Box on an OpenWrt router?

SSH in as root and run the install script from the README, then open http://<router LAN IP>:2026 in a browser and set the admin password on first access. The router must be x86_64 or aarch64 with at least 512MB of storage and 512MB of memory.

How does Open-Box work?

The install package carries the Open-Box program, the sing-box kernel, a Node runtime and the full GeoSite / GeoIP data. The browser panel converts subscriptions into outbound nodes, organises them into url-test, select and keyword-following dynamic groups, and expresses routing as site sets that match domains, suffixes, keywords or IP ranges.

What are the disadvantages of Open-Box?

It only ships x64 and arm64 packages and states a floor of 512MB storage and 512MB memory, so MIPS and small-memory routers are unsupported. Rollback needs GitHub or a mirror because no previous version is kept on the router, and the dependency step only warns when opkg or apk cannot reach a feed.

Is it worth buying open box items?

This question concerns retail open-box goods, not the Open-Box OpenWrt package, and the repository material does not address it. The project's own trade-off is different: you get a browser-configured sing-box stack in one install, in exchange for giving up a hand-editable config file.

Official sources

Community notes