After six months running OpenWrt in production across three routers, this guide covers what actually works: encrypted custom DNS with stubby, WireGuard VPN setup, and SQM QoS with CAKE to eliminate bufferbloat. Practical commands, real-world results.