Wiznet makers

1. 개요

이 프로젝트는 ESP32-C3와 W5500 Ethernet 컨트롤러를 이용하여 소형 보드에서 동작하는 완전한 기능의 이더넷 라우터 펌웨어입니다.

ESP32는 WiFi에 STA 모드로 연결되어 uplink(WAN) 역할을 수행하고, W5500은 Ethernet을 통해 downlink(LAN)를 구성합니다. 따라서 Ethernet에 연결된 모든 장치는 별도의 설정 없이 인터넷에 바로 접근할 수 있습니다. 

이 프로젝트는 esp32_nat_router를 기반으로 하며, 기존 구조와 달리 uplink 방향이 반대로 구성되어 있습니다:

• WiFi → WAN (인터넷)
• Ethernet → LAN (내부 네트워크)

👉 활용 분야:

• IoT 네트워크 분리
• 홈랩 환경 구축
• WiFi 기반 유선 네트워크 확장

2. 네트워크 구조

• WiFi STA → 상위 네트워크 연결
• Ethernet → LAN 게이트웨이 역할
• 필요 시 WireGuard VPN 사용 가능

3. 지원 하드웨어 (Supported Hardware)

두 가지 구성이 지원됩니다.

✔ Option 1: WT32-ETH01 (고성능)

• ESP32 듀얼코어 240MHz
• LAN8720 PHY 내장

✔ Option 2: ESP32-C3 + W5500 (저비용 / 유연성)

• ESP32-C3 (RISC-V, 160MHz)
• W5500 (SPI 인터페이스)

📌 성능:

• Downstream: 약 4 Mbps
• Upstream: 약 1 Mbps

📌 참고:

• W5500은 최대 250mA 소비 → 외부 3.3V 전원 권장
• WiFi 불안정 시:

set_tx_power 15

4. 주요 기능 (Key Features)

이 펌웨어는 소형 ESP32에서도 동작하는 고급 네트워크 기능을 제공합니다.

하드웨어

WT32-ETH01

• SoC: ESP32 듀얼코어 240MHz
• 플래시: 4MB
• 이더넷 PHY: LAN8720 (내장, MDC GPIO23 / MDIO GPIO18)
• 상태 LED: GPIO2 (변경 가능)
• 시리얼: 115200 bps

W5500 + ESP32-C3

• SoC: ESP32-C3 싱글코어 RISC-V 160MHz
• 이더넷: W5500 (SPI 연결)
  • (MISO=GPIO5, MOSI=GPIO6, SCLK=GPIO4, CS=GPIO7, INT=GPIO3, RST=GPIO2)
• 성능: 다운스트림 ~4Mbps / 업스트림 ~1Mbps
• 주의: W5500 최대 250mA 소비 — 외부 3.3V 전원 사용 필수
• 주의: WiFi가 불안정한 경우 TX 출력을 낮춰보세요: set_tx_power 15

빌드 및 플래시 방법

WT32-ETH01:

1. ESP-IDF v5.x 환경 소싱: . $IDF_PATH/export.sh
2. 빌드: ./build_firmware.sh
3. 플래시: esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 460800 write_flash 0x1000 firmware/bootloader.bin 0x8000 firmware/partition-table.bin 0xf000 firmware/ota_data_initial.bin 0x20000 firmware/esp32_eth_router.bin

W5500 + ESP32-C3:

1. 빌드: ./build_firmware_w5500_c3.sh
2. 플래시 (SuperMini: USB-JTAG / DevKit-M-1: UART): idf.py -B build_w5500_c3 -p /dev/ttyACM0 flash monitor

최초 부팅: 115200 bps로 시리얼 연결 후 set_sta MySSID MyPassword를 실행하세요. 이후 이더넷 LAN에 연결된 장치에서 http://192.168.4.1로 웹 UI에 접속할 수 있습니다.

플래시 방법

esptool.py를 사용하여 펌웨어를 플래시합니다:

esptool.py --chip esp32c3 --port COMx --baud 460800 write_flash -z \
0x0 bootloader.bin \
0x8000 partition-table.bin \
0xd000 ota_data_initial.bin \
0x10000 esp32_eth_router.bin

최적화 참고 사항

이 프로젝트에는 여러 성능 최적화가 적용되어 있습니다:

• 최적화된 W5500 SPI 드라이버
• 폴링 오버헤드 최소화
• 인터럽트 기반 처리

커밋 참조: optimized W5500 SPI driver; cpu load

내장 웹 인터페이스

이 프로젝트의 가장 강력한 기능 중 하나는 내장 웹 기반 관리 UI입니다.

다음 주소로 접속할 수 있습니다:

http://192.168.4.1

설정

모든 설정은 웹 UI(http://192.168.4.1) 또는 시리얼 / TCP CLI를 통해 변경할 수 있습니다. 주요 CLI 명령어:

c 192.168.4.1 19000 | wireshark -k -i -

set_vpn private_key <base64-개인키>
set_vpn public_key  <base64-피어-공개키>
set_vpn endpoint    vpn.example.com:51820
set_vpn killswitch  on
set_vpn route_all   on

Overview

The ESP32 Ethernet Router is open-source firmware that turns an WT32-ETH01 or ESP32-C3 + W5500 board into a full-featured network router. It uses WiFi as the uplink (connecting to an existing WiFi network as a client) and Ethernet as the downlink (sharing that connection with wired devices on a LAN). All Ethernet clients get transparent Internet access with no special configuration needed.

• WiFi → WAN (uplink)
• Ethernet → LAN (downlink)

👉 This makes it ideal for:

• IoT network segmentation
• Home lab environments
• Portable Ethernet access over WiFi

Derived from the popular esp32_nat_router project, this variant reverses the uplink direction — WiFi is the WAN, Ethernet is the LAN — making it ideal for home labs, IoT segments, and anywhere you need to bridge a wired network to WiFi.

Network topology

WiFi STA connects upstream to any WiFi AP, while the Ethernet port serves as the LAN gateway for all wired clients. An optional WireGuard VPN tunnel can replace or supplement the direct uplink path.

Supported hardware

Two hardware options are supported — the all-in-one WT32-ETH01 for best performance, and the more accessible ESP32-C3 SuperMini with an external W5500 SPI module for IoT-scale deployments.

✔ Option 1: WT32-ETH01 (High Performance)

• ESP32 dual-core @ 240 MHz
• Integrated LAN8720 PHY

✔ Option 2: ESP32-C3 + W5500 (Low-cost, flexible)

• ESP32-C3 (RISC-V, 160 MHz)
• W5500 via SPI interface

📌 Performance (W5500 + C3):

• ~4 Mbps downstream
• ~1 Mbps upstream

Key features

The firmware packs enterprise-grade networking features into a tiny ESP32 board, all configurable via web UI or serial CLI.

Feature list

👉 All features are configurable via:

• Web UI (http://192.168.4.1)
• Serial CLI

Hardware 

WT32-ETH01

• SoC: ESP32 dual-core 240MHz
• Flash: 4MB
• Ethernet PHY: LAN8720 (integrated, MDC GPIO23 / MDIO GPIO18)
• Status LED: GPIO2 (configurable)
• Serial: 115200 bps

 W5500 + ESP32-C3 

• SoC: ESP32-C3 single-core RISC-V 160MHz
• Ethernet: W5500 via SPI
  • (MISO=GPIO5, MOSI=GPIO6, SCLK=GPIO4, CS=GPIO7, INT=GPIO3, RST=GPIO2)
• Performance: ~4Mbps downstream / ~1Mbps upstream
• Note: W5500 draws up to 250mA — use external 3.3V power supply
• Note: If WiFi is unstable, try lowering TX power: set_tx_power 15

How to build & flash

WT32-ETH01:

1. Source ESP-IDF v5.x: . $IDF_PATH/export.sh
2. Build: ./build_firmware.sh
3. Flash: esptool.py --chip esp32 --port /dev/ttyUSB0 --baud 460800 write_flash 0x1000 firmware/bootloader.bin 0x8000 firmware/partition-table.bin 0xf000 firmware/ota_data_initial.bin 0x20000 firmware/esp32_eth_router.bin

W5500 + ESP32-C3:

1. Build: ./build_firmware_w5500_c3.sh
2. Flash via USB-JTAG (SuperMini) or UART (DevKit-M-1): idf.py -B build_w5500_c3 -p /dev/ttyACM0 flash monitor

First boot: Connect via serial at 115200 bps and run set_sta MySSID MyPassword. Then access the web UI at http://192.168.4.1 from a device on the Ethernet LAN.

Flashing Instructions

Flash the firmware using esptool.py:

esptool.py --chip esp32c3 --port COMx --baud 460800 write_flash -z \
0x0 bootloader.bin \
0x8000 partition-table.bin \
0xd000 ota_data_initial.bin \
0x10000 esp32_eth_router.bin

Optimization Notes

This project includes several performance optimizations:

• Optimized W5500 SPI driver
• Reduced polling overhead
• Interrupt-driven processing

Commit reference:

optimized W5500 SPI driver; cpu load

Built-in Web Interface

One of the most powerful aspects of this project is the embedded web-based management UI.

Users can access:

http://192.168.4.1                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  

Configuration

All settings are available via the web UI (http://192.168.4.1) or the serial / TCP CLI. Key CLI commands:

Command	Description
set_sta <ssid> <pass>	Set WiFi uplink credentials
set_eth_nat off	Disable NAT (routed mode)
set_tx_power <0–20>	Adjust WiFi TX power (dBm × 4)
set_vpn private_key <key>	Configure WireGuard private key
set_vpn public_key <key>	Configure WireGuard peer public key
set_vpn endpoint <host:port>	Set WireGuard endpoint
set_vpn killswitch on	Block traffic when VPN tunnel is down
set_vpn route_all on	Route all traffic through WireGuard
pcap promisc	Enable promiscuous live capture
pcap acl	Enable ACL-triggered capture (_monitor rules)

Live Packet Capture

Set capture mode, then run on any LAN client:

nc 192.168.4.1 19000 | wireshark -k -i -

Wireshark opens and receives live Ethernet frames. Use pcap acl with _monitor firewall rules to capture only specific traffic flows.

WireGuard VPN Setup

Configure via web UI (VPN page) or CLI:

set_vpn private_key <base64-private-key>
set_vpn public_key  <base64-peer-public-key>
set_vpn endpoint    vpn.example.com:51820
set_vpn killswitch  on
set_vpn route_all   on

• Kill switch (on): blocks all WAN traffic when the tunnel is down.
• Route-all (on): tunnels all traffic through WireGuard. Set off for split-tunnel (only specific subnets).

Firewall ACL

Four lists, 16 rules each:

Rules are stateless. Configure via web UI or CLI. Add _monitor suffix to a rule to trigger PCAP capture on matched packets.

FAQ

Q1. What is the difference between this and esp32_nat_router?
The original esp32_nat_router uses Ethernet as the uplink and WiFi AP as the downlink. This project reverses that: WiFi STA is the uplink (Internet) and Ethernet is the downlink (LAN). If you need a Layer 2 Ethernet ↔ WiFi bridge instead, see the related esp32_eth_wifi_bridge project.

Q2. Can I use this without NAT?
Yes. Disable NAT with set_eth_nat off (requires reboot). In routed mode, Ethernet clients keep their own IP addresses and the router simply forwards packets — provided the upstream network knows the 192.168.4.0/24 subnet.

Q3. How do I set up WireGuard VPN?
Configure the VPN via the web interface (VPN page) or CLI commands like set_vpn private_key, set_vpn public_key, set_vpn endpoint, etc. Enable kill switch (set_vpn killswitch on) to block unprotected traffic when the tunnel is down. Use set_vpn route_all on to send all traffic through the tunnel.

Q4. How does live packet capture work?
Set capture mode with pcap promisc, then on any LAN client run:
nc 192.168.4.1 19000 | wireshark -k -i -
Wireshark opens and shows live Ethernet traffic. You can also use ACL-triggered capture (pcap acl) with _monitor rules to capture only specific traffic.

Q5. How do I connect to a WPA2-Enterprise corporate WiFi?
Configure the EAP credentials (username, identity, EAP method, certificate) in the web interface under WiFi Settings. PEAP, TTLS, and TLS are supported, enabling connection to 802.1X-authenticated networks without modifying the client devices.

Q6. The W5500 + ESP32-C3 WiFi is unstable — what can I do?
The ESP32-C3 SuperMini antenna is often problematic. Try lowering TX power: set_tx_power 15. Also ensure the W5500 module has its own external 3.3V supply (the SuperMini's internal regulator cannot handle 250mA). If issues persist, search for DIY antenna fixes for the ESP32-C3 SuperMini.

Key Takeaway

The ESP32 Ethernet Router delivers a surprisingly capable network router from a $5 ESP32 board. With WIZnet W5500 Ethernet, WireGuard VPN, stateful firewall ACLs, live Wireshark capture, and a full web UI, it is a powerful tool for home labs, isolated IoT segments, and portable network testing setups.

Source Code: https://github.com/martin-ger/esp32_ethernet_router