other good defaults for OpenWrt?

ULA related (if you dont use):

uci set network.lan.delegate='0'
uci set network.wan6.delegate='0'

only request one ipv6 addr (dont use if need a subnet)

uci set network.wan6.reqaddress='try'
uci set network.wan6.reqprefix='no'
uci set network.wan6.norelease='1'

protect wan6 mac address

uci set network.wan6.ip6ifaceid='random'

give lan a nice reserved address (or use add_list), but better use anyip below instead.

#uci set network.lan.ip6addr='2001::1'
#no action
#uci set network.loopback.ip6addr='::1'

AnyIP is able to catch bad destination, or use as reserved address

# ip -6 route show table local
uci add network route6
uci set network.@route6[-1].interface='loopback'
uci set network.@route6[-1].type='local'
uci set network.@route6[-1].target='2001::/96'

# ipv4 version but blackhole
#uci add network route
#uci set network.@route[-1].interface='lan'
#uci set network.@route[-1].type='blackhole'
#uci set network.@route[-1].target='1.1.1.1/32'
#uci set network.@route[-1].gateway='0.0.0.0'

set zone to be ipv4 or ipv6 only. check the name and network first! then you can disable ra/dhcpv6/ndp (or dhcpv4/ignore for disable ipv4).

#uci set firewall.@zone[0].family='ipv4'
#uci set firewall.@zone[2].family='ipv6'

hw flow offloading

uci set firewall.@defaults[0].flow_offloading='1'
uci set firewall.@defaults[0].flow_offloading_hw='1'

hidden vlan/bridge device? make it explicit.

uci add network device
uci set network.@device[-1]=device
uci set network.@device[-1].type='8021q'
uci set network.@device[-1].ifname='eth0'
uci set network.@device[-1].vid='1'
uci set network.@device[-1].name='eth0.1'
uci add network device
uci set network.@device[-1]=device
uci set network.@device[-1].type='8021q'
uci set network.@device[-1].ifname='eth0'
uci set network.@device[-1].vid='2'
uci set network.@device[-1].name='eth0.2'
uci add network device
uci set network.@device[-1].type='bridge'
uci set network.@device[-1].name='br-lan'
# edit your ports!!!
uci add_list network.@device[-1].ports='eth0.2'
uci set network.@device[-1].bridge_empty='1'
#uci set network.@device[-1].macaddr='00:11:22:33:44:55'