How to Configure a VPN on an OpenWRT Router

By -
How to Configure a VPN on an OpenWRT Router

Disclosure: Some links on this page are affiliate links. We may earn a commission if you make a purchase through them, at no additional cost to you.

Setting up a VPN on an OpenWrt router gives you network-wide privacy and centralized control. Instead of configuring each device, the router handles encryption, routing policies, DNS, and fail-safes (kill switch). This deep-dive keeps your original steps intact, but adds expert guidance, robust security hardening, and performance tuning so you can deploy with confidence.

Contents show

Prerequisites

  • OpenWrt installed on your router (preferably a build with hardware crypto acceleration; check cat /proc/cpuinfo and opkg list-installed | grep kmod-crypto).
  • Access to LuCI (web UI) and/or SSH (ssh root@192.168.1.1).
  • A VPN account (OpenVPN or WireGuard). Obtain configuration files, keys, and CA certs from your provider.
  • Basic familiarity with UCI, opkg, and OpenWrt’s firewall/zones.
Protocol Latency Throughput CPU Load Roaming/Recovery Best for
WireGuard Very low High (near line-rate with offload) Low Fast handshakes Streaming, gaming, low-power routers
OpenVPN (UDP) Medium Medium Medium Stable, mature ecosystem Legacy setups, enterprise CA/PKI

Step 1: Accessing Your OpenWrt Router

Use LuCI at http://192.168.1.1 or SSH:

ssh root@192.168.1.1

Replace 192.168.1.1 as needed (ip route to confirm your LAN gateway). Update packages first:

opkg update

Step 2: Installing the VPN Client

OpenVPN

opkg install openvpn-openssl ca-bundle ca-certificates

Optional but recommended:

  • luci-app-openvpn for LuCI integration
  • kmod-tun (usually present)

WireGuard

opkg install wireguard-tools kmod-wireguard

Optional LuCI front-end:

opkg install luci-app-wireguard

Verify:

openvpn --version
wg --version

Step 3: Configuring the VPN Client

OpenVPN (using a .ovpn file)

Copy the file to the router:

scp your-vpn-config.ovpn root@192.168.1.1:/etc/openvpn/

Create a minimal UCI stub that points OpenVPN to your file:

uci set openvpn.vpnclient='openvpn'
uci set openvpn.vpnclient.enabled='1'
uci set openvpn.vpnclient.config='/etc/openvpn/your-vpn-config.ovpn'
uci commit openvpn

Best practices:

  • Use a credentials file with strict permissions:
cat > /etc/openvpn/cred.txt << 'EOF'
USERNAME
PASSWORD
EOF
chmod 600 /etc/openvpn/cred.txt

Then reference it inside your .ovpn (or include via uci add_list if using inline UCI options):

auth-user-pass /etc/openvpn/cred.txt
auth SHA256
cipher AES-256-GCM
remote-cert-tls server
tls-crypt /etc/openvpn/tls-crypt.key
explicit-exit-notify 3

Modern OpenVPN prefers data-ciphers over legacy cipher in some configs. Follow your provider’s recommended settings.

WireGuard (wg0)

Generate keys on the router (or use provider keys):

umask 077
wg genkey | tee /etc/wireguard/private.key | wg pubkey > /etc/wireguard/public.key

Edit /etc/config/network and add:

config interface 'wg0'
    option proto 'wireguard'
    option private_key 'YOUR_PRIVATE_KEY'
    option listen_port '51820'
    list addresses '10.14.0.2/32'   # or as provided
    option mtu '1420'               # common WG MTU; adjust as needed

config wireguard_wg0
    option description 'provider'
    option public_key 'PROVIDER_PUBLIC_KEY'
    option endpoint_host 'vpn-provider.example'
    option endpoint_port '51820'
    list allowed_ips '0.0.0.0/0'
    list allowed_ips '::/0'
    option persistent_keepalive '25'

Replace keys/addresses per your provider. Tip: If only routing some subnets over VPN, set allowed_ips to those ranges (policy-based routing section below).

Step 4: Enabling and Starting the VPN Service

OpenVPN

/etc/init.d/openvpn enable
/etc/init.d/openvpn start
logread -f | grep -i openvpn   # watch logs

WireGuard

uci set network.wg0.enabled='1'
uci commit network
/etc/init.d/network restart
wg show         # verify handshake and endpoint

Step 5: Configuring Firewall, Zones, and Kill Switch

OpenWrt’s firewall uses zones and forwardings. We will:

  1. Create a vpn zone bound to tun0 (OpenVPN) or wg0 (WireGuard).
  2. Allow forwarding from lan → vpn.
  3. Block lan → wan to act as a kill switch (traffic dies if VPN goes down).

Create the VPN zone

# For OpenVPN (interface tun0)
uci add firewall zone
uci set firewall.@zone[-1].name='vpn'
uci set firewall.@zone[-1].input='REJECT'
uci set firewall.@zone[-1].output='ACCEPT'
uci set firewall.@zone[-1].forward='REJECT'
uci add_list firewall.@zone[-1].device='tun0'

# For WireGuard (interface wg0) use:
# uci add_list firewall.@zone[-1].network='wg0'

# Forward LAN --> VPN
uci add firewall forwarding
uci set firewall.@forwarding[-1].src='lan'
uci set firewall.@forwarding[-1].dest='vpn'

# (Optional) Disable LAN --> WAN to enforce kill switch
# uci delete firewall.@forwarding[?] where src='lan' and dest='wan'

uci commit firewall
/etc/init.d/firewall restart

DNS leak protection: Route DNS via VPN by pointing dnsmasq to VPN DNS and preventing use of ISP resolvers.

uci set dhcp.@dnsmasq[0].noresolv='1'
uci add_list dhcp.@dnsmasq[0].server='1.1.1.1'     # or provider DNS over VPN
uci add_list dhcp.@dnsmasq[0].server='1.0.0.1'
uci commit dhcp
/etc/init.d/dnsmasq restart

Consider DoT/DoH on-router (e.g., stubby or https-dns-proxy) if your provider permits.

MSS Clamping (avoid fragmentation)

Enable MSS clamping for stable TCP over VPN:

uci set firewall.@defaults[0].synflood_protect='1'
uci set firewall.@defaults[0].flow_offloading='1'   # if your SoC supports it
uci set firewall.@defaults[0].flow_offloading_hw='1'
uci commit firewall

In LuCI: Network → Firewall → General Settings → MSS clamping (typically auto) and enable software/hardware flow offload where supported.

Step 6: Testing the VPN Connection

From the router:

curl -4 ifconfig.me
curl -6 ifconfig.me

From a LAN client, visit an “IP check” site. The IP/geolocation should match your VPN exit. For route testing:

traceroute -n 1.1.1.1
ip route show
ip rule show

Split Tunneling / Policy-Based Routing (Selective Routing)

If you only want specific devices or domains through the VPN, use policy-based routing. You can do this with vpn-policy-routing (easier) or native ip rule and fwmark (advanced).

vpn-policy-routing package

opkg install vpn-policy-routing luci-app-vpn-policy-routing

Example config (/etc/config/vpn-policy-routing):

config vpn-policy-routing 'config'
    option enabled '1'
    option strict_enforcement '1'
    option src_ipset '0'

config policy
    option name 'NAS over VPN'
    option src_addr '192.168.1.50'
    option interface 'wg0'    # or 'openvpn'
    option chain 'PREROUTING'

config policy
    option name 'Work laptop direct'
    option src_addr '192.168.1.60'
    option interface 'wan'

Restart:

/etc/init.d/vpn-policy-routing restart

Native ip rule/fwmark (advanced)

Create an alternate routing table for VPN (e.g., table 201) and mark packets via firewall mangle rules. Then add ip rule to lookup table 201 for marked packets. This is beyond scope for beginners, but it’s the most flexible approach for complex environments.

Performance Tuning & SQM

  • MTU: For WireGuard, start with 1420; for OpenVPN over UDP, tun-mtu 1500 with mssfix often works. Test with ping -M do -s to find PMTU.
  • Hardware offload: Enable software/hardware flow offloading in firewall (depends on SoC).
  • SQM QoS: If you experience bufferbloat with encrypted traffic, install SQM:
opkg install luci-app-sqm
/etc/init.d/sqm enable
/etc/init.d/sqm start

Set your upload/download slightly below your ISP rate to minimize latency spikes.

Security Hardening

  • OpenVPN: Prefer AES-256-GCM + auth SHA256, tls-crypt, remote-cert-tls server. Store creds in /etc/openvpn/cred.txt with chmod 600.
  • WireGuard: Restrict AllowedIPs to necessary ranges when doing split tunneling; keep private keys 0600.
  • Kill switch: Keep lan→wan forwarding disabled so if the VPN drops, traffic does not fall back to WAN.
  • DNS leaks: Set noresolv and specify DNS servers that are reachable via the VPN; optionally deploy DoT/DoH.
  • Admin surface: Disable LuCI from WAN; manage via LAN/VPN only. Use SSH keys instead of passwords where possible.

LuCI (Web UI) Quick Pointers

  • OpenVPN: Services → OpenVPN (upload or paste configs, manage instances).
  • WireGuard: Network → Interfaces → Add new interface (Protocol: WireGuard), then add peers.
  • Firewall: Network → Firewall (create vpn zone, forwarding lan→vpn, disable lan→wan if kill switch desired).
  • DNS: Network → DHCP and DNS: set custom DNS, enable No resolv.conf.
  • SQM: Network → SQM QoS: enable, set bandwidth.

Troubleshooting

Issue Diagnosis Fix
VPN connects, no internet Missing lan→vpn forwarding, wrong routes, DNS leak Check firewall zone, ip route, set dnsmasq DNS over VPN, verify provider DNS
Traffic bypasses VPN lan→wan forwarding still enabled Remove/disable lan→wan forwarding; confirm kill switch
WireGuard no handshake Firewall/port blocked, wrong key, wrong endpoint Open UDP 51820 on WAN (if server), verify keys, check wg show
OpenVPN slow CPU bound, MTU/mss issues Try UDP, enable flow offload, adjust MTU/MSS, choose closer server
DNS leak dnsmasq using ISP DNS noresolv + VPN DNS, or DoT/DoH; restart dnsmasq

Useful commands

logread -f | grep -E 'openvpn|wg|firewall'   # live logs
ip route show table all                      # routing overview
ip rule show                                 # policy rules
wg show                                      # WireGuard status
netstat -ulnp | grep 51820                   # listening WG

Original Steps (Enhanced)

Step 1: Accessing Your OpenWRT Router

First, you need to log into your OpenWrt router. You can either use the LuCI web interface or access it via SSH.

To log in via SSH, open a terminal on your computer and run:

ssh root@192.168.1.1

Replace 192.168.1.1 with your router’s IP address if it’s different.

Step 2: Installing the VPN Client

OpenWrt uses the opkg package manager to install software. To configure a VPN, you need to install the required VPN client, typically OpenVPN or WireGuard.

To install OpenVPN, run the following command:

opkg update
opkg install openvpn-openssl ca-bundle ca-certificates

For WireGuard, use this command:

opkg update
opkg install wireguard-tools kmod-wireguard

Once the installation is complete, verify that the packages are correctly installed by running:

opkg list-installed | grep -E 'openvpn|wireguard'

Step 3: Configuring the VPN Client

Next, you’ll need to configure the VPN client using files from your provider.

OpenVPN: Upload your .ovpn:

scp your-vpn-config.ovpn root@192.168.1.1:/etc/openvpn/
uci set openvpn.vpnclient='openvpn'
uci set openvpn.vpnclient.enabled='1'
uci set openvpn.vpnclient.config='/etc/openvpn/your-vpn-config.ovpn'
uci commit openvpn

WireGuard: Configure /etc/config/network with your peer details (see earlier example). Use wg show to verify.

Step 4: Enabling and Starting the VPN Service

OpenVPN:

/etc/init.d/openvpn start
/etc/init.d/openvpn enable

WireGuard:

uci set network.wg0.enabled='1'
uci commit network
/etc/init.d/network restart

Step 5: Configuring Firewall Rules

Create a vpn zone; forward lan→vpn; optionally disable lan→wan to enforce kill switch (see detailed section above). Open ports on WAN only if you are hosting a VPN server; for a client, outbound is sufficient.

Step 6: Testing the VPN Connection

From any LAN device, confirm your public IP is that of the VPN:

curl ifconfig.me

It should reflect the VPN location, not your ISP. If not, review firewall forwardings and DNS settings.

Conclusion

With OpenWrt acting as your VPN client, every device on your network benefits from encrypted egress, consistent DNS, and policy-driven routing. You now have a hardened setup with a kill switch, DNS leak protection, and performance optimizations. Enhance it further with SQM for latency control, DoT/DoH for private DNS, and vpn-policy-routing for fine-grained split tunneling. Maintain your router by keeping OpenWrt and packages up to date, rotating credentials periodically, and monitoring logs for reliability.

Leave a Comment

Your email address will not be published. Required fields are marked *