Soft Ferret

How to set up a VPN on your router

Proton VPN documents a WireGuard setup on OpenWrt. NordVPN's OpenWrt guide uses OpenVPN, and Nord says its staff haven't tested it.

Pasha, November 2, 2026, prices checked November 1, 2026

A router VPN covers every device on your network, including the ones that can't run an app. The price is a fiddly setup. Two vendors publish OpenWrt guides, and these steps follow them. The menu names below come from those pages, read as of November 1, 2026.

You need a router that already runs OpenWrt. Stock firmware is a different job, and each maker's menu differs.

Check the router first

Proton's AsusWRT page says the RT-AC series doesn't support WireGuard, and neither do some RT-AX models. On supported models the route is a VPN profile under the VPN Fusion tab. If your router isn't on OpenWrt, read your router vendor's VPN page before anything else.

Choosing a provider? NordVPN vs Proton VPN sets the two side by side, and the VPN catalog lists the rest.

Proton VPN on OpenWrt with WireGuard

This is Proton's own guide, and it's the shorter of the two.

  1. In your Proton account, go to Downloads and pick "WireGuard configuration". Set the platform to Router and download the file.
  2. In LuCI, open System, Software, and use "Update lists". Install luci-proto-wireguard, or luci-app-wireguard if the first isn't listed. Reboot from System, Reboot.
  3. Go to Network, Interfaces, "Add new interface". Name it (Proton's example is proton0), choose "WireGuard VPN" as the protocol, then create it.
  4. Under "Import configuration", choose "Load configuration", paste the file contents and import. On the Peers tab, edit the peer and make sure "Route Allowed IPs" is ticked. Save, then Save & Apply.
  5. Build a firewall zone under Network, Firewall, Zones. Proton's example is named vpn: Input Reject, Output Accept, Forward Reject, Masquerading on, and your WireGuard interface under "Covered networks". Allow forward from lan. Then edit the lan zone, turn on MSS clamping, and allow forward only to vpn.
  6. Under Network, Interfaces, wan, Edit, Advanced Settings, untick "Use DNS servers advertised by peer". Enter 10.2.0.1 as a custom DNS server and apply.

Proton warns that you lose internet through the router until the firewall step is done. Don't stop halfway.

To verify, check your public IP with Proton's IP scanner and look for DNS leaks at browserleaks.com/dns. Proton's page doesn't mention a kill switch.

NordVPN on OpenWrt with OpenVPN

NordVPN's page opens with a warning: its staff haven't tested this setup. Customers and the OpenWrt community wrote it. It also keeps your credentials in a plain text file.

The outline, in Nord's order:

  1. Set a root password under System, Administration. OpenWrt ships with none.
  2. From your Nord Account, copy the service credentials (NordVPN, Manual setup) and download an OpenVPN config, UDP or TCP.
  3. Install openvpn-openssl, ip-full and luci-app-openvpn from System, Software. Upload the .ovpn file in the new VPN tab and point its auth-user-pass line at a credentials file holding your username and password.
  4. Create an unmanaged interface on tun0, then a firewall zone and allow forwarding from the LAN zone. Check Nord's page for the zone settings.
  5. Set DNS forwardings to 103.86.96.100 and 103.86.99.100.
  6. Enable and start the OpenVPN instance. Nord's page says to check nordvpn.com, where the status should read "Protected".

Unlike Proton's page, Nord's includes an optional kill switch, with separate rules for OpenWrt 22.02 and older versus 22.03 and newer. Read it before relying on it.

Streaming services

A router tunnel sends everything through one server location. If your goal is a streaming library, see best VPN for streaming first.

Sources