Most consumer routers hide their VPN options behind a locked-down firmware, if they offer any at all. OpenWrt replaces that firmware entirely, and once it’s installed, setting up a VPN client that covers every device on your network becomes a matter of a few configuration screens instead of a workaround.
This guide covers connecting an OpenWrt router to a commercial VPN provider as a client, so every device on your home network, including consoles, smart TVs, and anything else that can’t run a VPN app directly, gets covered automatically.
Why do this at the router instead of on each device
A device-level VPN app is easier to set up, but it only protects that one device, and it does nothing for a PS5, a smart TV, or a set-top box that can’t install a VPN client. Configuring the VPN once at the router covers every device on the network without touching each one individually, and it survives factory resets on your other devices since the tunnel lives upstream of them.
The tradeoff: router-level VPNs are generally harder to switch between server locations quickly, since it means reconfiguring a network-wide setting rather than tapping a button in an app. Most people who go this route keep a phone or laptop VPN app for quick server switching and use the router setup as the always-on baseline for everything else.
What you need before starting
A router running OpenWrt, either one that shipped with it or one you’ve flashed yourself. Check the OpenWrt Table of Hardware before buying new hardware, since support and available flash storage vary a lot between models. A router with at least 128MB of RAM and 16MB of flash storage handles WireGuard comfortably; older or budget models with less headroom can struggle once you add extra packages.
You’ll also need your VPN provider’s WireGuard configuration details: a private key, the provider’s public key, an endpoint address and port, and the allowed IPs and DNS settings. Most providers that support WireGuard generate this as a downloadable .conf file or expose it through their app’s settings, since the same configuration format works across OpenWrt, other Linux systems, and the official WireGuard apps.
Step 1: install the WireGuard packages
Log into your router’s LuCI web interface (usually at 192.168.1.1 in a browser), or connect over SSH if you prefer the command line. Update the package list and install the required packages:
opkg update
opkg install wireguard-tools luci-app-wireguard kmod-wireguard
Reboot the router after the install finishes. LuCI should now show a WireGuard option under Network > Interfaces.
Step 2: create the WireGuard interface
In LuCI, go to Network > Interfaces > Add new interface. Name it something clear, vpn0 works fine, and set the protocol to WireGuard VPN.
On the interface’s General Settings tab, paste your private key (generated by your VPN provider or by you, depending on their setup process), and set the IPv4 address your provider assigned, typically something in a private range like 10.x.x.x/32.
Step 3: add the peer (your VPN provider’s server)
Switch to the Peers tab on the same interface and click Add Peer. This is where your provider’s server details go:
- Public key: your provider’s server public key
- Endpoint host: the server’s address or hostname
- Endpoint port: usually 51820, though some providers use a different port
- Allowed IPs:
0.0.0.0/0, ::/0to route all traffic through the tunnel - Route allowed IPs: enabled
- Persistent keepalive: 25 seconds, which keeps the tunnel alive through NAT on both ends
Save and apply.
Step 4: set the firewall zone
WireGuard interfaces need a firewall zone assigned or traffic won’t route correctly. Go to Network > Firewall > Zone, and either add the new vpn0 interface to your existing LAN zone (simplest, but means devices see the router as their default gateway with no separation) or create a dedicated VPN zone with forwarding rules to LAN, which gives you more control over which traffic uses the tunnel.
For most home setups, adding vpn0 to the LAN zone’s covered interfaces and setting the WAN zone to forward from the VPN zone (instead of the plain WAN) is enough to route all outbound traffic through the tunnel.
Step 5: route traffic through the VPN, not the raw internet
The step people most often get wrong: without adjusting routing metrics, some traffic can leak out over the regular WAN connection even after the tunnel is up. Under Network > Interfaces, edit your VPN interface and confirm “Use as default gateway” style routing is applied, either through the interface settings directly or through a policy routing rule if you’re using OpenWrt’s mwan3 package for more granular control.
If you want only specific devices routed through the VPN rather than the whole network (a common setup for a router that also needs some devices to bypass the tunnel for local services or specific streaming needs), mwan3 or a simple set of firewall marking rules based on source IP is the standard approach. That’s a more advanced configuration than this guide covers in depth, but the OpenWrt VPN policy routing documentation walks through it.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Step 6: confirm the tunnel is actually working
Don’t skip this. From a device connected to the router, run an IP leak test and confirm the address shown belongs to your VPN provider, not your ISP. Check the WireGuard interface status in LuCI (Status > WireGuard shows handshake times and data transferred) to confirm the tunnel is actively passing traffic rather than sitting idle.
A tunnel that shows as “up” in the interface list but has no recent handshake usually means a firewall or routing issue from Step 4 or 5, not a problem with the WireGuard keys themselves.
Troubleshooting the most common failures
| Symptom | Likely cause | Fix |
|---|---|---|
| Interface shows up but no handshake | Endpoint port blocked, or wrong public key | Recheck peer settings, confirm the port isn’t blocked by your ISP |
| Handshake succeeds, but no internet | Firewall zone not forwarding correctly | Revisit Step 4, confirm zone forwarding rules |
| Works on some devices, not others | Device using a stale DHCP lease or cached DNS | Reconnect the device, flush DNS |
| Speeds far below your normal connection | Router’s CPU can’t keep up with encryption | Check your model’s WireGuard throughput ceiling on the OpenWrt hardware wiki |
| Connection drops randomly | Persistent keepalive not set, or provider server rotating IPs | Confirm keepalive is set to 25 seconds |
Picking a provider that supports this well
Not every VPN provider makes WireGuard configuration files easy to generate manually, since some push users toward their own apps instead. NordVPN and Proton VPN both provide manual WireGuard configuration generation through their account dashboards, which is what this guide assumes. Providers without that option typically require a workaround involving their Linux command-line tools instead of a clean .conf file, which is a more involved setup than most OpenWrt users want to deal with.
Setting up a VPN client on OpenWrt takes roughly 30 to 45 minutes for someone comfortable with router firmware, and covers your entire network permanently once done. It's a better fit for a household that wants one VPN connection protecting every device, including consoles and smart TVs, than for someone who needs to switch VPN server locations frequently. Pick a provider with straightforward WireGuard configuration exports, confirm the firewall zone routing carefully, and test with an IP leak check before trusting the setup.
If you’d rather run a personal VPN server instead of connecting to a commercial one, our Raspberry Pi WireGuard server guide covers that alternative project, and our general router VPN guide covers the process for routers that don’t run OpenWrt.
Keep reading: VPN on a Raspberry Pi: Build Your Own VPN Router for the Price of a Pizza and WireGuard vs OpenVPN: Which Protocol Should You Use?.