How to Set Up IVPN on OpenWrt with WireGuard | Router VPN Guide

Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.

Today I want to talk about how to set up a whole-home VPN on OpenWrt.

If you already know why you want to do this, feel free to skip ahead to the instructions. The timestamps are listed below the video. But if you’re curious about why you might want a whole-home VPN, let’s start with a demonstration.

Imagine your normal home network. You have a router, a laptop, and a phone. In a typical setup, your devices connect to the router over Wi-Fi or through a LAN or Ethernet cable.

Your router is assigned an external IP address by your internet service provider, usually through a modem or another device depending on the type of internet connection you have. For this example, we’ll call that IP address 1.2.3.4.

When you request a website such as example.com, your device sends the request through your router. The request leaves your network using the IP address assigned by your ISP. When example.com checks who is visiting, it sees 1.2.3.4.

Many people use a VPN to mask that ISP-assigned address. In my case, I use IVPN. The usual way to use a VPN provider is to install its app on each device. You install the IVPN client, choose a server location, and establish a connection through your router and ISP to the VPN provider.

After that connection is established, a request to example.com uses the VPN provider’s IP address instead. For this example, we’ll call that address 5.6.7.8. The website now sees the VPN address rather than the IP address assigned by your ISP.

The drawback is that the VPN client must be installed and connected on every device. IVPN’s standard plan, for example, has a device limit. If the client is installed on both your phone and laptop, those count as two separate devices.

You may also have devices that do not support a VPN client. A Roku is one example. I’m not endorsing Roku; I’m only using it because it is popular in the United States. Because the Roku cannot run the VPN app, it continues accessing the internet through your ISP-assigned IP address even while your other devices use the VPN.

Instead of installing the VPN client directly on every device, you can configure the VPN connection on your router.

In that setup, the router establishes the connection to IVPN. Any outbound traffic routed through it uses the VPN address. Your laptop, phone, streaming box, and other devices do not need their own VPN clients. A firewall rule on the router directs outbound traffic through the VPN tunnel, so every connected device receives the same protection.

That is why this is often called a whole-home VPN.

Another benefit is that all of the devices behind the router share a single VPN tunnel. You might have three devices connected, or you might have ten, but the VPN provider generally sees the router’s tunnel as one connected device.

Guests also receive the same protection. When a friend connects a phone or laptop to your Wi-Fi, that traffic is routed through the VPN automatically. You do not need to install individual clients, confirm that every client is connected, or worry about exceeding the VPN account’s device limit.

The main reason I’m configuring this on my travel router is for hotel Wi-Fi.

The travel router connects to the hotel’s wireless network and then broadcasts a separate wireless network for my devices. Everyone traveling with me connects to the network broadcast by the travel router, and all of those devices are protected by the VPN connection.

This is also convenient when a hotel uses a captive portal. The travel router becomes the authorized device on the hotel network. Once the router has completed the hotel’s sign-in or registration process, the devices behind it can usually connect without each one going through the captive portal separately.

The network diagram may look a little confusing, but I hope it answers more questions than it creates. They say a picture is worth a thousand words. This was a diagram, so hopefully it was worth ten thousand.

For this setup, I’m following the official documentation on IVPN’s website, which is linked below the video.

Always check the provider’s current documentation before following a YouTube tutorial, because the video may eventually become outdated.

I have not configured this particular setup on OpenWrt before. I’m starting with a mostly default OpenWrt installation. I set an administrator password and enabled HTTPS, but I have not changed much else.

For the demonstration, the travel router is using my home Wi-Fi as its wireless uplink so that it has an internet connection.

In the router’s web interface, navigate to:

System → Software

Click Update Lists and allow the package list to finish refreshing. After it completes, dismiss the status window.

Use the filter field to search for WireGuard. Locate and install the following packages:

• WireGuard Tools
• Kmod WireGuard
• LuCI Proto WireGuard

IVPN also provides OpenVPN instructions, but I’m using WireGuard for this guide. In my opinion, there is no benefit to using OpenVPN for this setup at this point. Follow IVPN’s OpenVPN guide instead if that is the protocol you prefer.

Install WireGuard Tools first. Leave the “Allow overwriting files from other packages” option unchecked, then confirm the installation.

Kmod WireGuard may be installed automatically as a dependency. Finally, install LuCI Proto WireGuard, again leaving the overwrite option unchecked.

After the packages are installed, restart the router:

System → Reboot → Perform Reboot

My router took about 45 seconds to restart. When the login screen returns, sign in again.

The next step is to create the WireGuard interface.

First, generate a WireGuard configuration file using your preferred server and parameters. IVPN notes that its configuration-file generator is available only for accounts created after November 2020, so older accounts may require a different process.

Sign in to your IVPN account, scroll to the WireGuard setup section, and open the Configuration File Generator.

The key comment is optional. I entered OpenWrt.

Click Generate Key. The page will display a public key. I blurred mine in the video for privacy.

For this example, I’m creating a single-hop connection. Select the country, city, and server you want to use. I selected Reykjavik, Iceland, and one of the available servers.

I left the connection on the default port, selected IPv4 only to keep the demonstration simple, and left the DNS setting on Standard.

Click Download ZIP Archive. Extract the archive, open the configuration file in a text editor, and copy its entire contents. The file contains sensitive configuration information, so do not share it publicly.

In OpenWrt, navigate to:

Network → Interfaces

Click Add New Interface.

Give the interface any descriptive name. I used IVPN Iceland.

Set the protocol to WireGuard VPN, then click Create Interface.

On the General Settings tab, click Load Configuration. Paste the contents of the WireGuard configuration file and click Import Settings.

OpenWrt should parse the file and populate the configuration fields automatically. If it does not, the file contents may not have been copied correctly.

Next, open the Advanced Settings tab and set the MTU to:

1412

Make sure this value is set correctly. An incorrect MTU can cause poor performance or prevent some connections from working. MTU stands for maximum transmission unit. If it is too high, packets may be fragmented and the connection may behave unpredictably.

Open the Peers tab and click Edit next to the imported peer configuration.

Enable Route Allowed IPs.

Set Persistent Keep Alive to:

25

Click Save, then save the interface configuration and click Save & Apply.

Before continuing, I checked my current external IP information. At that point, my traffic was still appearing through a Chicago location. This gives us a baseline so we can confirm later that the route changes to the Iceland VPN server.

Navigate to:

Network → Firewall

Click Add and enter the following settings:

• Name: ivpn_firewall
• Input: Reject
• Output: Accept
• Intra-zone forward: Reject
• Masquerading: Enabled
• MSS clamping: Enabled

Under Covered Networks, select the VPN tunnel interface you created earlier. In my case, that is IVPN Iceland.

Under Allow Forward From Source Zones, select LAN.

This allows traffic from devices connected to the router’s LAN or wireless network to be forwarded through the IVPN interface.

Click Save, then click Save & Apply.

The next step is optional, but I recommend it.

A kill switch ensures that traffic from your LAN devices travels only through the VPN tunnel. It also prevents leaks if the router loses its connection to the VPN server.

Edit the existing LAN firewall zone and remove WAN from the allowed destination zones. This blocks outbound traffic if the IVPN connection goes down instead of allowing the connection to fail over to the normal WAN interface and expose your ISP-assigned IP address.

In the firewall page, click Edit on the LAN zone. Uncheck WAN under the allowed destination zones, then click Save and Save & Apply.

After this change, the LAN zone should forward only to the IVPN firewall zone.

Next, configure DNS.

Navigate to:

Network → Interfaces

Click Edit next to the WAN interface. On the Advanced Settings tab, uncheck Use DNS Servers Advertised by Peer.

Enter IVPN’s standard WireGuard DNS server address:

172.16.0.1

You may use IVPN’s AntiTracker DNS address instead if you prefer that option.

Click Save.

In my setup, the internet uplink is wireless, so I also needed to apply the same setting to the WWAN interface. If your router uses its physical WAN port, edit the WAN interface. If it uses a wireless uplink, edit the corresponding WWAN interface instead.

Uncheck the advertised-DNS option, enter the VPN DNS server address, and save the interface.

If your ISP also provides IPv6 connectivity, repeat the applicable steps for WAN6. My ISP does not provide IPv6, so I skipped that part.

Click Save & Apply.

A reboot is not strictly required, but it can help confirm that everything behaves correctly after a restart. When in doubt, reboot.

Navigate to:

System → Reboot

After the router restarts, sign in again.

With the configuration complete, run several tests from a device connected to the OpenWrt router.

First, use a service such as dnsleaktest.com. In my test, the connection showed Reykjavik, Iceland.

I also refreshed an IP-information service. The first site appeared to block the Icelandic VPN address, so I tested the address using MaxMind instead. That service showed Reykjavik and identified the hosting network.

This confirms that internet traffic is using the new VPN connection.

The DNS leak test also showed an Icelandic DNS server, confirming that DNS requests were using the server configured in the previous step.

The final test is the kill switch.

I started a continuous ping to:

1.1.1.1

The ping worked while the VPN interface was active.

I then returned to:

Network → Interfaces

I stopped the WireGuard interface. As soon as the VPN connection shut down, the ping requests began timing out. Restarting the ping did not restore internet access while the VPN interface remained disabled.

That confirms the kill switch is working. When I restarted the WireGuard interface, the internet connection returned.

At this point, the router is connected to the VPN, the kill switch is functioning, and any device connected through the router’s wireless network or LAN port is routed through the VPN connection.

There are some inconveniences with this setup.

For example, the VPN server may have an outage. If the selected server goes down, you may need to connect to a different server manually.

You can check IVPN’s server status page, select another server, and update the IVPN configuration in OpenWrt. In the interface settings, open the Peers section and update the endpoint host and public key as required.

[The original VTT transcript cuts off part of the sentence at this point.]

That about sums it up. I hope this helped address any concerns or doubts about setting up a whole-home VPN.

The setup is fairly straightforward once you become familiar with it. Test everything and make sure it behaves as expected. Do not wait until something breaks to learn how the configuration works.

If you have any questions or comments, leave them below, and I’ll see you next time.