flash a router with OpenWRT
flash a router with OpenWRT

 Learn the right way to flash a router with OpenWRT with this guide to get your VPN service up and running. 

In the second part of this three-part article, we discuss OpenWRT and how to get your router prepared so that you can reap the full benefits of adding VPN tunneling services to your network. To learn more of the basics of VPNs, refer to the first part of this article. If you've already flashed your router with OpenWRTand are having issues, check out part three where we go over troubleshooting or reach out to us.  

If you've been interested in the benefits of VPN tunneling, keep on reading to learn how to flash a router with OpenWRT. 

What is OpenWRT? 

The most common use for OpenWRT is as an OS for routers. Where stock firmware can often fall short, OpenWRT offers better customization through its extensive features for optimizing network traffic and configuring common network-related features. 

OpenWRT has become more popular for its stability and reduction in lag. As it relates to VPNs, It allows users to bypass simultaneous connection limitations while also encrypting data from Smart TVs and gaming consoles, which typically do not fully support VPNs.  

Why do I need to flash my router? 

Flashing your router simply means installing new firmware on it. To flash a router with OpenWRT can give you more functionality and possibly improve performance. To learn more about OpenWRT, refer to the first VPN post or check out this video below. 

 

How to Flash a Router with OpenWRT for VPN Services

Ready to begin? We have all the steps outlined in the images below. But before that, in order to get the right firmware for your device, use this firmware selector: https://firmware-selector.openwrt.org/  

First time setup requires you to use the factory image file. NOTE: Use “system upgrade” going forward once factory image is installed. 

 

For the OpenWRT compatible Linksys routers: 

  • Go to the connectivity page 
  • Select factory wrt image file 

 

 

Use the following URL to connect to the newly flashed router: 

192.168.1.1/cgi-bin/luci  

OpenWrt – LuCI 

OpenWrt setup with NordVPN | NordVPN support 

DITCH INTERFACE >> WAN6 – About Interfaces

Unless you have a use case, I would uncheck “bring up on boot” and “disable this interface” under interfaces, edit WAN6.  You can also just delete it.

  • Navigation Bar Features
    • VPN
      • OpenVPN or Wireguard (once installed)
  • Interfaces
    • Fix errors
      • “network device is not present” Resolve issue for VPN. This error also pops up during firmware update and thus VPN removed

Open WRT interfaces

CHOOSING THE SOFTWARE VPN 

OpenWRT -> System ->  Software

OpenVPN is a lot slower than Wireguard.  It is probably ideal to add Wireguard install rather than OpenVPN because OpenVPN max speed is 10 megabits versus Wiregarud few hundresd.  You have Wireguard modern encryption to thank for that.

DISCLAIMERS:

  • Firmware update will knock out and remove the VPN software.  It needs to be reinstalled through the “filter” as illustrated below but first “update lists”
  • Probably stick to OpenVPN first if you just updated your firmware and reinstalling OpenVPN just to see it work.  Then play around with Wireguard upgrade later.

NOTE:

  • The first illustration below is for the older firmware versus the second illustration is with the firware update.

 

The following settings are applied: 

  • openvpn-openssl 
  • ip-full 
  • luci-app-openvpn

 

OpenVPN install

 

 

 

Can change my virtual location on the fly? 

No, but you can change it manually on the router by choosing your preferred location. NordVPN will optimize the best VPN server. Download UDP or TCP configuration files, whichever you prefer. (UDP is faster, TCP is more reliable). We recommend UDP. You’ll find the server hostname under the server title. 

https://nordvpn.com/servers/tools   

 

NOTE:

  • First illustration is from ’24 where NordVPN did not offer Wireguard VPN
  • Second illustration is from late ’26 where NordVPN does now offer Wireguard over slower OpenVPN
  • NordVPN updates its servers in late ’26

 

WireguardVPN for NordVPN

After VPN Software Installation on OpenWRT Interface

 

Add New VPN Interface

If WireGuard VPN isn’t in the Protocol list, the package didn’t finish installing, or LuCI hasn’t picked it up yet. Reboot and check again. If it’s still missing, check the Installed tab for luci-proto-wireguard.

After you create it, you’ll land on its settings page. Look for Load configuration… (or Import configuration) and paste in the contents of your Nord file.

 

Edit Wireguard Configuration

firewall settings

 

VPN Instances

Note:

  • The VPN navigation bar only appears if you use the legacy OpenVPN, not WireGuard

    • The package isluci-app-openvp and it only manages OpenVPN.

    • If you uninstall luci-app-openvpn and openvpn-openssl once WireGuard is confirmed working, the VPN menu will disappear.

  • About WiredGuard

    • WireGuard lives in two other places:

      • Network → Interfaces → NordWireGuard: all the settings.
      • Status → WireGuard: the live connection status, including the last handshake and data transferred.

 

Under the “OVPN configuration file upload” section, name the VPN connection in the “Instance name” field (we have named it “nordvpn_us”.) After that, click on the “Browse” button, locate the downloaded server file and click “Upload”. 

1. Upload 

2. Choose file and provide instance name 

3. Edit instance once uploaded

 

4. In the “OpenVPN instances” section, click the “Edit” button next to the instance you have just created.

 

In the lower field, enter your NordVPN service credential username and password into separate lines (as seen in the image above). You can find your NordVPN service credentials (service username and service password) in the Nord Account dashboard.

5. Click Set up NordVPN manually. NordVPN – Nord Account

About Interfaces and Zones

Below is an example of the LAN interface.  OpenWrt’s firewall doesn’t write rules for each interface individually. Interfaces are group together in the form of “Zones” and rules are set between the zones.

  • LAN Zone (group)
    • is the trusted internal network.  Each device can talk to each other and reach outside work through the router’s gateway
  • WAN Zone
    • This is the internet side of things ( WAN and WAN6 that is now disabled).   We do trust it, so incoming connections are blocked
  • Forwarding(s):
    • This traffic flow so the default is LAN -> WAN and that rule allows devices to get online

OpenWRT LAN Interface

  • VPN interface
    • the NOrdVPNtun interface requires a zone.  We need to all0w traffic from the LAN to VPN
      • Check Network -> Firewall
        • Zone
          • VPN
            • NordVPNTun
              • Masquerading checked
              • Input set to reject and forward set to reject
              • Forward forwarding from LAN -> VPN allowed

If your old settings carried over, that zone is probably still there. You can check quickly by opening Edit on NordVPNtun and going to its Firewall Settings tab. If it shows a zone there, you’re set. If it says unspecified, send me a screenshot of the Firewall page and I’ll help you add it.

 

 

6. Click on the “Network” tab at the top of the page and choose “Interfaces”

7. Select the “Add new interface…” button and name it “nordvpntun”. 

 

8. Click on the “Protocol” dropdown menu and choose “Unmanaged”.  

9. In the “Interface” dropdown, enter the name “tun0” at the bottom — custom — field and press the Enter key.

10. Click the “Create interface” and “Save” buttons. 

 

 

11. Choose the “Network” tab at the top again and head to the “Firewall” section.

 

 

12. Click the “Add” button and adjust it as follows:

  • Name it “vpnfirewall” 
  • Set the “Input” option as “Reject”; 
  • Leave “Output” as “Accept” and “Forward” as “Reject”; 
  • Check the “Masquerading” option; 
  • Check the “MSS clamping” option; 
  • From the “Covered Networks” dropdown menu choose “nordvpntun”; 
  • In the “Allow forward from source zones” dropdown menu, choose “lan”; 
  • Click the “Save” button. 

 

 

13. In the “Zones” section, find the zone named “lan”, and click on the “Edit” button.

14. In the “Allow forward to destination zones” use the dropdown and check the “nordvpntun” entry.

 

 

15. Once more, click “Network” at the top of the page and then choose “DHCP and DNS” from the dropdown list.

16. In the “General Settings” tab, find the “DNS forwardings” option and enter NordVPN DNS addresses there. The addresses are: 103.86.96.100 and 103.86.99.100

 

 

17. Go to the “Resolv and Hosts Files” tab, check the “Ignore resolve file” checkbox, and click the “Save & Apply” button. 

 

 

18. Lastly, please head back to the “VPN” —> “OpenVPN” tab.

19. In the “OpenVPN instances” section, check the “Enable” option next to the NordVPN option in the list, and click the “Save & Apply” button.

20. Click the “Start” button next to the created NordVPN instance to connect to the VPN server. 

 

 

Once you have followed these instructions, you should be connected using the configured connection. To check if you were successful, visit NordVPN’s homepage — the status at the top of the page should say “Protected”.

If you wish to disconnect the VPN connection, you can click on the “Stop” button next to the NordVPN option in the “VPN” > “OpenVPN” > “OpenVPN instances” section. 

Bonus Resources for OpenWRT VPN Setup Support

Still curious about VPNs? Check out these other articles:

Set Up Your VPN Service: How to Flash a Router with OpenWRT Summary 

Using a VPN is a great advantage to anyone traveling, working remotely, or living abroad. This quality-of-life upgrade offers users peace of mind with greater security and access to all things previously limited by geolocation. Knowing how to flash a router with OpenWRT can further optimize your VPN service so you can connect anywhere worry-free. 

If you are facing issues with your setup, check out our troubleshooting article in part three of this VPN series, or send us a message to see how we can help.

 

Leave A Comment