How to Set Up an OpenVPN Server on an OpenWrt Router

Turning a modest home router into a full‑blown VPN gateway isn’t as mystical as it sounds. With OpenWrt’s flexibility and OpenVPN’s reliability, you can secure every device on your network without buying separate hardware. Below is a step‑by‑step walk‑through, from flashing the firmware to testing the tunnel.

What You’ll Need Before You Begin

• Router that supports OpenWrt (check the Table of Hardware)
• Computer running Linux, macOS, or Windows with an SSH client
• Basic familiarity with the command line
• A static public IP or a dynamic DNS service (e.g., DuckDNS, No-IP)

1. Install OpenWrt on Your Router

If your device already runs OpenWrt, you can skip this part. Otherwise, download the appropriate sysupgrade.bin file from the OpenWrt site, then follow the manufacturer’s firmware‑upgrade process. A quick tip: always back up the existing configuration before flashing.

Key steps

1. Connect your computer to the router via Ethernet.
2. Access the router’s web UI (usually 192.168.1.1).
3. Navigate to System → Backup / Flash Firmware and upload the .bin file.
4. Confirm the flash and let the router reboot.

2. Prepare the OpenVPN Packages

OpenWrt’s default install is lightweight; you’ll need to pull in the VPN components. SSH into the router (default user root, no password) and run:

opkg update
opkg install openvpn-openssl luci-app-openvpn

The first command refreshes the package list, the second adds the OpenVPN daemon and its LuCI web interface. Once installed, you’ll see a new OpenVPN option under Services in the router’s GUI.

3. Generate Certificates and Keys

OpenVPN relies on a public‑key infrastructure (PKI). You can generate everything directly on the router, but using a separate machine simplifies the process and keeps private keys off the device.

Using Easy‑RSA on a PC

1. Install Easy‑RSA (available for Windows, macOS, Linux).
2. Open a terminal, create a new PKI directory, and run ./easyrsa init-pki.
3. Build the Certificate Authority: ./easyrsa build-ca nopass.
4. Create server certificates: ./easyrsa gen-req server nopass then ./easyrsa sign-req server server.
5. Generate Diffie‑Hellman parameters: ./easyrsa gen-dh.
6. Optionally, create client certificates following the same steps, substituting client for server.

When finished, you’ll have a set of files: ca.crt, server.crt, server.key, dh.pem, plus any client files you created.

4. Transfer Keys to the Router

Use scp or WinSCP to copy the certificate bundle into /etc/openvpn/. Example using scp:

scp ca.crt server.crt server.key dh.pem root@192.168.1.1:/etc/openvpn/

Make sure the files keep their original permissions; OpenVPN will refuse to start if they’re world‑readable.

5. Create the Server Configuration File

In /etc/openvpn/, create server.conf. Below is a solid starter configuration; feel free to tweak routes or encryption settings later.

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
keepalive 10 120
cipher AES-256-CBC
persist-key
persist-tun
status /tmp/openvpn-status.log
verb 3

Save the file, then enable the service:

/etc/init.d/openvpn enable
/etc/init.d/openvpn start

6. Adjust Firewall Rules

OpenWrt’s firewall must allow VPN traffic and forward it to the LAN. In the LuCI UI, go to Network → Firewall → Traffic Rules and add:

• Rule 1: Source zone = wan, Destination zone = vpn, Protocol = udp, Port = 1194.
• Rule 2: Source zone = vpn, Destination zone = lan, Allow forwarding.

If you prefer the command line, the equivalent uci commands are:

uci add firewall rule
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].dest='vpn'
uci set firewall.@rule[-1].proto='udp'
uci set firewall.@rule[-1].dest_port='1194'
uci commit firewall
/etc/init.d/firewall restart

7. Test the Connection

On a client device, install the OpenVPN client (available for Windows, macOS, Android, iOS). Import the client .ovpn file, which should contain the client certificate, key, and the CA block. Connect – you should see a new tun interface and be able to ping 10.8.0.1 (the server’s VPN IP).

To verify that traffic really routes through the router, check your public IP on a site like whatismyip.com while the VPN is active. It should display the IP of your home network, not the client’s ISP.

8. Fine‑Tuning and Common Pitfalls

• Port forwarding: If your ISP blocks UDP 1194, try TCP or a different port and update both server.conf and the firewall rule.
• MTU issues: Some clients may need mssfix 1400 or fragment 1300 options to avoid “packet loss” messages.
• Dynamic IP: Pair your router with a dynamic DNS hostname; update the remote line in the client config accordingly.
• Log troubleshooting: The status log at /tmp/openvpn-status.log is a quick way to spot authentication failures.

9. Keep It Secure

Even though OpenVPN is robust, regular maintenance helps. Periodically rotate the server certificate, disable password‑based authentication if you only use certificates, and apply OpenWrt firmware updates to patch any underlying vulnerabilities.

With these steps complete, your OpenWrt router now acts as a reliable OpenVPN server, extending your home network safely to wherever you go. Happy tunneling!