Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.

Today I want to talk about how to set up a whole-home VPN on OpenWrt.

If you already know why you want to do this, feel free to skip ahead to the instructions. The timestamps are listed below the video. But if you’re curious about why you might want a whole-home VPN, let’s start with a demonstration.

Imagine your normal home network. You have a router, a laptop, and a phone. In a typical setup, your devices connect to the router over Wi-Fi or through a LAN or Ethernet cable.

Your router is assigned an external IP address by your internet service provider, usually through a modem or another device depending on the type of internet connection you have. For this example, we’ll call that IP address 1.2.3.4.

When you request a website such as example.com, your device sends the request through your router. The request leaves your network using the IP address assigned by your ISP. When example.com checks who is visiting, it sees 1.2.3.4.

Many people use a VPN to mask that ISP-assigned address. In my case, I use IVPN. The usual way to use a VPN provider is to install its app on each device. You install the IVPN client, choose a server location, and establish a connection through your router and ISP to the VPN provider.

After that connection is established, a request to example.com uses the VPN provider’s IP address instead. For this example, we’ll call that address 5.6.7.8. The website now sees the VPN address rather than the IP address assigned by your ISP.

The drawback is that the VPN client must be installed and connected on every device. IVPN’s standard plan, for example, has a device limit. If the client is installed on both your phone and laptop, those count as two separate devices.

You may also have devices that do not support a VPN client. A Roku is one example. I’m not endorsing Roku; I’m only using it because it is popular in the United States. Because the Roku cannot run the VPN app, it continues accessing the internet through your ISP-assigned IP address even while your other devices use the VPN.

Instead of installing the VPN client directly on every device, you can configure the VPN connection on your router.

In that setup, the router establishes the connection to IVPN. Any outbound traffic routed through it uses the VPN address. Your laptop, phone, streaming box, and other devices do not need their own VPN clients. A firewall rule on the router directs outbound traffic through the VPN tunnel, so every connected device receives the same protection.

That is why this is often called a whole-home VPN.

Another benefit is that all of the devices behind the router share a single VPN tunnel. You might have three devices connected, or you might have ten, but the VPN provider generally sees the router’s tunnel as one connected device.

Guests also receive the same protection. When a friend connects a phone or laptop to your Wi-Fi, that traffic is routed through the VPN automatically. You do not need to install individual clients, confirm that every client is connected, or worry about exceeding the VPN account’s device limit.

The main reason I’m configuring this on my travel router is for hotel Wi-Fi.

The travel router connects to the hotel’s wireless network and then broadcasts a separate wireless network for my devices. Everyone traveling with me connects to the network broadcast by the travel router, and all of those devices are protected by the VPN connection.

This is also convenient when a hotel uses a captive portal. The travel router becomes the authorized device on the hotel network. Once the router has completed the hotel’s sign-in or registration process, the devices behind it can usually connect without each one going through the captive portal separately.

The network diagram may look a little confusing, but I hope it answers more questions than it creates. They say a picture is worth a thousand words. This was a diagram, so hopefully it was worth ten thousand.

For this setup, I’m following the official documentation on IVPN’s website, which is linked below the video.

Always check the provider’s current documentation before following a YouTube tutorial, because the video may eventually become outdated.

I have not configured this particular setup on OpenWrt before. I’m starting with a mostly default OpenWrt installation. I set an administrator password and enabled HTTPS, but I have not changed much else.

For the demonstration, the travel router is using my home Wi-Fi as its wireless uplink so that it has an internet connection.

In the router’s web interface, navigate to:

System → Software

Click Update Lists and allow the package list to finish refreshing. After it completes, dismiss the status window.

Use the filter field to search for WireGuard. Locate and install the following packages:

• WireGuard Tools
• Kmod WireGuard
• LuCI Proto WireGuard

IVPN also provides OpenVPN instructions, but I’m using WireGuard for this guide. In my opinion, there is no benefit to using OpenVPN for this setup at this point. Follow IVPN’s OpenVPN guide instead if that is the protocol you prefer.

Install WireGuard Tools first. Leave the “Allow overwriting files from other packages” option unchecked, then confirm the installation.

Kmod WireGuard may be installed automatically as a dependency. Finally, install LuCI Proto WireGuard, again leaving the overwrite option unchecked.

After the packages are installed, restart the router:

System → Reboot → Perform Reboot

My router took about 45 seconds to restart. When the login screen returns, sign in again.

The next step is to create the WireGuard interface.

First, generate a WireGuard configuration file using your preferred server and parameters. IVPN notes that its configuration-file generator is available only for accounts created after November 2020, so older accounts may require a different process.

Sign in to your IVPN account, scroll to the WireGuard setup section, and open the Configuration File Generator.

The key comment is optional. I entered OpenWrt.

Click Generate Key. The page will display a public key. I blurred mine in the video for privacy.

For this example, I’m creating a single-hop connection. Select the country, city, and server you want to use. I selected Reykjavik, Iceland, and one of the available servers.

I left the connection on the default port, selected IPv4 only to keep the demonstration simple, and left the DNS setting on Standard.

Click Download ZIP Archive. Extract the archive, open the configuration file in a text editor, and copy its entire contents. The file contains sensitive configuration information, so do not share it publicly.

In OpenWrt, navigate to:

Network → Interfaces

Click Add New Interface.

Give the interface any descriptive name. I used IVPN Iceland.

Set the protocol to WireGuard VPN, then click Create Interface.

On the General Settings tab, click Load Configuration. Paste the contents of the WireGuard configuration file and click Import Settings.

OpenWrt should parse the file and populate the configuration fields automatically. If it does not, the file contents may not have been copied correctly.

Next, open the Advanced Settings tab and set the MTU to:

1412

Make sure this value is set correctly. An incorrect MTU can cause poor performance or prevent some connections from working. MTU stands for maximum transmission unit. If it is too high, packets may be fragmented and the connection may behave unpredictably.

Open the Peers tab and click Edit next to the imported peer configuration.

Enable Route Allowed IPs.

Set Persistent Keep Alive to:

25

Click Save, then save the interface configuration and click Save & Apply.

Before continuing, I checked my current external IP information. At that point, my traffic was still appearing through a Chicago location. This gives us a baseline so we can confirm later that the route changes to the Iceland VPN server.

Navigate to:

Network → Firewall

Click Add and enter the following settings:

• Name: ivpn_firewall
• Input: Reject
• Output: Accept
• Intra-zone forward: Reject
• Masquerading: Enabled
• MSS clamping: Enabled

Under Covered Networks, select the VPN tunnel interface you created earlier. In my case, that is IVPN Iceland.

Under Allow Forward From Source Zones, select LAN.

This allows traffic from devices connected to the router’s LAN or wireless network to be forwarded through the IVPN interface.

Click Save, then click Save & Apply.

The next step is optional, but I recommend it.

A kill switch ensures that traffic from your LAN devices travels only through the VPN tunnel. It also prevents leaks if the router loses its connection to the VPN server.

Edit the existing LAN firewall zone and remove WAN from the allowed destination zones. This blocks outbound traffic if the IVPN connection goes down instead of allowing the connection to fail over to the normal WAN interface and expose your ISP-assigned IP address.

In the firewall page, click Edit on the LAN zone. Uncheck WAN under the allowed destination zones, then click Save and Save & Apply.

After this change, the LAN zone should forward only to the IVPN firewall zone.

Next, configure DNS.

Navigate to:

Network → Interfaces

Click Edit next to the WAN interface. On the Advanced Settings tab, uncheck Use DNS Servers Advertised by Peer.

Enter IVPN’s standard WireGuard DNS server address:

172.16.0.1

You may use IVPN’s AntiTracker DNS address instead if you prefer that option.

Click Save.

In my setup, the internet uplink is wireless, so I also needed to apply the same setting to the WWAN interface. If your router uses its physical WAN port, edit the WAN interface. If it uses a wireless uplink, edit the corresponding WWAN interface instead.

Uncheck the advertised-DNS option, enter the VPN DNS server address, and save the interface.

If your ISP also provides IPv6 connectivity, repeat the applicable steps for WAN6. My ISP does not provide IPv6, so I skipped that part.

Click Save & Apply.

A reboot is not strictly required, but it can help confirm that everything behaves correctly after a restart. When in doubt, reboot.

Navigate to:

System → Reboot

After the router restarts, sign in again.

With the configuration complete, run several tests from a device connected to the OpenWrt router.

First, use a service such as dnsleaktest.com. In my test, the connection showed Reykjavik, Iceland.

I also refreshed an IP-information service. The first site appeared to block the Icelandic VPN address, so I tested the address using MaxMind instead. That service showed Reykjavik and identified the hosting network.

This confirms that internet traffic is using the new VPN connection.

The DNS leak test also showed an Icelandic DNS server, confirming that DNS requests were using the server configured in the previous step.

The final test is the kill switch.

I started a continuous ping to:

1.1.1.1

The ping worked while the VPN interface was active.

I then returned to:

Network → Interfaces

I stopped the WireGuard interface. As soon as the VPN connection shut down, the ping requests began timing out. Restarting the ping did not restore internet access while the VPN interface remained disabled.

That confirms the kill switch is working. When I restarted the WireGuard interface, the internet connection returned.

At this point, the router is connected to the VPN, the kill switch is functioning, and any device connected through the router’s wireless network or LAN port is routed through the VPN connection.

There are some inconveniences with this setup.

For example, the VPN server may have an outage. If the selected server goes down, you may need to connect to a different server manually.

You can check IVPN’s server status page, select another server, and update the IVPN configuration in OpenWrt. In the interface settings, open the Peers section and update the endpoint host and public key as required.

[The original VTT transcript cuts off part of the sentence at this point.]

That about sums it up. I hope this helped address any concerns or doubts about setting up a whole-home VPN.

The setup is fairly straightforward once you become familiar with it. Test everything and make sure it behaves as expected. Do not wait until something breaks to learn how the configuration works.

If you have any questions or comments, leave them below, and I’ll see you next time.

Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.

So I recently purchased the router you see on the screen now, the GL.iNet Beryl 7, or the GL-BE3600.

I’d always kind of wondered about the reasons behind having a travel router when traveling, thus the name.

But I came across this article that talked about some of the consumer devices that could be out there. And I always knew there were IoT devices that did some less-than-ideal things. But these Android TV streaming boxes, which, public service announcement, if you have one of these, read this article. It will be linked down below. Consider getting rid of it.

But again, after reading this article, I started to see that there could be some benefit to having another device between my devices and the untrusted network that I’m using, whether that’s a hotel network, a friend’s house, or a coffee shop, something like that.

And before I get too far into it, if you want to skip this part of the video because you’re here to see the instructions on installing OpenWrt on your router, feel free to skip ahead. Check the timestamps below.

Some other benefits, besides the added protection of having a router in between you and the wireless network or whatever network you’re trying to use: let’s say you go to a hotel, and you want to use the hotel Wi-Fi. Typically, those authenticate devices or register them based on MAC address. It can be kind of annoying to sign in every device you brought with you and whoever else is traveling with you.

So instead, what you can do is take this router, sign in using this, and once the router is authenticated, you can then connect all your devices you’re traveling with to the wireless network this is rebroadcasting. And since the travel router is already authenticated, that single device is using the hotel Wi-Fi as the uplink. Now all your devices connected to it are going to be good to go without re-registering.

Another benefit is that you can configure a VPN on the travel router. So let’s say you have IVPN. You configure that on the Beryl 7. Now any device that connects to the wireless network that it’s broadcasting out gets that same VPN connection protection without having to configure IVPN on every one of your devices.

I actually do that at my house with OPNsense. I have IVPN configured on there. All my traffic is configured to use that as the exit. So now it’s pretty cool that I can do that when I’m on the road instead of having the client installed on all my devices.

There are also a bunch of other things you can do with this. Again, it’s going to be using OpenWrt, but those are a couple of the main things.

So when I was traveling last month, I ended up using the stock firmware on this because OpenWrt was not available for it yet. They just released it, I think, about a week or two ago, so now I’m ready to get that installed on here.

Let’s begin that.

So again, all links will be available down below, so you can follow along if you’re trying to get this installed on your device. But if we go to the main page, scroll down to the installation section. The first step is to download the latest sysupgrade image for the GL-BE3600.

So let’s open the firmware selector. You should see a page like this. Confirm the model number there matches yours. We need to download the sysupgrade image. Select that, and it should go to your downloads folder or wherever your downloads are configured to go.

Let’s go back to the installation instructions. Use an Ethernet cable to connect to one of the router’s LAN ports. The reason you need to use a LAN cable is that by default, OpenWrt disables the Wi-Fi on the router for security reasons. So if you don’t have a LAN cable, you won’t be able to connect to it after the installation.

So if you need to use a dongle or something like that for an Ethernet port on your device, go ahead and get that, and then plug it into your laptop or computer. So I just plugged mine into my laptop.

So the next step is to browse to the GL.iNet web interface. The default IP is 192.168.8.1. If you haven’t logged into your device yet, then go ahead and try to access that IP address. If you’ve already set it up, then go to whatever you configured.

In my case, I haven’t configured it yet, so let’s just go there. If you’ve never set up your device before, go ahead through the initial setup. I’m just going to leave this set to the default because these settings will get overwritten shortly when we flash the new firmware.

Go back to the instructions. Now that we’re logged in, go to the upgrade page and drag in your downloaded sysupgrade image. When prompted, select do not keep configuration.

So let’s go here to System, Upgrade, Firmware, Local Upgrade. Select a file to upload, or drag it here. I’m going to drag it there. Again, it should be in your downloads or wherever you configured your download to go.

So you should have the OpenWrt sysupgrade image. We have GL-BE3600, which does match the model number of the Beryl 7. This version number might change if you’re watching this in the future, as versions do get upgraded.

So let’s drag it there. Upload successful. This is not official release firmware. Okay, let’s just walk through it then. There are no other instructions on the main page.

Verification result: pass. Keep settings. We don’t want to, so we’ll leave this disabled, and then click install. This might take a few minutes, so we’re just going to let this sit. Don’t touch anything. Just let it flash. Let it do its thing, and it should come back once it’s completed.

The page refreshed, but it went back to 192.168.8.1. If we go back to the instructions, the OpenWrt default IP address is 192.168.1.1, so we will have to go there in our browser.

1.1. Continue to site. And here we are. This looks like the OpenWrt interface. We can see on the tab that it is.

After flashing, OpenWrt can be configured as described in the quick start guide. Let’s open that up. I’m connected to the wireless router, or I’m connected to the Beryl 7, so I don’t have internet access currently.

I’m guessing the password is password. Okay, so it was online. For firmware upgrades, yes. Enable checking configured changes, yes. It’s going to check for upgrades. Save and apply.

Anyways, that’s OpenWrt and how to get it installed on the Beryl 7. I’m not going to go through the setup at this point, but I might make a video on it in the future. And if you have any questions or comments, feel free to leave those down below, and I’ll see you in the next one.