OpenWrt VPN: Which Services Work in LuCI and How to Set One Up

Top 3 OpenWrt VPNs on this page

TorGuard earns its lead on network reach and censorship bypass, with port forwarding included. Le VPN's privacy sub-score is dragged down by its own logging of connection IP addresses, a red flag shared with ZenVPN and Speedify. OVPN publishes downloadable router files yet scores almost nothing on getting past censorship systems.

What the ten entries actually are

Seven are regular consumer VPNs, Speedify among them: it bonds several links with its own protocol, so no WireGuard or OpenVPN file exists there. FineVPN and Shadowsocks are the free or mobile app entries, and Mudfish targets gamers, routing traffic per process by default with one device per account. Shadowsocks is a self-hosted proxy protocol with no subscription at all, and it sits outside the main ranking because too little about it is published.

Which file each service hands your router

TorGuard and ZenVPN state VLESS support, while FineVPN hands out Xray VLESS/VMess configs; running any of them takes an Xray or V2Ray client package on the router.

Setting up WireGuard or OpenVPN in LuCI

1. Install packages: wireguard-tools plus luci-proto-wireguard, or openvpn-openssl plus luci-app-openvpn. Recent releases use apk, older ones opkg.
2. Upload the provider's .ovpn through VPN → OpenVPN (available since 19.07) or add the WireGuard interface with its imported config. OpenVPN credentials go into an auth file referenced by auth-user-pass.
3. Move the tunnel interface into the wan firewall zone. Miss this and the LAN loses internet while the router itself stays reachable.
4. Set a netmask on the WireGuard address. LuCI never asks, and without it nothing routes through the tunnel.
5. Enable the kill switch from the official client guide so a dropped tunnel cannot leak traffic.
6. Check the handshake timer under Status → WireGuard, then run a DNS leak test from a laptop.

WireGuard needs less CPU than OpenVPN, so on slow router hardware prefer it where the provider allows. OpenWrt handles IPsec separately, through strongSwan packages; among the services here four state IKEv2 and four state L2TP/IPsec.

Policy-based routing: VPN for some devices, WAN for the rest

The pbr package with luci-app-pbr sends chosen hosts, subnets or domains through the VPN while the rest takes the WAN path, which keeps your banking app happy and port forwarding alive. For OpenVPN, add tun* as a supported interface first. The plain netifd method needs no extra software but cannot match domains. mwan3 is for multi-WAN failover, not split tunnelling; the routing overview compares them.

GL.iNet and other OpenWrt-based routers

GL.iNet firmware is OpenWrt at heart, with LuCI under advanced settings, and the vendor advertises uploadable configs for 30+ OpenVPN and WireGuard services. Le VPN and OVPN both list GL.iNet among supported routers.

How the page score treats these services

Apps and platforms weigh 35%, privacy 22%, security 14%, price and terms 11%, censorship bypass and network the rest. No service on the list holds an independent no-logs audit, which holds privacy sub-scores down across the board, and three carry the connection-IP red flag. The median paid plan runs €4.26 monthly; NVPN and ZenVPN sit at €2.86, with a 30-day refund from ZenVPN and only a 3-day window from NVPN.

OpenWrt VPN FAQ

Short answer

Pick a provider that lets you download a WireGuard or OpenVPN config, install the matching LuCI package, push the interface into the wan zone and switch on the kill switch. TorGuard tops this ranking, OVPN offers ready .ovpn and WireGuard files to download, and pbr keeps the devices you name outside the tunnel.