VPN Setup on DD-WRT Router: Step-by-Step

This guide walks you through configuring a VPN client on a DD-WRT router, so all devices on your home network route their traffic through the VPN automatically. You’ll need your VPN provider’s OpenVPN configuration files (usually a .ovpn file) and credentials. The process involves uploading the config, adjusting firewall rules, and restarting the VPN service.

What You’ll Need

A router with DD-WRT firmware installed (v24 SP2 or newer recommended).
Your VPN provider’s OpenVPN configuration file (typically named something like client.ovpn or us-east.ovpn).
Your VPN username and password (often separate from your account login).
Access to the DD-WRT web interface (usually at 192.168.1.1).
A computer or phone connected to the router’s network to access the admin panel.

Step-by-Step

Log into the DD-WRT web interface. Open a browser, go to your router’s IP address, and enter your admin username and password. If you haven’t changed them, the defaults are often root and admin.
Back up your current configuration. Go to Administration > Backup and click Backup to download a .bin file. This lets you restore settings if something goes wrong.
Prepare your OpenVPN configuration file. Open the .ovpn file in a text editor. You’ll need to extract the CA certificate, client certificate, and client key (if your provider uses them). Look for lines like <ca>, <cert>, and <key>. Copy the content between each tag into separate text files: ca.crt, client.crt, and client.key. If your provider uses a single shared CA, you may only need the CA.
Navigate to the VPN settings. In DD-WRT, go to Services > VPN and then click the OpenVPN Client tab.
Enable the OpenVPN client. Set OpenVPN Client to Enable. For Start Type, choose WAN Up so the VPN starts when the router boots.
Fill in the basic connection parameters. Under Server IP/Name, enter your VPN provider’s server address (e.g., us1.vpnprovider.com). For Port, use the port from your .ovpn file (commonly 1194 for UDP or 443 for TCP). Set Tunnel Device to TUN and Protocol to UDP or TCP as specified in your config.
Enter your credentials. In Username and Password, enter your VPN login details. If your provider uses a username/password, this is where they go.
Upload the CA certificate. In the CA Cert field, paste the entire content of your ca.crt file. If your provider uses a single .ovpn file, you can copy the content between <ca> and </ca>.
Upload the client certificate and key (if required). If your provider uses client certificates, paste the contents of client.crt into Public Client Cert and client.key into Private Client Key. Some providers only need the CA.
Add advanced options. In the Additional Config box, paste any extra directives from your .ovpn file that aren’t already covered, such as remote-cert-tls server, ns-cert-type server, or cipher AES-256-CBC. Do not include client, dev tun, proto udp, or remote lines—DD-WRT handles those separately.
Configure the firewall. Go to Administration > Commands and paste the following firewall script into the Command Shell box, then click Save Firewall:
```
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I INPUT -i tun0 -j ACCEPT
```
This allows traffic to flow between your LAN and the VPN tunnel.
Apply the settings. Click Apply Settings at the bottom of the VPN page. The router will save the configuration and attempt to connect.
Verify the connection. Go to Status > OpenVPN. You should see a green status indicating the client is connected, along with the assigned IP address and the server’s IP. If it shows red, check the logs for errors.
Test your IP address. Visit a site like whatismyip.com from a device on your network. It should show the VPN server’s location, not your ISP’s.

Common Mistakes

Forgetting to copy the entire certificate. Ensure you include the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. Truncated certs cause authentication failures.
Using the wrong protocol/port. Mismatching the protocol (UDP vs TCP) or port from your .ovpn file will prevent connection.
Not adding the firewall rules. Without the iptables rules, the VPN may connect but no device on your LAN can use it.
Leaving the DNS settings default. Your ISP’s DNS can leak your real location. Consider setting DNS Servers to the VPN provider’s DNS or a public DNS like 1.1.1.1.
Using the wrong username/password. Some providers use a separate VPN username (often a long string) rather than your account email.

Tips

Use a kill switch. DD-WRT doesn’t have a built-in kill switch, but you can add a firewall rule that drops all traffic if the VPN tunnel goes down. A simple approach is to set Policy based routing to only route specific devices, but for full protection, search for “DD-WRT kill switch” for scripts.
Enable auto-reconnect. In the OpenVPN client settings, set Reconnect to Enable so the router retries if the connection drops.
Keep your firmware updated. Newer DD-WRT builds have better OpenVPN support and security fixes.
Use a dedicated server. If your provider offers dedicated IPs, they can be more stable for router use.
Test with one device first. Before routing your whole network, test the VPN on a single device to ensure your provider’s config works.

Troubleshooting

VPN shows “Connecting” but never connects. Check the logs under Status > OpenVPN > Log. Common errors include incorrect CA, wrong username/password, or a firewall blocking outbound UDP. Temporarily disable the router’s SPI firewall to test.
VPN connects but no internet. This usually means the firewall rules are missing or the DNS settings are wrong. Re-add the iptables rules and set DNS manually in the VPN client settings.
Devices on LAN can’t reach the VPN. Ensure the firewall rules are saved and applied. Also check that NAT is enabled under Setup > Advanced Routing.
Router becomes slow or unresponsive after enabling VPN. The router’s CPU may be overloaded by encryption. Try a lighter cipher (e.g., AES-128-GCM) or reduce the MTU. If it persists, your router may not be powerful enough for VPN.
VPN works but IP leaks. Check DNS settings. Set DNS Servers to the VPN provider’s DNS or a public one. Also ensure Redirect Internet Traffic is set to Enable in the OpenVPN client settings.

Frequently Asked Questions

Can I use a free VPN service with DD-WRT?

Yes, but free services often have slower speeds and may not provide .ovpn files. Check their support pages for OpenVPN configuration downloads.

Will this VPN protect all devices on my network?

Yes, once configured, all devices that connect to the router will have their traffic routed through the VPN, including smart TVs, game consoles, and IoT devices.

How do I exclude certain devices from the VPN?

DD-WRT supports policy-based routing. Under Services > VPN > OpenVPN Client, set Policy based routing to Enable and list the IP addresses of devices you want to bypass the VPN.

What if my VPN provider doesn’t offer a .ovpn file?

Most reputable providers do. If not, you can manually create one using their server address, protocol, and port. You may need to contact support for the CA certificate.

Is it safe to flash DD-WRT on my router?

Flashing any third-party firmware carries a risk of bricking the device. Always follow the manufacturer’s instructions and use the correct firmware build for your router model.

Can I run both a VPN client and a VPN server on the same router?

Yes, DD-WRT allows multiple OpenVPN instances. You can enable both the client and server, but be aware of performance limitations on lower-end hardware.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →