VPN setup · Router

OpenWrt
VPN

Protect every device at home, smart TVs and consoles too, with IPHush on your OpenWrt. Load the WireGuard file from your account, then choose one device or the whole network. Zero connection logs.

By the IPHush team · Updated

OpenWrt VPN at a glance

Works withOpenWrt 24.10+OpenWrt 24.10 or newer.
SetupImport a fileIPHush.uci from your account
TestedIn our labEvery block run on a real router
Connection logsNoneNo sites, DNS queries, times or IP addresses
PlansFamily or ProEach includes 1 router; on Pro it leaves from your dedicated IP

How to set up IPHush on OpenWrt

1 · Before you start

  1. Save a backup

    Then copy it to your computer: scp -O root@[router IP]:/tmp/before-IPHush.tar.gz . (or LuCI → System → Backup / Flash Firmware → Generate archive).

    sysupgrade -b /tmp/before-IPHush.tar.gz
  2. Install WireGuard

    On OpenWrt 25 and newer, which use apk: apk update && apk add wireguard-tools kmod-wireguard luci-proto-wireguard.

    opkg update
opkg install wireguard-tools kmod-wireguard luci-proto-wireguard
service network restart

2 · Your file

  1. Make the file for your router

    Sign in at iphush.com/app, open Devices, add a Router and choose OpenWrt. The app makes IPHush.uci for your router and shows this guide with your own values filled in.

3 · Add the tunnel

  1. Copy the file to the router

    From your computer, in the folder where you saved it:

    scp -O IPHush.uci root@[router IP]:/tmp/
  2. Load it and delete the copy
    uci batch < /tmp/IPHush.uci
rm /tmp/IPHush.uci
service network reload
    In LuCI instead: Network → Interfaces → Add new interface → name IPHush, protocol WireGuard VPN → Load configuration… → IPHush.conf (the second download) → Save → Save & Apply.
  3. See the handshake

    A recent time (seconds). No handshake after a minute: check that the router has internet and that UDP 51900 is not blocked upstream.

    wg show IPHush latest-handshakes

4 · Choose who uses it

One device

Only the device you choose uses IPHush; the router and every other device keep your normal connection. Enter the device’s address above (give it a static lease in Network → DHCP and DNS so it keeps it).

  1. A routing table for IPHush and this device
  2. NAT out of IPHush (a firewall zone for it)
  3. DNS of this device to 10.96.0.1
  4. TCP MSS for MTU 1280
  5. IPv6: no leak
  6. Optional kill switch for this device

The whole network

Every device on the LAN and the router itself use IPHush. Do the steps in this order: step 1 must come before step 2, otherwise the tunnel’s own packets loop into the tunnel. Internet on the LAN pauses between steps 2 and 3 (seconds).

  1. Keep the IPHush server on your normal connection
  2. Default route through IPHush
  3. NAT out of IPHush (a firewall zone for it)
  4. DNS through IPHush
  5. TCP MSS for MTU 1280
  6. IPv6 · choice A (recommended): block IPv6 to your provider
  7. IPv6 · choice B: send IPv6 through IPHush instead of A
  8. Optional kill switch

5 · Check it works

  1. The tunnel is up

    A time under 2 minutes ago.

    wg show IPHush latest-handshakes
  2. Option 2: the router’s own exit

    Shows "iphush":true.

    uclient-fetch -qO- https://whoami.iphush.com/
  3. Check from a device

    On a device that should use IPHush, open https://whoami.iphush.com/ in a browser. It must show "iphush": true and an IPHush address. A device outside the option you chose shows false: that is expected.

OpenWrt VPN: questions

Which OpenWrt firmware works with IPHush?

OpenWrt 24.10 or newer.

Can the whole home go through IPHush on OpenWrt?

Every device on the LAN and the router itself use IPHush. Do the steps in this order: step 1 must come before step 2, otherwise the tunnel’s own packets loop into the tunnel. Internet on the LAN pauses between steps 2 and 3 (seconds).

Is there a kill switch on OpenWrt?

Your choice. With this rule the LAN can reach the internet only through IPHush: if IPHush is down or removed, devices have no internet until you remove this rule (first line of Remove everything). Without it, they fall back to your normal connection.

Which plan includes a router?

Family and Pro each include 1 router, and the router counts as one connection: every device behind it is protected. On Pro it leaves from your dedicated IP.

Has IPHush tested these steps on OpenWrt?

Yes. Our network team ran every block of this guide on a real router in our lab.

More routers

MikroTikGL.iNetASUSAsus-MerlinTP-LinkFRITZ!BoxUniFipfSenseOPNsenseAll 24 devicesDownload IPHush

Every device at home, one router

Family and Pro include a router and all 57 locations.

See plans