Route Selected Devices Through a VPN on OpenWrt

Sometimes you only want some traffic in the VPN: a TV that needs another country's catalogue, or a laptop, while games consoles and work calls use your normal connection. This is split tunnelling, and on OpenWrt the usual tool is the pbr (policy-based routing) package.

This assumes a working WireGuard client interface named vpn, as in our WireGuard client guide.

1. Stop routing everything through the VPN

By default the WireGuard peer installs a default route through the tunnel. Turn it off so traffic uses WAN unless a policy says otherwise:

uci set network.@wireguard_vpn[0].route_allowed_ips='0'
uci commit network
service network restart

Make sure the lan → wan forwarding exists in the firewall (it is removed if you set up a kill switch).

2. Install pbr

# OpenWrt 25.12 and later
apk update && apk add pbr luci-app-pbr

# OpenWrt 24.10 and earlier
opkg update && opkg install pbr luci-app-pbr

3. Add a policy

Give the device a fixed address first (Network → DHCP and DNS → Static Leases). Then, in LuCI under Services → Policy Routing, add a policy with the device's IP as Local addresses and vpn as the Interface. Over SSH:

uci add pbr policy
uci set pbr.@policy[-1].name='Living room TV'
uci set pbr.@policy[-1].src_addr='192.168.1.50'
uci set pbr.@policy[-1].interface='vpn'
uci set pbr.config.enabled='1'
uci commit pbr
service pbr restart

Policies can also match destinations (IP ranges or domain names), so you can route specific services through the VPN for every device.

4. Check it

service pbr status shows the active policies. On the TV, an IP-check site should show the VPN location; on other devices, your normal IP.

Notes

• pbr's options change between versions; LuCI shows the ones your version supports. The pbr documentation is the reference.
• Devices that use their own DNS (some TVs and phones do) may still resolve names outside the VPN.