Proton VPN on OpenWrt With WireGuard | Voltarum OpenWRT buyers guide

Editorial independence: some VPN providers run affiliate programmes. We never rank or recommend a provider because of one; our guides cover providers by how well they work on OpenWrt.

Proton VPN lets you download WireGuard configuration files for routers from your account, which makes OpenWrt setup straightforward. The steps below reflect Proton's dashboard at the time of writing; menu names may change, so check Proton's own router instructions if something looks different.

1. Download a WireGuard configuration

Sign in to your Proton VPN account on the web.
Open Downloads and find WireGuard configuration.
Give the configuration a name, choose Router as the platform, and pick the server or country you want.
Download the .conf file. It contains your private key: keep it secret.

Each configuration is tied to one server. Create several if you want to switch locations.

2. Import it into OpenWrt

Follow our WireGuard client guide:

Create an interface named vpn with protocol WireGuard VPN and use Load configuration… to import the file.
Make sure Route Allowed IPs is enabled on the peer.
Create the vpn firewall zone with masquerading and allow forwarding from lan.

3. DNS

Proton's WireGuard configurations set a DNS server inside the tunnel (the DNS = line, usually 10.2.0.1). Use it on the vpn interface and disable the ISP's DNS on WAN, as shown in step 4 of the WireGuard guide. This prevents DNS leaks.

4. Optional: kill switch

By default, if the tunnel goes down, traffic leaves through your normal connection. To block it instead, set up a VPN kill switch.

Is the router fast enough?

Encryption runs on the router's CPU. Routers rated Good or Excellent for WireGuard on Voltarum OpenWRT buyers guide handle typical home connections. Measured results, where we have them, are on each router page.