Openwrt Openvpn Server Setup With Luci: Simple Guide

Setting up an OpenVPN server directly on your OpenWrt router gives you secure, encrypted access to your home network from anywhere in the world. Instead of running third-party software on a separate always-on computer, you turn your existing gateway into a secure tunnel endpoint. By using the LuCI web interface, you avoid the friction of configuring everything raw via the command line.

You can complete this entire configuration in under twenty minutes if your router has enough flash storage and free RAM to install the cryptographic packages. This walkthrough shows you how to install OpenVPN, generate keys and certificates, configure the LuCI interface, and adjust your firewall rules so your remote devices can securely reach your home local area network.

Prerequisites and Package Installation

Before you touch any configuration files, your OpenWrt router needs the core OpenVPN binary and the LuCI management app. Log into your router's web interface, navigate to System and select Software. Click Update lists to fetch the latest package repository index.

Once the package lists reload, search for and install these specific packages:

openvpn-openssl: The core OpenVPN daemon compiled with OpenSSL support for cryptographic operations.
luci-app-openssl: Integrates OpenVPN management directly into your LuCI dashboard tabs.
openvpn-easy-rsa: A command-line script wrapper to manage a Public Key Infrastructure (PKI) and generate certificates.

If your router runs low on space, check your available storage under Status -> Overview before installing. OpenVPN requires a few megabytes for binaries and cryptographic key generation.

Generating Server Certificates and Keys

OpenVPN relies on asymmetric cryptography to secure data streams. You need a Certificate Authority (CA), a server certificate, a private server key, and client certificates for every device that connects. While you can generate these on a separate Linux machine, you can also run easy-rsa directly on the router via SSH for a self-contained setup.

Access your router via terminal using SSH and initialize the PKI directory:

opkg update
opkg install openvpn-easy-rsa
make-cadir /etc/openvpn/easy-rsa
cd /etc/openvpn/easy-rsa

Initialize the variables file, build the CA, and generate the server and client credentials:

./easyrsa init-pki
./easyrsa build-ca nopass
./easyrsa gen-req server nopass
./easyrsa sign-req server server
./easyrsa gen-req client1 nopass
./easyrsa sign-req client client1
./easyrsa gen-dh
openvpn --genkey secret ta.key

Keep your private keys (pki/private/server.key and ta.key) secure and never expose them publicly.

Configuring OpenVPN via LuCI

With your certificates ready, switch back to the browser interface to define the VPN tunnel parameters. Go to VPN -> OpenVPN in LuCI. You will see a section to manage OpenVPN instances.

Create a new instance named home_vpn and open it for editing. Paste or configure the core directives required to establish a routed tunnel:

dev: tun
proto: udp (UDP port 1194 is standard and avoids TCP-over-TCP meltdown issues)
port: 1194
server: 10.8.0.0 255.255.255.0 (assigns virtual IPs to connecting clients)
ca: /etc/openvpn/easy-rsa/pki/ca.crt
cert: /etc/openvpn/easy-rsa/pki/issued/server.crt
key: /etc/openvpn/easy-rsa/pki/private/server.key
dh: /etc/openvpn/easy-rsa/pki/dh.pem
tls-auth: /etc/openvpn/easy-rsa/ta.key 0

Save your settings, but don't start the service just yet. You must configure the network interface and firewall first, otherwise incoming packets will drop.

Defining Network Interfaces and Firewall Zones

OpenWrt treats VPN tunnels as virtual network interfaces. You need to assign the new tun0 device to a dedicated interface and configure firewall forwarding rules so remote clients can communicate with local machines.

Go to Network -> Interfaces and click Add new interface:

Name: vpn_server
Protocol: Unmanaged
Device: tun (or tun0)

Click Create interface, ensure Bring up on boot is checked, and save.

💡 You might also like: Wireless Application Protocol: History, Architecture, and Mobile Evolution

Next, navigate to Network -> Firewall and add a new custom zone:

Name: vpn_zone
Input: Accept (or Reject if you want strict isolation, but Accept simplifies routing)
Output: Accept
Forward: Accept
Masquerading: Checked
Covered networks: Select vpn_server
Allow forward from source zones: Select lan

This rule allows connected VPN clients to query devices on your home subnet, such as a Network Attached Storage (NAS) drive or home automation server. Make sure to check official guidelines on OpenWrt Security to ensure your firewall rules don't expose unintended management ports to the wider internet.

Starting the Server and Connecting Clients

Return to VPN -> OpenVPN, check the Enabled box next to your home_vpn instance, and click Save & Apply. Click Start to bring the service online. Check the system log under Status -> Log if the service fails to start; common errors involve syntax typos in configuration paths or missing certificate files.

To connect from an external device, generate an .ovpn client profile containing the public IP address of your router, port 1194, the embedded CA certificate, and the client1.crt and client1.key credentials. Import this file into your client application, such as the official OpenVPN Connect app on your phone or laptop.

Common Mistakes to Avoid

Setting up a home VPN server involves moving parts that easily break if minor details are missed. Review these common pitfalls before troubleshooting:

Ignoring Port Forwarding: If your router sits behind a primary ISP modem or fiber gateway, you must configure port forwarding (UDP port 1194) on that upstream device to point directly to your OpenWrt router's WAN IP.
Overlooking Dynamic DNS: Most residential internet connections use dynamic public IP addresses. If your public IP changes, your client profiles will lose connection. Pair your setup with a Dynamic DNS client package like ddns-scripts supported by providers listed on Dynu or similar services.
Clock Drift: Routers without a hardware Real-Time Clock can lose accurate time upon reboot. If system time defaults to an old year, TLS certificate validation will fail instantly. Install ntpd or ensure your time syncs via NTP on startup.

Frequently Asked Questions

Can I run an OpenVPN server on a router with only 8MB of flash storage?

It's risky. While the core packages might fit, you will likely run out of space when generating keys or installing updates. It's better to use routers with at least 16MB of flash and 128MB of RAM for VPN workloads.

🔗 Read more: Wireless Access Point Setup:

Should I use OpenVPN or WireGuard on OpenWrt?

WireGuard is significantly faster, uses less CPU, and has a much smaller codebase. However, OpenVPN remains useful if your network restricts UDP traffic, because OpenVPN can easily be configured to wrap traffic over TCP port 443 to mimic normal HTTPS web navigation.

How do I revoke a lost client certificate?

If a device containing your client configuration profile is lost or stolen, use easy-rsa via SSH to run ./easyrsa revoke client1, generate a new revocation list with ./easyrsa gen-crl, and restart the OpenVPN service to block access immediately.

Why can my VPN client connect to the router, but not other devices on the LAN?

This usually happens because firewall inter-zone forwarding is blocked. Double-check that your firewall zone configuration allows forwarding traffic from the VPN zone to the LAN zone, and ensure your LAN devices use the router as their default gateway.