OpenWRT (OpenVPN Setup from Config File)

This guide explains how to configure OpenVPN on a router running OpenWRT using a Private Internet Access (PIA) configuration file and the LuCI web interface.

Jump To…

Requirements

Step 1: Install the Required Packages

Step 2: Upload the PIA Configuration File

Step 3: Add Your PIA Credentials

Step 4: Start the VPN Connection

Step 5: Configure the Firewall

Step 6: Test the Connection

Requirements

To complete this setup, you need:

Step 1: Install the Required Packages

Before you can configure OpenVPN, you need to install two packages via LuCI.

  1. In LuCI, go to System > Software.
  2. Click Update lists to fetch the list of available packages.
  3. In the Filter field, search for “luci-app-openvpn” and click Install in the Available packages tab.
  4. Search for “openvpn-openssl “and click Install in the Available packages tab.

Once installed, a VPN menu will appear in LuCI.

Step 2: Upload the PIA Configuration File

  1. In LuCI, go to VPN > OpenVPN.
  2. Under OVPN configuration file upload, enter a name for the connection (for example, PIA_California) and upload your PIA .ovpn file.
  3. Click Browse and select the .ovpn file for the server location you want to use.
  4. Click Upload. The configuration will appear in the OpenVPN instances table above.

Step 3: Add Your PIA Credentials

  1. Click Edit next to the configuration you uploaded.
  2. In the section labelled Section to add an optional 'auth-user-pass' file with your credentials, enter your PIA username on the first line and your PIA password on the second line.
  3. Find the line beginning with auth-user-pass in the configuration text box and add the full path to the .auth file on the same line. The full path is shown just above the credentials text box and usually follows this format:
auth-user-pass /etc/openvpn/<config-name>.auth
  1. Click Save.

Step 4: Start the VPN Connection

  1. Go to VPN > OpenVPN.
  2. Click Start next to your PIA configuration in the OpenVPN instances table. Wait up to 10 seconds for the connection to start.

Note: If clicking Start does not work, tick the Enable checkbox first and click Save & Apply, then try again.

Step 5: Configure the Firewall

At this point the router can use the VPN, but devices connected to your router won't be able to access the internet yet. You need to assign the VPN interface to the WAN firewall zone.

  1. Go to Network > Interfaces.
  2. Click Add new Interface.
  3. Fill in the following details:
    • Name: OpenVPN
    • Protocol: Unmanaged
    • Interface: tun0
  4. Click Create Interface.
  5. In the General Settings tab, uncheck Bring up on boot.
  6. In the Firewall Settings tab, assign the firewall zone to wan.
  7. Click Save & Apply.
  8. Reboot the router.

Step 6: Test the Connection

Once connected, verify that your traffic is going through PIA by visiting ipleak.net or dnsleaktest.com from a device connected to your router. Your IP address should show a PIA server location, not your real IP address.

DNS not working? Go to Network > Interfaces > LAN, disable peer DNS, and enter a PIA DNS server address in the Use Custom DNS field.

Related articles