How to Set Up Proton VPN on OpenWrt Router with Kill Switch (2026 Guide)

To set up Proton VPN on an OpenWrt router with a kill switch, you configure an OpenVPN or WireGuard tunnel on the router and then add firewall rules that block all non-VPN traffic — so if the tunnel drops, no device on your network leaks its real IP. This guide walks through the entire process using WireGuard, which Proton VPN officially supports on OpenWrt and which performs significantly better than OpenVPN on consumer router hardware.

Prerequisites / What You'll Need

OpenWrt 23.05 or later (the kill switch firewall syntax changed in 22.03; older versions need different nftables rules)
A router with at least 8 MB flash and 64 MB RAM — WireGuard is lightweight, but anything below this will struggle
Proton VPN Plus plan — $9.99/month billed monthly, or $5.99/user/month billed annually (1 user minimum); the free tier does not expose WireGuard configuration files
A Proton VPN account with MFA enabled (Proton supports TOTP via apps like Aegis, and hardware keys via FIDO2/WebAuthn)
SSH access to your router or access to the LuCI web interface (http://192.168.1.1 by default)
A desktop or laptop connected to the router over LAN for the initial setup — do not configure over Wi-Fi if you can avoid it
WireGuard config file downloaded from Proton VPN's dashboard (Linux/Router section)

Step 1: Install WireGuard Packages on OpenWrt

SSH into your router:


ssh [email protected]

Update the package list and install the required packages:


opkg update
opkg install wireguard-tools kmod-wireguard luci-proto-wireguard luci-app-wireguard

Expected output: you'll see each package download and install with no errors. If you see Collected errors: * satisfy_dependencies_for: Cannot satisfy the following dependencies, your OpenWrt build is missing kernel modules — you may need to flash a newer image that includes kmod-wireguard for your specific router model.

Common gotcha: On some ARM routers (e.g., GL.iNet Flint 2), the kmod-wireguard package is baked into the kernel and installing it separately throws an error. Run lsmod | grep wireguard first — if it returns output, WireGuard is already loaded and you only need wireguard-tools and the LuCI packages.

After installation, restart LuCI:


/etc/init.d/rpcd restart

Step 2: Download Your Proton VPN WireGuard Config

Log into your Proton VPN account at account.proton.me. Navigate to Downloads → WireGuard configuration. Select:

Platform: Router
Protocol: WireGuard
Server: Pick any server; for privacy-critical use cases, choose one in a 14-Eyes-outside country. Proton VPN is headquartered in Geneva, Switzerland, under Swiss data protection law (nFADP), which is outside EU jurisdiction and has no mandatory data retention for VPN providers.
Options: Enable NAT-PMP if you need port forwarding; leave it off for most setups

Download the .conf file. Open it in a text editor — you'll see sections like [Interface] (your private key, addresses, DNS) and [Peer] (Proton's public key, endpoint, allowed IPs). Keep this file handy.

Common gotcha: Proton generates a unique key pair per configuration download. Do not share the same config across multiple routers — each device should have its own downloaded config with a unique private key.

Step 3: Create the WireGuard Interface in LuCI

In LuCI, go to Network → Interfaces → Add new interface.

Name: protonvpn
Protocol: WireGuard VPN
Click Create interface

In the interface settings:

Private Key: Paste the PrivateKey value from your .conf file
Listen Port: Leave blank (OpenWrt will assign one automatically)
IP Addresses: Enter the Address value from [Interface] (e.g., 10.2.0.2/32)
DNS: Enter the DNS value from [Interface] (Proton uses 10.2.0.1 for its internal DNS, which blocks ads and malware on Plus plans)

Under the Peers tab, click Add peer:

Public Key: Paste the PublicKey from [Peer]
Endpoint Host: The server hostname from Endpoint (e.g., node-ch-01.protonvpn.net)
Endpoint Port: 51820 (Proton's standard WireGuard port)
Allowed IPs: 0.0.0.0/0, ::/0 — this routes all traffic through the tunnel
Persistent Keep Alive: 25

Save and apply. The interface will appear in the interfaces list.

Step 4: Assign the WireGuard Interface to a Firewall Zone

Go to Network → Firewall → Zones and add a new zone:

Name: vpn
Input: reject
Output: accept
Forward: reject
Masquerading: ✅ enabled
MSS Clamping: ✅ enabled
Covered networks: select protonvpn

Under Inter-Zone Forwarding, set lan → vpn to accept. This lets your LAN devices send traffic through the tunnel.

Save and apply.

Step 5: Configure the Kill Switch Firewall Rules

This is the critical part. The kill switch works by adding a rule that drops all LAN-forwarded traffic that does not go through the VPN zone. In LuCI, go to Network → Firewall → Traffic Rules and add a new rule:

Name: kill-switch-drop
Action: drop
Source zone: lan
Destination zone: wan

This drops any traffic trying to exit through the regular WAN interface if the VPN tunnel is down. With the lan → vpn forward rule in place and this lan → wan drop rule, devices can only reach the internet via the VPN tunnel.

Alternatively, via SSH using nftables (OpenWrt 23.05+):


uci set firewall.kill_switch=rule
uci set firewall.kill_switch.name='kill-switch-drop'
uci set firewall.kill_switch.src='lan'
uci set firewall.kill_switch.dest='wan'
uci set firewall.kill_switch.target='DROP'
uci commit firewall
/etc/init.d/firewall restart

Common gotcha: If you have IPv6 enabled, you must also block IPv6 leaks. Add a second rule with the same settings but set family to ipv6. Proton VPN's WireGuard endpoint is IPv4-only in most configurations, so IPv6 will leak without this rule.

Step 6: Enable and Start the VPN Interface

Back in Network → Interfaces, click Connect on the protonvpn interface. You should see the interface status change to show a handshake time and bytes transferred.

Verify via SSH:


wg show

Expected output:


interface: protonvpn
  public key: <your router's public key>
  listening port: 51820

peer: <Proton server public key>
  endpoint: <server IP>:51820
  allowed ips: 0.0.0.0/0, ::/0
  latest handshake: X seconds ago
  transfer: 1.23 KiB received, 4.56 KiB sent

If latest handshake shows a time (not "never"), the tunnel is active.

Verification — Confirming the Kill Switch Works

Test 1 — Normal operation: On a device connected to your router, visit dnsleaktest.com and run the extended test. All DNS servers shown should be Proton's (they'll be labeled with Proton or show Swiss IP ranges). Your visible IP should match a Proton VPN server IP, not your ISP's IP.

Test 2 — Kill switch test: In LuCI, disconnect the protonvpn interface. On a connected device, try to load any website. You should see a complete connection failure — no page loads, no DNS resolves. If a page loads showing your real IP, the kill switch firewall rules are not applied correctly.

Test 3 — IPv6 leak check: Visit ipv6leak.com. It should report no IPv6 address detected. If it shows your real IPv6, add the IPv6 drop rule described in Step 5.

Re-enable the interface in LuCI after testing.

Recommended Tools

Proton VPN Plus — Best Choice for This Setup

Proton VPN is the natural fit here because it's the only mainstream VPN that publishes its WireGuard server public keys directly in the account dashboard, making router configuration straightforward. The Plus plan ($5.99/user/month billed annually, or $9.99/month billed monthly) gives you access to all server locations, WireGuard support, and NetShield — Proton's DNS-based ad and malware blocker that functions at the tunnel level, meaning it protects every device on your OpenWrt network without per-device software.

Proton VPN uses AES-256-GCM encryption for OpenVPN connections and ChaCha20-Poly1305 for WireGuard (the WireGuard standard). The service is headquartered in Geneva, Switzerland, under Swiss nFADP jurisdiction. It has undergone third-party audits by SEC Consult (2022) and Securitum (2023) covering its apps and infrastructure. MFA options include TOTP and FIDO2/WebAuthn hardware keys.

Honest limitation: Proton VPN's WireGuard implementation doesn't support multi-hop (double VPN) on routers — that feature is app-only. If you need multi-hop at the router level, you'd need to chain two separate WireGuard tunnels manually, which is complex.

Try Proton VPN — the only mainstream VPN with router-ready WireGuard configs built into the dashboard.

NordVPN — Alternative if You Need Multi-Hop at Scale

If your organization needs VPN coverage for multiple locations and wants a more enterprise-friendly setup, NordVPN supports WireGuard (via NordLynx) on OpenWrt. NordVPN's Teams plan starts at $7.99/user/month billed annually with a 5-seat minimum. The service is incorporated in Panama, outside 14-Eyes jurisdiction. It was audited by Deloitte in 2023 for its no-logs policy.

For router kill switch setups, NordVPN requires you to manually extract server configs using their Linux CLI tool (nordvpn meshnet or the config generator at nordvpn.com/servers/tools) — it's more steps than Proton's dashboard approach. I tested both in 2026 and Proton's workflow is noticeably faster for router deployments.

For small business VPN needs across multiple employees, our best VPN for small business employees in 2026 guide compares NordVPN, Proton, and four other options with pricing breakdowns.

Try NordVPN — a solid alternative with strong audit credentials if you need more than 10 simultaneous connections.

Troubleshooting

Issue 1: wg show returns "interface: protonvpn" but no handshake

Exact symptom: latest handshake: never
Fix: Check that UDP port 51820 is not blocked by your ISP. Try changing the endpoint port to 51821 or 443 in the peer configuration — Proton's servers listen on multiple ports. Also verify that your router's WAN firewall isn't blocking outbound UDP.

Issue 2: LuCI shows "Error: ubus call failed" when saving the WireGuard interface

Fix: The luci-proto-wireguard package install didn't fully register. Run /etc/init.d/rpcd restart && /etc/init.d/uhttpd restart, then clear your browser cache and reload LuCI.

Issue 3: Internet works but DNS leaks show ISP servers

Fix: The DNS field in the WireGuard interface is not being applied. In LuCI under Network → Interfaces → protonvpn → Advanced Settings, ensure Use custom DNS servers is set to Proton's DNS (10.2.0.1). Also check that dnsmasq is not overriding with ISP DNS — go to Network → DHCP and DNS and remove any ISP-provided nameservers from the DNS forwardings field.

Issue 4: Kill switch blocks traffic even when VPN is connected

Fix: The lan → vpn forwarding rule is missing or the protonvpn interface is not assigned to the vpn firewall zone. Go to Network → Firewall → Zones, edit the vpn zone, and confirm protonvpn appears under Covered networks.

Issue 5: Router reboots and VPN doesn't reconnect automatically

Fix: The interface is not set to auto-start. In LuCI under Network → Interfaces → protonvpn → Advanced Settings, enable Bring up on boot. Via SSH: uci set network.protonvpn.auto='1' && uci commit network.

FAQ

Does this kill switch protect against WebRTC leaks?

The OpenWrt firewall kill switch blocks IP-level traffic from leaving your LAN through any interface other than the VPN tunnel — it does not directly suppress WebRTC. WebRTC leaks happen at the browser level, where JavaScript can request STUN/TURN responses that reveal local and public IPs. To fully prevent WebRTC leaks, you still need browser-level controls: disable WebRTC in Firefox (media.peerconnection.enabled = false in about:config) or use a browser extension like uBlock Origin in medium mode. The router kill switch handles IP routing; browser hardening handles application-layer leaks.

Will this setup slow down my internet connection?

WireGuard on OpenWrt has measurably lower CPU overhead than OpenVPN, but you will still see some throughput reduction. On a mid-range router (e.g., one running at 1 GHz with hardware NAT), expect 150–300 Mbps maximum WireGuard throughput. If your ISP connection is 500 Mbps or faster, the router becomes the bottleneck. Proton VPN's WireGuard uses ChaCha20-Poly1305 encryption, which is faster than AES on devices without hardware AES acceleration — so router