OpenWrt router

The router connects over WireGuard and counts as one device of your plan. You set it up once; later you change the country for the whole home from your account, without touching the router. You need OpenWrt 22.03 or newer and SSH access to the router.

Get the files

1. Sign in to your Tayra account, open Devices and choose Connect a device.
2. Choose Router (beta), the firmware OpenWrt and the Entry country (or leave Chosen by the service).
3. Tap Create the config and download both files: the setup script …-openwrt.sh and the .conf file. They have the private key of the router and are shown only once.

Run the script

Copy the script to the router and run it over SSH (put the name of your file instead of vpn-router-N-openwrt.sh):

opkg update
opkg install wireguard-tools luci-proto-wireguard
sh vpn-router-N-openwrt.sh

You can run the script again safely: it replaces the previous VPN settings.

Leak protection

The script protects the devices of the lan zone (your home network):

• The tunnel has its own zone vpn, and the home network reaches the internet only through it. If the tunnel does not work, home devices have no internet: they do not go out directly through your provider.
• IPv6 is not carried through the tunnel yet, so IPv6 from the home network is rejected. With working IPv6 from your provider, devices fall back to IPv4 through the VPN.
• DNS queries of home devices go to the VPN DNS through the tunnel, not to the DNS of your provider. Names of home devices such as *.lan do not resolve then.
• Only the router itself works directly through your provider: it connects to the entry server and looks up its address.

Other zones (for example a guest network) keep their own settings and are not protected. To remove the VPN and give the home network direct internet again: sh vpn-router-N-openwrt.sh remove.

Good to know

• The exit place of the router is changed in your account, in Places: the router keeps its config.
• If the entry server is not available, the router has no VPN until the server is back or you run a new script (New key and config in Devices).