DD-WRT VPN Gateway | Chr0nicHacker

> DD-WRT VPN Gateway: Full-Network Privacy Using Surfshark

Posted by: ChronicHacker
GitHub Project: nighthawk-ddwrt-vpn-gateway

Encrypt every packet that leaves your home. Browser extensions won’t save you — but a VPN-powered router will.

VPN Gateway Diagram

> 🧰 Requirements

  • Netgear Nighthawk R6700v3 (or DD-WRT supported router)
  • Surfshark VPN subscription
  • ATT Modem/Router with IP Passthrough
  • DD-WRT firmware (latest stable)

> 🌐 Step 1: Avoid IP Conflict

ATT modems usually run 192.168.1.0/24. Change DD-WRT LAN IP:

  1. Setup > Basic Setup
  2. Router IP: e.g., 192.168.2.1
  3. Subnet mask: 255.255.255.0
  4. Local DNS: 0.0.0.0
  5. Save & Apply

> 📦 Step 2: Get VPN Config Files

  1. Surfshark Account > Manual Setup > OpenVPN
  2. Download server config (.ovpn)
  3. Extract server address & CA cert

> 🔧 Step 3: Configure OpenVPN Client

Services > VPN > Enable OpenVPN Client:

  • Server IP/Name: from .ovpn
  • Port: 1194
  • Tunnel Device: TUN
  • Protocol: UDP
  • Encryption Cipher: AES-256-CBC
  • Hash Algorithm: SHA512
  • User Pass Auth: Enable
  • Username/Password: Surfshark creds

Additional Config:

persist-key
persist-tun
tls-client
remote-cert-tls server
verb 3
auth-user-pass /tmp/openvpncl/userpass.conf

Certificates:

  • CA Cert: From <ca> section
  • Client Cert/Key: Leave blank

Apply Settings.

> 🛡️ Step 4: ATT IP Passthrough

  1. 192.168.1.254 > Firewall > IP Passthrough
  2. Allocation Mode: Passthrough
  3. Passthrough Mode: DHCPS-fixed
  4. MAC: your DD-WRT router
  5. Turn off 2.4GHz/5GHz WiFi
  6. Save & reboot

> 🚫 Step 5: Kill Switch + DNS Leak Protection

DNS Setup:

  • Static DNS: 162.252.172.57, 149.154.159.92
  • Enable DNSMasq
  • Disable Recursive DNS

Kill Switch:

iptables -I FORWARD -i br0 -o $(nvram get wan_iface) -j DROP

Save Startup.

> 🧪 Step 6: Verify Connection

  1. Status > OpenVPN: Look for CONNECTED SUCCESS
  2. Check VPN IP assigned
  3. Check packets
  • AUTH_FAILED: Wrong login
  • VERIFY ERROR: Certificate issue
  • TLS Error: Wrong server or port

> ✅ Final Test

> 🔗 Resources

You’ve just turned a consumer router into a full-network VPN gateway. Welcome to the encrypted elite.

— Chr0nicHacker

Scroll to Top