[OPEN CALL 📣] Bring NymVPN to OpenWRT!

alu2a · December 29, 2025, 7:35am

So I have disabled AdGuard Home, and tried again to connect the nym vpn on openwrt: still the same issue, it connect but I don t have internet on the device connected to the router.

Here is the requested log

root@OpenWrt:~# nft list ruleset | grep -B5 -A5 nym
        chain _reject {
                iifname != "eth1" meta l4proto tcp reject with tcp reset
                reject with icmpx host-unreachable
        }
}
table inet nym {
        chain prerouting {
                type filter hook prerouting priority -199; policy accept;
                iif "nym-entry" iif "nym-exit" ct mark 0x00000f42 meta mark set 0x0000014d
                ip saddr 62.210.91.229 tcp sport 9000 meta mark set 0x0000014d
                ip saddr 62.210.91.229 tcp sport 9001 meta mark set 0x0000014d
                ip saddr 62.210.91.229 udp sport 51822 meta mark set 0x0000014d
        }

--
                ip6 daddr fe80::/10 icmpv6 type nd-neighbor-solicit icmpv6 code 0 accept
                ip6 daddr fe80::/10 icmpv6 type nd-neighbor-advert icmpv6 code 0 accept
                ip daddr 62.210.91.229 tcp dport 9000 meta mark 0x0000014d accept
                ip daddr 62.210.91.229 tcp dport 9001 meta mark 0x0000014d accept
                ip daddr 62.210.91.229 udp dport 51822 meta mark 0x0000014d accept
                oif "nym-exit" udp dport 53 ip daddr 9.9.9.9 accept
                oif "nym-exit" tcp dport 53 ip daddr 9.9.9.9 accept
                oif "nym-exit" udp dport 53 ip daddr 149.112.112.112 accept
                oif "nym-exit" tcp dport 53 ip daddr 149.112.112.112 accept
                oif "nym-exit" udp dport 53 ip daddr 1.1.1.1 accept
                oif "nym-exit" tcp dport 53 ip daddr 1.1.1.1 accept
                oif "nym-exit" udp dport 53 ip daddr 1.0.0.1 accept
                oif "nym-exit" tcp dport 53 ip daddr 1.0.0.1 accept
                udp dport 53 reject
                tcp dport 53 reject with tcp reset
                oif "nym-entry" accept
                oif "nym-exit" accept
                ip daddr 10.0.0.0/8 accept
                ip daddr 172.16.0.0/12 accept
                ip daddr 192.168.0.0/16 accept
                ip daddr 169.254.0.0/16 accept
                ip6 daddr fe80::/10 accept
--
                ip6 saddr fe80::/10 icmpv6 type nd-neighbor-solicit icmpv6 code 0 accept
                icmpv6 type nd-neighbor-advert icmpv6 code 0 accept
                ip saddr 62.210.91.229 tcp sport 9000 ct state established accept
                ip saddr 62.210.91.229 tcp sport 9001 ct state established accept
                ip saddr 62.210.91.229 udp sport 51822 ct state established accept
                iif "nym-entry" accept
                ip daddr 10.1.14.38 drop
                iif "nym-exit" accept
                ip daddr 10.1.240.250 drop
                ip saddr 10.0.0.0/8 accept
                ip saddr 172.16.0.0/12 accept
                ip saddr 192.168.0.0/16 accept
                ip saddr 169.254.0.0/16 accept
--
                ip6 daddr ff02::1:ff00:0/104 icmpv6 type nd-neighbor-solicit icmpv6 code 0 accept
                ip6 daddr fe80::/10 icmpv6 type nd-neighbor-solicit icmpv6 code 0 accept
                ip6 saddr fe80::/10 icmpv6 type nd-neighbor-solicit icmpv6 code 0 accept
                ip6 daddr fe80::/10 icmpv6 type nd-neighbor-advert icmpv6 code 0 accept
                icmpv6 type nd-neighbor-advert icmpv6 code 0 accept
                oif "nym-exit" udp dport 53 ip daddr 9.9.9.9 accept
                oif "nym-exit" tcp dport 53 ip daddr 9.9.9.9 accept
                oif "nym-exit" udp dport 53 ip daddr 149.112.112.112 accept
                oif "nym-exit" tcp dport 53 ip daddr 149.112.112.112 accept
                oif "nym-exit" udp dport 53 ip daddr 1.1.1.1 accept
                oif "nym-exit" tcp dport 53 ip daddr 1.1.1.1 accept
                oif "nym-exit" udp dport 53 ip daddr 1.0.0.1 accept
                oif "nym-exit" tcp dport 53 ip daddr 1.0.0.1 accept
                udp dport 53 reject
                tcp dport 53 reject with tcp reset
                oif "nym-entry" accept
                iif "nym-entry" ct state established accept
                oif "nym-exit" accept
                iif "nym-exit" ct state established accept
                ip daddr 10.0.0.0/8 accept
                ip daddr 172.16.0.0/12 accept
                ip daddr 192.168.0.0/16 accept
                ip daddr 169.254.0.0/16 accept
                ip6 daddr fe80::/10 accept
--
                reject
        }

        chain mangle {
                type route hook output priority mangle; policy accept;
                oif "nym-entry" udp dport 53 ip daddr 9.9.9.9 accept
                oif "nym-entry" tcp dport 53 ip daddr 9.9.9.9 accept
                oif "nym-exit" udp dport 53 ip daddr 9.9.9.9 accept
                oif "nym-exit" tcp dport 53 ip daddr 9.9.9.9 accept
                oif "nym-entry" udp dport 53 ip daddr 149.112.112.112 accept
                oif "nym-entry" tcp dport 53 ip daddr 149.112.112.112 accept
                oif "nym-exit" udp dport 53 ip daddr 149.112.112.112 accept
                oif "nym-exit" tcp dport 53 ip daddr 149.112.112.112 accept
                oif "nym-entry" udp dport 53 ip daddr 1.1.1.1 accept
                oif "nym-entry" tcp dport 53 ip daddr 1.1.1.1 accept
                oif "nym-exit" udp dport 53 ip daddr 1.1.1.1 accept
                oif "nym-exit" tcp dport 53 ip daddr 1.1.1.1 accept
                oif "nym-entry" udp dport 53 ip daddr 1.0.0.1 accept
                oif "nym-entry" tcp dport 53 ip daddr 1.0.0.1 accept
                oif "nym-exit" udp dport 53 ip daddr 1.0.0.1 accept
                oif "nym-exit" tcp dport 53 ip daddr 1.0.0.1 accept
                meta cgroup 5087042 ct mark set 0x00000f42 meta mark set 0x0000014d
        }

        chain nat {
                type nat hook postrouting priority srcnat; policy accept;
                oif "nym-entry" oif "nym-exit" ct mark 0x00000f42 drop
                oif != "lo" ct mark 0x00000f42 masquerade
        }
}

jul8mbq9 · December 29, 2025, 8:55am

There is now the problem, when i hit to connect, the system is not responsible anymore, no more internet at the clients, and i cant access the router, neither ssh nor webpage. So i cant get a log, because after reboot there are no logs anymore just from beginnig of the actual boot.

alu2a · December 29, 2025, 8:57am

you should set
allow_lan: true
Like this even if you loose connection, you can still go on the router gui page and disable nym vpn

jul8mbq9 · December 29, 2025, 9:30am

thanks for the advice. I do have allow_lan all the time… But I dont get access after connecting.

jul8mbq9 · December 29, 2025, 9:32am

Here is a log. I created until I shutdown the system. The log starts just before storing account infos etc. (thats another bug. After reboot the account information is gone)

Is there away to attach a file? Log is too long for texting

salazar · December 29, 2025, 12:10pm

You can post links to text files here, it should work

jul8mbq9 · December 29, 2025, 12:39pm

code-zm · December 29, 2025, 1:00pm

I’ll look into this later today. Thanks for posting logs

code-zm · December 29, 2025, 1:00pm

Will get on this in the evening, thank you

moejoe · December 29, 2025, 5:38pm

on an glinet router (GL-MT300N-V2), do i have to remove the glinet components first or could they work each by each without errors.
how do i have to write down the login seed with placeholder or not etc.

regards

moejoe · December 29, 2025, 6:05pm

Device: GL-MT300N-V2
Firmware: Glinet 4.3.25 based on OpenWrt 22.03.4 r20123-38ccc47687
**Other :**Expanded with extroot/usbstick.

I cannot edit my post.

so i write an reply. after install everything,
i got an error if i open the webif on the bottom:
Network: Error: Failed to create RPC client Caused by: 0: transport error 1: No such file or directory (os error 2) 2: No such file or directory (os error 2)

so what does that mean ?

~~regards~~

code-zm · December 30, 2025, 12:49am

I’ve seen this error myself a few times. This happens in 2 cases: when you aren’t running the app as root user, or if the daemon is not started / broken. To check the status of the daemon you can use the ‘Service Management’ menu in the LuCI app or via command line with:

/etc/init.d/nym-vpnd status

This should return running. If you get anything else restart the daemon.

/etc/init.d/nym-vpnd restart

Also, make sure you have all dependencies:

opkg update
opkg install kmod-wireguard wireguard-tools kmod-tun

If it still doesn’t work, share the output of logread and I can look into it for you

moejoe · December 30, 2025, 9:27am

Hello @code-zm

ok the service was always running and the deps are also on the system, so no issue at that point.

here is the logread:

regards

code-zm · December 30, 2025, 11:07pm

Looks like the service needs a restart, it’s in a crash loop per your logs:

Tue Dec 30 10:09:33 2025 daemon.info procd: Instance nym-vpnd::instance1 s in a crash loop 6 crashes, 0 seconds since last crash

Try a fresh install, may fix things.

opkg remove nym-vpn

opkg install nym-vpn*.ipk

code-zm · December 30, 2025, 11:11pm

Thanks for the logs, good news is that it’s successfully connecting.

As far as account persistence, it should get stored on your device when you first log in. Maybe some odd bug from having installed it a few times.

I recommend a fresh install. Before you connect, make sure you save the allow_lan setting via LuCI interface.

Run:

opkg remove nym-vpn

opkg install nym-vpn*.ipk

code-zm · December 31, 2025, 12:05am

Just picked up a GL.inet sft1200 to test it, getting the same error you describe here. Looking into it!

alu2a · December 31, 2025, 7:52am

any news on this?

Context:
I have successfully installed the ipk on the router.
the interface says I m connected to nym network, but in reality, none of the device behind the router has internet access.

moejoe · December 31, 2025, 8:45am

I have also an glinet sft 1200
But these router asfaik uses an other chip not mediatek, so for not getting more compatibility problems i choose my GL-MT300N-V2 for testing

Regards

moejoe · December 31, 2025, 12:17pm

Hello @alu2a

Does the other wg interface works ?
Is it an specific one which refers to an other vpn provider software ?
Or just an defualt openwrt one

U could also try to create an firewall rule for accept icmp for testing ping from ir Computer to an website.
I had an forwarding service from my recent provider and i had to open some ports also for forward, but im not confident enough if its the same issue part.

regards

code-zm · December 31, 2025, 2:00pm

What version of OpenWRT does the MT300 run?

After looking further into the error, I discovered that OpenWRT 18 (what the SFT1200 is based on) uses iptables by default as it’s firewall, whereas OpenWRT 22+ uses nftables as the default. The VPN app uses the nft rust crate, so installing nftables seemed to fix it. Getting a new error now that I need to look further into today. Something with the bandwidth controller.

Try installing nftables and see if this fixes it!

Apologies for this taking so long to get resolved, I’m working full time at my job and doing this in my free time.

opkg update
opkg install nftables kmod-nft-core kmod-nft-nat firewall4