AmneziaWG Installation on OpenWRT: How to Use NvoVPN

The installation of AmneziaWG on OpenWRT for connecting to NvoVPN involves preparing compatible packages, transferring configuration from the personal account, and setting up routing with the firewall. We recommend NvoVPN as a working solution for this connection: the service provides AmneziaWG configuration for compatible hardware. But first, check the support for your OpenWRT build — a regular WireGuard client for obfuscated connections is not enough.

Below is the setup order through the LuCI web interface and SSH. The names of the items are provided for the English interface of OpenWRT; they may differ in translations and custom builds. There is no universal installation script here: the AmneziaWG module must match the kernel of your specific router.

What is AmneziaWG and Its Advantages

AmneziaWG is a WireGuard-based protocol with obfuscation: it alters the recognizable features of the exchange that the provider's equipment can use to identify a VPN. Encryption protects the content of the connection, while obfuscation makes it difficult to classify the traffic itself.

VPN for the whole home

Connect every device at once

1. Download the NvoVPN app
2. Sign in with Google or email
3. Set up your router with our guide

Download for Windows Other devices →

• from 0.06 € a day
• card or crypto
• 14 servers online

Traffic Obfuscation

DPI analyzes the characteristics of network exchanges, not just the destination address. Therefore, the availability of a server does not necessarily mean that a regular VPN tunnel to it will work: the provider may restrict a specific protocol.

AmneziaWG changes the packet signatures and adds masking parameters. These parameters must match the server, so take them from the NvoVPN configuration, not from other instructions. Self-replacing obfuscation values can disrupt the connection even with the correct keys.

However, obfuscation does not guarantee access from any network. Blocking the server address, UDP restrictions, or allowed address modes by the mobile operator can hinder the connection.

Comparison with Other Protocols

In the NvoVPN apps, protocol switching is done automatically. A manual AmneziaWG tunnel on OpenWRT does not receive such switching: if it stops connecting, the router will not switch to VLESS/Reality by itself.

Advantages of Using NvoVPN

NvoVPN provides configuration for manual connection, traffic obfuscation, and modern encryption. Servers are available in Europe, Russia, the CIS, and the USA; choose the specific location based on the required access and the quality of your provider's route.

Setting up on the router is convenient for devices that cannot install the app. However, speed depends on the router's processor, the quality of internet access, and the route to the server — an expensive provider plan does not eliminate hardware limitations by itself.

Preparing for AmneziaWG Installation on OpenWRT

Hardware Requirements

Check the exact model and hardware revision of the router, the version of OpenWRT, the processor architecture, and free space. Support for OpenWRT does not necessarily mean the availability of a suitable AmneziaWG module: kernel packages are tied to a specific build.

In LuCI, system information can be found under "Status → Overview." For checking via SSH, the following commands will be useful:

ubus call system board
uname -r
df -h
free

If there is little free space or no compatible packages, stop before changing routes. Do not install a module from another kernel version while forcibly ignoring dependencies: this can lead to a non-working tunnel or an unstable system.

Downloading Necessary Files

In the NvoVPN personal account, open "Connection" → "Manually" and download the AmneziaWG configuration file. Keep it like a password: it contains the private key and connection data.

Check for the presence of sections [Interface] and [Peer]. For configuration, you will need the interface address, private key, server public key, connection address, allowed networks, as well as all issued obfuscation parameters. Transfer DNS and pre-agreed keys if they are present in the file.

Separately prepare packages for your OpenWRT build. Usually, the names used are amneziawg-tools, kmod-amneziawg and luci-proto-amneziawg, but their availability and content depend on the repository. Do not download a random archive just because it mentions your architecture in the name.

Setting up OpenWRT

1. Connect your computer to the router with a cable. Changing network settings may disrupt the wireless connection, and a wired connection will simplify recovery.

2. Open "System → Backup / Flash Firmware" and save a backup of the configuration. Do not publish the archive: it may contain network secrets.

3. Make sure the internet through WAN works without VPN. Check website loading and domain name resolution.

4. Check the date and time in "System → System". Proper time synchronization is needed for the correct operation of network services and diagnostics.

If suitable packages are only available for another supported version of OpenWRT, plan to update the firmware first. Use an image strictly for your model and revision, not for a similar device.

Step-by-step guide to installing AmneziaWG

When installing AmneziaWG on OpenWRT, it is easier to divide the work: first install protocol support, then create the interface, and only after that route your home network through it. This makes it easier to understand at which stage an error occurred.

Connecting to the router

1. Check the gateway address in the properties of your computer's network connection. Open this address in a browser to log into LuCI, or connect via SSH using the router's administrator account.

2. Determine the package manager. For builds with opkg update the package list with the command below; it does not update the firmware itself.

opkg update
opkg list | grep -i amnezia

If your build uses apk, apply its commands instead of installing a second package manager:

apk update
apk search amnezia

When the repository actually contains compatible packages with the specified names, install them with the corresponding command:

opkg install kmod-amneziawg amneziawg-tools luci-proto-amneziawg

Either for builds with apk:

apk add kmod-amneziawg amneziawg-tools luci-proto-amneziawg

If the search returns nothing, these commands will not fix the problem. A trusted source of packages for your build is needed, or switch to compatible firmware. After installation, refresh the LuCI page; if the package description requires a reboot, perform it before configuring the interface.

Loading configuration

In LuCI, open "Network → Interfaces → Add new interface". Set the name awg and select the AmneziaWG protocol. If it is not in the list, check the installation of the LuCI extension and module — do not choose regular WireGuard instead.

If the extension offers to import configuration, upload the NvoVPN file and check the filled fields. If there is no import, transfer the data manually according to the table. The labels of additional fields may differ between versions of the extension.

Do not ignore unknown parameters. If the file contains settings not present in the installed extension, compatibility has not yet been confirmed: a suitable version of the components will be needed. Simply deleting such lines may deprive the connection of necessary obfuscation or completely disrupt communication.

Next, configure traffic transmission:

1. In the node settings, enable "Route Allowed IPs" if you are using standard routing through networks from the configuration. For a full tunnel, the file must contain routes covering the required internet traffic; do not change them arbitrarily.

2. In "Network → Firewall," create a zone vpn and bind an interface to it awg. For a standard client scheme, allow outgoing traffic, block unsolicited incoming traffic, and enable masquerading for IPv4.

3. Allow redirection from the zone lan to vpn. Do not add reverse permission from the VPN to the home network without specific necessity.

4. Configure DNS from the configuration in the interface settings or the DNS redirection used. Ensure that client requests are indeed using the selected path and are not continuing to go directly to the provider.

5. Click "Save & Apply" and ensure that access to LuCI is preserved. Do not delete working access rules to the router while the tunnel is not verified.

The route to the NvoVPN server itself must remain through WAN. If the server address begins to route inside its own tunnel, the connection breaks. In a complex scheme with multiple gateways, check this separately.

Testing the connection

Open the interface status and check communication with the server. Use the following via SSH:

awg show
ip route show
ip -6 route show
logread | grep -i -e amnezia -e awg -e netifd

A successful handshake and increased transmission counters indicate that the tunnel is exchanging data. But this is not enough: from a device on the home network, check the external IP address, website accessibility, and domain name resolution.

Check IPv6 separately. If it is available directly through the provider, and the tunnel serves only IPv4, some connections may bypass the VPN. Configure IPv6 routing through the tunnel if supported by the configuration, or restrict direct IPv6 for the necessary clients.

Compare speed with a connection without VPN on the same device, preferably via cable. At the same time, monitor the router's CPU load: high load will help distinguish hardware limits from server or Wi-Fi issues.

Problems and solutions during installation

Connection errors

If the tunnel works through another internet access but not through the current provider, the reason may be network restrictions. The NvoVPN app offers automatic protocol selection, including VLESS/Reality; the manual OpenWRT profile does not replicate this feature.

Security settings

Do not open LuCI and SSH from the WAN side for VPN configuration. Do not send the full configuration file to support unless necessary: usually, the system version, error text, and log with removed keys are sufficient.

Check the behavior when the tunnel is disconnected. If LAN → WAN transition is allowed in the firewall, devices may continue to operate directly. To prohibit such access, configure the restriction separately, keeping the router's access to the server and management capability from the local network.

And do not confuse the tunnel with complete anonymity. Authorization on websites, cookies, and browser settings continue to affect the information received by the visited service.

Firmware update

Updating OpenWRT is necessary when the current build is unsupported, contains incompatible components, or a suitable module cannot be obtained for it. A mass package update does not replace a proper firmware update.

Before flashing, back up and configure NvoVPN, and study the recovery method for your model. After the update, recheck the AmneziaWG packages: old kernel modules may be incompatible, even if the interface settings are preserved.

Conclusion and recommendations

Advantages of using NvoVPN

NvoVPN is recommended for connecting a home network via AmneziaWG: the configuration is taken from the personal account, and devices use the router's tunnel without separate applications. The main check before paying for a long period is the compatibility of OpenWRT and the functionality of the connection with your provider.

Before connecting, check the router's compatibility with AmneziaWG. Refunds are possible if the service does not work due to NvoVPN's fault and support does not resolve the issue within 3 working days. There is no free trial period.

Comparison with other VPNs

For routers, it is more useful to compare not advertising promises but the availability of the required configuration, support for obfuscation, and the ability to diagnose. Ordinary compatibility with WireGuard does not equal support for AmneziaWG — this is a fundamental difference when choosing a connection for a network with DPI.

A strong point of NvoVPN is the combination of AmneziaWG for manual configuration and VLESS/Reality in applications with automatic switching. The limitation is also specific: installing AmneziaWG on OpenWRT does not transfer all application functions to the router.

Where to get support

Contact support through the NvoVPN website, specifying the router model, OpenWRT version, installed packages, and handshake status. Attach a cleaned error log and clarify whether the same access works through the app on another device.

To check on your network connect to NvoVPN, obtain the configuration in your personal account, and start by checking the router's compatibility.