Google Nest Wifi (all generations), Google Wifi, and Nest Wifi Pro run Google's proprietary firmware and do not support running a VPN client directly on the device. Windscribe does not support flashing Google mesh hardware as a setup path.
There are two practical approaches for routing traffic through Windscribe on a Google mesh network:
Figure 1: The two approaches side by side — what each one covers, and what it costs you.
The VPN router sits between your modem and the Google mesh system. Traffic flows in this order:
Device → Google mesh node → VPN router → Windscribe server → Internet
Manual OpenVPN and WireGuard configs do not include the Windscribe app's built-in protections. Before proceeding, be aware:
If the VPN tunnel drops and your router is not configured to block non-VPN traffic, your traffic will fall back to the regular WAN connection without any warning. See the Kill Switch section in Troubleshooting.
Figure 2: Where the VPN router sits, which devices end up inside the tunnel, and the order to power everything on.
.conf file..ovpn file. Then select Get Credentials separately and note the generated OpenVPN username and password. These are separate from your main Windscribe login.Install WireGuard packages
192.168.1.1.luci-proto-wireguard, wireguard-tools, and kmod-wireguard. Reboot after installation.Create the interface
windscribe) and set the protocol to WireGuard VPN. Click Create Interface.Read the config file
Open the downloaded .conf file in a plain text editor. It will contain values in this form:
[Interface] PrivateKey = <your_private_key> Address = <your_vpn_tunnel_ip> DNS = <dns_server>[Peer] PublicKey = <server_public_key> PresharedKey = <preshared_key> AllowedIPs = <allowed_ip_ranges> Endpoint = <server_hostname>:<port>
PresharedKey is present in some Windscribe configs and absent in others. Paste it if it appears in your file; leave the field blank if it does not. Treat every generated value, including AllowedIPs, as authoritative for that config.
Figure 3: The same seven generated config values mapped into OpenWrt LuCI and DD-WRT. Copy AllowedIPs exactly from your file, and do not add an IPv6 route unless the config provides a working IPv6 tunnel.
General Settings tab
PrivateKeyAddressAdvanced Settings tab
DNS. Without this, DNS queries may not route through the VPN tunnel.Peers tab
Click Add Peer and enter:
PublicKey under [Peer]PresharedKey if present in the config file; leave blank if absentAllowedIPsEndpointEndpoint25Click Save.
Firewall and routing
Go to Network > Firewall and configure the WireGuard interface so that LAN traffic can forward to it and masquerading is enabled on the VPN egress. The cleanest approach is a dedicated VPN firewall zone. Assigning the interface to the existing WAN zone can also work, but behavior varies by OpenWrt version and configuration.
On most OpenWrt versions, WireGuard handles routing automatically via route_allowed_ips. Check Network > Routing to confirm routes matching the generated AllowedIPs values are present on the WireGuard interface. If they are absent and you add routes manually, confirm they do not conflict with an existing default WAN route.
Click Save & Apply.
Windscribe has two current DD-WRT WireGuard guides. Use the recommended guide if your DD-WRT build supports config import; use the manual guide for older builds or if you prefer entering values by hand:
The steps below reflect the general flow of the manual method.
192.168.1.1..conf file using the import option if your build supports it, or enter values manually from the config:
PrivateKeyAddressDNS[Peer]:
PublicKeyPresharedKey if presentEndpointAllowedIPs25If your DD-WRT build does not include WireGuard support, use OpenVPN and consult the Windscribe Help Center rather than following an outdated DD-WRT OpenVPN guide.
Placing the Google mesh system behind another router creates double NAT: two layers of Network Address Translation. For most activities, this causes no issues. It can cause problems with games, VoIP, and services that require port forwarding.
If you are using a single Google Wifi device with no additional mesh points:
Bridge mode is available but not recommended by Google as a first-choice configuration. To enable it:
With bridge mode active, the Google unit acts as a pass-through access point. NAT and DHCP for the downstream Google network are handled by the upstream VPN router.
If you are using multiple Google mesh points:
Do not put the primary node in bridge mode. Enabling bridge mode on the primary point in a multi-node setup disables mesh functionality and drops several Google Nest Wifi features. Instead:
Figure 4: Whether to use bridge mode depends on how many Google Wifi devices you have and whether your ISP device is also doing NAT. The diagram includes the final Save step and the Pro-only and Static IP port-forwarding boundaries.
This guide configures IPv4 routing through Windscribe. If your router or Google network is also passing IPv6 traffic and that traffic is not routed through the tunnel, it will bypass the VPN and reveal your real IP address on IPv6-capable sites.
To prevent this:
Run all three checks after setup is complete.
Install Windscribe directly on each device. This requires no router changes but must be set up individually on every device.
Download at windscribe.com/download.
The desktop and mobile apps include Windscribe's built-in Firewall, which blocks all traffic if the VPN tunnel drops unexpectedly. This protection is not available in the browser extension.
VPN is active but the IP address has not changed: Confirm the VPN tunnel is active and routing traffic. On OpenWrt, check Network > Routing for routes matching the generated AllowedIPs values on the WireGuard interface; WireGuard usually adds them automatically via route_allowed_ips. On DD-WRT, check the connection status under Status > WireGuard or Status > OpenVPN.
Kill switch: configuring fail-closed behavior: Without the Windscribe app's Firewall, the VPN router must be manually configured to block non-tunnel traffic. The exact approach varies by firmware and is outside the scope of this guide. Consult your router platform's documentation for fail-closed VPN firewall configuration. If Windscribe publishes a kill switch guide for your firmware, follow that instead of generic firewall rules.
Slow speeds: WireGuard delivers faster throughput than OpenVPN in most cases and is preferred where supported. If using OpenVPN over TCP, switch to UDP. Choose a Windscribe server geographically close to your location. Also check the VPN router's CPU usage: older consumer hardware can bottleneck VPN throughput regardless of connection speed.
DNS leaks: Set the DNS server on the VPN interface to the value in the DNS field of the Windscribe config file. If ISP DNS servers still appear in a leak test, confirm the VPN router is pushing Windscribe DNS through the tunnel and that the Google mesh system is using the VPN router as its upstream DNS, not your ISP's gateway. If the generated config does not provide a working IPv6 tunnel, disable IPv6 because IPv6 DNS requests may still reach your ISP.
Double NAT causes problems with games, VoIP, or port forwarding: Configure port forwarding on both the VPN router and the Google mesh router for local network traffic. If you also need inbound traffic to reach a service through the VPN tunnel itself, local router forwards alone will not accomplish this: you must also configure port forwarding within Windscribe. Ephemeral port forwarding is Pro-only. Permanent port forwarding requires a purchased Static IP. See the port forwarding section in your Windscribe account or documentation for setup details. If using a single Google Wifi device, consider enabling bridge mode as described in Part 4. If your ISP modem is also doing NAT, bridge the ISP device first.
WireGuard tunnel drops during idle periods: Confirm Persistent Keep Alive is set to 25 seconds in the peer configuration.
OpenVPN authentication failure: Confirm you are using the Windscribe OpenVPN credentials obtained with Get Credentials from the OpenVPN Config Generator, not your main account login. Re-download the .ovpn config file if the issue persists.
Devices on the Google network cannot reach the internet after setup: Reboot in order: modem first, VPN router second, Google mesh primary node third. Wait 30 to 60 seconds between each device before powering on the next. On OpenWrt, verify the WireGuard interface firewall zone is correctly configured for VPN forwarding and masquerading. Re-download the config file from the Windscribe Config Generator to rule out a stale or malformed config.
App connects but speeds are slow: Switch to a Windscribe server geographically closer to your location. On mobile, switch from a cellular connection to Wi-Fi or vice versa to rule out network-side throttling. On desktop, check whether another application is consuming bandwidth in the background.
Windscribe Firewall is blocking all traffic after disconnecting: The Windscribe app's Firewall is designed to block all traffic when the VPN is not active. To restore normal connectivity, reconnect to Windscribe or disable the Firewall under Preferences > Firewall before disconnecting.
Browser extension is not protecting all traffic: The Chrome, Firefox, and Edge extensions cover browser traffic only. Traffic from other apps on the same device bypasses the extension entirely. Install the full Windscribe desktop or mobile app for device-wide coverage.
R.O.B.E.R.T. blocking a site you need: Log in to your Windscribe account dashboard, go to the R.O.B.E.R.T. section, and review your active block lists. Disable any category that is catching the site, or add a whitelist entry for the specific domain.
The per-device app method (Method B) works with Windscribe's free plan. It provides up to 10GB of data per month after email confirmation, and requires no credit card to sign up.
The upstream router method (Method A) requires a paid account to generate OpenVPN or WireGuard config files. Two paid options are available:
Confirm current pricing at windscribe.com/upgrade before purchasing.