Check each item before proceeding:
Installing Windscribe at the router level routes traffic from every device connected through that router through the encrypted VPN tunnel automatically, including smart TVs, game consoles, and any other device that cannot run a VPN app on its own.
Config generator pages:
Use this decision tree to find the correct section for your situation:
Scope of this guide: The steps below cover the WRT32X, WRT1900AC, WRT1900ACS, and WRT3200ACM only. If you have a Linksys Velop, EA-series, MR-series, or a Linksys business router, this guide does not apply to your device.
Firmware note: Of the Linksys WRT models covered in this guide, the WRT32X is the only one expected to expose a stock-firmware OpenVPN client. The WRT1900AC, WRT1900ACS, and WRT3200ACM stock firmware generally provide OpenVPN server and remote-access features, not an outbound VPN client for connecting to a service like Windscribe.
Figure 1: Which part of the guide applies to your model and firmware, and where flashing DD-WRT fits in.
Flashing third-party firmware may void your warranty or affect Linksys support eligibility. An incorrect or interrupted flash can permanently brick the device.
Before flashing:
.ovpn profile. The profile contains the CA certificate and TLS-auth key in embedded <ca> and <tls-auth> blocks.
One config file, one location. Each config file is tied to one server location. Download a separate config file for each location you may want to use. Only one tunnel can be active on the router at a time.
.ovpn file downloaded in Step 1 and click Open.
After connecting, follow the steps in the Verifying Your Connection section below.
This setup is based on Windscribe's DD-WRT OpenVPN setup flow. DD-WRT's OpenVPN client requires entering individual values extracted from the config files rather than importing a single file.
.ovpn profile. Keep the file open: it contains the connection directives plus embedded <ca> and <tls-auth> blocks.
remote. It will read:remote [hostname] [port]
Keep this file open: you will need it again in Step 4.
Fill in the following fields using the values from your config file and credentials. Leave all fields not listed here at their default values.
| Field | Value |
|---|---|
| Server IP/Name | Copy the full hostname exactly from the remote line of your .ovpn file |
| Port | Copy the port number exactly from the remote line of your .ovpn file |
| Tunnel Device | TUN |
| Tunnel Protocol | UDP or TCP (match the protocol you selected when generating the config) |
| Encryption Cipher | Copy the cipher value from your generated profile. Current 2.4.6+ profiles use AES-256-GCM; older profiles use AES-256-CBC. |
| Hash Algorithm | Copy the auth value from your generated profile (SHA512 in current profiles). |
| User Pass Authentication | Enable |
| Username | Your Windscribe OpenVPN Username (from Step 1) |
| Password | Your Windscribe OpenVPN Password (from Step 1) |
| Advanced Options | Enable |
| TLS Cipher | None |
| LZO Compression | No |
| NAT | Enable |
| Firewall Protection | Enable |
| IP Address | Leave blank |
| Subnet Mask | Leave blank |
| Tunnel MTU Setting | 1500 |
| Tunnel UDP Fragment | Leave blank |
| Tunnel UDP MSS-Fix | Disabled (enable only if your ISP requires it) |
| nsCertType verification | Checked, if present in your DD-WRT build |
Figure 2: Part 2 — which value from the generated .ovpn profile goes in which DD-WRT OpenVPN Client field, plus the settings that are always fixed.
TLS Auth Key: In the generated .ovpn file, copy everything inside the <tls-auth> block, including the BEGIN and END lines, and paste it into the TLS Auth Key field.
Additional Config: Enter the following directives exactly as shown in the Additional Config field:
reneg-sec 432000 resolv-retry infinite
CA Cert: In the generated .ovpn file, copy everything inside the <ca> block, including the BEGIN and END lines, and paste it into the CA Cert field.
If the Username and Password fields are not visible in your version of DD-WRT, your build is older and requires a workaround. Search for "DD-WRT" in the Windscribe knowledge base to find the current DD-WRT OpenVPN guide, which includes the appendix for this scenario. Updating to a current DD-WRT build is recommended.
Navigate to Administration → Backup. Click Backup to save a file named nvrambak.bin to your computer. This file can be used to restore your configuration if the router is reset.
This is Windscribe's recommended method for current DD-WRT builds. It uses the Import Configuration feature, which populates all tunnel fields automatically from the downloaded config file.
If you do not see an Import Configuration button in Step 3 below, your DD-WRT build is older. Use Part 4 instead.
Figure 3: Parts 3 and 4 — the import-or-manual fork, and the WireGuard config values behind every DD-WRT tunnel field.
Press Apply Settings at the bottom. Before considering setup complete, also complete the Verify IPv6 and DNS Routing step and the Verifying Your Connection steps below.
Use this method if your DD-WRT build does not show an Import Configuration button. Windscribe recommends updating to the latest DD-WRT build for your model before proceeding: dd-wrt.com/support/router-database/
Note: DD-WRT field labels, field availability, and default values vary between builds. The table below reflects the current DD-WRT WireGuard setup flow, but your build may label or arrange some fields differently. Use the field names below as a guide, not a guarantee.
Enter the following values. Leave all fields not listed here at their defaults.
| Field | Value |
|---|---|
| Protocol Type | WireGuard |
| CVE-2019-14899 Mitigation | Enable |
| NAT via Tunnel | Enable |
| Local Port | Leave as default (51820) |
| MTU | 1420 |
| Local Public Key | Leave blank |
| DNS servers via tunnel | Copy the DNS value exactly from your config file. It is account/config-derived and is reachable through the tunnel. |
| Firewall inbound | Enable |
| Kill Switch | Enable |
| Advanced Settings | Enable |
| Local Private Key | Copy the PrivateKey value from your config file |
| Field | Value |
|---|---|
| Peer Tunnel IP | 0.0.0.0 (verify this matches your DD-WRT build's expected peer IP field) |
| Peer Tunnel DNS | Copy the DNS value from your config file |
| Endpoint | Enable |
| Endpoint Address | Copy the Endpoint value from your config file. Some DD-WRT builds show a single combined host:port field; others split host and port into separate fields. Check your UI and enter accordingly. |
| Allowed IPs | Copy the complete AllowedIPs value from your config file. Current permanent configs use 0.0.0.0/0, ::/0. |
| Route Allowed IPs via tunnel | Enable |
| Persistent Keepalive | 25 |
| Peer Public Key | Copy the PublicKey value from your config file |
| Use Pre-shared Key | Enable |
| Pre-shared Key | Copy the PresharedKey value from your config file |
At the bottom of the tunnel configuration:
| Field | Value |
|---|---|
| IP Address/Netmask | Copy the complete Address value from your config file. Current configs can contain both an IPv4 and IPv6 address. If your DD-WRT build exposes separate fields, enter each value in its matching field. |
Click Apply Settings at the bottom. Then complete the Verify IPv6 and DNS Routing step and Verifying Your Connection steps below.
Current Windscribe WireGuard configs include both IPv4 and IPv6 routes when available. Use the complete Address, DNS, and AllowedIPs values from your downloaded config rather than copying examples from this guide. This check applies to both Part 3 and Part 4.
::/0 route, or the leak test shows your normal ISP IPv6 address, open Setup > IPv6 and set IPv6 to Disabled.
Figure 4: How to verify the generated dual-stack routes and what the Kill Switch does and does not promise.
After completing any setup in this guide:
Download a new config file for the target location from the OpenVPN config generator and repeat the import process in Part 1, Step 4. Switching locations requires loading a different config file.
The safest approach is to download a new config file for the target location from the OpenVPN config generator and update the Server IP/Name, Port, and Tunnel Protocol fields to match the values in the new config. Also update the TLS Auth Key and CA Cert if the new config file uses different certificate material. Confirm all changed values in the new .ovpn file before assuming they match your current settings. Click Save, then Apply Settings.
Each WireGuard config file is tied to a specific server location and key pair. To switch locations, generate a new config file from the WireGuard config generator for the target location. Use Import Configuration on current DD-WRT builds, or update each affected field manually on older builds. Importing a new config will overwrite the existing tunnel.
Tunnel will not connect: Check that your OpenVPN Username and Password or WireGuard keys came from the config generator, not your Windscribe account login. For DD-WRT OpenVPN, confirm the hostname and port are copied exactly from the remote line in the .ovpn file, and that the CA Cert and TLS Auth Key were pasted in full including header and footer lines. If the Username and Password fields are absent in DD-WRT, search for the DD-WRT guide in the Windscribe knowledge base for the legacy credential workaround. For WireGuard, confirm all key fields match the config file exactly with no extra spaces or line breaks.
Connected, but real IP or original location still showing: On DD-WRT, confirm Kill Switch is Enabled in the WireGuard tunnel settings, or confirm the OpenVPN client is set to redirect all traffic through the tunnel. Restart the router after the first-time connection.
DNS leak detected at ipleak.net: Ensure DNS queries are routed through the tunnel. On DD-WRT, one approach is to set a static DNS under Setup → Basic Setup → Network Address Server Settings to your Windscribe tunnel DNS, but exact DNS handling varies by build and setup. For WireGuard, the tunnel DNS is the DNS value in your config file; copy it exactly rather than using a value from an example. Run a leak test after any DNS change to confirm. Also complete the Verify IPv6 and DNS Routing section above; disable IPv6 only when your build cannot apply the generated IPv6 route or testing proves bypass.
Slow speeds: Switch to a geographically closer server. Prefer WireGuard over OpenVPN for throughput, and UDP over TCP unless UDP is blocked on your network. TCP on port 443 may help on restrictive networks, but it is not a substitute for Windscribe's app-based Stealth or WStunnel modes.
Router-level VPN config does not replicate the full Windscribe app experience on individual devices:
For any of these controls on a specific device, run the Windscribe app on that device directly.
Do I need a paid Windscribe account to set up a VPN on my router?
Yes. The OpenVPN and WireGuard config generators are available to Pro and Build-A-Plan subscribers only. A free account cannot generate config files and cannot be used for router-level setup.
Will a router-level VPN slow down my internet?
Some performance reduction is expected. The router's processor handles encryption for every connected device, and consumer routers have less processing power than a desktop or phone. WireGuard has lower overhead than OpenVPN and typically delivers better throughput at the router level. The actual impact depends on your router model, connection speed, and the distance to the server location you connect to.
Can I run the Windscribe app on a device that is also connected through the router VPN?
Technically yes, but this creates a double-VPN setup on that device. If you need app-level features like Split Tunneling, protocol switching, or Emergency Connect, it is usually cleaner to run the Windscribe app directly on that device instead of relying on the router tunnel for that device. Advanced users can also use DD-WRT policy-based routing to exclude specific devices from the router tunnel, but that is outside the scope of this guide.
What happens if the VPN connection drops?
For DD-WRT WireGuard with Kill Switch enabled, traffic should be blocked rather than falling back to the unencrypted WAN connection, but this behavior can vary by DD-WRT build. Verify with IP and DNS leak tests after setup before relying on it. For stock WRT32X OpenVPN and DD-WRT OpenVPN without a separately configured kill switch, traffic may fall back to the regular WAN path if the tunnel drops. Run an IP and DNS leak test after setup to verify the behavior under normal conditions.
Does Windscribe log my activity?
No. Windscribe does not log browsing activity, DNS queries, connection logs, IP timestamps, or session logs. Windscribe does store limited account and service data, including last activity time and bandwidth used over a 30-day period, for plan limits and abuse prevention. See the full Windscribe Privacy Policy for complete details. This applies whether you connect through the Windscribe app or a manual router config.
Can I use one Windscribe account on my router and my other devices at the same time?
Yes. Windscribe allows unlimited simultaneous connections on a single account. You can run the router VPN for your home network while using the Windscribe app on your phone, laptop, or any other device concurrently. This is intended for your own devices and household use. Account sharing is prohibited.
Router configuration requires an eligible paid Windscribe plan. Check the current plan options and pricing before generating a configuration.
Compare plans at windscribe.com/upgrade