Before you start – VPN server vs. VPN client: Most Netgear routers on stock firmware include a "VPN Service" feature. This is a VPN server that lets your devices connect back into your home network remotely. It is not a VPN client, and it cannot send your traffic through Windscribe. To connect a Netgear router to Windscribe, you need VPN client capability. This guide covers the three paths that provide it.
⚠ Advanced setup. A misconfigured router VPN cuts internet access for every device on the network. Back up your router settings before proceeding: if something breaks, a factory reset and restore from backup is the recovery path.
Your model number is printed on the label on the underside or back panel of the router. It will read something like R7000, R7800, XR500, or XR700. Some models also list a hardware version (e.g., R7000 v1.1): note this as well, since some revisions use different chipsets.
You can also find it by logging into the router admin page at routerlogin.net and checking the firmware version page.
| Path | Supported Models | Firmware Flashing Required | Warranty Impact |
|---|---|---|---|
| Path A: DumaOS Hybrid VPN | XR450, XR500, XR700 | No | None |
| Path B: DD-WRT | Many Nighthawk AC models: confirm your specific model and hardware revision at dd-wrt.com/support/router-database | Yes | May affect warranty coverage and Netgear support |
| Path C: Voxel Firmware | R7800, R8900, R9000 | Yes | May affect warranty coverage and Netgear support |
A note on specific models that do not fit neatly into the table above:
Figure 1: Choosing a setup path by model number, including the models that fall outside the three main paths.
These steps apply regardless of which path you follow.
Account requirement: Downloading configuration files requires a Pro or Build-A-Plan subscription: the config generators are a paid feature.
No firmware flashing is needed. Hybrid VPN is built into DumaOS on these three models.
Settings > Administration > Firmware Update.
Important: Hybrid VPN is per-device. Only the devices you add here will use Windscribe. Devices you do not add will continue to use your standard internet connection.
On a device you assigned to Hybrid VPN:
This path requires flashing DD-WRT firmware onto your router. Flashing third-party firmware constitutes a product modification. Under Netgear's published warranty terms, modified products may not be eligible for warranty coverage or Netgear technical support.
Prerequisite: Confirm your exact router model and hardware revision support DD-WRT before proceeding. Search your model number in the DD-WRT Router Database at dd-wrt.com/support/router-database. Download the recommended build file from there: do not use a build intended for a different model or revision, as this can brick the router.
ADVANCED > Administration.
Services > VPN.
Verify each field against your downloaded .ovpn file before entering values. The cipher, port, and auth directive in your file are what matter: forcing values that differ from the file causes connection failure.
| Field | Value |
|---|---|
| Server IP/Name | Hostname from the remote line in your .ovpn file (e.g., us-east.windscribe.com) |
| Port | Port from the same remote line: use this exact value |
| Tunnel Device | TUN |
| Tunnel Protocol | UDP or TCP: match what you selected in the config generator |
| Encryption Cipher | Match your .ovpn file: look for the cipher directive (typically AES-256-GCM) |
| Hash Algorithm | Match your .ovpn file: look for the auth directive (typically SHA512) |
| Advanced Options | Enable |
| TLS Cipher | None |
| LZO Compression | Disabled (Windscribe does not use compression: enabling it causes connection errors) |
| NAT | Enable |
| Firewall Protection | Enable |
| User Pass Authentication | Enable |
| Username | Your Windscribe OpenVPN Username |
| Password | Your Windscribe OpenVPN Password |
Figure 2: Where each value in your Windscribe .ovpn file goes in the DD-WRT OpenVPN Client panel.
<ca> and </ca>.
<ca> or </ca> tags themselves).
<tls-auth> and </tls-auth>.
<tls-auth> or </tls-auth> tags or any # comment lines.
In the Additional Config text box, paste:
tun-mtu-extra 32 mssfix 1450 persist-key persist-tun
Click Save, then Apply Settings.
Setup > Basic Setup.
Note: Because 10.255.255.1 only resolves through the Windscribe tunnel, DNS will stop working if the VPN disconnects. This is intentional and prevents DNS queries from leaking to your ISP.
Figure 3: How the 10.255.255.1 DNS setting behaves while the tunnel is up, and what happens when it drops.
Administration > Backup.
Status > OpenVPN. The State field should read CONNECTED SUCCESS.
Voxel is a community-maintained firmware for the Nighthawk X4S R7800, the Nighthawk X8S R8900, and the Nighthawk X10 R9000. It is based on the stock Netgear firmware but adds OpenVPN client support and other features not present in standard firmware. Voxel also has active builds for the Orbi RBK50/RBK53 and Orbi LBR20. Flashing Voxel constitutes a product modification. Under Netgear's published warranty terms, modified products may not be eligible for warranty coverage or Netgear technical support.
Note: Voxel includes a README with each firmware download that covers setup details specific to that build. The steps below reflect the confirmed general method, but file paths and procedures can change between releases: check the README in your downloaded package before proceeding.
ADVANCED > Administration, then click Router Update, Firmware Update, or Firmware Upgrade (the label varies by model). All three options lead to the same manual upload screen.
For these models, Voxel's OpenVPN client can load configuration from a USB drive connected to the router. LBR20 does not use this USB procedure; follow the separate LBR20 steps below.
openvpn-client (no leading slash, no quotes)..ovpn config file, downloaded from windscribe.com/getconfig/openvpn.auth.txt, containing your Windscribe OpenVPN Username on the first line and your Windscribe OpenVPN Password on the second line, with nothing else in the file..ovpn file in a text editor. Find the line that reads auth-user-pass. Change it to:auth-user-pass /etc/openvpn/config/client/auth.txt
Figure 4: The folder and file layout used by the USB-based Voxel setup, and the one line to change inside the .ovpn file. This USB layout does not apply to LBR20.
LBR20 does not use the USB openvpn-client procedure above. Its current Voxel QuickStart stores persistent files under the Circle overlay path.
/mnt/circle/overlay/etc/openvpn/config/client..ovpn file and auth.txt in that directory. Keep the OpenVPN username on the first line of auth.txt and the OpenVPN password on the second line..ovpn file, change auth-user-pass to auth-user-pass /etc/openvpn/config/client/auth.txt./etc/init.d/openvpn-client start for testing, or reboot after following the QuickStart. Check /var/log/openvpn-client.log if it does not connect.If the connection does not come up, consult Voxel's README or QuickStart and the SNBForums thread for your model. Common issues include incorrect file paths in the .ovpn file and unsupported drive formatting.
Regardless of which path you followed:
If the IP has changed but DNS still shows your ISP, revisit the DNS configuration steps for your path.
Setup > Basic Setup and that the VPN tunnel is active.
Setup > IPV6, set it to Disabled, click Save and Apply Settings.
Status > OpenVPN to confirm the tunnel is active.
ROBERT (ad and tracker blocking): ROBERT is a server-side DNS feature. It applies automatically to any connection made with your Windscribe credentials, including router-level setups. All DNS queries routing through the Windscribe tunnel are subject to your ROBERT settings. Configure and manage ROBERT rules at windscribe.com/myaccount: the router itself has no ROBERT controls.
Static IP: Static IP works on any router with a compatible OpenVPN or WireGuard client. When generating your config at windscribe.com/getconfig/openvpn, select your Static IP location from the Location dropdown rather than a standard server location. In most cases, no other changes are needed.
Split Tunneling: Split Tunneling routes specific applications through the VPN while leaving others on the regular internet connection. This requires software running at the device level and is not available through any of the manual router configurations in this guide. On DumaOS (Path A), the per-device selection in Hybrid VPN provides a router-level equivalent: devices not added to Hybrid VPN continue to use the regular connection while assigned devices route through Windscribe.
For all other Windscribe app features, install the Windscribe app on individual devices. This is also the recommended approach for devices where VPN coverage is optional or where you need per-application routing control.
Downloading configuration files requires a compatible paid plan: the config generators are a paid feature. Windscribe offers a monthly Pro plan, a yearly Pro plan, and Build-A-Plan, which lets you pay per server location at $1 per location per month with a $3 per month minimum. See current pricing at windscribe.com/upgrade.
Windscribe does not enforce a hard simultaneous-device limit for personal use. The router establishes one connection to Windscribe's servers, and all devices behind it benefit from that single tunnel. Windscribe's terms prohibit commercial use and extreme abuse, but normal household use across multiple devices is explicitly covered.
It depends on the path. Under Path B (DD-WRT) and Path C (Voxel), all devices connected to the router route through Windscribe by default, including smart TVs, game consoles, and any device that cannot run a VPN app. Under Path A (DumaOS Hybrid VPN), protection is per-device: only devices you explicitly add to Hybrid VPN use the tunnel. Devices you do not add continue on the regular internet connection.
For Path B, the DNS configuration in this guide sets your router's DNS to 10.255.255.1, an internal Windscribe address that only resolves through an active tunnel. If the tunnel drops, DNS stops resolving and internet access stops for connected devices. This is intentional: it prevents traffic from quietly bypassing the VPN. To restore access without the VPN, set your DNS back to your ISP's DNS or your preferred public resolver. Path C follows the DNS behavior documented by the Voxel build for your model; this guide does not apply the DD-WRT DNS setting to Path C.
Yes. ROBERT is a server-side DNS feature that applies to any traffic routed through the Windscribe tunnel, regardless of how the connection was established. Devices connected through your router receive the same DNS-level blocking as devices running the Windscribe app. Configure your ROBERT rules at windscribe.com/myaccount.
For Path B (DD-WRT), generate a new config for the location you want and open it in a text editor. Update the location-specific fields in the DD-WRT panel to match (at minimum the Server IP/Name and Port from the new remote line), then click Apply Settings. Other fields such as the CA certificate and TLS Auth Key are typically the same across locations, but verify against the new file before assuming. For Path A (DumaOS Hybrid VPN), add a new VPN entry in the Advanced tab with the new .ovpn file. For the USB-based Path C models, replace the .ovpn file in openvpn-client and restart the client as described by the model's QuickStart. For LBR20, replace the file under /mnt/circle/overlay/etc/openvpn/config/client and start the client or reboot according to its QuickStart.
Windscribe generates a separate set of OpenVPN credentials that are different from your main account email and password. Find them by logging in at windscribe.com, going to the OpenVPN config generator at windscribe.com/getconfig/openvpn, and clicking Get Credentials. Do not use your account login credentials in the router's username and password fields: the connection will fail.
Router-level VPN protection covers every device on your network, including smart TVs, game consoles, and IoT devices that cannot run a VPN app on their own. The setup paths in this guide work assuming your plan includes config file access and your router supports a compatible VPN client.
To get started: