How to Set Up OpenWRT Router VPN for Whole Network Proxy Access

You can configure an OpenWRT router as a network-wide VPN gateway by installing the shadowsocksR-plus plugin, importing a subscription URL from an SSR/V2Ray provider, and setting the routing mode to bypass China IPs or use a GFW list, eliminating the need for per-device VPN clients.

The bannedbook/fanqiang repository provides a complete implementation guide for converting consumer OpenWRT routers into centralized VPN gateways. This approach allows every device on your LAN to automatically route traffic through encrypted tunnels without individual configuration. By leveraging the shadowsocksR-plus plugin as documented in router/OpenWRT.md, you can achieve whole-network censorship circumvention with minimal hardware investment.

Architecture Overview

The solution implements a gateway-proxy pattern where the router handles all encryption and routing decisions. According to the source code analysis, three core components work together:

• OpenWRT Gateway: Runs the shadowsocksR-plus plugin to create a local SOCKS/HTTPS proxy and manage NAT/forwarding rules.
• Remote Proxy Service: An SSR or V2Ray airport (provider) that supplies encrypted node information via a subscription URL.
• LAN Clients: All devices inherit proxy settings automatically through the router’s default gateway configuration; no client-side software is required.

Step-by-Step Configuration

Follow the workflow defined in router/OpenWRT.md to activate network-wide VPN access:

1. Obtain a Subscription Link

Register with an SSR or V2Ray airport (the repository references options in v2ss/V2ray机场.md) and copy the subscription URL. This URL contains encrypted node configurations and functions as a credentials token—treat it as a password. This step corresponds to lines 13-26 in router/OpenWRT.md.

2. Configure the Plugin

Access the OpenWRT LuCI web interface and navigate to Services > ShadowsocksR Plus+ > Server Nodes. Paste your subscription URL into the Subscribe URL field and click Save & Apply. The plugin will fetch the node list within a few minutes. This procedure is documented in router/OpenWRT.md lines 29-35.

3. Activate a Node

Navigate to the Client page in the shadowsocksR-plus interface. Select a usable node from the populated list and click Save & Apply. Verify the service status displays “ShadowsocksR Plus+ 运行中” to confirm the encrypted tunnel is active (see router/OpenWRT.md lines 36-41).

4. Set Routing Mode

In the Running Mode dropdown, select one of three traffic handling strategies:

• Bypass China mainland IP: Routes only international traffic through the VPN (optimal for domestic speed).
• GFW list: Proxies only domains blocked by the Great Firewall.
• Global: Tunnels all traffic through the remote server.

This configuration step is detailed at line 43 of router/OpenWRT.md.

5. Verify Network-Wide Access

Once active, all devices connected to the LAN automatically route traffic according to the selected mode. No additional proxy settings are required on individual phones, laptops, or smart TVs (referenced in router/OpenWRT.md line 45).

Command Line Configuration

If you prefer SSH access over the LuCI web interface, use the uci utility to apply identical settings. The underlying configuration is stored in UCI (Unified Configuration Interface) values:

# Add the subscription URL

uci set shadowsocksr.@global[0].url='https://example.com/subscription/abcd1234'

# Select node index (verify actual index with uci show shadowsocksr)

uci set shadowsocksr.@servers[0].id='3'

# Set routing mode: bypass_china, gfwlist, or global

uci set shadowsocksr.@global[0].mode='bypass_china'

# Persist changes and restart service

uci commit shadowsocksr
/etc/init.d/shadowsocksr restart

Key Configuration Parameters

The shadowsocksR-plus plugin stores settings in JSON structure. A minimal configuration object appears as follows:

{
  "subscription_url": "https://example.com/subscription/abcd1234",
  "selected_node": "node-3",
  "run_mode": "bypass_china",
  "auto_update": true,
  "update_interval_minutes": 60
}

• subscription_url: The endpoint that returns base64-encoded node information.
• run_mode: Controls traffic bifurcation logic; bypass_china maintains direct connections to domestic IPs while proxying international destinations.
• auto_update: Enables periodic polling of the subscription URL to refresh available nodes.

Summary

• The shadowsocksR-plus plugin transforms OpenWRT routers into VPN gateways that require no per-device configuration.
• Configuration centers on importing a subscription URL from an SSR/V2Ray provider via LuCI or uci commands.
• Routing modes (bypass China, GFW list, global) provide granular control over which traffic enters the encrypted tunnel.
• All LAN clients automatically inherit proxy settings because the router handles NAT and forwarding at the network edge.

Frequently Asked Questions

What is the shadowsocksR-plus plugin?

The shadowsocksR-plus plugin is an OpenWRT package that implements the Shadowsocks and ShadowsocksR protocols, creating a local proxy server on the router. According to the router/OpenWRT.md documentation, it handles subscription management, node switching, and traffic routing rules through an integrated LuCI interface.

Do individual devices need VPN software installed?

No. Because the OpenWRT router acts as the network gateway, all devices on the LAN automatically route through the VPN tunnel established by shadowsocksR-plus. The repository emphasizes this architecture in router/OpenWRT.md as the primary advantage over per-device proxy clients.

Which routing mode should I select for use in China?

Select "Bypass China mainland IP" if you want domestic websites and services to use your direct ISP connection while routing international traffic through the VPN. Alternatively, choose "GFW list" to proxy only blocked domains. These options are defined in router/OpenWRT.md line 43 and optimize performance by avoiding unnecessary encryption overhead for domestic traffic.

Can I use this method on any router?

The solution requires a router capable of running OpenWRT firmware. While many consumer routers are supported, you must verify your specific model is compatible with OpenWRT before flashing. The router/readme.md file in the bannedbook/fanqiang repository provides links to compatible hardware lists and alternative guides for Asus-Merlin firmware.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}