5 ms·

Show HN: Whole-home VPN router with hardware kill switch (OpenWrt and WireGuard)

19 points by yoloshii 10mo ago

With internet censorship and surveillance on the rise, ie; UK Online Safety Bill (July 2025) and Australia's social media legislation (Dec 2025) introducing mandatory age verification (read: initial step on the pathway to social credit), I wanted a privacy-first solution that protects browsing history from ISPs and third-party verification services, but not one that requires you to be an Einstein to deploy. This stack turns a Raspberry Pi (or any OpenWrt-compatible device) into a network-wide VPN gateway. Key features: - Firewall kill switch: VPN down = no internet (not a software rule that can leak) - AmneziaWG obfuscation for DPI-resistant connections - Optional AdGuard Home for DNS filtering - Works for all devices including smart TVs and IoT that can't run VPN apps Not a techie? The README is optimized for AI-assisted deployment. Feed it to your LLM of choice (Claude, GPT, etc.) and it can walk you through the entire setup for your specific hardware. Mullvad-focused but works with any WireGuard provider. MIT license. Docker deploy in testing (coming soon)

cbsks 10mo ago
The downside is that some services, such as video streaming, block access from VPNs.
- yoloshii 10mo ago
  That's where VPN obfuscation is the play, imo. A lot of people nowadays are leaving streaming platforms or watch YT on smart TVs, so it does have a place. You can always exclude a device from the VPN coverage too.
  - Retr0id 10mo ago
    Obfuscation only protects you from your own ISP messing with VPN connections. Streaming services (etc.) can't see what protocol you're using between yourself and the VPN in any case, they just see the VPN's exit IP address. Which is likely on their list of known VPN IPs.
    - yoloshii 10mo ago
      If you start countering geolocation blocking with vps rental and VLESS vray etc then its still good to obfuscate at the endpoint. Passing VPN traffic off as something else is good policy wherever your tunnel goes.
dontdoxxme 10mo ago
> Not a techie? The README is optimized for AI-assisted deployment. Feed it to your LLM of choice (Claude, GPT, etc.) and it can walk you through the entire setup for your specific hardware. The whole thing is AI slop. I thought there might be something interesting here but it's just a bunch of disconnected fragments of OpenWRT config and some other bits without any overall thought. It doesn't even use network namespaces. You can probably do better by giving your LLM https://www.wireguard.io/netns/ https://www.wireguard.io/netns/ as input.
- yoloshii 10mo ago
  It prompts the user's agent to audit their network devices and topology first, and research online if it gets stuck. The configs need to be agnostic and contain placeholders. The whole idea is that the agent helps the user vibe code this, which is very doable, and probably the norm when there are so many people looking for solutions like this given the current climate. And netns is for single-host isolation. This is a router forwarding LAN→WAN. Different problem.
  - dontdoxxme 10mo ago
    > And netns is for single-host isolation. This is a router forwarding LAN→WAN. Different problem Not at all. Put the LAN interface in a network namespace that is different to the host (ip link set ... netns ...). This gives you your "kill switch" without even needing firewall rules, it happens on a lower level.
    - yoloshii 10mo ago
      In this setup the "kill switch" works in tandem with the VPN server failover logic. Maybe a netns would be good for redundancy.
globalnode 10mo ago
im kinda off vpns since i learnt that id likeley become an ai crawler or a proxy for someones paid ddos
mzajc 10mo ago
> The kill switch is implemented in the firewall and routing table, not in software. As far as I know, both of these are in the kernel (not hardware). It's odd that so much of the README is dedicated to describing this relatively simple firewall rule, but the whole thing smells like generated slop.
- yoloshii 10mo ago
  You're right that iptables rules execute in kernel space, not dedicated hardware. "Hardware kill switch" in VPN contexts typically means the protection is implemented at the network appliance level (router) rather than a software client on each device. The distinction matters because a) client-side kill switch: App crashes → traffic leaks until you notice, and b) router-level kill switch :Default DROP policy persists regardless of client state. Also, the project is for non-techies and vibe coders, so simple explanations help. For their agents, there's the juice in other docs.
  - pa7ch 10mo ago
    I've not seen it called this before. I'd say something like 'fail-safe' instead.
  - mzajc 10mo ago
    But this isn't a simple explanation, it's just... wrong? Could you share where else it's referred to as such.
    - yoloshii 10mo ago
      I mean if you want to be anal about it, its just semantics, right? You know, how something is one way relative to something else, but relative to the other thing its not. Certainly not something to get bothered about.
  - orev 10mo ago
    No, it does not. Please stop responding with AI slop. A hardware kill switch always means a hardware (i.e. physical) mechanism. ALWAYS. You might have something interesting here, but arguing this point is burying anything else of value you might have. Just take the feedback and remove it.
neilv 10mo ago
> Hardware kill switch - Firewall-level failsafe, not software I think that firewalling/filtering and routing are software (though they can be accelerated in hardware). "Hardware kill switch" is a useful pre-existing term, which I've only seen used to mean a user-controlled mechanical switch that physically opens or closes one or more electrical circuit conductor paths necessary for whatever is to be "killed" (electrically disconnected). For example, let's say your network connector had several pins; a kill switch might mechanically disconnect those pins from wires or PCB traces, in a very simple and verifiable way, which obviously nothing in software/firmware/backdoors/etc. could circumvent. (Well, unless the software could control a robot arm, to go flip the mechanical switch, or solder in a bypass.) Calling something else "hardware kill switch" seems incorrect. I don't say this to be pedantic, but because it's an important security feature, which this system claims to have, but does not.
- yoloshii 10mo ago
  You're probably right lol. It does have that connotation. I'll change it.
  - neilv 10mo ago
    Was this AI-generated?
    - yoloshii 10mo ago
      Some, yes.
    - cadamsdotcom 10mo ago
      I’m curious why you’re asking this. Are you concerned the author didn’t review what was generated? If (I’m speculating here) that’s the real question you wanted to ask, it’s perfectly okay to ask that.
      - neilv 10mo ago
        I asked that because I suspected it was AI-generated, but didn't want to assume.
beAbU 10mo ago
Honest no-snark question, coming from someone who does not know a lot about VPNs other than the wireguard app I have for work. What's the difference between this, and just configuring the VPN settings that's available on my router that came with my ISP?

19 points by yoloshii 10mo ago

cbsks 10mo ago

The downside is that some services, such as video streaming, block access from VPNs.

yoloshii 10mo ago
That's where VPN obfuscation is the play, imo. A lot of people nowadays are leaving streaming platforms or watch YT on smart TVs, so it does have a place. You can always exclude a device from the VPN coverage too.
- Retr0id 10mo ago
  Obfuscation only protects you from your own ISP messing with VPN connections. Streaming services (etc.) can't see what protocol you're using between yourself and the VPN in any case, they just see the VPN's exit IP address. Which is likely on their list of known VPN IPs.
  - yoloshii 10mo ago
    If you start countering geolocation blocking with vps rental and VLESS vray etc then its still good to obfuscate at the endpoint. Passing VPN traffic off as something else is good policy wherever your tunnel goes.

dontdoxxme 10mo ago

> Not a techie? The README is optimized for AI-assisted deployment. Feed it to your LLM of choice (Claude, GPT, etc.) and it can walk you through the entire setup for your specific hardware. The whole thing is AI slop. I thought there might be something interesting here but it's just a bunch of disconnected fragments of OpenWRT config and some other bits without any overall thought. It doesn't even use network namespaces. You can probably do better by giving your LLM https://www.wireguard.io/netns/ https://www.wireguard.io/netns/ as input.

yoloshii 10mo ago
It prompts the user's agent to audit their network devices and topology first, and research online if it gets stuck. The configs need to be agnostic and contain placeholders. The whole idea is that the agent helps the user vibe code this, which is very doable, and probably the norm when there are so many people looking for solutions like this given the current climate. And netns is for single-host isolation. This is a router forwarding LAN→WAN. Different problem.
- dontdoxxme 10mo ago
  > And netns is for single-host isolation. This is a router forwarding LAN→WAN. Different problem Not at all. Put the LAN interface in a network namespace that is different to the host (ip link set ... netns ...). This gives you your "kill switch" without even needing firewall rules, it happens on a lower level.
  - yoloshii 10mo ago
    In this setup the "kill switch" works in tandem with the VPN server failover logic. Maybe a netns would be good for redundancy.

globalnode 10mo ago

im kinda off vpns since i learnt that id likeley become an ai crawler or a proxy for someones paid ddos

mzajc 10mo ago

> The kill switch is implemented in the firewall and routing table, not in software. As far as I know, both of these are in the kernel (not hardware). It's odd that so much of the README is dedicated to describing this relatively simple firewall rule, but the whole thing smells like generated slop.

yoloshii 10mo ago
You're right that iptables rules execute in kernel space, not dedicated hardware. "Hardware kill switch" in VPN contexts typically means the protection is implemented at the network appliance level (router) rather than a software client on each device. The distinction matters because a) client-side kill switch: App crashes → traffic leaks until you notice, and b) router-level kill switch :Default DROP policy persists regardless of client state. Also, the project is for non-techies and vibe coders, so simple explanations help. For their agents, there's the juice in other docs.
- pa7ch 10mo ago
  I've not seen it called this before. I'd say something like 'fail-safe' instead.
- mzajc 10mo ago
  But this isn't a simple explanation, it's just... wrong? Could you share where else it's referred to as such.
  - yoloshii 10mo ago
    I mean if you want to be anal about it, its just semantics, right? You know, how something is one way relative to something else, but relative to the other thing its not. Certainly not something to get bothered about.
- orev 10mo ago
  No, it does not. Please stop responding with AI slop. A hardware kill switch always means a hardware (i.e. physical) mechanism. ALWAYS. You might have something interesting here, but arguing this point is burying anything else of value you might have. Just take the feedback and remove it.

neilv 10mo ago

> Hardware kill switch - Firewall-level failsafe, not software I think that firewalling/filtering and routing are software (though they can be accelerated in hardware). "Hardware kill switch" is a useful pre-existing term, which I've only seen used to mean a user-controlled mechanical switch that physically opens or closes one or more electrical circuit conductor paths necessary for whatever is to be "killed" (electrically disconnected). For example, let's say your network connector had several pins; a kill switch might mechanically disconnect those pins from wires or PCB traces, in a very simple and verifiable way, which obviously nothing in software/firmware/backdoors/etc. could circumvent. (Well, unless the software could control a robot arm, to go flip the mechanical switch, or solder in a bypass.) Calling something else "hardware kill switch" seems incorrect. I don't say this to be pedantic, but because it's an important security feature, which this system claims to have, but does not.

yoloshii 10mo ago
You're probably right lol. It does have that connotation. I'll change it.
- neilv 10mo ago
  Was this AI-generated?
  - yoloshii 10mo ago
    Some, yes.
  - cadamsdotcom 10mo ago
    I’m curious why you’re asking this. Are you concerned the author didn’t review what was generated? If (I’m speculating here) that’s the real question you wanted to ask, it’s perfectly okay to ask that.
    - neilv 10mo ago
      I asked that because I suspected it was AI-generated, but didn't want to assume.

beAbU 10mo ago

Honest no-snark question, coming from someone who does not know a lot about VPNs other than the wireguard app I have for work. What's the difference between this, and just configuring the VPN settings that's available on my router that came with my ISP?