Whole-home VPN router with hardware kill switch (OpenWrt and WireGuard)
With internet censorship and surveillance on the rise, ie; UK Online Safety Bill (July 2025) and Australia's social media legislation (Dec 2025) introducing mandatory age verification (read: initial step on the pathway to social credit), I wanted a privacy-first solution that protects browsing history from ISPs and third-party verification services, but not one that requires you to be an Einstein to deploy. This stack turns a Raspberry Pi (or any OpenWrt-compatible device) into a network-wide VPN gateway. Key features: - Firewall kill switch: VPN down = no internet (not a software rule that…
In plain words
This project turns a Raspberry Pi or compatible device into a network-wide VPN router using OpenWrt and WireGuard. It includes a hardware-based firewall kill switch that blocks all internet if the VPN connection drops, AmneziaWG obfuscation to resist deep packet inspection, and optional DNS filtering via AdGuard Home. The setup protects all connected devices, including those that cannot run VPN software. The documentation is designed to work with AI assistants to simplify deployment for non-technical users.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
With internet censorship and surveillance on the rise, ie; UK Online Safety Bill (July 2025) and Australia's social media legislation (Dec 2025) introducing mandatory age verification (read: initial step on the pathway to social credit), I wanted a privacy-first solution that protects browsing history from ISPs and third-party verification services, but not one that requires you to be an Einstein to deploy. This stack turns a Raspberry Pi (or any OpenWrt-compatible device) into a network-wide VPN gateway. Key features: - Firewall kill switch: VPN down = no internet (not a software rule that can leak) - AmneziaWG obfuscation for DPI-resistant connections - Optional AdGuard Home for DNS filtering - Works for all devices including smart TVs and IoT that can't run VPN apps Not a techie? The README is optimized for AI-assisted deployment. Feed it to your LLM of choice (Claude, GPT, etc.) and it can walk you through the entire setup for your specific hardware. Mullvad-focused but works with any WireGuard provider. MIT license. Docker deploy in testing (coming soon)
Does the same job
all alternatives →- WCWireHole combines WireGuard, Pi-hole, and Unbound with an easy UI2023 · github.com · ▲298
WireHole offers a unified docker-compose project that integrates WireGuard, PiHole, and Unbound, complete with a user interface. This solution is designed to empower users to swiftly set up and manage either a full or split-tunnel WireGuard VPN. It features ad-blocking capabilities through PiHole and enhanced DNS caching and privacy options via Unbound. The intuitive UI makes deployment and ongoing management straightforward, providing a comprehensive VPN solution with added privacy features.
- FAFirezone, an open-source WireGuard-based alternative to OpenVPN AS2021 · github.com · ▲183
I created Firezone to make it easier to host and manage your own WireGuard VPN server. While working at Cisco as a security automation engineer I experienced a lot of unnecessary pain managing secure network-level access into our cloud VPCs. I tried OpenVPN Access Server but I personally feel that security software should be open source to be validated (and improved) by the community. I discovered WireGuard and quickly fell in love with it, but soon found managing the peer configs to be a bit tedious and error-prone. So I built some convenience functionality on top, added a simple Web UI,…
- TBTailGuard – Bridge your WireGuard router into Tailscale via a containerSep 2025 · github.com · ▲150
My elderly parents are behind a 5G connection in rural areas, and I help them manage their network from overseas. I found a reasonably priced 5G router that can do external antennas required for it to work, but the only reasonable ways to get access to it is either through OpenVPN or WireGuard, the latter of which is much more lightweight and preferred with the memory constraints of the device. The problem with WireGuard is that it requires handling key management oneself, and configuring the keys to every device you want to access it from. It also doesn't play nicely together with other…
- WEWireHub – easily create and share WireGuard networks2023 · wirehub.org · ▲312
WireHub is a side project I've been working on, on and off, for close to a year now. It's made with django and minimal javascript. It's a hosted WireGuard config generator/manager, that you can invite others to join your networks and manage their own configs/devices. It's still very much a beta, maybe an mvp, but I just wanted to get some early from the community. Thanks!
More dev tools this month
the category →
The first open-source price index for GPU compute
Dev tools · 10d ago · getcomputable.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 2d ago · opentrailpaper.com
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
Launched alongside, November 2025
the whole month →
- IB
Life & fun · Nov 2025 · bitsnpieces.dev
- BBoing▲782
Life & fun · Nov 2025 · boing.greg.technology