FlashRouters Support Portal

Prioritizing Privacy

Search Results for: dns settings

Device Settings That Can Interfere With Your Router VPN

· ·

If your router VPN is connected and working on other devices but one phone, tablet, computer, or streaming device shows the wrong IP address, wrong location, cannot access certain websites, or behaves differently, check the affected device before changing the router.

VPN applications, privacy features, custom DNS settings, antivirus software, firewalls, browser settings, and corporate security software can all change how traffic is handled directly on a device.

This guide applies to all FlashRouter types and VPN providers.

Jump to a Section

Start Here: Is the Problem the Router or One Device?

Before changing your router VPN configuration, compare the affected device with another device connected to the same FlashRouter.

If several devices show the correct VPN IP and location while only one device does not, the router VPN is already demonstrating that it can route traffic through the VPN.

Focus troubleshooting on the affected device.

If every device connected to the FlashRouter has the same VPN problem, continue with router-level VPN troubleshooting instead.

Privacy Hero users should also check the Privacy Hero dashboard. If the VPN itself displays Failed, Disconnected, Connecting, or a timeout error, troubleshoot that connection before changing device settings.

Disconnect VPN Applications Running on the Device

Do not run a VPN application directly on the device while troubleshooting a VPN running on your router.

This includes applications from NordVPN, ExpressVPN, Surfshark, Proton VPN, IPVanish, Private Internet Access, Mullvad, corporate VPN providers, and other VPN services.

If both the router VPN and device VPN are active, the device VPN can take control of that device’s traffic after it passes through the router.

This can cause:

  • An unexpected public IP address.
  • An unexpected VPN location.
  • Websites or applications not loading.
  • Streaming region problems.
  • DNS problems.
  • Slow or unstable connections.
  • One device behaving differently from other devices on the same router.

Disconnect the VPN application completely before testing the router VPN.

Closing the VPN app window may not disconnect the VPN. Confirm in the application or device network settings that the device-level VPN is actually disconnected.

iPhone and iPad: Check Private Relay and Limit IP Address Tracking

Apple devices include privacy features that can change how supported internet traffic is handled and make router VPN testing more difficult.

Limit IP Address Tracking

To temporarily disable Limit IP Address Tracking for your FlashRouter WiFi network:

  1. Open Settings.
  2. Select Wi-Fi.
  3. Tap the information button next to the FlashRouter WiFi network.
  4. Find Limit IP Address Tracking.
  5. Turn it Off.
  6. Disconnect from WiFi and reconnect.
  7. Test the connection again.

This setting is configured per WiFi network, so make sure you are changing it for the FlashRouter network being tested.

iCloud Private Relay

iCloud Private Relay can also alter IP address visibility for supported traffic.

For troubleshooting:

  1. Open Settings.
  2. Tap your Apple Account/name.
  3. Select iCloud.
  4. Select Private Relay.
  5. Temporarily turn Private Relay Off.
  6. Reconnect to the FlashRouter.
  7. Test the IP address and connection again.

These settings can be restored after testing.

Android: Check Private DNS and Always-On VPN

Android devices can have DNS and VPN settings that operate independently of the router.

Private DNS

Android Private DNS can send DNS requests to a selected DNS provider instead of relying solely on the DNS configuration supplied by the router.

If you are troubleshooting DNS, website access, streaming, filtering, or location behavior:

  1. Open Settings.
  2. Select Network & internet.
  3. Select Private DNS.
  4. Temporarily select Off.
  5. Save the setting.
  6. Reconnect to the FlashRouter WiFi.
  7. Test again.

Android menus vary by manufacturer and Android version. Search the device Settings for Private DNS if necessary.

Always-On VPN

An Android VPN application can be configured to automatically reconnect even after you believe the VPN has been disconnected.

  1. Open Settings.
  2. Select Network & internet.
  3. Select VPN.
  4. Select the configured VPN.
  5. Disable Always-on VPN while testing.
  6. Check whether Block connections without VPN is enabled and temporarily disable it if necessary for testing.

Then reconnect to the FlashRouter and test the router VPN again.

Check Antivirus, Firewall, Browser, and Work Security Settings

If the problem affects a computer or only occurs in one browser, check for software that modifies network traffic directly on the device.

Antivirus and Internet Security Software

Security applications may include network features such as:

  • Web Protection.
  • Safe Browsing or Secure Web.
  • Network Protection.
  • DNS Protection.
  • HTTPS scanning.
  • Tracking protection.
  • Built-in VPN services.
  • Firewall controls.

Temporarily disable the relevant network protection feature and test again. You do not normally need to disable the entire antivirus product.

Third-Party Firewalls

A third-party firewall can block applications, DNS requests, VPN-related traffic, or specific network interfaces.

Temporarily disable the firewall and test the connection. If the problem disappears, re-enable the firewall and review its network rules.

Browser VPN, Proxy, and Secure DNS

Browsers and browser extensions can also use their own:

  • VPN services.
  • Proxy connections.
  • Secure DNS or DNS-over-HTTPS.
  • Privacy or filtering extensions.
  • Location-changing extensions.

If the problem occurs only in one browser, test another browser without extensions or custom networking settings.

Work and Corporate Devices

Company-managed computers and mobile devices may use corporate VPN clients, DNS filtering, web filtering, endpoint security, device-management profiles, or zero-trust networking software.

These systems may intentionally override the local router’s network behavior.

If a personal device works correctly on the same FlashRouter while a company-managed device does not, the company security configuration may be responsible.

Run a Clean Router VPN Test

For the cleanest test, temporarily remove device-level networking variables and let the FlashRouter VPN handle the connection.

  • FlashRouter VPN: On
  • Device VPN: Off
  • iCloud Private Relay: Off while testing
  • Limit IP Address Tracking: Off while testing
  • Android Private DNS/custom DNS: Off while testing
  • Always-On VPN: Off while testing
  • Third-party network filtering: Off while testing

Then:

  1. Disconnect the affected device from WiFi.
  2. Reconnect it to the FlashRouter.
  3. Open a fresh private/incognito browser window.
  4. Check the device’s public IP address and location.
  5. Compare the result with another device connected to the same FlashRouter.

If the second device shows the correct VPN IP but the affected device does not, continue troubleshooting settings or software on the affected device.

If all devices show the same incorrect IP address or all devices fail to use the VPN, continue with router-level VPN troubleshooting.

Privacy Hero VPN Connected but Device Still Shows the Wrong IP?

Privacy Hero provides device-level VPN controls. Make sure the affected device is actually assigned to use the VPN.

  1. Open app.privacyhero.com.
  2. Open the Devices section.
  3. Select the affected device.
  4. Confirm VPN protection is enabled for that device.
  5. Disconnect any VPN application running directly on the device.
  6. Test the public IP address again.

If other Privacy Hero devices show the correct VPN IP and only one device remains incorrect, continue with the device-level checks above.

Related FlashRouters Guides

What is a DNS leak and how can I prevent a DNS leak in my router?

· ·

What is a DNS leak?

A DNS Leak is an instance where your ISP receives DNS requests despite being connected to a VPN tunnel.

How do I check if my DNS is leaking?

  1. Perform the extended test on DNSLeakTest.com. Be sure to do so on multiple web browsers for best accuracy.
  2. Here you should only find one server and your ISP should not be listed as your actual ISP.
  3. If your actual ISP is not listed there is no DNS leak.

How can I prevent a DNS leak in DD-WRT?

Check your device's browser settings

Updates to web browsers have added DNS settings capabilities, while this often makes your browsing experience more secure it can also effect the results of a DNS leak test. You can go into your browser’s settings and search for “DNS” and disable the DNS of the browser for more accurate DNS leak test results.

A simple web search for “DNS settings [browser name]” should return helpful information for finding the setting in your browser.

Adjust DD-WRT settings

1. On the Setup > Basic Setup page of the DD-WRT settings check the Ignore WAN DNS box.

This setting may not appear in older DD-WRT firmware builds. If it is not appearing for you, upgrade your DD-WRT firmware.

DD-WRT Check Ignore WAN DNS

2. Lower on the same page check the Forced DNS Redirection box.

DD-WRT Check Forced DNS Redirection

3. Click Apply Settings at the bottom of the page and then wait a full minute and power the FlashRouter off and back on. Reconnect to the FlashRouter’s network once it boots back up and then make sure you are connected to VPN by going to https://whatismyipaddress.com then perform the DNS leak test again.

Adding your VPN provider’s DNS servers to the router’s configuration can be helpful as well. The DNS servers are typically found on the VPN provider’s website or you can reach out to their team for a recommendation of what DNS servers to enter.

DNS Setup for DD-WRT FlashRouters

· ·

The Domain Name System (DNS) is the phonebook of the Internet. DNS resolves website domain names (www.website.com) to IP Addresses so you don’t have to remember the IP Address of every site you visit.

We setup each FlashRouter with Google DNS (8.8.8.8 , 8.8.4.4) and/or OpenDNS (208.67.220.220 , 208.67.222.222) to prevent your ISP DNS from leaking when connected to the FlashRouter.

By using a trusted DNS server like those listed below, or from your trusted VPN service provider, you can prevent ISP’S from compiling your browsing data and selling it to third parties without your consent.

Recommended DNS servers

GoogleDNS

Primary DNS: 8.8.8.8

Secondary DNS: 8.8.4.4

OpenDNS

Primary DNS: 208.67.220.220

Secondary DNS: 208.67.222.222

Cloudfare

Primary DNS: 1.1.1.1

Secondary DNS: 1.0.0.1

Level 3

Primary DNS: 209.244.0.3

Secondary DNS: 209.244.0.4

How to change the DNS on your FlashRouter

We preset each FlashRouter with GoogleDNS and OpenDNS so there is no need to change the DNS servers unless you have reset the FlashRouter or want to use different DNS servers.

Navigate to Setup > Basic Setup

DNS Setup on DD-WRT FlashRouters
  1. Scroll down to Network Address Server Settings (DHCP).
  2. Enter in any combination of valid DNS servers into Statict DNS fields 1, 2, and 3.
  3. Click Apply Settings at the bottom of the page.
  4. Power cycle your FlashRouter off and back on.

DNS Leak Test

We recommend checking to see if your DNS is leaking when using VPN.

Why is my DNS showing as 192.168.11.1 on my devices?

· ·

When connected to a FlashRouter’s network the DNS settings of the devices will be reporting as 192.168.11.1. This means that the router is handling DNS internally through the servers you have set in the Setup > Basic Setup section of the router. If you did not set any custom DNS here, then you will using your ISP or VPN DNS servers automatically.

You can always customize the DNS servers in the router to your preferred servers and through DNSmasq the router will use 192.168.11.1 to route these servers to your connected devices.

In some instances disabling DNSMasq in the DD-WRT settings can help unblock previously blocked websites while connected to VPN. This will force devices to report the DNS servers set in the router directly as opposed to 192.168.11.1.

Disabling DNSMasq is not recommended unless FlashRouters specifically advises you but we have seen this work for certain VPN providers. To disable the DNSMasq do the following.

Navigate to Setup > Basic Setup

Disable DNSMaq Settings
  1. Uncheck Use DNSMasq for DHCP.
  2. Uncheck Use DNSMasq for DNS.
  3. Uncheck DHCP-Authoritative.
  4. Click Save.

Navigate to Services > Services

Disable DNSMaq Settings 2
  1. Set DNSMasq to Disable.
  2. Click Apply Settings.
  3. Reboot router.

ExpressVPN MediaStreamer SmartDNS Setup

· ·

ExpressVPN offers a SmartDNS service known as MediaStreamer for unblocking geo-restricted content without the encryption of a VPN service. SmartDNS routes DNS servers to different regions which “tricks” the website to allow access to previously restricted content.

SmartDNS does not change your IP Address or provide the encryption that a VPN connection does. This can result in faster speeds and unblocked content.

SmartDNS and VPN should not both be configured at the same time. When using a SmartDNS connection make sure to disable your VPN connection on the FlashRouter.

Login to ExpressVPN

If you are not already a ExpressVPN user Sign Up Now.

Visit ExpressVPN website login page and successfully login.

Register your IP with ExpressVPN

Navigate to the DNS Settings tab on top right of the ExpressVPN Dashboard.

ExpressVPN MediaStreamer DNS Settings

Click on Register my IP address.

Register IP for ExpressVPN MediaStreamer use on FlashRouter DD-WRT

Navigate to the ExpressVPN Dashboard.

Finding ExpressVPN MediaStreamer Specific DNS Servers in ExpressVPN Dashboard

Click on Set Up on More Devices.

Finding ExpressVPN MediaStreamer Specific DNS Servers

Scroll down and click on MediaStreamer and note the DNS servers that appear on the right side of the page.

ExpressVPN MediaStreamer Specific DNS servers

Enter MediaStreamer SmartDNS servers on your FlashRouter

Navigate to Setup > Basic Setup

  1. Scroll down to Network Address Server Settings (DHCP).
  2. Enter in the MediaStreamer SmartDNS servers you noted into Static DNS fields 1 and 2.
  3. Click Apply Settings at the bottom of the page.
  4. Reboot the FlashRouter.

Once the FlashRouter has fully rebooted, you can now access your desired regional content on any device that connects to the FlashRouter’s network.

IPVanish Setup for Privacy Hero

· ·

Privacy Hero supports IPVanish VPN through WireGuard (recommended) and OpenVPN. Both are configured in Privacy Hero using the Custom VPN provider option. You will need an active IPVanish VPN subscription and the configuration file for the protocol and server location you select.

Choose your method: WireGuard uses a generated .conf file and generally provides better performance. OpenVPN uses a downloaded .ovpn file plus your IPVanish VPN username and password.

Privacy Hero is cloud-managed. You can sign in and adjust VPN settings from a computer, phone, or tablet connected to any internet connection. You do not need to be on the Privacy Hero WiFi network to configure the router.

Download an IPVanish WireGuard Configuration (Recommended)

Use the WireGuard configuration generator in your IPVanish account to create a server file for your router. A generated WireGuard file contains the connection keys and server details, so keep it private.

  1. Open the IPVanish account sign-in page and log in.
  2. Open WireGuard in the account navigation to access the WireGuard Configuration Generator.
  3. Select your preferred IPVanish server location and choose Generate to download the WireGuard configuration file. Save the downloaded .conf file to the device you are using for setup.

Important: Do not publicly share your WireGuard configuration file. To switch server locations later, generate and upload a new configuration.

Add IPVanish WireGuard to Privacy Hero

  1. Sign in to the Privacy Hero dashboard at app.privacyhero.com.
  2. Open the VPN section, select Change beside the provider, and choose Custom.
  3. Choose WireGuard and upload the IPVanish .conf file you just generated.
  4. Click Save to apply the settings. Wait for Privacy Hero to report Connected.
Privacy Hero Custom WireGuard configuration with WireGuard file upload

WireGuard authentication is contained in the generated configuration file; there is no separate OpenVPN username/password step in this method.

Download an IPVanish OpenVPN Configuration File

OpenVPN is a good alternative if WireGuard is unavailable or fails to connect on your network. It requires an IPVanish .ovpn configuration file and VPN login credentials.

  1. Open the IPVanish OpenVPN server configuration list.
  2. Download an .ovpn file for your preferred available server location. If IPVanish provides both UDP and TCP files, start with UDP and keep a TCP file as a fallback.
  3. Have your IPVanish account username and password available for the OpenVPN setup. Use the credentials accepted by your IPVanish VPN account; these are not Privacy Hero login credentials.

If the linked server directory has changed, check the latest manual OpenVPN configuration downloads offered by IPVanish before selecting a file.

Add IPVanish OpenVPN to Privacy Hero

  1. Sign in at app.privacyhero.com and open VPN.
  2. Select Change, choose Custom, and select OpenVPN.
  3. Upload the IPVanish .ovpn file you downloaded.
  4. Enter your IPVanish username and password in the Custom OpenVPN fields. Do not enter the Privacy Hero account login.
  5. Click Save and wait for the connection status to show Connected.
Privacy Hero Custom OpenVPN configuration showing server file upload and username and password fields

Tip: If OpenVPN UDP times out or cannot connect, try an available IPVanish OpenVPN TCP configuration or another server location.

Verify Your IPVanish VPN Connection

After Privacy Hero displays Connected, verify that a device on the router is actually using IPVanish.

  1. Connect the device you want to test to the Privacy Hero WiFi or LAN network.
  2. Temporarily disconnect any IPVanish app, other VPN app, or device-level VPN connection on that device so you test the router VPN alone.
  3. Open a new private/incognito browser window and visit IPVanish What Is My IP Address.
  4. Confirm that your public IP address and approximate location correspond to the VPN server you selected.

Note: Privacy Hero settings can be managed remotely, but the device used for this IP test must be on the Privacy Hero network.

Streaming Relocation and Your VPN Location

If Streaming Relocation is enabled for a supported streaming service, that service may use the configured Streaming Relocation location instead of the IPVanish server location. See Privacy Hero Streaming Relocation.

IPVanish Not Connecting?

If Privacy Hero remains on Connecting, displays Failed, or reports a timeout, check the following:

  1. Make sure your IPVanish subscription is active and that Custom is selected as the VPN provider in Privacy Hero.
  2. For WireGuard, generate a fresh configuration from your IPVanish account and upload that .conf file again.
  3. For OpenVPN, confirm your IPVanish username/password and upload a fresh .ovpn file for a different server.
  4. Try a different server location. With OpenVPN, also try switching between available UDP and TCP files.
  5. Temporarily disable the Privacy Hero VPN connection and test normal internet access. If enabled, temporarily turn off the VPN Kill Switch for this test, then restore your preferred Kill Switch setting.
  6. Check whether a device-level VPN app, private DNS, proxy, or security software is interfering with the router VPN connection.

VPN Disconnected and No Internet?

The VPN Kill Switch can intentionally block internet access when the VPN disconnects. Review Privacy Hero VPN Kill Switch Setup.

VPN Connected but One Device Shows the Wrong IP?

If only one device shows an unexpected IP address, look for another VPN app, iCloud Private Relay, Private DNS, browser proxy/DNS settings, or security software on that device. See Device Settings That Can Interfere With Your Router VPN.

Related Privacy Hero Guides

DNS Setup for Asus Merlin

· ·

Enter custom DNS servers in your Asus Merlin firmware to avoid using your ISP DNS, which will steal and collect your browsing data.

Login to Asus Merlin firmware settings in a browser on any computer or smart device.

1. Under Advanced Settings select LAN.

2. Click the DHCP Server tab.

3. In the DNS Server 1 and DNS Server 2 fields enter the DNS server that you wish to use.

Merlin DNS Setup

4. Click Apply and then reboot the router and reconnect to the network.

How do I check for static network settings on my devices?

· ·

Static network settings set on a device from a previous connection will interfere with the FlashRouter’s network. Typically the FlashRouter’s network performs best when connected devices are set to automatically use the FlashRouter’s IP Address and DNS.

Make sure you are connected to the FlashRouter’s network via ethernet or WiFi. Keep in mind these instructions may vary based on your current software version.

Check for Static IP Address in Windows

1.  Open the Window search box, and search “Network Status”

Find Static DNS settings for FlashRouter DD-WRT in Windows Computer

2. Select “Change adapter optons”

Find Static DNS settings for FlashRouter DD-WRT in Windows Computer 2

3. Right click on the WiFi and/or ethernet adapter and select Properties.

Find Static DNS settings for FlashRouter DD-WRT in Windows Computer 3

4. Highlight Internet Protocol Version 4 (TCP/IPv4) and click Properties.

5. Delete the values entered for IP address, Subnet mask, Default gateway, Preferred DNS server, and Alternate DNS server.

6. Select Obtain an IP address automatically and Obtain DNS server address automatically.

7. Click OK.

Find Static DNS settings for FlashRouter DD-WRT in Windows Computer 4

Check for Static IP Address in Apple / Mac

1. Open System Preferences, and select Network.

Find Static DNS settings for FlashRouter DD-WRT Using a MAC Computer

2. Select the adapter that is connected via ethernet or wireless. This will vary based on your current connection.

3. Select Advanced.

Find Static DNS settings for FlashRouter DD-WRT Using a MAC Computer 2

4. Select the TCP/IP tab.

5. Set Configure IPv4 to Automatically.

Find Static DNS settings for FlashRouter DD-WRT Using a MAC Computer 4

6. Select the DNS field and highlight any DNS servers you see there. If they can be removed you should click the minus symbol below.

Find Static DNS settings for FlashRouter DD-WRT Using a MAC Computer 5

7. Click OK.

8. Click Apply.

Check for Static IP Address in iOS

1.  Open Settings

2. Select WiFi, and select the blue icon next to your current connection.

Select FlashRouters DD-WRT Wireless Network in order to Check Static IP Network Settings on iOS Mobile Device

3. Make sure Configure IP is set to Automatically.

Check Static IP Network Settings on iOS Mobile Device and set Configure IP to Automatic

Check for Static IP Address in Android

1. From the top of the screen, swipe down to display settings.

2. Select WiFi.

WiFi Icon and Settings in Android Mobile Device

3. Select your current network.

4. Select Advanced.

Advanced Settings Button in Android Mobile Device

5. Make sure that IP settings is set to DHCP.

Check Static IP DHCP Network Settings in Android Mobile Device

ExpressVPN Setup for Privacy Hero

· ·

Privacy Hero supports ExpressVPN using OpenVPN. To connect, you need your ExpressVPN Manual Configuration username and password and an OpenVPN (.ovpn) configuration file for your preferred server location.

Important: In Privacy Hero, choose Custom as the VPN provider. Upload the ExpressVPN .ovpn file and enter your separate Manual Configuration credentials, not your regular ExpressVPN website login.

Privacy Hero is cloud-managed, so you can complete setup from any computer, smartphone, or tablet with an internet connection. You do not need to be connected to Privacy Hero WiFi while changing the settings.

Get Your ExpressVPN Manual Configuration Credentials

ExpressVPN provides separate credentials for manual OpenVPN connections. These are different from your normal ExpressVPN website email and password.

  1. Open ExpressVPN Set Up Devices and sign in to your ExpressVPN account.
  2. In the left navigation, select Set Up Devices.
  3. Under Applications, expand Advanced setup and choose Manual Configuration.
  4. Find your unique Username and Password under Manual Configuration. Keep this tab open so you can copy them into Privacy Hero.

Important: Do not use your regular ExpressVPN account password, and do not share your manual configuration credentials publicly.

Download Your ExpressVPN OpenVPN Server File

Each available ExpressVPN location has its own OpenVPN configuration file. The file determines the server location used by Privacy Hero.

  1. On the same Manual Configuration page, locate the server regions, such as Americas, Europe, Asia Pacific, or Middle East & Africa.
  2. Expand your preferred region and download the UDP .ovpn file for an available location. Save it to the device you are using to configure Privacy Hero.

Only locations offered on your ExpressVPN Manual Configuration page can be used for this setup. To change locations later, download the corresponding .ovpn file and upload it to Privacy Hero.

Add ExpressVPN to Privacy Hero as a Custom VPN

ExpressVPN uses Privacy Hero’s Custom VPN configuration rather than a dedicated ExpressVPN provider option.

Upload the OpenVPN File and Enter Credentials

  1. Open app.privacyhero.com and sign in to your Privacy Hero account.
  2. Open the VPN section.
  3. Click Change beside the VPN provider and choose Custom.
  4. Choose OpenVPN if prompted, then upload the UDP .ovpn file downloaded from ExpressVPN.
  5. Copy the separate ExpressVPN Manual Configuration Username and Password into the corresponding Privacy Hero fields.
Privacy Hero Custom OpenVPN configuration showing file upload and manual username and password fields

Check the UDP Configuration and Connect

  1. If Privacy Hero displays the OpenVPN configuration in an editor, confirm that the downloaded UDP configuration specifies proto udp. If the directive is missing, add proto udp at the beginning of the configuration. Do not add a conflicting second protocol directive.
  2. Click Save to apply the configuration and establish the VPN connection.
  3. Confirm Privacy Hero displays Connected for the Custom OpenVPN connection.
Privacy Hero Custom OpenVPN configuration editor with proto udp directive

Verify Your ExpressVPN Connection

After Privacy Hero reports Connected, check that devices on the Privacy Hero network are actually using the VPN.

  1. Connect the testing device to the Privacy Hero WiFi or LAN network.
  2. Disconnect the ExpressVPN app or any other VPN application running directly on that device.
  3. Open a fresh private/incognito browser window.
  4. Visit ExpressVPN What Is My IP.
  5. Confirm the public IP address and approximate location correspond to the ExpressVPN server selected in your .ovpn file.

Important: You can manage Privacy Hero’s VPN settings from another network or cellular data. However, to verify the router’s VPN IP, the testing device must be connected to the Privacy Hero network. Running another VPN app on the device can produce double-VPN results.

Streaming Relocation and VPN Location

If Streaming Relocation is enabled for a supported streaming service, that service may use its Streaming Relocation region instead of the location defined in the ExpressVPN configuration file. See Privacy Hero Streaming Relocation.

ExpressVPN Not Connecting?

If Privacy Hero shows Failed, stays on Connecting, or displays a timeout error, try these checks:

  1. Confirm your ExpressVPN subscription is active and you entered the separate Manual Configuration username and password.
  2. Check that you selected Custom in Privacy Hero, rather than another VPN provider.
  3. Download a fresh UDP .ovpn file for an available ExpressVPN server location and upload it again.
  4. Check that the OpenVPN configuration uses proto udp without conflicting protocol directives.
  5. Temporarily disable the VPN Kill Switch while testing whether normal internet access works without the VPN, then restore your preferred Kill Switch setting.
  6. Try another ExpressVPN server location or reconnect the VPN.

No Internet After the VPN Disconnects?

The Privacy Hero VPN Kill Switch may intentionally block normal internet traffic when the VPN connection is unavailable. See Privacy Hero VPN Kill Switch: No Internet or WiFi Troubleshooting.

VPN Connected, but One Device Shows the Wrong IP?

If other devices show the correct VPN IP, check the affected device’s VPN apps, iCloud Private Relay, Private DNS, antivirus filtering, browser proxy/DNS settings, or other security software. See Device Settings That Can Interfere With Your Router VPN.

Related Privacy Hero Guides

ASUS Guest WiFi With or Without VPN: Setup Guide

· ·

On supported ASUS routers, you can create a separate WiFi network (SSID) that routes connected devices through a VPN profile, while another network uses the regular ISP connection. This is useful for streaming TVs, guests, work devices, and family members who need different VPN behavior.

The available controls depend on your ASUS model and firmware. Newer routers may call the feature Guest Network Pro or simply Network; older routers may only have Guest Network, which does not offer the same VPN-by-SSID options.

What You Need Before Starting

  1. Connect to your ASUS router and open http://www.asusrouter.com or its LAN IP. For login details, see AsusWRT Router Access Guide.
  2. For a VPN WiFi network, first set up and verify at least one connected VPN profile under VPN > VPN Fusion. Choose a supported VPN provider from the AsusWRT VPN Setup Guides, then review How to Use ASUS VPN Fusion: Assign Devices and Multiple VPNs for routing options.
  3. Look for Guest Network Pro, Network, or VPN Network in your ASUS firmware. If you only see the traditional Guest Network screen, read the legacy note below before proceeding.

Create a Dedicated WiFi Network That Uses the VPN

Preferred route for supported ASUS models: create a VPN Network SSID so all devices joining that SSID use the chosen VPN without individual device assignments.

  1. Open Guest Network Pro > VPN Network, or the equivalent Network > Add Network > VPN Network menu in newer firmware.
  2. Choose a recognizable WiFi name such as Home-VPN and a strong WiFi password.
  3. Select the configured, connected VPN Fusion client/profile and enable VPN routing for that network.
  4. Review any options for local-network access, guest isolation, and bands, then click Apply.
  5. Connect a test device to the new Home-VPN WiFi SSID and check its public IP.

ASUS official walkthrough: Guest Network Pro / VPN Network Setup.

Alternative: Assign a VPN to an Existing Guest Network Pro SSID

  1. In Guest Network Pro / Network, open the existing Guest Network profile.
  2. Select the VPN tab, enable VPN routing, and choose your existing VPN Fusion client.
  3. Click Apply, reconnect a device to the guest SSID, and verify the VPN IP.

ASUS also documents this path: Assign a VPN to Guest Network Pro.

Create a Separate WiFi Network Without a VPN

Use a guest/secondary network routed through the regular ISP internet connection for devices that should not use the VPN.

  1. Under Guest Network Pro / Network, add a normal Guest Network or other suitable network profile (not the VPN Network preset).
  2. Set a clear name such as Home-ISP and secure it with a strong password.
  3. In that network profile’s VPN tab, leave the VPN assignment disabled or choose the Internet/ISP path if your firmware offers it.
  4. Check your VPN Fusion default connection and device policies. If a VPN is set to Apply to all devices, simply turning off the Guest Network’s VPN toggle may not guarantee an ISP bypass on every firmware. Configure an explicit ISP/bypass route where supported.
  5. Save, join the Home-ISP network with a test device, and confirm the public IP matches the ISP connection.

Confirm Each WiFi Network Uses the Intended Internet Route

  1. Connect a phone or laptop to the VPN WiFi SSID. Disable any VPN app or iCloud Private Relay on the device for this test.
  2. Visit WhatIsMyIPAddress.com and note the public IP and location. This should reflect your selected VPN endpoint.
  3. Disconnect and join the ISP WiFi SSID. Repeat the IP check; it should now show the ISP’s public internet route.
  4. If both SSIDs show the same IP, review the VPN Fusion default profile, guest-network VPN assignment, and any device-specific rules.

Common Issues and What to Check

I only see “Guest Network,” not “Guest Network Pro” or “VPN Network”

Your router may use older firmware or lack this feature. Traditional Guest Network creates a separate WiFi SSID, but the VPN routing option may not exist. Use VPN Fusion device assignments as an alternative rather than assuming the guest network automatically bypasses or uses the VPN.

Every network still uses the VPN

Check whether Apply to all devices is enabled in VPN Fusion. If it is, verify that the guest profile actually overrides the default route on your firmware. You may need an explicit per-network or per-device ISP rule.

A phone reports the wrong IP although the guest VPN profile is correct

Temporarily disable device-level VPN apps, iCloud Private Relay / Limit IP Address Tracking, browser proxy, or Private DNS settings, then reconnect. See Device Settings That Interfere With Router VPN.

Guest devices cannot reach local printers or other LAN devices

Check the guest network’s intranet access / network isolation settings. Changing isolation affects LAN access, not necessarily VPN selection. Keep guests isolated unless LAN access is actually needed.

Upgrade your ASUS router

Explore the Latest WiFi 7 ASUS FlashRouters

Looking for a newer ASUS router? Browse WiFi 7 models available from FlashRouters and compare features to find the right fit for your home or office. VPN Fusion and other features vary by router model and firmware.

Shop ASUS WiFi 7 Routers →

Privacy Hero NordVPN Not Connecting or Showing Timeout Errors

· ·

If NordVPN will not connect on Privacy Hero, shows a timeout error, remains stuck on Connecting, or displays Failed, the Privacy Hero router itself may still be working normally.

NordVPN connections can occasionally stop working when servers are placed into maintenance, removed or cycled out of service, account credentials change, or a previously saved NordVPN access token or manual service credential is no longer valid.

Start by confirming that Privacy Hero has normal internet access, then troubleshoot the NordVPN connection.

Jump to a Section

First: Confirm Privacy Hero Has Internet

Before changing your NordVPN settings, confirm that Privacy Hero itself has normal internet access.

  1. Open app.privacyhero.com.
  2. Open the VPN section.
  3. If the VPN Kill Switch is enabled, temporarily turn it Off.
  4. Turn the failed NordVPN connection off.
  5. Connect a device to the Privacy Hero network.
  6. Test normal internet access.

If internet access works normally with NordVPN and the Kill Switch disabled, the underlying Privacy Hero internet connection is working. Continue troubleshooting the NordVPN connection.

If your internet stopped working because NordVPN failed while the VPN Kill Switch was enabled, follow our Privacy Hero VPN Kill Switch: No Internet or WiFi Troubleshooting guide.

Reconnect NordVPN

A temporary NordVPN server or connection issue may resolve without changing your account information.

  1. Open the VPN section at app.privacyhero.com.
  2. Turn the NordVPN connection off.
  3. Wait a few seconds.
  4. Turn NordVPN back on.
  5. Allow the connection time to establish.
  6. Check whether the VPN status changes to Connected.

If NordVPN still shows Failed, Connecting, or a timeout error, continue with the steps below.

Try Another NordVPN Server

NordVPN regularly maintains, replaces, and cycles servers in its network. A specific NordVPN server that worked previously may eventually be taken offline, removed, or temporarily unavailable.

If your Privacy Hero NordVPN connection is configured to use a specific server and suddenly stops working, try another server or return to the normal country selection.

  1. Open app.privacyhero.com.
  2. Open the VPN section.
  3. Select your NordVPN connection.
  4. If you previously entered a specific NordVPN server under Advanced Options, remove or replace that server.
  5. Select the country or location you want to use.
  6. Save the settings.
  7. Reconnect NordVPN.
  8. Check whether the status changes to Connected.

If you specifically need to use an individual NordVPN server, make sure that server is still active before continuing to use it.

Important: A previously working specific server should not be assumed to remain available indefinitely. NordVPN may change its server network over time.

Update Your NordVPN Token for NordLynx

Privacy Hero uses a NordVPN access token to authenticate NordLynx connections.

If the saved token is expired, revoked, replaced, or otherwise no longer valid, NordLynx may show Failed, Connecting, or a timeout error.

Generating a new token is a good troubleshooting step if your NordVPN account information has changed or the existing token is no longer working.

  1. Sign in to your NordVPN account.
  2. Open the NordVPN Access Tokens page.
  3. Generate a new access token.
  4. Select Doesn’t expire if NordVPN provides that option.
  5. Copy the new token.
  6. Open app.privacyhero.com.
  7. Open the NordVPN settings.
  8. Confirm that NordLynx is the selected protocol.
  9. Replace the existing token with the newly generated token.
  10. Save the settings.
  11. Reconnect NordVPN.

Important: NordVPN access tokens are sensitive account credentials. Do not post or share your token publicly.

For complete setup instructions, see Privacy Hero NordVPN / NordLynx Setup.

Update NordVPN Manual Service Credentials for OpenVPN

If you are using OpenVPN instead of NordLynx, Privacy Hero uses NordVPN’s Manual Service Credentials.

These are different from the email address and password you normally use to sign in to the NordVPN website or application.

If the saved credentials are no longer valid, update them:

  1. Sign in to your NordVPN account.
  2. Open NordVPN Manual Service Credentials.
  3. Copy the current service username and password.
  4. Open app.privacyhero.com.
  5. Open your NordVPN settings.
  6. Confirm that OpenVPN is the selected protocol.
  7. Replace the existing manual service credentials with the current credentials from NordVPN.
  8. Save the settings.
  9. Reconnect NordVPN.

Do not enter your regular NordVPN website email address and password in place of the manual service credentials.

Did You Recently Change Your NordVPN Account Information?

If NordVPN stopped connecting after an account change, update the authentication information stored in Privacy Hero.

This is especially important after changes such as:

  • Changing your NordVPN account password.
  • Changing or updating NordVPN account security settings.
  • Generating or replacing NordVPN access tokens.
  • Changes to NordVPN manual service credentials.
  • Renewing, changing, or restoring your NordVPN subscription.

The credentials used by Privacy Hero depend on the VPN protocol:

  • NordLynx: Uses a NordVPN access token.
  • OpenVPN: Uses NordVPN manual service credentials.

Your regular NordVPN website login should not be entered as the router’s OpenVPN credentials.

If you are unsure whether the existing authentication information is still valid, retrieve current credentials directly from your NordVPN account and update Privacy Hero.

Confirm Your NordVPN Subscription Is Active

Privacy Hero cannot establish a NordVPN connection if the NordVPN account being used no longer has active VPN service.

Sign in to your NordVPN account and confirm that your subscription is active before continuing with server, token, or credential troubleshooting.

Try Another VPN Protocol

If your NordVPN account, credentials, and server selection are correct but the connection still fails, try another NordVPN protocol available in Privacy Hero.

For example, if NordLynx is not connecting, testing OpenVPN can help determine whether the issue is specific to the protocol or authentication method.

Remember that changing protocols also changes the required NordVPN authentication:

  • NordLynx requires a NordVPN access token.
  • OpenVPN requires NordVPN manual service credentials.

Important: Do Not Run Two VPNs at Once

Do not leave the NordVPN application connected directly on your phone or computer while testing the Privacy Hero VPN.

Running a VPN application on the device while also routing that device through the Privacy Hero VPN creates a double-VPN connection and can cause routing, connectivity, or IP-location problems.

Disconnect the device-level NordVPN app before testing the router VPN.

Verify the NordVPN Connection

Once Privacy Hero displays NordVPN as Connected:

  1. Connect your device to the Privacy Hero WiFi.
  2. Make sure the NordVPN app on the device is disconnected.
  3. Open a fresh private/incognito browser window.
  4. Visit NordVPN What Is My IP.
  5. Confirm that the public IP address and location correspond to your selected NordVPN location.
  6. Test several websites or applications.

If you use the Privacy Hero VPN Kill Switch, enable it only after confirming that NordVPN is connected and working.

NordVPN Is Connected but One Device Shows the Wrong IP

If Privacy Hero shows NordVPN as Connected and other devices display the correct VPN IP, the NordVPN connection itself is likely working.

Check the affected device’s Privacy Hero VPN assignment and review any VPN, privacy, DNS, browser, antivirus, firewall, or security settings running directly on that device.

See Device Privacy, DNS, VPN, and Security Settings That Can Interfere With Your Router VPN.

Related Privacy Hero Guides

How do I reset and reconfigure my FlashRouter?

· ·

When is a router reset needed?

A reset of the FlashRouter should only be performed in the following instances:

  • You have exhausted all other troubleshooting methods and cannot access your router settings.
  • A backup file was saved of your previously working settings.
  • Username and password to access the FlashRouter’s settings are not working.
  • Power light on the router is blinking steadily.
  • Firmware upgrade was performed with Reset to Default settings selected.

Reset Router

Asus FlashRouters:

  1. While the router is powered off press and hold the WPS button on the back or side of the router. Power up the router while continuing to hold the WPS. Continue to hold for 15 seconds as the router powers on (note this could be up to 45 seconds on some models before lights flash).
  2. You will see the lights on the router flashing steadily and this is how you know you have reset the router.
  3. Let the router sit for about a minute and then reboot the router.

Linksys and Netgear FlashRouters:

  1. While the router is plugged in, find the reset button located on the back of the router. You will need a pin or pencil to hold down the button for 15 seconds.
  2. You will see the lights on the back of the router flash simultaneously and this is how you know you have reset the router.
  3. Let the router sit for about a minute and then reboot the router.

Access Router Settings

1. Connect to the FlashRouter’s network via ethernet cable or wireless.

The wireless network will appear as “dd-wrt” and will likely not require a password to join. If it does require a password to join the password will be the default wireless password found on the bottom of the router.

2. Open your web browser and enter 192.168.1.1 in the URL.

Reset FlashRouters DD-WRT Settings Back to Default Settings

3. Delete the dots and enter the new administration login in the Router Username, Router Password, and Re-enter to confirm fields.

TYPE CAREFULLY when setting the administration login as a typo will result in needing to reset the router again.

Change Local IP Address and DNS

Navigate to Setup > Basic Setup

1. Set the Local IP Address to 192.168.11.1

2. Set the Static DNS 1 to 8.8.8.8

3. Set the Static DNS 2 to 8.8.4.4

4. Set the Static DNS 3 to 208.67.220.220

Enter New Local IP Address and DNS Servers After FlashRouter DD-WRT Reset

CLICK SAVE

Setup WiFi

Navigate to Wireless > Basic Settings

Find your FlashRouter model in the WiFi Setup section and replicate the wireless settings on this page.

CLICK APPLY SETTINGS

REBOOT ROUTER

Connect to the FlashRouter's network

You will be able to connect to the newly setup wireless network using the details you set. The router will now be accessible at 192.168.11.1

Back up your settings

  1. Click the Backup button.
  2. A file named nvrambak.bin will be saved to your computer.
  3. You can load nvrambak.bin to restore your settings in the event of a reset.

Privacy Hero VPN Kill Switch Troubleshooting: No Internet or WiFi

· ·

If your Privacy Hero router suddenly loses internet access, devices report that WiFi has no internet, or devices will not stay connected after a VPN failure, the VPN Kill Switch may be blocking normal internet traffic.

The VPN Kill Switch is designed to prevent traffic from passing through Privacy Hero without VPN protection. If the VPN disconnects or fails while the Kill Switch is enabled, normal internet access is intentionally blocked.

Important: You can still access app.privacyhero.com to manage Privacy Hero, turn off the Kill Switch, or repair the VPN connection.

Privacy Hero is cloud-managed, so you do not need to be connected to the Privacy Hero WiFi to change these settings. You can also access the dashboard using cellular data, your main router’s WiFi, or another internet connection as long as Privacy Hero remains connected to the internet and Privacy Hero cloud.

Jump to a Section

Common Privacy Hero Kill Switch Symptoms

A failed VPN connection combined with an enabled Kill Switch can make the Privacy Hero network appear unavailable even though the router itself may still be functioning.

Common symptoms include:

  1. Your device connects to Privacy Hero WiFi but websites and apps will not load.
  2. Your phone, computer, television, or streaming device reports that WiFi has no internet.
  3. A device refuses to remain connected because it detects that the WiFi network does not currently provide normal internet access.
  4. Your phone automatically switches from Privacy Hero WiFi to cellular data or another saved WiFi network.
  5. Your computer displays “No Internet” or “Connected without Internet.”
  6. The VPN displays Failed, Disconnected, Connecting, or a timeout error.
  7. Privacy Hero was working normally and suddenly stopped providing internet access.

If the Privacy Hero WiFi network itself is completely missing and cannot be detected by any device, that is different from normal Kill Switch behavior. Continue with WiFi or router connectivity troubleshooting instead.

Restore Internet Access

The fastest way to determine whether the Kill Switch is responsible is to temporarily disable it and test Privacy Hero without VPN.

  1. Open app.privacyhero.com.
  2. Sign in to your Privacy Hero account.
  3. Open the VPN section.
  4. Check the current VPN status.
  5. If the VPN shows Failed or Disconnected, turn the VPN Kill Switch Off.
  6. Turn the failed VPN connection off.
  7. Connect a device to the Privacy Hero network.
  8. Test normal internet access.

If internet access returns with the VPN and Kill Switch disabled, Privacy Hero’s basic internet connection is working and the problem is isolated to the VPN connection.

Important: Disabling the Kill Switch allows normal non-VPN internet traffic through Privacy Hero. Leave it disabled only while troubleshooting if continuous VPN protection is required.

VPN Still Fails to Connect

Do not turn the Kill Switch back on until the VPN is connected and working.

If you are using NordVPN and the VPN shows Failed, Connecting, or a timeout error, continue with our dedicated Privacy Hero NordVPN Not Connecting or Showing Timeout Errors guide.

That guide covers:

  • Selecting a different NordVPN server.
  • Replacing a failed Auto Country connection with a specific NordVPN server.
  • Generating a new NordVPN NordLynx access token.
  • Verifying NordVPN OpenVPN manual service credentials.
  • Avoiding double-VPN conflicts while testing.

If you use another VPN provider, try another available VPN server or protocol and verify that your VPN account and credentials remain active.

Verify the VPN Before Re-Enabling the Kill Switch

Once the VPN reconnects:

  1. Confirm Privacy Hero displays the VPN as Connected.
  2. Connect a device to the Privacy Hero WiFi.
  3. Make sure a separate VPN application is not connected directly on the testing device.
  4. Check your public IP address.
  5. Confirm the IP address and location reflect the VPN server you selected.
  6. Test normal websites and applications.
  7. Return to Privacy Hero and enable the VPN Kill Switch.

If you enable the Kill Switch while the VPN is still failing, normal internet access will be blocked again.

What If Privacy Hero Appears Offline?

If Privacy Hero shows Offline in the dashboard, the router may not currently be communicating with the Privacy Hero cloud.

  1. Confirm Privacy Hero is powered on.
  2. Confirm the Ethernet cable from your ISP gateway or primary router is connected to the Privacy Hero WAN/Internet port.
  3. Confirm your ISP gateway or primary router has working internet access.
  4. Restart Privacy Hero and allow it to finish booting.
  5. Using another internet connection, open app.privacyhero.com.
  6. Check whether Privacy Hero returns online.

If the router returns online, check the VPN and Kill Switch status before enabling the VPN again.

Privacy Hero Has a WAN IP but Devices Have No Internet

Privacy Hero can receive an IP address from your ISP gateway while the Kill Switch is still blocking normal internet traffic.

Before changing IP Passthrough, bridge mode, firewall settings, or other ISP gateway settings:

  1. Check the VPN status.
  2. Check whether the Kill Switch is enabled.
  3. Disable the VPN and Kill Switch temporarily.
  4. Test internet access again.

If internet access returns, troubleshoot the VPN connection rather than changing the ISP gateway configuration.

Kill Switch, WiFi, or WAN Problem?

WiFi Connects but There Is No Internet

If the VPN shows Failed or Disconnected and the Kill Switch is enabled, the Kill Switch is likely blocking normal internet traffic.

Device Will Not Stay Connected to Privacy Hero WiFi

Some devices automatically leave a WiFi network when they detect that it does not provide internet access. Use cellular data or another internet connection to access app.privacyhero.com and check the VPN and Kill Switch.

Privacy Hero WiFi Is Completely Missing

The Kill Switch does not normally cause the WiFi network itself to stop broadcasting. If no devices can detect the Privacy Hero WiFi network, troubleshoot the WiFi or router connection separately.

Privacy Hero Is Not Receiving a WAN IP Address

Check the Ethernet connection between Privacy Hero and your ISP gateway or primary router and confirm the upstream internet connection is working.

VPN Shows Connected but One Device Has the Wrong IP

If the VPN works correctly on other devices, the Kill Switch is probably not the issue. Check that device’s Privacy Hero VPN assignment and its own VPN, privacy, DNS, or security settings.

See Device Privacy, DNS, VPN, and Security Settings That Can Interfere With Your Router VPN.

Frequently Asked Questions

Why does Privacy Hero WiFi say no internet?

If the VPN has failed while the Kill Switch is enabled, normal internet traffic is intentionally blocked. Your device may therefore report that Privacy Hero WiFi has no internet.

Can I access Privacy Hero settings while the Kill Switch is blocking internet?

Yes. Open app.privacyhero.com. You can use the Privacy Hero network, cellular data, your main router’s WiFi, or another internet connection.

Do I have to be connected to Privacy Hero WiFi to change the settings?

No. Privacy Hero is cloud-managed and can be managed remotely while the router remains connected to the Privacy Hero cloud.

Why does my phone keep leaving the Privacy Hero WiFi?

Some phones automatically switch to cellular data or another saved WiFi network when the current WiFi connection does not provide normal internet access.

Should I turn the Kill Switch back on immediately?

Only after the VPN is connected and you have confirmed that your internet traffic is using the VPN.

Related Privacy Hero Guides

SmartDNSProxy SmartDNS Setup

· ·

SmartDNSProxy offers a SmartDNS service for unblocking geo-restricted content without the encryption of a VPN service. SmartDNS routes DNS servers to different regions which “tricks” the website to allow access to previously restricted content.

SmartDNS does not change your IP Address or provide the encryption that a VPN connection does. This can result in faster speeds and unblocked content.

SmartDNS and VPN should not be configured at the same time. When using a SmartDNS connection, make sure to disable your VPN connection on the FlashRouter.

Register your IP Address

If you are not already a SmartDNSProxy user Sign Up Now.

Click on Sign Up and fill in the requested information.

SmartDNSProxy SmartDNS Account Sign Up For DD-WRT FlashRouter

Access the e-mail you entered and Verify your new account.

SmartDNSProxy SmartDNS Activate DNS for DD-WRT FlashRouter

Your account will now be verified.

Activate SmartDNSProxy SmartDNS Service and Subscription

Login to SmartDNSProxy

SmartDNSProxy Server Location Addresses for FlashRouter DD-WRT Settings

Visit SmartDNSProxy’s DNS servers list and note the DNS servers of the location you would like to access content from.

Enter SmartDNSProxy SmartDNS servers on your FlashRouter

Navigate to Setup > Basic Setup

  1. Scroll down to Network Address Server Settings (DHCP).
  2. Enter in any combination of SmartDNSProxy SmartDNS servers you noted into Static DNS fields 1 and 2.
  3. Click Apply Settings at the bottom of the page.
  4. Reboot the FlashRouter.

Once the router is fully booted back up, you can access your desired regional content on any device that connects to the FlashRouter’s network.

Getflix SmartDNS Setup

· ·

Getflix offers a SmartDNS service for unblocking geo-restricted content without the encryption of a VPN service. SmartDNS routes DNS servers to different regions which “tricks” the website to allow access to previously restricted content.

SmartDNS does not change your IP Address or provide the encryption that a VPN connection does. This can result in faster speeds and unblocked content.

SmartDNS and VPN should not both be configured at the same time. When using a SmartDNS connection make sure to disable your VPN connection on the FlashRouter.

Login to Getflix

If you are not already a Getflix user Sign Up Now.

New customer Signup for GetFlix SmartDNS Service

Login to Getflix’s website login page.

Visit Getflix’s DNS servers list page and note the DNS servers of the location you would like to access content from.

Getflix DNS Server Location Addresses for FlashRouter DD-WRT Settings

Enter Getflix SmartDNS servers on your FlashRouter

Navigate to Setup > Basic Setup

  1. Scroll down to Network Address Server Settings (DHCP).
  2. Enter in any combination of Getflix SmartDNS servers you noted into Static DNS fields 1 and 2.
  3. Click Apply Settings at the bottom of the page.
  4. Reboot the FlashRouter.

Register your IP Address

When the router is fully booted back up visit your Getflix user dashboard and make sure your IP Address is registered with Getflix. If it is not click Force IP Update.

Register IP Address for Getflix use on FlashRouter DD-WRT

Once you are successfully registered you can now access your desired regional content on any device that connects to the FlashRouter’s network.

Wireless Guest Network Setup – Bridged (Advanced)

· ·

If you would like to prevent visitors from connecting to your main WiFi network then you can create a Bridged Guest Network that will prevent access to the main router. This setup also allows you to create different rules for different WiFi SSID’s in your home ranging from QoS controls, access restrictions, VPN network segmentation, and more.

Preparing for Wireless Guest Network Setup

If you have a Dual-band or Tri-Band router you can setup a WiFi Guest Network, creating a separate VLAN (virtual local area network) for your visitors, or in order to segment your VPN networks on any band you like. We recommend using the 2.4GHz network for your DD-WRT Guest Wireless Network so it is compatible with the most possible WiFi devices. Setting up a guest network for visitors in your home allows you to keep them off of your main WiFi network.

We recommend performing this setup while connected to the FlashRouter via ethernet cable. If your computer does not have an ethernet port and you must proceed via wireless connection to the FlashRouter pay attention to the wireless connection as you may need to rejoin the FlashRouter’s network after making changes.

DD-WRT Router Setup for Wireless Guest Network

Enter Wireless settings

Navigate to Wireless > Basic Settings

Bridged Wireless Guest Network Setup on DD-WRT FlashRouter – Setting SSID for Guest Network
  1. Under the 2.4GHz or 5GHz Interface click the Add button.
  2. In the Wireless Network Name (SSID) field enter the unique network name of the guest network.
  3. Click Save.

Enter Wireless Security settings

Navigate to Wireless > Wireless Security

Bridged Wireless Guest Network Setup on DD-WRT FlashRouter – Setting Guest Network Wireless Password
  1. Duplicate the wireless security settings that are set for the other bands for the newly created virtual interface.
  2. Click Apply Settings.
  3. Reboot your router.

Create Bridge

Navigate to Setup > Networking

Bridged Wireless Guest Network Setup on DD-WRT FlashRouter – Create Bridge
  1. Under Create Bridge click Add. Name the newly created bridge br1.
  2. Click Apply Settings

Assign to Bridge

Bridged Wireless Guest Network Setup on DD-WRT FlashRouter – Assign Bridge
  1. Under Assign to Bridge select br1 from the Assignment dropdown. Select wl1.1 or ath1.1 depending on your router model.
  2. Click Apply Settings.

Depending on the router model and WiFi band you are using, the wireless interfaces will be labelled differently.

This setting can be labelled wl1.1, ath0.1, wl2.1, and so on. Make sure when you get up to the bridge assignment section that you are using the correct guest network Virtual Interface.

Network Configuration br1

Bridged Wireless Guest Network Setup on DD-WRT FlashRouter – Configure Bridge DNS Redirection
  1. Under Network Configuration br1 select Enable for Forced DNS Redirection.
  2. Set Optional DNS Target to 208.67.220.220
  3. Set IP Address to 192.168.12.1
  4. Set Subnet Mask to 255.255.255.0
  5. Click Apply Settings.

Multiple DHCP Server

Bridged Wireless Guest Network Setup on DD-WRT FlashRouter – Configure DHCP Server Settings
  1. Under Multiple DHCP Server click Add.
  2. Set the first dropdown to br1.
  3. Click Apply Settings.
  4. Reboot your router.

Firewall Rules

Navigate to Administration > Commands

  1. Copy the fire script from below and paste into the empty Commands shell
  2. Click Save Firewall.
  3. Wait one minute and then reboot your router.

iptables -I FORWARD -i br1 -o br0 -m state –state NEW -j DROP
iptables -I FORWARD -i br0 -o br1 -m state –state NEW -j DROP
iptables -I INPUT -i br1 -p tcp –dport telnet -j REJECT –reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp –dport ssh -j REJECT –reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp –dport www -j REJECT –reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp –dport https -j REJECT –reject-with tcp-reset

You will now have a working Bridged Guest Network on the FlashRouter. By inputting the firewall rules, this will also prevent any guests on your network from gaining access to your router settings.

Back up your settings

Navigate to Administration > Backup

  1. Click the Backup button.
  2. A file named nvrambak.bin will be saved to your computer.
  3. You can load nvrambak.bin to restore your settings in the event of a reset.

TROUBLESHOOTING

Still having issues? Visit our Troubleshooting section to diagnose common problems here.

Troubleshoot Here

Wireless Repeater Bridge Setup

· ·

If you need to extend your connection capabilities and you are not able to wire directly into your main router, you can setup a FlashRouter as a Wireless Repeater Bridge. In Wireless Repeater Bridge mode the FlashRouter connects to your main router on the same subnet via WiFi, and then transmits your internet signal via the FlashRouter for internet access anywhere in your home or office.

Preparing for Wireless Repeater Bridge Setup

Verify your wireless information

In order to setup your FlashRouter as a Wireless Repeater Bridge, you will need the exact SSID and password of your existing wireless network. Make sure you have this information before proceeding.

We recommend using a 2.4GHz network to repeat as this network will have more range. Be sure to click Add under the 2.4GHz settings and not the 5GHz settings.

Locate the Local IP Address of the existing wireless network

Locate the Local IP Address of the existing router that the FlashRouter will be bridged to.

DD-WRT Router Setup for Wireless Repeater Bridge

Disable Firewall

Navigate to Security > Firewall

Wireless Repeater Bridge Setup on FlashRouter DD-WRT - Disable Firewall and Enable Filter Multicast
  1. Set SPI Firewall to Disable.
  2. Uncheck all boxes except for Filter Multicast.
  3. Click Save.

Disable DNSmasq

Navigate to Services > Services

Wireless Repeater Bridge Setup on FlashRouter DD-WRT - Disable DNSMasqButton
  1. Set DNSmasq to Disable.
  2. Click Save.

Enter Wireless settings

Navigate to Wireless > Basic Settings

Select Add in the Virtual Interface area.

Wireless Repeater Setup on DD-WRT FlashRouter - Add Virtual Interface

In the Wireless Physical Interface settings for the 2.4GHz network set the Wireless Mode to Repeater Bridge.

Change the Wireless Network Name (SSID) to match exactly with the Wireless Network Name of the network that you will bridge to.

Set Wireless Mode to Repeater Bridge in FlashRouter DD-WRT Basic Wireless Settings Page

In the Virtual Interfaces settings change the Wireless Network Name (SSID) to FlashRouter24 or any other unique SSID.

Wireless Repeater Setup on DD-WRT FlashRouter - Set SSID for Repeated Band

CLICK SAVE

Enter Wireless Security settings

Navigate to Wireless > Wireless Security

Wireless Repeater Setup on DD-WRT FlashRouter - Set Wireless Password
  1. Duplicate the wireless security settings that are set for the other bands for the newly created virtual interface.
  2. Change the WPA Shared Key to match exactly with the Wireless Password of the network that you will bridge to.
  3. Click Save.

Change the FlashRouter's Local IP Address

Navigate to Setup > Basic Setup

Wireless Repeater Bridge Setup on FlashRouter DD-WRT - Set Local Router IP, Gateway, Local DNS
  1. Set the Local IP Address to a different address on the same subnet as the existing network that you noted early. (example: if the existing network is 192.168.1.1 then set the Local IP Address to 192.168.1.2)
  2. Set the Gateway to the Local IP Address of the existing network. (example: 192.168.1.1)
  3. Set the Local DNS to the Local IP Address of the existing network. (example: 192.168.1.1)
  4. Click Save.

Change the FlashRouter's Operating Mode

Navigate to Setup > Advanced Routing

Set Operating Mode to Router in FlashRouter DD-WRT Basic Wireless Settings Page
  1. Set the Operating Mode to Router.
  2. Click Apply Settings.

Reboot your FlashRouter

Power off the FlashRouter for 30 seconds and then power it back on. When it boots back up you will be able to access the FlashRouter’s settings at the new Local IP Address that you set. Your existing network and the FlashRouter’s network will now be bridged wirelessly.

Back up your settings

Navigate to Administration > Backup

  1. Click the Backup button.
  2. A file named nvrambak.bin will be saved to your computer.
  3. You can load nvrambak.bin to restore your settings in the event of a reset.

TROUBLESHOOTING

Still having issues? Visit our Troubleshooting section to diagnose common problems here.

Troubleshoot Here

Mullvad WireGuard Setup

· ·

Preparing for Mullvad WireGuard Setup

Verify your Mullvad login information

If you are not already a Mullvad user Sign Up Now.

Log in to your account on the Mullvad website.

Mullvad Login

Select Manage ports and WireGuard Keys displayed on the account page.

Mullvad Manage ports and WireGuard Keys

DD-WRT Router Setup for Mullvad WireGuard

Navigate to Setup > Tunnels 

Enter Mullvad WireGuard settings

1. Click Add Tunnel.

2. Set Tunnel to Enable.

Setup - Tunnel - Enable Tunnel

3. Select Wireguard from the dropdown.

Setup - Tunnel - Select Wireguard

4. Click Add Peer.

Setup - Tunnel - Add Peer

5. Set Endpoint to Enable.

Setup - Tunnel - Enable Endpoint

6. Set Router Allowed IP’s via tunnel and Use Pre-shared Key to Disable.

Setup - Tunnel - Disable Preshare Key and Allow IP

7. Click Generate Key.

Setup - Tunnel - Generate Key

8. Set Advanced Settings to Enable.

Setup - Tunnel - Enable Advanced Settings

9. Copy the Local Private Key.

Setup - Tunnel - Copy Local Private Key

10. In a new tab (leave the DD-WRT settings opened), go to your Mullvad Account and click Manage Ports and WireGuard Keys.

Mullvad Account - Manage ports and Wireguard Keys

11. Click WireGuard configuration file.

Mullvad - Wireguard configuration file

12. Select Linux as your Platform.

Mullvad - Select Linux

13. Click Manage Keys.

Mullvad - Manage Keys

14. Paste the copied Local Private key to the Manage WireGuard Keys field and click Import Keys.

Mullvad - Import Key

15. Select your Country, City, and Server number that you want to connect to.

Mullvad - Select Location

16. Click Advanced Settings.

Mullvad - Advanced Settings

17. Set the Tunnel Traffic to Only IPv4.

Mullvad - Only IPv4

18. Click Download File.

Mullvad - Download Config

19. Open the config file that was downloaded to your computer with NotePad or Notepad++ for Windows or TextEdit for Mac.

20. In the downloaded config file under [Interface] enter the Address into the IP Addresses/Netmask(CIDR) field in the DD-WRT settings.

Config File - Copy IP Address
Setup - Tunnel - IP Address Netmask Note

Certain DD-WRT builds will show two separate fields here: IP Address and Subnet Mask. If that is the case set the IP Address field to the Address without the /32 added and set the Subnet Mask to 255.255.255.255

21. In the config file under [Peer] copy the PublicKey and paste it into the Peer Public Key field in the DD-WRT Settings.

Config File - Copy PublicKey
Setup - Tunnel - Paste Public Key

22. In the config file under [Peer] copy the Endpoint and paste it into the Endpoint Address field.

Config File - Endpoint
Setup - Tunnel - Endpoint Address

23. At the bottom of the page click Save and then click Apply Settings.

Enter Mullvad WireGuard Commands

Navigate to Administration > Commands

1. Copy and paste the text below and click Save Startup.

sleep 30
echo "Update route table on startup..."
WGSERVER=$(/usr/sbin/nvram get oet1_rem0)
WANGW=$(/usr/sbin/nvram get wan_gateway)
WANIF=$(/usr/sbin/nvram get wan_iface)
route add -host $WGSERVER gw $WANGW dev $WANIF
route del default
route add default dev oet1
ip route flush cache
mkdir -p /tmp/etc/config
ln -s /tmp/custom.sh /tmp/etc/config/wg-route-fix.wanup
echo "... Done route table update."

2. Copy and paste the text below and click Save Custom.

#!/bin/sh
sleep 5
echo "Update route table on wanup ..."
WGSERVER=$(/usr/sbin/nvram get oet1_rem0)
WANGW=$(/usr/sbin/nvram get wan_gateway)
WANIF=$(/usr/sbin/nvram get wan_iface)
route add -host $WGSERVER gw $WANGW dev $WANIF
route del default
route add default dev oet1
ip route flush cache
echo "... Done route table update."

3. Copy and paste the text below and click Save Firewall.

WANIF=$(/usr/sbin/nvram get wan_iface)
iptables -t nat -I POSTROUTING -o oet1 -j MASQUERADE
iptables -I FORWARD -i br0 -o $WANIF -m state –state NEW -j REJECT –reject-with icmp-host-prohibited
iptables -I FORWARD -i br0 -p tcp -o $WANIF -m state –state NEW -j REJECT –reject-with tcp-reset

Set Mullvad DNS servers

Navigate to Setup > Basic Setup

Set Static DNS 1 to 10.64.0.1

Set Static DNS 2 to 193.138.218.74

Setup - Basic Setup - Mullvad DNS

Click Apply Settings.

Reboot the FlashRouter

Navigate to Administration > Management

Scroll to the bottom of the page and click the red Reboot Router button. Wait for the FlashRouter to reboot and then reconnect.

Verify a successful Mullvad connection

Navigate to Setup > Tunnels

  1. You should see Endpoint, Latest handshake, and Transfer in the WireGuard status area.
  2. Visit Mullvad’s IP Check to verify your status as using Mullvad.

Back up your settings

Navigate to Administration > Backup

  1. Click the Backup button.
  2. A file named nvrambak.bin will be saved to your computer.
  3. You can load nvrambak.bin to restore your settings in the event of a reset.

TROUBLESHOOTING

Still having issues? Visit the VPN Troubleshooting section.

Troubleshoot Here

Privacy Hero Dashboard Not Updating or Showing Old Information

· ·

If the Privacy Hero dashboard is showing old information, a VPN status does not appear to update, settings you changed are not displaying correctly, or the dashboard behaves unexpectedly, your browser may be displaying cached Privacy Hero website data.

Before changing your router or VPN configuration again, open a fresh browser session and confirm that the dashboard is displaying the current information.

Start With a Private or Incognito Browser Window

The fastest test is to open the Privacy Hero dashboard in a new private or incognito browser window.

  1. Close any existing Privacy Hero dashboard tabs.
  2. Open a new private or incognito browser window.
  3. Visit app.privacyhero.com.
  4. Sign in to your Privacy Hero account.
  5. Check the router, VPN, device, or setting again.

If the correct information appears in the private browser window, the original browser session was likely displaying cached or stale website information.

Refresh the Privacy Hero Dashboard

If the dashboard has been open while you are changing VPN or router settings, refresh the page before assuming that a change failed.

  1. Refresh the Privacy Hero dashboard.
  2. Allow the page to finish loading.
  3. Return to the section you were changing.
  4. Check the current status again.

If the information still appears incorrect, sign out of Privacy Hero, close the browser tab, and sign back in through a fresh browser session.

Clear Cached Privacy Hero Site Data

If Privacy Hero works correctly in a private/incognito window but not in your normal browser window, clear the cached website data for Privacy Hero.

Browser menus vary, but look for settings related to:

  • Cached files and images.
  • Cookies and site data.
  • Website data.
  • Privacy and browsing data.

If your browser allows you to remove data for an individual website, clear the stored data for app.privacyhero.com rather than clearing your entire browser history.

Then reopen app.privacyhero.com, sign in again, and check the dashboard.

Try Another Browser or Device

If the dashboard still behaves unexpectedly, test it from another browser or device.

  1. Open app.privacyhero.com in another browser.
  2. Sign in using the same Privacy Hero account.
  3. Check whether the same router and settings appear correctly.

You can also test from another computer, phone, or tablet.

Privacy Hero is cloud-managed, so you do not need to be connected to the Privacy Hero WiFi to access the dashboard. You can use cellular data, another WiFi network, or another internet connection.

Disable Browser Extensions While Testing

Browser extensions can sometimes interfere with website login, scripts, or dashboard functions.

If the problem occurs only in one browser, temporarily test without extensions such as:

  • Ad blockers.
  • Privacy extensions.
  • Script blockers.
  • VPN or proxy extensions.
  • Security or filtering extensions.

A private/incognito window may disable some extensions automatically, depending on your browser configuration.

VPN Status Still Shows Failed or Connecting?

If a fresh browser session confirms that Privacy Hero is actually reporting the VPN as Failed, Connecting, Disconnected, or showing a timeout error, the problem is no longer just a browser display issue.

NordVPN users should continue with Privacy Hero NordVPN Not Connecting or Showing Timeout Errors.

No Internet After the VPN Failed?

If the dashboard confirms that the VPN has failed and your Privacy Hero network also has no internet access, check whether the VPN Kill Switch is enabled.

See Privacy Hero VPN Kill Switch: No Internet or WiFi Troubleshooting.

One Device Shows the Wrong VPN IP?

If Privacy Hero shows the VPN as connected and working but only one device shows an unexpected IP address or location, the browser cache is probably not the main issue.

Check the device for its own VPN application, Private Relay, Private DNS, browser Secure DNS, antivirus, firewall, or other network settings.

See Device Settings That Can Interfere With Your Router VPN.

Related Privacy Hero Guides

IVPN WireGuard Setup

· ·

Preparing for IVPN WireGuard Setup

Verify your IVPN login information

If you are not already a IVPN user Sign Up Now.

Log in to your account on the IVPN website.

IVPN website login

DD-WRT Router Setup for IVPN WireGuard

Navigate to Setup > Tunnels 

Enter IVPN WireGuard settings

1. Click Add Tunnel.

2. Set Tunnel to Enable.

Setup - Tunnel - Enable Tunnel

3. Select Wireguard from the dropdown.

Setup - Tunnel - Select Wireguard

3. Set MTU to 1412.

IVPN Wireguard MTU setting

4. Click Generate Key.

Setup - Tunnel - Generate Key

9. Copy the Local Public Key.

IVPN Wireguard Local Public Key

10. In a new tab (leave the DD-WRT settings opened), go to your IVPN Account and click WireGuard and then click WireGuard Key Management.

IVPN Wireguard Key Management

11. Click Add New Key.

IVPN Wireguard Add New Key

12. Paste the copied Local Public key to the Public Key field and click Add Key.

IVPN Wireguard Paste Public Key

13.Copy the IP Address assigned to your public key and add it to the IP Addresses/Netmask(CIDR) field followed by a /32 subnet mask.

IVPN Wireguard copy IP Address
IVPN Wireguard paste IP Address

Certain DD-WRT builds will show two separate fields here: IP Address and Subnet Mask. If that is the case set the IP Address field to the Address without the /32 added and set the Subnet Mask to 255.255.255.255

14. Click Add Peer.

Setup - Tunnel - Add Peer

15. Set the Peer Tunnel IP to 0.0.0.0. Set Peer Tunnel DNS to 172.16.0.1

IVPN Wireguard Peer Tunnel IP and DNS

16. Set Endpoint to Enable.

IVPN Wireguard Enable Endpoint

17. Go to the IVPN Server Status page and copy the server name for the WireGuard server location you want to connect to.

IVPN Wireguard Endpoint server

Be sure to copy the WireGuard server address and not the OpenVPN server address.

18. Paste the server name you copied into the Endpoint Address field and set the Port to 2049.

IVPN Wireguard Endpoint Address

19. On the IVPN Server Status page copy the Public Key of the server location you entered. Paste the Public Key into the Peer Public Key field.

IVPN Wireguard copy server Public Key
IVPN Wireguard enter Peer Public Key

20. Leave Allowed IPs as 0.0.0.0/0. Set Router Allowed IP’s via tunnel to Enable. Set Persistent Keep Alive to 25.

IVPN Wireguard Peer settings

21. At the bottom of the page click Save and then click Apply Settings.

Set IVPN DNS servers

Navigate to Setup > Basic Setup

Set Static DNS 1 to 172.16.0.1

Set Static DNS 2 to 198.245.51.147

IVPN Wireguard Static DNS

Click Apply Settings.

Reboot the FlashRouter

Navigate to Administration > Management

Scroll to the bottom of the page and click the red Reboot Router button. Wait for the FlashRouter to reboot and then reconnect.

Verify a successful IVPN connection

Navigate to Setup > Tunnels

  1. You should Endpoint, Latest handshake, and Transfer in the WireGuard status area.
  2. Visit IVPN’s website to verify your status as using IVPN.

Back up your settings

Navigate to Administration > Backup

  1. Click the Backup button.
  2. A file named nvrambak.bin will be saved to your computer.
  3. You can load nvrambak.bin to restore your settings in the event of a reset.

TROUBLESHOOTING

Still having issues? Visit the VPN Troubleshooting section.

Troubleshoot Here

Privacy Hero VPN Kill Switch Setup

· ·

The Privacy Hero VPN Kill Switch prevents regular internet traffic from passing through your router if its VPN disconnects or fails to connect. This helps prevent devices from using your normal ISP connection without VPN protection.

Before enabling: Make sure your VPN is already Connected and that internet access works through the VPN. The Kill Switch is optional, but useful if you prefer internet access to stop rather than continue unprotected when the VPN goes down.

Privacy Hero is managed at app.privacyhero.com. You can make changes using a computer, phone, or tablet.

How to Enable the VPN Kill Switch

  1. Open app.privacyhero.com and sign in using your Privacy Hero account. If the router has not been activated yet, follow the Privacy Hero Activation and Setup guide first.
  2. Open the VPN section of your Privacy Hero settings.
  3. Confirm that your selected VPN provider is active and its connection status shows Connected. If the VPN is failing, fix the connection before proceeding.
  4. Find VPN Killswitch (VPN Kill Switch) and move its toggle to On (orange). The setting is enabled when its toggle is On.
  5. Keep a device connected to the Privacy Hero WiFi or LAN and confirm that ordinary websites work with the VPN connected.
Privacy Hero Security and Privacy VPN Killswitch toggle enabled, highlighted on the right side of the settings page
In Privacy Hero, the VPN Killswitch toggle is shown directly below the VPN provider setting.

Tip: To check the router’s VPN IP address, use a browser on a device connected to Privacy Hero, not on a phone using cellular data or another WiFi network. Disable any separate VPN app on the test device so you can verify the router VPN independently.

What Happens When the Kill Switch Is On?

VPN status Kill Switch Normal internet traffic
Connected On Allowed through the VPN
Disconnected or Failed On Blocked until the VPN reconnects or you turn the Kill Switch off
Disconnected or Failed Off May use the normal ISP connection without VPN protection

The Kill Switch does not turn off the WiFi network. Your device may stay connected to Privacy Hero WiFi but report No Internet when the VPN is unavailable. Some phones and computers may automatically switch to cellular data or another saved WiFi network.

Access Privacy Hero Even When the Kill Switch Is Blocking Internet

Important: Privacy Hero includes a built-in exception for its cloud management dashboard. If the VPN is down and the Kill Switch blocks normal internet traffic, you can still access app.privacyhero.com while connected to the Privacy Hero WiFi or LAN network, provided the router itself still has its upstream/cloud connection.

This means you can sign in, check the VPN status, change the server or protocol, or switch off the Kill Switch without first leaving the Privacy Hero network.

You can also access the cloud dashboard through another working WiFi connection or cellular data. If the router shows Offline in the dashboard, that indicates a separate WAN or cloud-connectivity problem rather than normal Kill Switch behavior.

How to Turn Off the Kill Switch or Restore Internet

If your VPN has stopped connecting and you need to restore ordinary internet access temporarily:

  1. Open app.privacyhero.com, including from the Privacy Hero network if the Kill Switch is blocking regular internet.
  2. Open VPN and check the current VPN status.
  3. Move VPN Killswitch to Off.
  4. If the VPN remains Failed or Disconnected, temporarily switch the VPN connection Off and test internet access using a device on the Privacy Hero network.
  5. Repair the VPN connection, confirm Connected, and verify that ordinary internet traffic works through the VPN before turning the Kill Switch back On.

Security note: With the Kill Switch off, devices may access the internet without VPN protection if the VPN is disconnected. Re-enable it after testing if preventing non-VPN traffic is your goal.

VPN showing Failed? Privacy Hero includes a Reset option that removes all saved third-party VPN settings. With an active Privacy Premium subscription, the router reconnects using the built-in Privacy Hero VPN. With Privacy Core, it returns to your normal ISP connection without a router VPN.

Before using Reset, see our How to Reset a Failed VPN Connection on Privacy Hero guide.

For a complete diagnosis of WiFi connected but no internet, VPN failures, and router Offline status, follow the Privacy Hero VPN Kill Switch: No Internet or WiFi Troubleshooting guide.

Related Privacy Hero Guides

Wireless Guest Network Setup – Unbridged (Recommended)

· ·

If you would like to prevent visitors from connecting to your main WiFi network then you can create a separate Guest Network that will prevent access to the main router. This setup also allows you to create different rules for different WiFi SSID’s in your home ranging from QoS controls, access restrictions, VPN network segmentation, and more.

Preparing for Wireless Guest Network Setup

If you have a Dual-band or Tri-Band router you can setup a WiFi Guest Network, creating a separate VLAN (virtual local area network) for your visitors, or in order to segment your VPN networks on any band you like. We recommend using the 2.4GHz network for your DD-WRT Guest Wireless Network so it is compatible with the most possible WiFi devices. Setting up a guest network for visitors in your home allows you to keep them off of your main WiFi network.

We recommend performing this setup while connected to the FlashRouter via ethernet cable. If your computer does not have an ethernet port and you must proceed via wireless connection to the FlashRouter. Be sure to pay attention to the wireless connection as you may need to rejoin the FlashRouter’s network after making changes.

DD-WRT Router Setup for Wireless Guest Network

Enter Wireless settings

Navigate to Wireless > Basic Settings

FlashRouter DD-WRT Wireless Guest Network Settings Unbridged

Under the 2.4GHz or 5GHz Interface click the Add button.

Wireless Network Name (SSID)

Enter the a unique network name for the guest network.

Network Configuration

Unbridged

Force DNS Redirection

Enable

Optional DNS Target

208.67.220.220

IP Address

192.168.12.1

Subnet Mask

255.255.255.0

CLICK SAVE

Enter Wireless Security settings

Navigate to Wireless > Wireless Security

Wireless Guest Network Setup on DD-WRT FlashRouter Unbridged
  1. Duplicate the wireless security settings that are set for the other bands for the newly created virtual interface.
  2. Click Apply Settings.
  3. Reboot your router.

Enable DHCP for Guest Network

Navigate to Setup > Networking

Wireless Guest Network Setup on DD-WRT FlashRouter Unbridged Setting DHCP Server
  1. Scroll to the very bottom of the page and under DHCPD click Add.
  2. Select wl0.1 or ath1.1 depending on your router model.
  3. Click Apply Settings.
  4. Reboot your router.

Depending on the router model and WiFi band you are using, the wireless interfaces will be labelled differently.

This setting can be labelled wl1.1, ath0.1, wl2.1, and so on. Make sure when you get up to the bridge assignment section that you are using the correct guest network Virtual Interface.

Back up your settings

Navigate to Administration > Backup

  1. Click the Backup button.
  2. A file named nvrambak.bin will be saved to your computer.
  3. You can load nvrambak.bin to restore your settings in the event of a reset.

TROUBLESHOOTING

Still having issues? Visit our Troubleshooting section to diagnose common problems here.

Troubleshoot Here

Private Internet Access (PIA) Setup for Privacy Hero

· ·

Privacy Hero supports Private Internet Access (PIA) with WireGuard (recommended) and OpenVPN. You need an active PIA subscription and your PIA VPN username and password.

Important difference: PIA WireGuard has a built-in provider integration in Privacy Hero. Choose Private Internet Access from the VPN provider list—not Custom WireGuard. No WireGuard configuration file or key generation is needed.

By default, Privacy Hero can automatically select an optimal available PIA server based on your location and server conditions. Alternatively, use Advanced Options to enter a specific PIA server hostname from the regional list below.

Privacy Hero is cloud-managed. You can configure your router from any device with an internet connection, whether or not you are on the Privacy Hero WiFi network.

Set Up PIA WireGuard in Privacy Hero (Recommended)

Unlike most other providers, PIA WireGuard does not use Custom VPN file uploads in Privacy Hero. The built-in PIA integration connects using your PIA account credentials and handles the WireGuard configuration for you.

  1. Open app.privacyhero.com and sign in to your Privacy Hero account.
  2. Open the VPN section. Select Change beside your current VPN provider.
  3. Choose Private Internet Access from the provider list. Do not select Custom for this WireGuard setup.
  4. Enter your PIA VPN account username and password (not your Privacy Hero dashboard credentials). You can check your account at PIA Client Control Panel.
  5. For automatic server selection, leave the optional server hostname unset, then click Save to connect. Wait until Privacy Hero displays Connected.
Privacy Hero built-in Private Internet Access provider login settings

Choose the Automatic Server or a Specific PIA Location

Privacy Hero offers two ways to select the PIA WireGuard server:

  • Automatic (recommended for most users): Leave the server hostname field blank. Privacy Hero selects an optimal available PIA location, generally favoring nearby servers and server conditions such as load. You do not need to manually maintain a server address.
  • Specific location: Enter a PIA region hostname under Advanced Options. This is useful when you need an IP address from a particular country or city.
  1. To use a specific location, open the existing Private Internet Access connection and select Advanced Options.
  2. Enter a complete PIA server hostname from the list below, for example us-newyorkcity.privacy.network or uk-london.privacy.network.
  3. Click Save, wait for Connected, then verify your new public IP address. If the selected location becomes unavailable, try another hostname or remove the hostname to return to automatic selection.
Privacy Hero Private Internet Access Advanced Options field for entering a VPN server hostname

PIA Server Hostname List by Region

Use these hostnames in PIA > Advanced Options when you prefer a specific location. Expand a region below and copy the complete hostname, including .privacy.network. This list is retained from the existing FlashRouters guide.

Server availability can change. Some hostnames, particularly those ending in -pf or marked for streaming, are specialized locations and may not be available for every connection. If a hostname no longer works, use automatic selection or check PIA’s current location list for available locations. PIA’s location list names regions; it does not necessarily provide matching hostnames.

North America (65 locations)
bahamas.privacy.networkca-ontario.privacy.networkca-toronto.privacy.networkca-vancouver.privacy.networkca-montreal.privacy.networkgreenland.privacy.networkgt-guatemala-pf.privacy.networkmexico.privacy.networkpanama.privacy.networksanjose.privacy.networkus-alabama-pf.privacy.networkus-alaska-pf.privacy.networkus-arkansas-pf.privacy.networkus-atlanta.privacy.networkus-california.privacy.networkus-chicago.privacy.networkus-connecticut-pf.privacy.networkus-denver.privacy.networkus-florida.privacy.networkus-houston.privacy.networkus-idaho-pf.privacy.networkus-indiana-pf.privacy.networkus-iowa-pf.privacy.networkus-kansas-pf.privacy.networkus-kentucky-pf.privacy.networkus-lasvegas.privacy.networkus-louisiana-pf.privacy.networkus-maine-pf.privacy.networkus-massachusetts-pf.privacy.networkus-michigan-pf.privacy.networkus-minnesota-pf.privacy.networkus-mississippi-pf.privacy.networkus-missouri-pf.privacy.networkus-montana-pf.privacy.networkus-nebraska-pf.privacy.networkus-new-hampshire-pf.privacy.networkus-new-mexico-pf.privacy.networkus-newyorkcity.privacy.networkus-north-carolina-pf.privacy.networkus-north-dakota-pf.privacy.networkus-ohio-pf.privacy.networkus-oklahoma-pf.privacy.networkus-oregon-pf.privacy.networkus-pennsylvania-pf.privacy.networkus-rhode-island-pf.privacy.networkus-seattle.privacy.networkus-siliconvalley.privacy.networkus-south-carolina-pf.privacy.networkus-south-dakota-pf.privacy.networkus-texas.privacy.networkus-tennessee-pf.privacy.networkus-vermont-pf.privacy.networkus-virginia-pf.privacy.networkus-washingtondc.privacy.networkus-west-virginia-pf.privacy.networkus-wisconsin-pf.privacy.networkus-wyoming-pf.privacy.networkus3.privacy.networkus-baltimore.privacy.networkus-honolulu.privacy.networkus-newjersey.privacy.networkus-saltlakecity.privacy.networkus-streaming-2.privacy.networkus-streaming.privacy.networkus-wilmington.privacy.network
South America (9 locations)
ar.privacy.networkbo-bolivia-pf.privacy.networkbogota.privacy.networkbr.privacy.networkec-ecuador-pf.privacy.networkpe-peru-pf.privacy.networksantiago.privacy.networkuy-uruguay-pf.privacy.networkvenezuela.privacy.network
Europe (51 locations)
al.privacy.networkad.privacy.networkaustria.privacy.networkbrussels.privacy.networkba.privacy.networksofia.privacy.networkzagreb.privacy.networkczech.privacy.networkde-berlin.privacy.networkde-frankfurt.privacy.networkdenmark.privacy.networkdenmark-2.privacy.networkspain.privacy.networkes-valencia.privacy.networkee.privacy.networkfi.privacy.networkfi-2.privacy.networkfrance.privacy.networkgr.privacy.networkhungary.privacy.networkitaly.privacy.networkitaly-2.privacy.networkis.privacy.networkireland.privacy.networkman.privacy.networklv.privacy.networkliechtenstein.privacy.networklt.privacy.networklu.privacy.networkmalta.privacy.networkmd.privacy.networkmonaco.privacy.networkmontenegro.privacy.networknl-amsterdam.privacy.networkmk.privacy.networkno.privacy.networkpoland.privacy.networkpt.privacy.networkro.privacy.networksweden.privacy.networksweden-2.privacy.networkrs.privacy.networksk.privacy.networkslovenia.privacy.networkswiss.privacy.networktr.privacy.networkuk-london.privacy.networkuk-manchester.privacy.networkuk-southampton.privacy.networkuk-2.privacy.networkua.privacy.network
Asia (26 locations)
ae.privacy.networkbangladesh.privacy.networkcambodia.privacy.networkchina.privacy.networkcyprus.privacy.networkgeorgia.privacy.networkhk.privacy.networkin.privacy.networkisrael.privacy.networkjakarta.privacy.networkjapan.privacy.networkjapan-2.privacy.networkkazakhstan.privacy.networkkr-south-korea-pf.privacy.networkkualalumpur.privacy.networkmacau.privacy.networkmongolia.privacy.networknp-nepal-pf.privacy.networkphilippines.privacy.networkqatar.privacy.networksaudiarabia.privacy.networksg.privacy.networksrilanka.privacy.networktaiwan.privacy.networkvietnam.privacy.networkyerevan.privacy.network
Oceania (7 locations)
au-adelaide-pf.privacy.networkau-australia-so.privacy.networkau-brisbane-pf.privacy.networkaus-melbourne.privacy.networkaus-perth.privacy.networkau-sydney.privacy.networknz.privacy.network
Africa (5 locations)
dz.privacy.networkegypt.privacy.networkmorocco.privacy.networknigeria.privacy.networkza.privacy.network

Set Up PIA OpenVPN in Privacy Hero

OpenVPN is the alternative when you need a manually uploaded connection or if the built-in PIA WireGuard method does not work on your network. OpenVPN uses Custom in Privacy Hero, unlike the built-in PIA WireGuard setup.

Download a PIA OpenVPN Configuration File

  1. Sign in to the PIA Client Control Panel using your PIA VPN account.
  2. Open Downloads and scroll to OpenVPN Configuration Generator or OpenVPN Configurations.
  3. If using the generator, choose OpenVPN 2.4 or newer and Linux when these options are offered, then choose an available server location.
  4. Select your preferred configuration. UDP / 1198 (AES-128-CBC) is a standard default. UDP / 1197 (AES-256-CBC) is an alternative. Use a PIA-provided TCP configuration if UDP does not work on your network.
  5. Click Generate or download a suitable pre-made configuration and save the resulting .ovpn file. Each server file is tied to its selected location/settings.

PIA also provides pre-made OpenVPN configuration bundles; see PIA’s OpenVPN file instructions.

Add PIA OpenVPN as a Custom VPN

  1. Open Privacy Hero, go to VPN, click Change, and select Custom.
  2. Choose OpenVPN and upload the PIA .ovpn file downloaded in the previous section.
  3. Enter your PIA VPN username and password in the Custom OpenVPN authentication fields.
  4. Click Save and confirm Privacy Hero shows Connected.
Privacy Hero Custom OpenVPN configuration with file upload and username password fields

Note: If OpenVPN UDP cannot connect, try a TCP profile from PIA or another server. When switching protocols, make sure you upload a matching PIA configuration file.

Verify Your Private Internet Access Connection

  1. Connect a device to the Privacy Hero WiFi or LAN network.
  2. Disconnect any PIA app or other VPN running directly on the device so the router VPN can be tested independently.
  3. Open a private/incognito browser window and visit PIA What Is My IP.
  4. Confirm that your public IP address reflects the VPN connection, and that the approximate location is consistent with either the selected hostname or Privacy Hero’s automatic server selection.

Privacy Hero VPN settings can be changed remotely, but the device used to verify the VPN IP must be connected to the Privacy Hero network.

Streaming Relocation and Your PIA Location

If Streaming Relocation is enabled for a supported service, that service may use the Streaming Relocation location instead of your PIA VPN server location. See Privacy Hero Streaming Relocation.

PIA VPN Not Connecting?

If Privacy Hero reports Failed, stays on Connecting, or connected devices lose internet access, try these checks:

  1. Confirm your PIA subscription is active and enter your PIA VPN login, not your Privacy Hero email/password.
  2. For built-in PIA WireGuard, verify the provider is Private Internet Access—not Custom. No downloaded WireGuard file is required.
  3. Remove any specific server hostname to test automatic server selection. If that connects, the previous hostname may be unavailable.
  4. For Custom OpenVPN, upload a fresh PIA .ovpn file, re-enter the PIA credentials, and try a different server or a TCP configuration.
  5. Turn off the router VPN temporarily to check that normal internet access works. If the VPN Kill Switch is blocking internet traffic, temporarily disable it for testing, then restore your preferred setting.
  6. Check whether a separate VPN app, iCloud Private Relay, Private DNS, proxy, or security software on the testing device is affecting your VPN IP results.

No Internet When the VPN Disconnects?

The Privacy Hero VPN Kill Switch may intentionally block internet access if the VPN goes down. See Privacy Hero VPN Kill Switch: No Internet or WiFi Troubleshooting.

VPN Connected but One Device Shows the Wrong IP?

If other devices show the expected VPN address, review device VPN apps, iCloud Private Relay, Private DNS, and security settings.

Related Privacy Hero Guides

Windscribe WireGuard Setup

· ·

Preparing for Windscribe WireGuard Setup

Verify your Windscribe login information

If you are not already a Windscribe user Sign Up Now.

Log in to your account on the Windscribe website.

Windscribe Login

Go to the Windscribe WireGuard config generator page and select the Server location and Port you would like to use. Click Download Config.

Windscribe Wireguard select server location

Open the .conf file that is downloaded using Notepad in Windows or TextEdit in Mac.

DD-WRT Router Setup for Windscribe WireGuard

Navigate to Setup > Tunnels 

Enter Winscribe WireGuard settings

1. Click Add Tunnel.

2. Set Tunnel to Enable.

Setup - Tunnel - Enable Tunnel

3. Select Wireguard from the dropdown.

Setup - Tunnel - Select Wireguard

3. Set CVE-2019-14899 Mitigation to Enable. Set NAT via Tunnel to Enable. Set Local Port to 51820. Set MTU to 1420.

Windscribe Wireguard Basic Settings

4. Check Firewall inbound and Kill Switch.

Windscribe Wireguard enable Firewall and Kill Switch

5. Set Advanced Settings to Enable and copy the PrivateKey from the .conf file and paste it into the Local Private Key field.

Windscribe Wireguard conf file PrivateKey
Windscribe Wireguard Local Private Key

6. Click Add Peer.

Windscribe Wireguard Add Peer

7. Set Peer Tunnel IP to 0.0.0.0. Set Peer Tunnel DNS to the DNS found in the .conf file.

Windscribe Wireguard Peer Tunnel IP and DNS

8. Set Endpoint to Enable. Copy and Paste the Endpoint from the .conf file and paste it into the Endpoint Address field. Enter the same Port that appears next to the Endpoint.

Windscribe Wireguard conf file Endpoint
Windscribe Wireguard paste Endpoint

9. Leave Allowed IPs as 0.0.0.0/0. Set Router Allowed IP’s via tunnel to Enable. Set Persistent Keep Alive to 25.

Windscribe Wireguard settings

10. Copy and Paste the PublicKey from the .conf file and paste it into the Peer Public Key field.

Windscribe Wireguard conf file PublicKey
Windscribe Wireguard Peer Public Key

11. Set Use Pre-shared Key to Enable. Copy and Paste the Presharedkey from the .conf file and paste it into the Pre-Shared Key field.

Windscribe Wireguard conf file PresharedKey
Windscribe Wireguard Pre-shared Key

12. Copy the Address from the .conf file and paste it into the IP Addresses/Netmask(CIDR) field.

Windscribe Wireguard IP Address
Windscribe Wireguard conf file Address

Certain DD-WRT builds will show two separate fields here: IP Address and Subnet Mask. If that is the case set the IP Address field to the Address without the /32 added and set the Subnet Mask to 255.255.255.255

21. At the bottom of the page click Save and then click Apply Settings.

Verify a successful Winscribe connection

Navigate to Setup > Tunnels

  1. You should Endpoint, Latest handshake, and Transfer in the WireGuard status area.
  2. Visit whatismyipaddress.com to verify your status as using Winscribe.

Back up your settings

Navigate to Administration > Backup

  1. Click the Backup button.
  2. A file named nvrambak.bin will be saved to your computer.
  3. You can load nvrambak.bin to restore your settings in the event of a reset.

TROUBLESHOOTING

Still having issues? Visit the VPN Troubleshooting section.

Troubleshoot Here

How to Use ASUS VPN Fusion: Assign Devices and Multiple VPNs

· ·

ASUS VPN Fusion lets supported AsusWRT routers run VPN client profiles and decide which connected devices use each VPN connection. You can send the entire network through one VPN, use separate VPN profiles for selected devices, or leave certain devices on the regular ISP connection.

This guide covers how to use ASUS VPN Fusion to assign devices to specific VPN connections, manage multiple VPN profiles simultaneously, and choose which devices use a VPN or connect directly through your ISP. These features work with supported VPN providers and protocols, including WireGuard and OpenVPN.

Open VPN Fusion

  1. Connect your computer or phone to your ASUS FlashRouter’s WiFi or LAN.
  2. Open http://www.asusrouter.com or the router’s LAN IP (often 192.168.50.1) and log in. See How to Access Your AsusWRT FlashRouter Settings.
  3. Go to VPN > VPN Fusion. Add and configure at least one working VPN client profile before assigning devices.
ASUS VPN Fusion page with Add Profile and Internet Connection
VPN Fusion displays your saved VPN profiles and the Add Profile option.

Method 1: Apply One VPN to All Devices

Use this option when you want the selected VPN profile to be your router’s default connection.

  1. In VPN Fusion, open the VPN profile that should provide the default internet route.
  2. Enable Apply to all devices (or Default Connection in firmware that uses that label).
  3. Click Apply all settings, then enable the VPN profile.
  4. Connect a test device to the router and check its IP. If you use per-device overrides, verify those rules separately.
ASUS VPN Fusion Apply to all devices setting and device count
Enable Apply to all devices to use the selected VPN as the default connection.

Method 2: Send Only Selected Devices Through a VPN

  1. In VPN Fusion, turn off Apply to all devices for a profile when you do not want that VPN used network-wide.
  2. Open the profile’s Device area using the pencil/edit icon or the firmware’s device-assignment control.
  3. Select the intended devices (for example, a TV and streaming box), confirm with OK, then click Apply all settings.
  4. Enable the VPN profile and verify the selected devices’ public IPs.
  5. For devices that should use the normal ISP internet, leave them on the Internet Connection route or explicitly set the Internet/bypass rule available in your firmware. Remove any conflicting VPN assignments.

Important: A device being connected to ASUS WiFi does not guarantee that it is assigned to the desired VPN. Check the assigned profile and the actual public IP.

How Multiple VPN Connections Work

On supported models, VPN Fusion can keep several VPN connections active and route different devices through different providers at the same time. For example:

TVNordVPN — WireGuard
LaptopProton VPN — OpenVPN
Streaming deviceSurfshark — OpenVPN
Work computerRegular ISP connection

You may be able to run one WireGuard profile and multiple OpenVPN profiles concurrently, but connection limits and supported combinations vary by ASUS router model and firmware. Adding many saved OpenVPN profiles is not the same as having all of them connected at once.

  1. Create separate profiles with clear names, such as Nord-US-WG, Proton-US-OVPN, and Surfshark-UK-OVPN.
  2. Enable only the profiles you need and confirm each shows connected.
  3. Assign each client device to the appropriate active profile; avoid applying conflicting default routes.
  4. Verify each device’s observed IP and server country. If one tunnel fails, test it individually with the other profiles temporarily disabled.

ASUS reference: How VPN Fusion handles multiple tunnels and devices.

Confirm a Device Is Actually Using the VPN

  1. In VPN Fusion, confirm the target profile’s connection status is active.
  2. Check the device’s assignment in the ASUS VPN Fusion interface.
  3. On that same device, visit IPLeak.net or another public-IP checker.
  4. Compare the reported public IP and location with the VPN server assigned to that device.
  5. If the device still shows your ISP IP, test with its own VPN app and iCloud Private Relay / Private DNS / browser proxy disabled. Use Device Settings That Can Interfere With Your Router VPN.

Quick isolation test

  1. Turn off VPN Fusion routing for a test device and confirm ISP internet works.
  2. Turn on just one known-working VPN profile for that device.
  3. Recheck public IP. If it now works, reintroduce other profiles/assignments individually.

Want a Separate WiFi Network With or Without VPN?

Rather than selecting devices one at a time, supported ASUS routers offer Guest Network Pro or Network > VPN Network features that can associate a WiFi SSID with VPN routing. See ASUS Guest WiFi With or Without VPN: Setup Guide.

On routers with only the traditional Guest Network feature, available VPN-by-SSID behavior may differ; do not assume the standard guest SSID bypasses a network-wide VPN default.

Related AsusWRT Guides

Upgrade your ASUS router

Explore the Latest WiFi 7 ASUS FlashRouters

Looking for a newer ASUS router? Browse WiFi 7 models available from FlashRouters and compare features to find the right fit for your home or office. VPN Fusion and other features vary by router model and firmware.

Shop ASUS WiFi 7 Routers →

DD-WRT Router Setup Guide

DD-WRT Router Setup Guide

Quick Start Guide for DD-WRT FlashRouters

Find setup guides, FAQs and troubleshooting tips for DD-WRT configured FlashRouters.

VIEW SUPPORTED ROUTER MODELS

AC1450, R6220, R6230, R6250, R6260, R6300 V1, R6300 V2, R6400 V1, R6400 V2, R6700 V1, R6700 V2, R6700 V3, R7000, R7000P, R7800, R8000, R9000, XR500

Asus Logo

RT-AC56U/R, RT-AC68U V1, RT-AC68U V2, RT-AC1900P, RT-AC87U, RT-AC3100, RT-AC5300

WRT1200AC, WRT1900AC V1, WRT1900AC V2, WRT1900ACS V1, WRT1900ACS V2, WRT32X, WRT3200ACM

Internet Setup

WiFi Setup

VPN Setup

DD-WRT Features

Search Support Articles

Troubleshooting

More Ways to Get Help

GET IN TOUCH

BUY SUPPORT
BROWSE FAQs

Surfshark Setup for Privacy Hero

· ·

Privacy Hero supports Surfshark through WireGuard and OpenVPN using the Custom VPN provider option.

WireGuard is recommended for most users. It requires a Surfshark WireGuard key pair and a downloaded server configuration file. OpenVPN uses a downloaded .ovpn file and Surfshark’s separate Manual Setup credentials, not your usual Surfshark login email and password.

Privacy Hero is cloud-managed. You can change these settings from any computer, smartphone, or tablet with an internet connection; you do not need to be on the Privacy Hero WiFi to configure the VPN.

Surfshark WireGuard Setup (Recommended)

WireGuard uses a key pair for authentication. A separate Surfshark username and password is not needed for the WireGuard configuration.

Create or Select Your Surfshark WireGuard Key Pair

  1. Sign in to your Surfshark account.
  2. Open VPN → Manual Setup, choose the Router setup option, and select WireGuard.
  3. If you already registered a key pair with Surfshark, select I have a key pair and follow the prompts to register your public key. Otherwise, select I don’t have a key pair.
  4. If generating a new key pair, enter a name and choose Generate a new key pair. Save the generated keys securely when prompted.

Important: Your WireGuard private key is sensitive. Do not publish or send it in a support ticket. Surfshark notes that you may not be able to view the generated keys again after leaving that screen.

Download a Surfshark WireGuard Server File

  1. After setting up the key pair, select Choose a location or open the Locations section.
  2. Choose an available Surfshark server and download its WireGuard configuration file to your device.

Do not download the WireGuard configuration before setting up the key pair. Surfshark warns that a file downloaded too early can be missing the required key information. For more detail, see Surfshark’s manual WireGuard router instructions.

Upload WireGuard to Privacy Hero

  1. Open app.privacyhero.com and log in to your Privacy Hero account.
  2. Open the VPN section, click Change, and choose Custom as the VPN provider.
  3. Select WireGuard and upload the Surfshark WireGuard configuration file you downloaded.
  4. Click Save and allow Privacy Hero to establish the connection. Confirm the VPN status shows Connected.
Privacy Hero Custom WireGuard configuration and file upload panel

Surfshark OpenVPN Setup

OpenVPN is an alternative to WireGuard. It requires a Surfshark Manual Setup username and password and a downloaded OpenVPN configuration (.ovpn) file.

Get Your Surfshark OpenVPN Credentials

  1. Sign in to your Surfshark account.
  2. Open VPN → Manual Setup, choose Router, and select OpenVPN.
  3. Open the Credentials tab. If credentials are not yet available, select Generate credentials.
  4. Copy the Manual Setup username and password, or keep the tab open to enter them into Privacy Hero later.

Important: These are not your regular Surfshark website email and password. Keep the service credentials private.

Download a Surfshark OpenVPN Server File

  1. In Surfshark’s OpenVPN Manual Setup area, open the Locations tab.
  2. Select a country or server and download its UDP .ovpn configuration file. UDP is the recommended starting option; a TCP configuration may be worth trying later if needed.

Download a new .ovpn file whenever you want to switch to a different Surfshark server location. See Surfshark’s manual server selection instructions.

Upload OpenVPN to Privacy Hero

  1. Open app.privacyhero.com, sign in, and select the VPN section.
  2. Click Change, select Custom, and choose OpenVPN.
  3. Upload the Surfshark UDP .ovpn file you downloaded.
  4. Enter the Surfshark Manual Setup username and password into the Custom OpenVPN fields.
  5. Click Save, then confirm the VPN status shows Connected.
Privacy Hero Custom OpenVPN screen with configuration file upload and username and password fields

Verify Your Surfshark Connection

Privacy Hero showing Connected confirms the router connection status. Test a device on the Privacy Hero network to confirm it is using Surfshark.

  1. Connect your device to the Privacy Hero WiFi or LAN.
  2. Disconnect the Surfshark app or any other VPN app running directly on the testing device.
  3. Open a fresh private/incognito browser window.
  4. Visit Surfshark’s IP address checker.
  5. Confirm the displayed public IP and approximate location correspond to your selected Surfshark server.

You can change Privacy Hero settings while using another WiFi network or cellular data, but the device performing this VPN IP test must be connected to Privacy Hero. Avoid running a separate VPN app on the same testing device, as that creates a double-VPN connection.

Streaming Relocation and Your VPN Location

When Streaming Relocation is enabled for a supported streaming service, that service may use its Streaming Relocation region instead of the Surfshark VPN server region. See Privacy Hero Streaming Relocation.

Surfshark Not Connecting?

If Privacy Hero displays Failed, remains on Connecting, or reports a timeout, try these steps:

  1. Confirm your Surfshark subscription is active and that Custom is selected as the VPN provider in Privacy Hero.
  2. If using WireGuard, confirm that the key pair was created or registered before downloading the server file. If necessary, generate a new key pair, download a fresh configuration, and upload it again.
  3. If using OpenVPN, double-check your separate Surfshark Manual Setup username and password, not your regular website login.
  4. Download a fresh server configuration for another available Surfshark location and try again.
  5. If OpenVPN UDP continues to fail, try a Surfshark TCP .ovpn configuration file to check for a protocol-specific issue.
  6. Temporarily disable the VPN Kill Switch while checking whether internet access works without the VPN, then restore your preferred Kill Switch setting.

No Internet After Surfshark Disconnects?

The VPN Kill Switch may intentionally block normal internet traffic when the VPN connection is unavailable. See Privacy Hero VPN Kill Switch: No Internet or WiFi Troubleshooting.

VPN Connected but One Device Shows the Wrong IP?

If other Privacy Hero devices display the expected Surfshark VPN IP, review the affected device for VPN apps, iCloud Private Relay, Private DNS, proxy settings, antivirus filtering, or other security software. See Device Settings That Can Interfere With Your Router VPN.

Related Privacy Hero Guides

Wireless Client Bridge Setup

· ·

If you need to extend your wired connection capabilities and you are not able to wire directly into your main router, you can setup a FlashRouter as a Wireless Client Bridge. In Wireless Client Bridge mode the FlashRouter connects to your main router via WiFi, and then transmits your internet signal via the FlashRouter LAN ports for wired internet access anywhere in your home or office.

Preparing for Wireless Client Bridge Setup

Verify your wireless information

In order to setup your FlashRouter as a Wireless Client Bridge, you will need the exact SSID and password of your existing wireless network. Make sure you have this information before proceeding.

We recommend using a 2.4GHz network to repeat as this network will have more range.

Locate the Local IP Address of the existing wireless network

Locate the Local IP Address of the existing router that the FlashRouter will be bridged to.

DD-WRT Router Setup for Wireless Client Bridge

Disable Firewall

Navigate to Security > Firewall

Wireless Repeater Bridge Setup on FlashRouter DD-WRT - Disable Firewall and Enable Filter Multicast
  1. Set SPI Firewall to Disable.
  2. Uncheck all boxes except for Filter Multicast.
  3. Click Save.

Disable DNSmasq

Navigate to Services > Services

Wireless Repeater Bridge Setup on FlashRouter DD-WRT - Disable DNSMasqButton
  1. Set DNSmasq to Disable.
  2. Click Save.

Enter Wireless settings

Navigate to Wireless > Basic Settings

Wireless Client Bridge Setup on FlashRouter DD-WRT - Set Wireless Mode to Client Bridge
  1. In the Wireless Physical Interface settings for the 2.4GHz network set the Wireless Mode to Client Bridge.
  2. Change the Wireless Network Name (SSID) to match exactly with the Wireless Network Name of the network that you will bridge to.
  3. Click Save.

Enter Wireless Security settings

Navigate to Wireless > Wireless Security

Wireless Client Bridge Setup on FlashRouter DD-WRT - Set Wireless Password
  1. Change the WPA Shared Key to match exactly with the Wireless Password of the network that you will bridge to.
  2. Click Save.

Change the FlashRouter's Local IP Address

Navigate to Setup > Basic Setup

  1. Set the Local IP Address to a different address on the same subnet as the existing network that you noted early. (example: if the existing network is 192.168.1.1 then set the Local IP Address to 192.168.1.2)
  2. Set the Gateway to the Local IP Address of the existing network. (example: 192.168.1.1)
  3. Set the Local DNS to the Local IP Address of the existing network. (example: 192.168.1.1)
  4. Click Apply Settings.

Reboot your FlashRouter

Power off the FlashRouter for 30 seconds and then power it back on. When it boots back up you will be able to access the FlashRouter’s settings at the new Local IP Address that you set. Your existing network and the FlashRouter’s network will now be bridged wirelessly.

Your FlashRouter is now providing wired connection access to your main router network. Wireless connections to the FlashRouter are disabled in this setup.

Back up your settings

Navigate to Administration > Backup

  1. Click the Backup button.
  2. A file named nvrambak.bin will be saved to your computer.
  3. You can load nvrambak.bin to restore your settings in the event of a reset.

TROUBLESHOOTING

Still having issues? Visit our Troubleshooting section to diagnose common problems here.

Troubleshoot Here

IPv6 Internet Setup

· ·

Most ISPs only support IPv4. Unless your ISP supports IPv6 then enabling it on the FlashRouter will not enable it across your network.

For most VPN users IPv6 should remain disabled as the VPN connection was designed to operate under IPv4 addresses only. Enabling IPv6 in this instance may compromise the security of the VPN tunnel.

We typically only recommend enabling IPv6 if you are not using VPN or if your VPN provider requires that IPv6 be enabled.

Enable IPv6

Navigate to Setup > IPv6

Access FlashRouters DD-WRT Admin Settings and Disable Remote Access
  1. Set IPv6 to Enable.
  2. Select Native IPv6 from ISP in the dropdown.
  3. If you have specific IPv6 DNS servers you would like to add you can add them in the Static DNS fields or leave those fields blank.
  4. Click Apply Settings.

Power cycle your FlashRouter

Power your FlashRouter off and then power it back on by unplugging and then plugging it back in or using the button on the back of the FlashRouter.

Verify a successful IPv6 connection

Once the FlashRouter is finished powering back up, connect one of your devices to the FlashRouter via Ethernet or Wireless.

Visit  http://ipv6-test.com/ where you should see Supported under IPv6 connectivity if your ISP supports IPv6 and your modem is setup to passthrough IPv6.

Please be aware that we can not replicate ISP specific IPv6 issues, which makes them challenging to troubleshoot. We recommend contacting your ISP as the first step of troubleshooting.

NordVPN Merlin OpenVPN Setup

· ·

Preparing for NordVPN Merlin Setup

Obtain your NordVPN manual Username and Password

If you are not already an NordVPN user Sign Up Now.

1. Log in to your account on the NordVPN website.

NordVPN login

2. Click NordVPN on the left hand side and then click Setup NordVPN manually.

NordVPN setup manually

3. Enter in the verification code that was sent to your email.

NordVPN verify code

4. Copy and paste your NordVPN manual username and password to a secure location. This is the username and password you will enter into the router settings to connect to NordVPN.

NordVPN credentials

Download your NordVPN .ovpn file

1. There are two options for obtaining the .ovpn file. The first and recommended is to navigate to NordVPN’s server recommendation page. Click Recommended Server to display the fastest server based on your actual location. You can adjust the country if you don’t want to connect to the recommended country.

Then click Show Available Protocols. Click Download Config next to OpenVPN UDP. This will download the .ovpn file to your computer for this server. Do not open this file.

NordVPN Recommended Server

The second method to obtain a server is for connecting to a specific server number that you know you want to use. This applies to NordVPN Dedicated IP servers if you are signed up for that service. Go to NordVPN’s .ovpn file page. Then search for the server number that you want to use and click Download UDP.

NordVPN Download Specific Server

Merlin Router Setup for NordVPN

Login to Asus Merlin firmware settings in a browser on any computer or smart device connected to the Merlin FlashRouter’s network.

1. Navigate to the VPN tab.

Merlin VPN Tab

2. Navigate to the VPN Client tab.

Merlin VPN Client Tab

3. Click Choose file and select the .ovpn file you downloaded earlier. Then click Upload.

Merlin Choose File Upload

4. Set Automatic Start at boot time to Yes if you want the VPN connection to begin automatically when the router is powered off and back on.

Merlin Automatic Start at boot time

5. In the Description field enter in the name you’d like to use for this OpenVPN Client profile. We typically advise entering in the location or server number here. Our example server was in us5835.nordvpn.com so I have entered in NordVPN us5835.

Merlin NordVPN Description

6. Set Accept DNS Configuration to Strict. Set Redirect Internet traffic through tunnel to Yes (all). Set Kill Switch to Yes or No depending on if you want the Internet to be killed if the VPN connection drops.

Merlin Accept DNS configuration Redirect Internet and Kill Switch

If you only want certain devices to connect to the OpenVPN Client profile you are setting up instead of all the devices connected to the FlashRouter’s network please set the Redirect Internet traffic through tunnel to VPN Director. Then complete the instructions on this page and then view our VPN Director guide.

7. Enter your NordVPN username and password that you obtained earlier in the Username and Password. Note that these are different from your NordVPN email login and password.

Merlin VPN Username and Password

8. Click Apply at the bottom of the page.

9. At the top of the page set the Service State toggle to ON to activate the VPN connection.

Merlin Service State All Providers

Verify a successful NordVPN connection

  1. You should now see a CONNECTED message.
  2. Visit NordVPN’s IP Check to verify your new IP address and virtual location.

In some cases you may notice that the location is not showing the same location as the server you have input in your router settings; this is because geo tracking tools are often tricked by VPN connections. As long as you see an IP address that is not the same as your normal Internet IP address then you are indeed connected to NordVPN.

How to change the NordVPN server

  1. Follow the steps at the top of the page to obtain a new .ovpn file.
  2. Then proceed with the settings same as initial setup.

TROUBLESHOOTING

Still having issues? Visit the VPN Troubleshooting section.

Troubleshoot Here