Skip to content

Installation

One-line installer

curl -fsSL https://packages.dial0ut.org/install.sh | sh

It detects your package manager (opkg or apk), asks it for the CPU architecture, pulls the matching package from the latest GitHub release, and installs it. On a 32-bit router (arm, i386, mips, mipsel) it first checks for musl 1.2, i.e. OpenWrt 22.03 or later, and stops with a message if the firmware is older.

Manual install

Find your architecture

opkg print-architecture

Take the line with the highest priority — the largest number in the third column:

arch all 1
arch noarch 1
arch aarch64_cortex-a53 10

Here it is aarch64_cortex-a53.

apk --print-arch

Prints the architecture directly, e.g. aarch64.

Download and install

Grab the matching package from GitHub Releases:

scp nym-vpn_*.ipk root@192.168.1.1:/tmp/
opkg install /tmp/nym-vpn_*.ipk

scp nym-vpn_*.apk root@192.168.1.1:/tmp/
apk add --allow-untrusted /tmp/nym-vpn_*.apk

After installing

Check the daemon came up and the CLI can reach it:

/etc/init.d/nym-vpnd status
nym-vpnc status

NymVPN appears in the LuCI navigation menu at your router's web interface (usually http://192.168.1.1). If the page loads but every action fails with "No related RPC reply", see Troubleshooting — GL.iNet routers need port 8080.

If you installed from the LuCI Software page, LuCI asks you to log in again a few seconds after the install finishes — the package restarts rpcd so the new page and its permissions load. Log in and the menu entry is there.

You need a Nym account before you can connect. Quick Start covers that.

Upgrading

opkg update && opkg upgrade nym-vpn

apk update && apk upgrade nym-vpn

The package registers its own feed at install time, so both commands find the new version. The LuCI Software page (System → Software, update lists, then upgrade nym-vpn) works as well. Either way the tunnel drops while the daemon is replaced. If the upgrade changed the web UI's permissions, LuCI asks you to log in again a few seconds after it finishes; that is expected.

Firmware upgrades

sysupgrade (and LuCI's Flash new firmware image with Keep settings checked) keeps /etc/config/nym-vpn and /etc/nym, the account and the daemon settings. The package itself is not part of a stock image, so install it again after flashing; it picks up the same account and settings, the kill-switch included.

Dependencies

Pulled in automatically:

Package Why
libc musl libc, 1.2 or newer on the 32-bit architectures (OpenWrt 22.03+)
libgcc GCC runtime (libgcc_s.so.1) the binaries link against
kmod-tun TUN device — userspace WireGuard needs it
kmod-ipt-conntrack-extra conntrack marking for inbound exemptions on fw3
luci-base LuCI web framework
rpcd RPC backend the LuCI app talks to

Uninstall

opkg remove nym-vpn

apk del nym-vpn

Removing the package keeps /etc/nym: the account (the device keys and any tickets not used yet) and the daemon settings. Installing it again picks up the same account. To erase them too:

rm -rf /etc/nym

If the package database is broken and you have to do it by hand:

/etc/init.d/nym-vpnd stop
/etc/init.d/nym-vpnd disable
rm -f /usr/sbin/nym-vpnd /usr/bin/nym-vpnc
rm -rf /www/luci-static/resources/view/nym-vpn
rm -rf /www/luci-static/resources/nym-vpn
rm -f /usr/libexec/rpcd/nym-vpn
rm -f /etc/init.d/nym-vpnd
rm -f /usr/share/luci/menu.d/luci-app-nym-vpn.json
rm -f /usr/share/rpcd/acl.d/luci-app-nym-vpn.json
rm -f /lib/upgrade/keep.d/nym-vpn
/etc/init.d/rpcd restart

Stop the daemon first. The init script tears down the kill-switch firewall table on stop; delete the binary out from under a running daemon and you can be left with no internet.