LuCI Web Interface¶

Your router's IP (usually http://192.168.1.1), then NymVPN in the navigation menu.

The main view shows a connection status ring (green connected, pulsing connecting, grey disconnected), uptime since the tunnel came up, and the hop chain through entry and exit gateways. While connected, each gateway also shows its operator family when the directory knows one; if entry and exit turn out to share a family, both are marked Same operator family in amber.

While disconnected, the two side panels are the gateway pickers — entry on one side, exit on the other. Choose a country (the dropdown shows how many gateways each has, or Random), then a row in the list under it. The first row, Any Gateway (Random), leaves the pick within that country to NymVPN; each row below is one gateway, showing its name, a performance tier — HIGH, MEDIUM, LOW, OFFLINE or N/A, with a green / amber / red / grey dot — and a line with its current load, its 24-hour uptime, its operator family when known, so you can avoid picking two servers from the same operator by hand, and its city. Rows are sorted best tier first; the selected row is outlined in green. Some rows carry a small tag; the ⓘ button beside the gateway count under the list explains them, and so does Gateway Tags.

The search box above the list narrows it to gateways whose name, city, operator family, country or identity key contains every word you type; the selected row stays in view. All countries in the dropdown lists every gateway with its flag, and typing in the search box before choosing a country switches to it, so you can find a gateway by name alone. Esc clears the search.

Below the connection panel the settings come as expandable cards, in this order: Tunnel Settings, Split Tunneling, Mixnet Tuning, DNS & Ad Blocking, Account, Service Management, Diagnostics, Daemon Logs.

Gateway Tags¶

The right-hand end of a gateway row can show:

Tier — HIGH, MEDIUM, LOW, OFFLINE, or N/A when unknown, with a green / amber / red / grey dot: the directory's performance score for the gateway. The line under the name gives its load, 24-hour uptime, operator family and city.
No CT, amber — the gateway cannot carry Circumvention Transports. While that switch is on it sinks to the bottom of the list, greyed out, and cannot be picked.

Tunnel Settings¶

Switches save the moment they are flipped. Each row states in a few words what the switch does; the small ⓘ button after the title unfolds the full explanation under the row and ends in a Learn more link to the matching section below. Rows marked with a small reconnect tag only take effect the next time you connect; the rest apply straight away.

Protection¶

Always On¶

Keeps the tunnel up while the router is on, with nothing to schedule or tune. It connects once your internet connection is up, reconnects by itself after a drop or an outage, and keeps retrying failures — waiting longer between attempts and moving off a gateway that keeps failing. A connect that drags on for ten minutes starts over with a fresh gateway. If it still cannot recover it restarts itself, and the kill-switch stays in place throughout.

The line under the switch says what it is doing: Active, Waiting for network, Retrying in N s (attempt K), Paused — disconnected by you after you press Disconnect (the setting stays on and the next connect or reboot resumes it), or Stopped: … for errors that need you to change something first — an account problem, or a pinned entry/exit pair that fails the independence criteria. Fixing the configuration, a renewed subscription or pressing Connect resumes it. Its log lines are prefixed always-on: in the daemon log (logread -e nym-vpnd). The same switch is nym-vpnc tunnel set --always-on on|off.

Kill-Switch¶

Stops anything leaving for the internet outside the tunnel, so nothing quietly falls back to your ordinary connection when the VPN is down. Connection setup and anything you have deliberately excluded still get through. Leaving it on does not change where your traffic goes while you are connected — that always uses the tunnel.

Turn it off to let traffic fall back to the ordinary connection whenever the tunnel is down; while it is off the row shows an amber reminder that LAN traffic can leave the router unprotected at those times. You do not need to turn it off for split-tunnel exclusions — those work with it on. It is greyed out while legacy PBR split tunnelling is on, as the two cannot both be used.

Inbound Services¶

Nested directly under the kill-switch, and shown only while it is on. Ports whose reply traffic bypasses the tunnel, so a service on the router (LuCI, SSH) or on the LAN (Jellyfin, a NAS) stays reachable from the WAN with the kill-switch on. + Add exemption in the group's title bar opens the form (it is already open while the list is empty): pick TCP or UDP, type the port, optionally a label, Add (or Enter). × removes a row. Rows read ● Active while the kill-switch is on and ● Inert when it is off — an exemption is only meaningful while there is a block to be exempt from. For a LAN-hosted service, create the port forward in Network → Firewall → Port Forwards first, then add the exemption here using the WAN-side port. Inbound Services has the recipes.

Gateway Independence¶

On by default. Entry and exit must be run by different operators (node families in the NymVPN apps), sit in different networks (ASNs) and in different subnets. One operator seeing both ends of the tunnel could link your traffic going in and coming out, which is what the two hops are there to prevent; with this on, such a pair is refused. Turn it off to allow any combination. Takes effect on your next connect.

Server Family Reminders¶

On by default. When you press Connect, NymVPN checks the entry/exit pair your selection would produce. If that pair fails the independence criteria, a warning — The selected servers are in the same operator family! — offers Connect anyway, which connects with the criteria relaxed for that connection only (the setting above is untouched), or Change servers, which returns you to the pickers. With reminders off the connection goes ahead relaxed and a notice says so. The check never holds up connecting: if it cannot complete, the connect goes ahead as usual and any refusal appears as a status error offering the same two choices.

Transport¶

Two-Hop Mode¶

2-hop WireGuard instead of 5-hop mixnet routing. Faster, with less mixing: your packets are not delayed and blended with cover traffic on the way, so the two hops still hide your address from the exit but offer weaker protection against traffic analysis. Takes effect on your next connect.

Circumvention Transports¶

Wraps the connection to the entry gateway so it is harder for a censor to recognise and block. Two-hop mode only; while it is on, entry gateways that cannot carry it sink to the bottom of the picker, greyed out with an amber No CT tag, and cannot be selected. Takes effect on your next connect.

Stealth API Connect¶

The same switch as in the NymVPN apps. The daemon normally reaches the Nym API (account, gateway directory, discovery) directly and only falls back to cover domains (domain fronting through a CDN) when a direct request fails. On, every API request goes through the cover domains from the start. Use it where the API hosts are blocked; API calls — gateway lists, account sync, the setup phase of a connect — get slower. It affects only these background requests, so it applies immediately. If your network environment publishes no cover domains the row says so and the switch has no effect.

IPv6¶

Off by default. Most exit gateways have no IPv6 egress, and IPv6 that gets tunnelled and then dropped makes dual-stack clients stall on every new connection. Turn it on only if your exit demonstrably carries IPv6. Takes effect on your next connect.

Split Tunneling¶

Two ways of sending some traffic around the VPN. Everything not carved out stays in the tunnel, and the kill-switch keeps covering it.

Exclusions¶

Carve specific devices or domains out to the WAN. Devices are stored by MAC, so they survive an IP change; domain rules need clients to use this router for DNS, and need dnsmasq-full (the card says so, with the opkg command, when it is missing). Each row has its own on/off switch and a ×. See Split Tunneling for the caveats — particularly that an excluded device's DNS still goes through the tunnel.

Legacy Split Tunneling (PBR)¶

Listed under Policy-based routing. Hands routing to luci-app-pbr: only the traffic PBR selects goes through the VPN, everything else uses your ordinary connection in the clear. It cannot be combined with the kill-switch or the exclusion list, so switching it on greys out the kill-switch in Tunnel Settings and replaces the exclusion list with a note saying PBR owns the routing. Switch it off to get both back (the kill-switch stays off until you turn it on again). Takes effect on your next connect.

Mixnet Tuning¶

5-hop mode only. These trade anonymity for speed — the defaults are the private end. Turning off delays or cover traffic makes traffic analysis easier.

Disable Poisson Delays¶

Send real traffic immediately instead of on a randomised schedule. Turning this on reduces latency but makes traffic timing easier to correlate.

Disable Background Cover Traffic¶

Stop sending decoys. Turning this on saves bandwidth and CPU but makes real traffic easier to distinguish.

Delay settings¶

Cover traffic delay — 0–200 ms; blank leaves it as is
Mixing delay per hop — 0–200 ms; blank leaves it as is
Sending delay — 5–50 ms; blank leaves it as is

The switches save at once; the three delays apply with Apply Tuning.

DNS & Ad Blocking¶

Custom DNS¶

Enable, then add servers one at a time (IPv4 or IPv6); × removes one. The servers replace the VPN's default resolvers for clients that use the router for DNS. Public resolvers use the tunnel while connected. Private resolvers on a non-WAN interface (such as a LAN Pi-hole) remain reachable with the kill-switch on, and are the ones used while you are disconnected; a private resolver reached through the WAN stays blocked outside the tunnel. See DNS for resolver setup and routing caveats.

If the custom DNS setting appears to do nothing, dnsmasq is probably set to ignore its resolv file (noresolv, as set by AdGuard Home, https-dns-proxy or stubby); the card says so in amber, and Custom DNS setting has no effect has the fix.

Ad Blocking¶

Blocks ads, trackers and malware domains at the DNS level, on the resolvers the tunnel uses.

Account¶

Logged in: device identity (with a copy button) and account state, with Rotate keys and Sign out. Logged out: recovery phrase field and Login. If the daemon reports a stuck or stale account, the card offers Reset account state as a last resort.

Service Management¶

Shows whether nym-vpnd is running and enabled at boot. Start starts the daemon; Always On controls automatic connection. Restart restarts the daemon while preserving the enabled kill-switch. Stop stops the daemon and removes its kill-switch protection, allowing normal WAN routing. Disconnect in the connection panel leaves the daemon running and the enabled kill-switch in place. See Troubleshooting if Stop cannot clear protection.

Diagnostics¶

Run Diagnostic runs the daemon's connectivity self-test — DNS resolution, the Nym VPN API over HTTP, the selected gateway's TCP/WebSocket handshake — and lists each probe as PASS or FAIL. Skip DNS and Skip HTTP leave those sections out.

Daemon Logs¶

A live tail of nym-vpnd entries from the system log, started when the card is expanded. Pick how many lines, how often to refresh, and a level filter (Errors only or errors with ±10 / ±30 lines of context); pause, resume and copy to the clipboard.

The footer shows the daemon version and current network (mainnet or canary).

Notifications¶

Toasts for status updates, modals to confirm anything destructive — disconnecting, forgetting an account — or risky, such as connecting through two gateways of the same operator family.