HN Explorer

Show HN: Whole-home VPN router with hardware kill switch (OpenWrt and WireGuard) (github.com)

19 points by yoloshii ↗ HN
With internet censorship and surveillance on the rise, ie; UK Online Safety Bill (July 2025) and Australia's social media legislation (Dec 2025) introducing mandatory age verification (read: initial step on the pathway to social credit), I wanted a privacy-first solution that protects browsing history from ISPs and third-party verification services, but not one that requires you to be an Einstein to deploy.

This stack turns a Raspberry Pi (or any OpenWrt-compatible device) into a network-wide VPN gateway.

Key features: - Firewall kill switch: VPN down = no internet (not a software rule that can leak) - AmneziaWG obfuscation for DPI-resistant connections - Optional AdGuard Home for DNS filtering - Works for all devices including smart TVs and IoT that can't run VPN apps

Not a techie? The README is optimized for AI-assisted deployment. Feed it to your LLM of choice (Claude, GPT, etc.) and it can walk you through the entire setup for your specific hardware.

Mullvad-focused but works with any WireGuard provider. MIT license.

Docker deploy in testing (coming soon)

6 comments

[ 3.1 ms ] story [ 23.6 ms ] thread
cbsks
The downside is that some services, such as video streaming, block access from VPNs.
dontdoxxme
> Not a techie? The README is optimized for AI-assisted deployment. Feed it to your LLM of choice (Claude, GPT, etc.) and it can walk you through the entire setup for your specific hardware.

The whole thing is AI slop. I thought there might be something interesting here but it's just a bunch of disconnected fragments of OpenWRT config and some other bits without any overall thought.

It doesn't even use network namespaces. You can probably do better by giving your LLM https://www.wireguard.io/netns/ as input.

globalnode
im kinda off vpns since i learnt that id likeley become an ai crawler or a proxy for someones paid ddos
mzajc
> The kill switch is implemented in the firewall and routing table, not in software.

As far as I know, both of these are in the kernel (not hardware). It's odd that so much of the README is dedicated to describing this relatively simple firewall rule, but the whole thing smells like generated slop.

neilv
> Hardware kill switch - Firewall-level failsafe, not software

I think that firewalling/filtering and routing are software (though they can be accelerated in hardware).

"Hardware kill switch" is a useful pre-existing term, which I've only seen used to mean a user-controlled mechanical switch that physically opens or closes one or more electrical circuit conductor paths necessary for whatever is to be "killed" (electrically disconnected).

For example, let's say your network connector had several pins; a kill switch might mechanically disconnect those pins from wires or PCB traces, in a very simple and verifiable way, which obviously nothing in software/firmware/backdoors/etc. could circumvent. (Well, unless the software could control a robot arm, to go flip the mechanical switch, or solder in a bypass.)

Calling something else "hardware kill switch" seems incorrect. I don't say this to be pedantic, but because it's an important security feature, which this system claims to have, but does not.

beAbU
Honest no-snark question, coming from someone who does not know a lot about VPNs other than the wireguard app I have for work.

What's the difference between this, and just configuring the VPN settings that's available on my router that came with my ISP?