How to set up NordVPN on an OpenWRT router using NordVPN Lite?

Introduction

This article explains how to set up a NordVPN connection on your OpenWrt router using the NordVPN Lite (nordvpnlite) client. You can install it from the official NordVPN package repository (recommended) or by manually downloading the .ipk package, and you can set up the connection through the LuCI web interface or the command-line interface (CLI).

Before you start

• You will need an OpenWrt router running either OpenWrt 24.10 (uses opkg) or OpenWrt 25.12 (uses apk), with either LuCI enabled for the web interface steps or SSH access for the command-line steps.
• You will need your Nord Account authentication token, which you can get by logging in to your Nord Account dashboard.
• You will need to know your router's architecture. To find it, go to Status → Overview → Architecture in LuCI, or run opkg print-architecture | awk 'NR==3{print $2}' (OpenWrt 24.10) or cat /etc/apk/arch (OpenWrt 25.12) via SSH.

The following architectures are supported:

NOTE: If you have a custom OS on top of OpenWRT (for example, GL.iNET routers have their OS and OpenWRT combined), you might get an error in the LuCI Web Interface if you want to install it "from URL".

Here's what to do

Installing from the official NordVPN Lite package repository (recommended)

Installing from the repository lets you use your router's package manager to install and upgrade NordVPN Lite the same way as any other OpenWrt package. The LuCI panel for NordVPN Lite is installed automatically alongside the main package.

OpenWrt 25.12 (apk) using the CLI

1. Connect to your router via SSH by entering ssh root@<router-ip>.
2. Add the signing key:
 

wget -O /etc/apk/keys/nordvpnlite-apk.rsa.pub https://downloads.nordcdn.com/nordvpnlite/feeds/nordvpnlite-apk.rsa.pub

 
3. Add the feed:
 

echo "https://downloads.nordcdn.com/nordvpnlite/feeds/25.12/$(cat /etc/apk/arch)/packages.adb" >> /etc/apk/repositories.d/nordvpn.list

 
4. Install the package:
 

apk update
apk add nordvpnlite

 
5. To update later, run:
 

apk update
apk upgrade nordvpnlite

OpenWrt 25.12 (apk) using the LuCI web interface

1. On your computer, download the signing key:
 

curl -o nordvpnlite-apk.rsa.pub https://downloads.nordcdn.com/nordvpnlite/feeds/nordvpnlite-apk.rsa.pub

NOTE: The file must be named exactly nordvpnlite-apk.rsa.pub before uploading.

 
2. In LuCI, navigate to System → Administration → Repo Public Keys and upload the nordvpnlite-apk.rsa.pub file under Repository Public Keys.
3. Still under System → Software → Configure apk, add the following line under APK Configuration (customfeeds.list), replacing <arch> with your router's architecture, then click Save:
 

https://downloads.nordcdn.com/nordvpnlite/feeds/25.12/<arch>/packages.adb

 
4. Navigate to System → Software, click Update lists, search for nordvpnlite, and click Install.

OpenWrt 24.10 (opkg) using the CLI

1. Connect to your router via SSH by entering ssh root@<router-ip>.
2. Add the signing key:
 

wget -O /tmp/nordvpn-feed.pub https://downloads.nordcdn.com/nordvpnlite/feeds/nordvpnlite-feed.pub
opkg-key add /tmp/nordvpn-feed.pub
rm /tmp/nordvpn-feed.pub

 
3. Add the feed:
 

echo "src/gz nordvpn https://downloads.nordcdn.com/nordvpnlite/feeds/24.10/$(opkg print-architecture | awk 'NR==3{print $2}')" >> /etc/opkg/customfeeds.conf

 
4. Install the package:
 

opkg update
opkg install nordvpnlite

 
5. To update later, run:
 

opkg update
opkg upgrade nordvpnlite

 

OpenWrt 24.10 (opkg) using the LuCI web interface

1. On your computer, download the key with the correct filename:
 

curl -o 70b3d2681841a6a4 https://downloads.nordcdn.com/nordvpnlite/feeds/nordvpnlite-feed.pub

NOTE: The file must be named exactly 70b3d2681841a6a4 before uploading. LuCI does not rename it automatically.

 
2. In LuCI, navigate to System → Administration → Repo Public Keys and drag and drop the 70b3d2681841a6a4 file.
3. Navigate to System → Software → Configure opkg... → Custom feeds (customfeeds.conf) and add the following line, replacing <arch> with your router's architecture, then click Save:
 

src/gz nordvpn https://downloads.nordcdn.com/nordvpnlite/feeds/24.10/<arch>

 
4. Navigate to System → Software, click Update lists, search for nordvpnlite, and click Install.

Manual installation using the .ipk package

If your setup requires it, you can still install NordVPN Lite by downloading the .ipk package directly.

Using the LuCI web interface

1. Download the package:

Download the .ipk package that matches your router's CPU from the NordVPN downloads page to your computer.

2. Install the package:

Open the LuCI web interface in your browser: http://<router-ip>/ (often 192.168.1.1). Click System and then Software. Click Update lists. Under Upload Package, select the downloaded .ipk file and click Upload & Install.

NOTE: If you only see a URL field, paste the direct link to the .ipk and install.

Using the command-line interface (CLI)

1. Connect to your router via SSH by entering ssh root@<router-ip>.
2. Download the package directly into the /tmp directory on your router. Replace <file-name>.ipk with the correct file URL from the downloads page:
 

wget https://downloads.nordcdn.com/nordvpnlite/<file-name>.ipk -P /tmp

 
3. Update the package lists and install the package:
 

opkg update
opkg install /tmp/<file-name>.ipk

 

Configuring NordVPN Lite

After installation, configure NordVPN Lite using either the LuCI panel (available with feed-based installations) or by editing the configuration file directly.

Using the LuCI panel

1. In LuCI, navigate to Services → NordVPN Lite.
2. Enter your Authentication Token.
3. Optionally enter a two-letter Country Code (for example, US, DE, GB) - leave it empty to connect to a recommended server.
4. Click Save.

The service starts automatically on installation. Once you save your configuration, the daemon picks it up on its next start and establishes the connection.

Using the configuration file

If you prefer to edit the configuration file directly (for example, after a manual .ipk install), use one of the methods below.

In the LuCI web interface: Navigate to System → File Editor. In the Path field, enter /etc/nordvpnlite/config.json. Paste the configuration below into the text field and click Save.

Via SSH: Create and edit the configuration file by running the command below.

cat >/etc/nordvpnlite/config.json <<'JSON'
{
  "log_level": "error",
  "log_file_path": "/var/log/nordvpnlite.log",
  "adapter_type": "linux-native",
  "interface": {
    "name": "nordvpnlite",
    "max_route_priority": 6000,
    "config_provider": "uci"
  },
  "authentication_token": "YOUR_AUTH_TOKEN_HERE",
  "vpn": "recommended"
}
JSON

NOTE: Replace YOUR_AUTH_TOKEN_HERE with the token from your Nord Account. Keep your token secret.

Starting the connection

• In LuCI: Navigate to System → Startup, find nordvpnlite in the list, and click Start. You can also start, stop, or restart the service from this screen.
• Via SSH: Run nordvpnlite start.

Verifying the connection

• In LuCI: Check the connection status by navigating to Status and clicking System Log for connection messages. You can also see the nordvpnlite interface under Network → Interfaces.
• Via SSH: Use the following commands to check your connection:
  • nordvpnlite status - Shows the current connection status.
  • ip addr show nordvpnlite - Confirms that the nordvpnlite network interface is active.
  • wget -qO- https://ipinfo.io/ip - Shows your current public IP address, which should be a NordVPN server IP.

Changing the location

Edit the configuration file to change the VPN server location. For example, to connect to Germany via SSH, run:

sed -i 's/"vpn": "recommended"/"vpn": { "country": "de" }/' /etc/nordvpnlite/config.json

Restart the service to apply the new settings:

nordvpnlite stop
nordvpnlite start

To see a list of all available country codes, run nordvpnlite countries.

If you configured NordVPN Lite via the LuCI panel, you can simply update the Country Code field under Services → NordVPN Lite and click Save.

Updating or removing

• To update from the repository: Run apk update && apk upgrade nordvpnlite (OpenWrt 25.12) or opkg update && opkg upgrade nordvpnlite (OpenWrt 24.10).
• To update manually: Download the newer .ipk package and install it using the same method as in the manual installation steps. Your configuration file will be preserved.
• To remove: Run apk del nordvpnlite (OpenWrt 25.12) or opkg remove nordvpnlite (OpenWrt 24.10).

Stopping the connection

To disconnect from the VPN, run nordvpnlite stop, or stop the service from System → Startup in LuCI.

Troubleshooting tips

• If you have connection issues, recheck your authentication token, JSON syntax, and your router's time.
• If the network interface is missing, make sure the service is started and that no other VPN client is using the same interface name.
• For more detailed logs, temporarily set "log_level": "info" in the config file, restart the service, and review the log at /var/log/nordvpnlite.log.
• Your existing /etc/nordvpnlite/config.json settings - including your authentication token, log level, and VPN location - are preserved when switching from a manual install to feed-based installation, and across upgrades.
• If you see a signature verification error on OpenWrt 24.10, check that the signing key has the correct filename by running ls /etc/opkg/keys/. You should see 70b3d2681841a6a4. If it shows key_<numbers> instead, rename it:
 

cd /etc/opkg/keys
mv key_* 70b3d2681841a6a4

 
• If you see a signature verification error on OpenWrt 25.12, verify the key is in place by running ls /etc/apk/keys/. You should see nordvpnlite-apk.rsa.pub. If it is missing, re-add it:
 

wget -O /etc/apk/keys/nordvpnlite-apk.rsa.pub https://downloads.nordcdn.com/nordvpnlite/feeds/nordvpnlite-apk.rsa.pub

 
• You may visit the official GitHub project page and repository, which contains more information.