Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm going to be traveling out of the country, and want to still be able to browse as though I'm in the US. My router, running DD-WRT, will still be connected back home with a US IP address. Is there a plugin for DD-WRT that would let me connect to the router and use it as proxy to browse websites as though I'm in the US? Or is this perhaps already built-in?

Ideally the plugin would be secured with its own username and password so it isn't just an open relay for anyone to abuse. I'd also be OK with using a certificate to authenticate rather than user/pass.

share|improve this question

migrated from Nov 22 '11 at 8:00

This question came from our site for system and network administrators.

Kind of sound like you are looking for OpenVPN. It allows you to setup a secure SSL/TLS tunnel from your laptop or other device. Also there is an option to forward ALL traffic through the VPN, instead of the default method call 'split tunneling' which only sends data destined for the remote network over the VPN. – ianc1215 Nov 21 '11 at 22:31
@Solignis You should have posted this as an answer! – Chris Moschini Nov 22 '11 at 20:56
up vote 2 down vote accepted

You have a few options:

  • DD-WRT supports a PPTP VPN server in most builds.
  • If you have control of an SSH server you can use its built-in SOCKS proxy.
  • The Tor Network can provide you with anonymity.

If your primary goal is to avoid the watchful eyes of a country that censors and/or monitors Internet traffic you should be very careful; encrypted traffic is a huge red flag for authorities. It is best to hide among the noise using something like Tor and then additionally ensure that you are using some kind of end-to-end encryption if you are transferring sensitive information.

share|improve this answer
My goal is far less insidious: Watch Hulu. – Chris Moschini Nov 22 '11 at 8:06
If it's a requirement (although I can't see why it would be) that your HTTP traffic to Hulu originates from your IP address in the U.S. either DD-WRT's VPN or SOCKS proxy will work. – kce Nov 22 '11 at 9:13
Apparently you've never tried using legal streaming services outside the US! Basically every content agreement is US only, so Netflix, Hulu, some YouTube videos, etc, all present you with an annoyance. – Chris Moschini Nov 22 '11 at 15:47
I don't use any streaming services... so the requirement is new to me (but makes sense now). An appropriately configured SSH server running on a machine at home and a SOCKS proxy is probably the easiest way to do this. – kce Nov 22 '11 at 19:04
Is there anything special I need to do on the DD-WRT router under OpenVPN or PPTP to ensure I can get to the wider internet, not just LAN resources, or is that entirely up to the routing tables on the client? – Chris Moschini Nov 24 '11 at 17:54

Additional info for those looking to get this done:


This is the easy, insecure way, if you're just trying to do something simple like what I'm trying to do here. These instructions cover it:

Additional info:

But I found I had to reboot my router in order for the settings to take. Once I did, connecting from Windows 7 was simple. I was able to test the connection while still sitting behind the router.


This is not easy. I began with these instructions:

They're for an older version of DD-WRT unfortunately. Some addendum to the instructions there:

Every time it says "Common Name," you need to name the certificate/keypair the same thing as the Common Name. So for example when generating server keys, if you plan to end up with ddwrt.crt and ddwrt.key, you need to use the command:

build-key-server ddwrt

Then when it asks for Common Name, again enter ddwrt.

The newer version of DD-WRT has "GUI" and "config file" options. Use the GUI option.

That interface has changed, to have 2 fields: Public Server Cert, and CA Cert. This eliminates the confusion about what to place in each. Obviously you copy/paste your ca.crt into CA Cert, and your server.crt (or ddwrt.crt or whatever you named it) into the Public Server Cert, and only the portions between BEGIN and END.

Where they describe a server config file, they're referring to the field Additional Config. Here's what I used:

push "route"

dev tun0
proto tcp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

# Only use crl-verify if you are using the revoke list &#-106; otherwise leave it commented out
# crl-verify /tmp/openvpn/ca.crl

# management parameter allows DD-WRTs OpenVPN Status web page to access the servers management port
# port must be 5001 for scripts embedded in firmware to work
management localhost 5001

In my case, is the local IP of my router I've setup elsewhere in the DD-WRT interface. refers to a new network specifically for OpenVPN, not in use anywhere else. It's the starting IP for the network; you'll have to enter this same IP in the new field "Network," and then enter the standard netmask in Netmask (

I used TCP, AES-128-CBC, and SHA1.

The firewall step had text that, if copy/pasted directly, caused crazy HTML entities to appear in the firewall commands that screwed everything up, so here they are without the problematic formatting (like emdashes):

iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT
iptables -I FORWARD 1 --source -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

Notice that I'm using the OpenVPN network IP - - in the second line. Remember to click Save Firewall after filling this in, not Run Commands.

And again, after saving everything, I had to reboot for the settings to take.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.