Whole home or chosen devices on OpenWrt
Choose which devices behind your OpenWrt router use ForestVPN, keep a game console or work laptop on Direct, and handle phones whose Wi-Fi address changes.
Updated October 8, 2026
Not yet verified on hardware as a whole. The three modes and the Direct switch passed the lab leak suite on OpenWrt 21.02.7 and 24.10.8. They have not yet been followed on a household router with a mix of real devices.
What you get
You say who uses ForestVPN in one choice. ForestVPN on a router picks by device, never by website or app, and remembers each device by its hardware address.
Before you start
- Device: an OpenWrt router with ForestVPN installed and linked, see first run.
- Plan: every device behind the router shares one plan and one location. On the Free plan that is one allowance for the whole home, so choose a few devices or get Premium. The pricing page has the numbers.
- Time: two minutes.
- What can break: a phone that uses a changing private Wi-Fi address looks like a new device each time. In the mode where you choose the devices, such a phone can drop out of the list and go direct, with no sign on the phone.
Steps
-
Open Services > ForestVPN > Devices. The list shows the devices the router knows. Devices appear once they connect.
-
Choose the mode.
- Every device: the whole home. Anything that connects is protected.
- Only the devices I choose: tick the devices that should use ForestVPN. Devices you leave on Direct are not protected.
- Every device except the ones I choose: everything is protected, and you list the exceptions. A new device is protected by default, so this is the mode that does not leak when a phone changes its address.
-
Set a device to Direct when it should never use the tunnel. A game console, a banking app that refuses VPN traffic, a work laptop, or a server at home that you reach from outside. A device set to Direct is never blocked by the kill switch and never uses the tunnel's name lookups.
-
Add a device that does not appear in the list, one with a fixed address, by its hardware address, which looks like aa:bb:cc:dd:ee:ff. Nicknames are optional and never leave the router.
-
Press Save. The change applies within a few seconds, with no reboot.
Prints the mode that is in force: all, chosen or except
uci -q get forestvpn.main.mode
Check it worked
From a device you chose, open a what-is-my-address page: it shows the location's address. From a device on Direct it shows your home address. After a device gets a new IP address from the router it keeps its choice, because the choice follows the hardware address.
Undo it
Switch the mode back to Every device, or set the device to Direct. To stop all protection press Pause protection on the status page.
If something is wrong
| Symptom | Cause | Fix |
|---|---|---|
| A phone shows your home address although you chose it | The phone uses a private Wi-Fi address that changed, so the router sees a new device | Turn the private address off for your home network on the phone, or use Every device except the ones I choose. If the router asks "Is the new device the same as ...", answer yes to copy the setting. |
| A game console reports a strict NAT type | The console is behind the tunnel, which cannot forward ports | Mark the console Direct. |
| A server at home cannot be reached from outside | Port forwarding does not work through the tunnel | Mark that device Direct. |
| Nothing changes after Save | Protection is not on yet | Finish the setup first. The choices take effect after it. |
Limits
- ForestVPN itself chooses by device, not by site or app. To choose by site, press Let another app route and let passwall2, podkop or pbr decide: see beside your other router software.
- Port forwarding and hosting do not work through the tunnel.
- Your own router traffic never enters the tunnel.
- A device with a fixed address does not appear in the list. Add it by its hardware address.