What you trust on OpenWrt, and what it cannot do
Who you trust when ForestVPN updates on an OpenWrt router, why to use https on shared networks, and the honest limits of ForestVPN on a router.
Updated October 8, 2026
Not yet verified on hardware as a whole. This page describes how the package is built and signed and how the router's page behaves. It prints no speed figure, because none has been measured on real hardware.
What you get
A plain account of who you trust when you update ForestVPN on a router, how to link a router safely on a shared network, and the things a router cannot do.
Before you start
- Device: an OpenWrt router with ForestVPN installed.
- Know: the router's own page is open to everyone on the same network.
- Time: five minutes to read.
- What can break: typing your account number where someone on the network can read it.
Steps
-
Choose how to update. ForestVPN's own update button installs a package only if its SHA-256 is in a small release file that ForestVPN signs with a key of its own. It also checks the package manager's signature. Two keys have to agree. That protects the update button, and nothing else.
-
When you run opkg upgrade or apk upgrade yourself, or use LuCI's Software page, you trust ForestVPN's repository key alone. If that key were ever stolen, a package signed with it would install. ForestVPN's own button would still refuse it. So for ForestVPN, prefer the update button. Use the package manager only if you accept that trade. We never ask you to turn off a signature check, and if a page or a person tells you to, it is not us.
-
Link on a shared network with a code. The router's own page is open to everyone on the same network. Over plain HTTP, what you type can be read. The page shows the account number field only over https://. The router makes its own certificate, so your browser warns about it. On a network that only you use, continue. On a shared network (a flat share, a hotel, an office, a guest network) do not type your account number on the router, even over https://: someone on that network can still put themselves in between if you click through the warning.
Link the router with a code instead. On the router press Add to account, and type the 8-character code into the ForestVPN app on your phone or computer. The code works for 10 minutes. The app must be signed in to a ForestVPN account.
-
Keep the backup private. Device names never leave the router. A settings backup (System > Backup) holds this router's key, and lets someone act as this router on your account.
Check it worked
Your browser's address bar shows https:// on the router's page before you type anything. The Updates page shows the installed version, the latest, and when it last checked.
Undo it
If you linked the router on a network you do not trust, press Sign out on the Account page. If a backup file from this router got out, see updates, firmware upgrades and uninstall.
If something is wrong
| Symptom | Cause | Fix |
|---|---|---|
| The browser warns about the certificate | The router makes its own certificate | Expected on a network only you use. On a shared network link with a code. |
| The update button refuses a package | The release file does not list its SHA-256, or the signature does not verify | Do not install it by hand. Try again later, or install again from the download page. |
| A page or a person says to turn off a signature check | It is not ForestVPN | Do not. |
Limits
- Port forwarding and hosting: not through the tunnel. A server at home keeps working on your own connection: mark that device Direct.
- Game consoles: a console behind the tunnel reports a strict NAT type. Mark the console Direct.
- Speed: everything behind the router is carried by the router, and its processor sets the limit. Small routers are the slowest. We publish no speed figure until we have measured one on real hardware.
- IPv6: some locations have no IPv6. The router handles that without letting IPv6 go around the tunnel.
- Mobile uplink: a router on a mobile connection may need smaller packets: the setting is forestvpn.main.mtu.
- Browsers with their own DNS: a browser that does its own secure DNS cannot be caught by the router. Turn it off in the browser.
- Without an account: a router that is not linked to an account is on the free plan. That is a trial on a router: the free allowance was sized for a phone, and a household can use it up in a day. The router tells you when it does.
- MIPS routers: MediaTek MT7621, MT7620 and MT7628, Qualcomm Atheros (ath79), Lantiq and Realtek routers with 128 MB of memory and enough free storage. Other MIPS chips: not yet, and not promised before they are measured.