The problem is this: The only officially supported router configuration for nordvpn is to use a static config file and openvpn.

That doesn't work for me.

The question: Using linux, how does one setup a nordvpn router/gateway that allows use of dynamic connections, nordlynx, and whatever other options available in the native nordvpn apps?


1 Answer 1


Full disclosure, this is essentially a duplicate of an answer I provided here:Setting up a NordVPN gateway on my Raspberry Pi

Now, down to business.

I don't like being told I can only use a feature if I use only one preselected-at-setup configuration, especially when the infrastructure supports, and provides a tool for, allowing dynamic selection of the best available path at any given time on the fly.

The options I have found on the interwebs all share a common OpenVPN-only solution. Lather, rinse, repeat.

The current commonly accepted solution is as follows:

Select a single server. Download a static config file for that single server which is only available for the more inferior protocol. Walk through an unnecessarily complex setup and configuration process. Finally, keep your fingers crossed that the chosen server continues to perform consistently over time, or repeat the process again when performance degrades again, and again, and again.............. That doesn't work for me, so I went to work cracking this problem. For those interested, I believe I have cracked the 'dynamic-nordlynx-whole-network-router' problem.

My solution: UPDATED 2024-04-13 removed erroneous mangle rule

It boils down to 3 iptables rules. Since this uses the native linux app, it can use all the features available. That means you can tell which server to connect to or let it dynamically connect to the current best one in the category you choose, such as p2p, onion, etc. Autoconnect works. I think you get the idea. It would probably work using the OpenVPN protocol, but I haven't tried it because moving on from OpenVPN was part of my reason for doing this. Killswitch is always on and cannot be disabled with this setup.

The iptables rules are the real key. We all know the 3 basic rules to forward traffic, but you must use 'nordlynx' as the WAN interface.

$ iptables -t nat -A POSTROUTING -o nordlynx -j MASQUERADE
$ iptables -A FORWARD -i <LAN> -o nordlynx -m state --state RELATED,ESTABLISHED -j ACCEPT
$ iptables -A FORWARD -i <LAN> -o nordlynx -j ACCEPT

Set to your lan facing interface.

I have deployed this on several Proxmox VMs and lxc containers on various consumer and enterprise equipment. I'm certain this can easily be adapted to a pi. I may dig one out to try it if I find some time. My current configuration is running as an lxc on Proxmox along side a pihole lxc and pfsense vm on a N100 sff computer with 4 NICs. This setup is noticeably faster than the OpenVPN-on-pfsense combo. Although it is still in place, it's bypassed. Kept as a backup option just in case.

             |<---physical port
************ | ************
*          * | *          *
*       NordVPN lxc       *
*   vmbr---->|            *
*         pfsense   vmbr  *
*          * | * \<----   *
*          * | *  pihole  *
************ | ************
   |         |        |<---physical ports
  LAN      WiFi     Guest

I tried to post his on the nordvpn subreddit, but apparently I don't have enough karma.

I just want to help others when I can.

My project and fairly complete writeup for my linux-based router can be found here: https://github.com/theOtherLuke/nordlynx-router/tree/main

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .