10

My preferred VPN is SoftEther which is one of the reasons for using OpenWrt, as there is not enough room in 16MB of flash to add SoftEther to the GL iNet firmware, but I have no problems fitting SoftEther, OpenVPN and Wireguard on my AR300M16 using OpenWrt 19.07.7. My kill switch for SoftEther, which would probably work for OpenVPN, as it uses the TUN device for its interface, is to setup the following two iptable rules:

iptables -w -I FORWARD -i br+ -o eth0  -j REJECT
iptables -w -I FORWARD -i br+ -o wlan0 -j REJECT

These rules keep any packets from being able to be forwarded to the wan or wwan interfaces. The packets can only be forwarded to my SoftEther interface.

For DNS I am using the stubby package along with dnsmasq to force my DNS to go to Cloudflare over TLS. When I am also using SoftEther, my DNS requests are sent over SoftEther, so the Cloudflare DNS server selected is near my SoftEther server. I also add to /etc /firewall.user the rules:

iptables -t nat -I PREROUTING -i br+  -p udp -m udp  --dport 53 -j DNAT --to 192.168.1.1:53
iptables -t nat -I PREROUTING -i br+  -p tcp -m tcp  --dport 53 -j DNAT --to 192.168.1.1:53

Which forces all router clients to use the router DNS, and not some other DNS address. I have disable IPv6 on my router.