Skip to content

Nym VPN v1.31.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Jul 03:51
v1.31.0
923cc2e

Nym VPN v1.31.0 for OpenWrt

Added

  • Mixnet Tuning card in LuCI: adjust Sphinx traffic knobs (Poisson delays,
    background cover traffic, cover/mixing/sending delays) for mixnet mode —
    the daemon-side support existed; this exposes it on the router, matching
    the upstream apps' new Mixnet Tuning screens. Includes a new
    nym-vpnc tunnel set --disable-background-cover-traffic flag and a short
    -l alias for nym-vpnc status --listen.

Changed

  • Fresh installs now default IPv6-into-tunnel to off. Tunneled IPv6 toward
    exits without IPv6 egress was silently dropped, so dual-stack LAN clients
    tried IPv6 first and waited out a timeout before falling back to IPv4 on
    every new connection. Existing installs keep their stored setting; the
    LuCI toggle still enables IPv6.

Fixed

  • Kill-switch no longer leaks established IPv6 (or IPv4) flows out the WAN
    during tunnel reconnects. The firewall's established-connection accept was
    unqualified; it is now scoped to the tunnel interface, so only genuine
    tunnel return traffic is allowed while new and pre-existing WAN-bound flows
    are blocked. Most visible with circumvention (QUIC) transports, which
    reconnect frequently.

  • Toggling the kill-switch in LuCI (or nym-vpnc tunnel set --killswitch) now
    takes effect immediately instead of silently doing nothing until the daemon
    was restarted.

  • The firewall backend is re-detected instead of caching an early "unknown"
    result, so the kill-switch installs correctly even if the firewall service
    starts late or is restarted (previously surfaced as Error state: SetFirewallPolicy).

  • TCP MSS is now clamped to the tunnel path MTU for forwarded LAN traffic
    (both in the daemon's fw4 integration and the reload-restore script). The
    2-hop WireGuard tun runs at MTU 1340; without clamping, LAN clients hit
    PMTU blackholes — web pages stalled while bulk transfers still passed.

  • dnsmasq now gets only IPv4 upstream resolvers when any are available.
    IPv6 upstreams (half of the default set) are unreachable through exits
    without IPv6 egress and added per-lookup timeout stalls; AAAA records
    still resolve over IPv4 transport.

  • Explicitly selected gateways are no longer dropped by the failure
    blacklist — a transient failure on your chosen entry no longer forces
    "switch gateways" errors (upstream #5529).

  • QUIC bridge connections are bounded by a 10 s timeout instead of hanging
    the connect (upstream #5740).

  • A reconnect can no longer race a throttled settings update and re-run
    with stale tunnel settings (upstream #5686, #5817).

  • Reconnecting now retries account sync when the account controller is
    stuck on device-time-desync (upstream #5551).

  • .apk packages shipped with only rpcd in their dependency list: repeated
    -I depends: flags to apk mkpkg overwrite each other, so kmod-tun and
    the other dependencies were silently dropped and fresh apk-based installs
    ended up without the TUN driver (Error state: TunDevice). All dependencies
    are now passed as a single space-separated depends: value.

  • install.sh now runs opkg update/apk update before installing so
    dependencies resolve on routers with stale package lists, and verifies the
    TUN device is available after install (installing kmod-tun explicitly if
    not).

Quick Install

curl -fsSL https://packages.dial0ut.org/install.sh | sh

Auto-detects your architecture and package manager (opkg or apk), downloads the latest release, and installs everything.

Manual Install

Download the .ipk (OpenWrt ≤24.10) or .apk (OpenWrt 25.x+) for your architecture from the assets below, then:

# opkg (OpenWrt ≤24.10)
opkg update && opkg install ./nym-vpn_*.ipk

# apk (OpenWrt 25.x+)
apk add --allow-untrusted ./nym-vpn_*.apk

Dependencies (kmod-tun, luci-base) are installed automatically. Uses pure Rust userspace WireGuard — no kernel WireGuard module needed.

After Installation

Access the web interface at: LuCI → VPN → Nym VPN

Supported Architectures

Architecture Example Devices
aarch64_generic Raspberry Pi 3/4, modern ARM64 routers
aarch64_cortex-a53 MediaTek, Qualcomm ARM64 routers
aarch64_cortex-a53_neon-vfpv4 ARM64 Cortex-A53 with NEON/VFPv4
aarch64_cortex-a72 Raspberry Pi 4, Marvell Armada
arm_cortex-a5_vfpv4 Marvell Armada 375
arm_cortex-a7 GL.iNet Flint, custom ARM builds
arm_cortex-a7_neon-vfpv4 Many MediaTek/Qualcomm routers
arm_cortex-a7_vfpv4 Zyxel, some MediaTek routers
arm_cortex-a8_vfpv3 TI AM335x, BeagleBone
arm_cortex-a9 Broadcom BCM47xx, older Netgear
arm_cortex-a9_neon Zyxel NBG6817, some Marvell
arm_cortex-a9_vfpv3-d16 Linksys WRT, Netgear R7800
arm_cortex-a15_neon-vfpv4 TI OMAP5, Samsung Exynos
arm_arm926ej-s Marvell Kirkwood (Linksys EA3500, Seagate GoFlex)
x86_64 x86 VMs, PC Engines APU
i386_pentium4 Older x86 devices
i386_pentium-mmx Legacy x86 devices
mipsel_24kc MediaTek MT7621 routers (GL.iNet, Xiaomi)
mips_24kc Atheros/Qualcomm routers (AR71xx, QCA9xxx)
mips_siflower Siflower SF19A28 (GL.iNet SFT1200)
riscv64_riscv64 SiFive, StarFive VisionFive

Check your architecture: grep OPENWRT_ARCH /etc/os-release or opkg print-architecture | grep -v all

Package Feed (automatic updates)

The install script registers the feed automatically. To add it manually:

ARCH=$(grep OPENWRT_ARCH /etc/os-release | cut -d'"' -f2)

# opkg
echo "src/gz nym-vpn https://packages.dial0ut.org/opkg/$ARCH" >> /etc/opkg/customfeeds.conf

# apk (point directly at the packages.adb index, like OpenWrt's own distfeeds.list)
echo "https://packages.dial0ut.org/apk/$ARCH/packages.adb" > /etc/apk/repositories.d/nym-vpn.list
Assets 93
Loading