Nym VPN v1.32.0

Nym VPN v1.32.0 for OpenWrt

Changed

• Connects are ~4x faster: time-to-Connected drops from ~11.5 s to 2.2-3 s
  on the reference router (what remains is dominated by gateway registration
  latency, 1.3-4 s, which is upstream-parity). Three fixes stack up:
  • gotatun is pinned past mullvad/gotatun@a89bba8, fixing in-flight
    handshake indices being purged every 250 ms — the bug that silently
    discarded the exit hop's first handshake response and forced a 5-second
    WireGuard retry on nearly every connect.
  • Connectivity probing starts the moment the exit WireGuard handshake
    completes (port of upstream #5571 adapted to gotatun) instead of on a
    fixed 3-second probe grid, with handshake completion detected within
    50 ms of it happening.
  • Connecting and disconnecting no longer restart dnsmasq. Upstream DNS now
    switches through a daemon-managed resolv file
    (/tmp/resolv.conf.d/nym-resolv.conf) that dnsmasq reloads via inotify,
    removing the ~3.3 s /etc/init.d/dnsmasq restart from every connect and
    the LAN-wide DNS outage window at teardown. dnsmasq is restarted at most
    once per boot (the first daemon start repoints its resolvfile; staged
    uci only, so a reboot reverts to stock automatically) and never by a
    crash-looping daemon. While the VPN is disconnected the daemon mirrors
    netifd's WAN resolvers into the managed file, tracking WAN DHCP renewals.
• Behavior change: user-configured dhcp.@dnsmasq[0].server entries (e.g.
  server=/corp.example/10.0.0.1 domain forwards) are no longer overridden
  while the VPN is connected — they stay active, with queries routed through
  the tunnel. Previous releases replaced the whole server list for the
  session.

---

Quick Install

curl -fsSL https://packages.dial0ut.org/install.sh | sh

Auto-detects your architecture and package manager (opkg or apk), downloads the latest release, and installs everything.

Manual Install

Download the .ipk (OpenWrt ≤24.10) or .apk (OpenWrt 25.x+) for your architecture from the assets below, then:

# opkg (OpenWrt ≤24.10)
opkg update && opkg install ./nym-vpn_*.ipk

# apk (OpenWrt 25.x+)
apk add --allow-untrusted ./nym-vpn_*.apk

Dependencies (kmod-tun, luci-base) are installed automatically. Uses pure Rust userspace WireGuard — no kernel WireGuard module needed.

After Installation

Access the web interface at: LuCI → VPN → Nym VPN

Supported Architectures

Architecture	Example Devices
aarch64_generic	Raspberry Pi 3/4, modern ARM64 routers
aarch64_cortex-a53	MediaTek, Qualcomm ARM64 routers
aarch64_cortex-a53_neon-vfpv4	ARM64 Cortex-A53 with NEON/VFPv4
aarch64_cortex-a72	Raspberry Pi 4, Marvell Armada
arm_cortex-a5_vfpv4	Marvell Armada 375
arm_cortex-a7	GL.iNet Flint, custom ARM builds
arm_cortex-a7_neon-vfpv4	Many MediaTek/Qualcomm routers
arm_cortex-a7_vfpv4	Zyxel, some MediaTek routers
arm_cortex-a8_vfpv3	TI AM335x, BeagleBone
arm_cortex-a9	Broadcom BCM47xx, older Netgear
arm_cortex-a9_neon	Zyxel NBG6817, some Marvell
arm_cortex-a9_vfpv3-d16	Linksys WRT, Netgear R7800
arm_cortex-a15_neon-vfpv4	TI OMAP5, Samsung Exynos
arm_arm926ej-s	Marvell Kirkwood (Linksys EA3500, Seagate GoFlex)
x86_64	x86 VMs, PC Engines APU
i386_pentium4	Older x86 devices
i386_pentium-mmx	Legacy x86 devices
mipsel_24kc	MediaTek MT7621 routers (GL.iNet, Xiaomi)
mips_24kc	Atheros/Qualcomm routers (AR71xx, QCA9xxx)
mips_siflower	Siflower SF19A28 (GL.iNet SFT1200)
riscv64_riscv64	SiFive, StarFive VisionFive

Check your architecture: grep OPENWRT_ARCH /etc/os-release or opkg print-architecture | grep -v all

Package Feed (automatic updates)

The install script registers the feed automatically. To add it manually:

ARCH=$(grep OPENWRT_ARCH /etc/os-release | cut -d'"' -f2)

# opkg
echo "src/gz nym-vpn https://packages.dial0ut.org/opkg/$ARCH" >> /etc/opkg/customfeeds.conf

# apk (point directly at the packages.adb index, like OpenWrt's own distfeeds.list)
echo "https://packages.dial0ut.org/apk/$ARCH/packages.adb" > /etc/apk/repositories.d/nym-vpn.list