Nym VPN v1.32.1

Nym VPN v1.32.1 for OpenWrt

Fixed

• Routers with a committed noresolv in the dnsmasq config (AdGuard Home,
  https-dns-proxy, stubby and similar user-owned DNS setups) could not
  connect on 1.32.0: the restart-free DNS handover verified a resolv-file=
  repoint that OpenWrt's init script never emits under noresolv, so every
  connect failed with a DNS error after restarting dnsmasq twice. The daemon
  now detects this and steps aside — dnsmasq is left untouched (zero
  restarts), the connect succeeds, and the user's chosen upstreams simply
  ride the tunnel while connected.
• Ad-blocking no longer silently fails to restore when the daemon starts
  while the kill-switch is engaged (the blocklist download was rejected by
  our own firewall). After a daemon restart the already-installed list is
  reused without a download or dnsmasq restart; after a reboot the download
  retries in the background and completes once a tunnel is up.
• A dead or hung nym-vpnd no longer strands the router behind its own
  kill switch (reproduced on real hardware: WAN egress and LAN forwarding
  blocked, DNS still resolving, with no process left able to clear the
  firewall). /etc/init.d/nym-vpnd stop now tears down the kill-switch
  table after the daemon is gone — including when the daemon is
  unresponsive and cannot be asked to disconnect (the graceful disconnect
  is bounded at 10s instead of wedging stop forever) — and procd now
  respawns the daemon indefinitely instead of abandoning it after a crash
  loop with the fail-closed firewall left up.

Security

• Bumped the bundled WireGuard implementation (mullvad/gotatun) from the
  March 2026 pin (~0.4.1) to 0.8.1, picking up upstream security fixes:
  a remotely triggerable crash in the UDP receive path (an oversized
  datagram could panic the batched recvmmsg handler; fixed in 0.7.2),
  cross-peer allowed-IPs subnet spoofing (a peer could hijack another
  peer's routed subnets; fixed in 0.7.2), enforcement of the WireGuard
  nonce limit (Reject-After-Messages), and cookie replies being sent from
  a mismatched source port (fixed in 0.6.0).

Changed

• WireGuard anti-replay window grew from 1024 to 8192 packets (fewer
  spurious drops under heavy packet reordering) and passive-keepalive
  timers now match wireguard-go semantics — idle tunnels no longer
  keepalive-ping-pong each other. The 7 MB UDP socket buffers that
  gotatun 0.7.0 stopped setting are restored explicitly, so throughput
  on OpenWrt's small default socket buffers is unaffected by the bump.

---

Quick Install

curl -fsSL https://packages.dial0ut.org/install.sh | sh

Auto-detects your architecture and package manager (opkg or apk), downloads the latest release, and installs everything.

Manual Install

Download the .ipk (OpenWrt ≤24.10) or .apk (OpenWrt 25.x+) for your architecture from the assets below, then:

# opkg (OpenWrt ≤24.10)
opkg update && opkg install ./nym-vpn_*.ipk

# apk (OpenWrt 25.x+)
apk add --allow-untrusted ./nym-vpn_*.apk

Dependencies (kmod-tun, luci-base) are installed automatically. Uses pure Rust userspace WireGuard — no kernel WireGuard module needed.

After Installation

Access the web interface at: LuCI → VPN → Nym VPN

Supported Architectures

Architecture	Example Devices
aarch64_generic	Raspberry Pi 3/4, modern ARM64 routers
aarch64_cortex-a53	MediaTek, Qualcomm ARM64 routers
aarch64_cortex-a53_neon-vfpv4	ARM64 Cortex-A53 with NEON/VFPv4
aarch64_cortex-a72	Raspberry Pi 4, Marvell Armada
arm_cortex-a5_vfpv4	Marvell Armada 375
arm_cortex-a7	GL.iNet Flint, custom ARM builds
arm_cortex-a7_neon-vfpv4	Many MediaTek/Qualcomm routers
arm_cortex-a7_vfpv4	Zyxel, some MediaTek routers
arm_cortex-a8_vfpv3	TI AM335x, BeagleBone
arm_cortex-a9	Broadcom BCM47xx, older Netgear
arm_cortex-a9_neon	Zyxel NBG6817, some Marvell
arm_cortex-a9_vfpv3-d16	Linksys WRT, Netgear R7800
arm_cortex-a15_neon-vfpv4	TI OMAP5, Samsung Exynos
arm_arm926ej-s	Marvell Kirkwood (Linksys EA3500, Seagate GoFlex)
x86_64	x86 VMs, PC Engines APU
i386_pentium4	Older x86 devices
i386_pentium-mmx	Legacy x86 devices
mipsel_24kc	MediaTek MT7621 routers (GL.iNet, Xiaomi)
mips_24kc	Atheros/Qualcomm routers (AR71xx, QCA9xxx)
mips_siflower	Siflower SF19A28 (GL.iNet SFT1200)
riscv64_riscv64	SiFive, StarFive VisionFive

Check your architecture: grep OPENWRT_ARCH /etc/os-release or opkg print-architecture | grep -v all

Package Feed (automatic updates)

The install script registers the feed automatically. To add it manually:

ARCH=$(grep OPENWRT_ARCH /etc/os-release | cut -d'"' -f2)

# opkg
echo "src/gz nym-vpn https://packages.dial0ut.org/opkg/$ARCH" >> /etc/opkg/customfeeds.conf

# apk (point directly at the packages.adb index, like OpenWrt's own distfeeds.list)
echo "https://packages.dial0ut.org/apk/$ARCH/packages.adb" > /etc/apk/repositories.d/nym-vpn.list