How to set up Surfshark VPN on DD-WRT router – Surfshark Customer Support

In this tutorial, you will learn how to configure the Surfshark VPN tunnel on your DD-WRT router.

You will learn how to:

Find your login details
Choose Surfshark server
Configure the OpenVPN client
Connect to the VPN

To proceed, you need to have a router with DD-WRT firmware and an active Surfshark subscription. It's worth mentioning that your router must have at least 8 MB of flash memory to maintain the VPN connection.

If you don’t have the subscription yet, you can get it on our pricing page.

Find your login details

Surfshark service credentials are different from your Surfshark account credentials, namely your email address and your password. You’ll need Surfshark service credentials to connect to the VPN using the manual OpenVPN configuration method explained below.

Here is how you can get your Surfshark service credentials:

Go to this page, where you will find all of the details required for a manual connection.

You may need to log in before proceeding to this page. In that case, enter your email address and your password, then click Log in.
Click on the Credentials tab at the top. You will find the Surfshark service credentials here.

It's a good idea to keep this page open for now. You will need these credentials a bit later.

Choose a Surfshark server

Every server (location) has a configuration file that you will need to connect to the VPN. You can download all of the configuration files from our website.

Go to this page. It’s the same page where the Surfshark service credentials are stored.
Select the Locations tab, where you will see all of the Surfshark servers.
You will need an OpenVPN configuration file for the location of your choice. For example, if you wish to connect to Germany, download Germany - Berlin or Germany - Nuernberg server by clicking on the location and then on UDP to download the configuration file.

Configure the OpenVPN client

Before connecting to the VPN, you will need to configure the OpenVPN client on your router.

First of all, you will need to open the control panel of your router.

You can reach it by entering the IP address of your router to the URL bar in your browser.

Most often, this IP address is used to reach DD-WRT router: 192.168.1.1
If this one does not work, try the following:
192.168.2.1 (Linksys/ Asus routers)
192.168.10.1 (Buffalo routers)
192.168.11.1 / 192.168.30.1 (Motorola and some others)
You will need to set up Surfshark’s DNS servers. In the DD-WRT control panel open the Setup tab, scroll down to the Network Address Server Settings (DHCP) and enter the following information:

Static DNS 1 = 162.252.172.57
Static DNS 2 = 149.154.159.92
Static DNS 3 = 0.0.0.0 (default)
Use DNSMasq for DHCP = Checked
Use DNSMasq for DNS = Checked
DHCP-Authoritative = Checked

Then, click Save and Apply Settings.
Then, click on the Service tab, select VPN, and find the OpenVPN client.
Enter the following information:

Server IP/Name: enter the server hostname that you have collected in the "Choose Surfshark server" section of this tutorial.

Port: 1194;
Tunnel Device: TUN;
Tunnel Protocol: UDP;
Encryption Cipher: None;
Hash Algorithm: SHA-512;
User Pass Authentication: Enable;
Username: Your Surfshark service username that you have found at the "Find your login details" section of this guide.
Password: Your Surfshark service password that you have found at the "Find your login details" section of this guide.

Note: If there are no Username and Password fields, fill in the other fields as specified in this tutorial and proceed to step 3.1.

Advanced Options = Enable (this will enable additional options);
TLS Cipher: None;
LZO Compression: Disabled;
NAT: Enable

We recommend that you avoid changing any other fields.

4.1 (Optional, depending on step 4.) If you do not see any fields to enter your credentials, please advance to Administration > Commands, and enter these commands:
```
echo "USERNAME
PASSWORD" > /tmp/openvpncl/user.conf
/usr/bin/killall openvpn
/usr/sbin/openvpn --config /tmp/openvpncl/openvpn.conf --route-up /tmp/openvpncl/route-up.sh --down-pre /tmp/openvpncl/route-down.sh --daemon
```
Please make sure to replace USERNAME and PASSWORD with your Surfshark service credentials that can be found at this page under the Credentials tab. Click Save Startup, and return to the previous VPN tab.

Also, add this line to the field of Additional Config:

auth-user-pass /tmp/openvpncl/user.conf

In Additional Config field enter these commands:

remote-cert-tls server
remote-random
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ping-timer-rem
reneg-sec 0
cipher AES-256-GCM
auth SHA512
log /tmp/vpn.log

5. Copy the Certificate from here and paste it to the CA Cert field.

Copy the Static key from here and paste it to the TLS Auth Key field.

-----BEGIN OpenVPN Static key V1-----
b02cb1d7c6fee5d4f89b8de72b51a8d0
c7b282631d6fc19be1df6ebae9e2779e
6d9f097058a31c97f57f0c35526a44ae
09a01d1284b50b954d9246725a1ead1f
f224a102ed9ab3da0152a15525643b2e
ee226c37041dc55539d475183b889a10
e18bb94f079a4a49888da566b9978346
0ece01daaf93548beea6c827d9674897
e7279ff1a19cb092659e8c1860fbad0d
b4ad0ad5732f1af4655dbd66214e552f
04ed8fd0104e1d4bf99c249ac229ce16
9d9ba22068c6c0ab742424760911d463
6aafb4b85f0c952a9ce4275bc821391a
a65fcd0d2394f006e3fba0fd34c4bc4a
b260f4b45dec3285875589c97d3087c9
134d3a3aa2f904512e85aa2dc2202498
-----END OpenVPN Static key V1-----

Make sure you have entered everything correctly and click Save and Apply Settings.

Connect to the VPN

Once you click the Apply Settings after configuring your OpenVPN client, your router connects to the VPN automatically.

In order to disconnect from the VPN, go to Services -> VPN -> OpenVPN client and disable the OpenVPN Client. To reconnect, enable it again.

To make sure you have connected to the VPN, go to Status -> OpenVPN. If the connection was successful, you should see this:

Congratulations - you have successfully installed and configured Surfshark VPN on your router! As long as you’re connected, your location is private, and your sensitive data is secure.