Before you change anything: write down the working setup
A migration goes wrong when the old profile is deleted before the new one is proven. Record what works today, so you can get back to it from a hotel room without your laptop's notes.
| Record | Where to find it | Why it matters |
|---|---|---|
| OpenVPN group name and server | VPN, then OpenVPN Client, left sidebar groups [2] | So you know which profile to reconnect if WireGuard fails |
| UDP or TCP | The config you downloaded; NordVPN and Proton both offer each [7][5] | TCP is the one to keep as a fallback |
| Credential type | NordVPN service credentials; Proton's OpenVPN credential under Account [2] | Not your website login; easy to lose |
| Kill switch state | VPN Dashboard tunnel options, or Global Options on 4.7 and earlier [9] | Re-check it after switching tunnels |
| Firmware version | Router admin panel | Kill-switch and policy options differ before and after 4.8 [9] |
| Dedicated IP in use? | Nord Account | NordLynx allows one simultaneous connection on a dedicated IP [8] |
Step 1: get the WireGuard configuration
NordVPN: GL.iNet routers include NordVPN in their built-in WireGuard provider list. Log in to your Nord Account on the web, open NordVPN, find Access Token, click Get Access token, then Generate new token, pick an expiration date and click Generate token. GL.iNet warns that the token is displayed only once, so copy it immediately [1]. On the router, go to VPN, then WireGuard Client, then NordVPN. Paste the token and click Save and Continue, and the router generates a configuration for each server. Select the servers you want and click Apply [1].
Proton VPN: Proton is not in GL.iNet's built-in list [1]. Sign in at account.protonvpn.com, open the WireGuard configuration page under Downloads, name the config, choose platform, options and server, click Create, then Download the .conf file [4]. The options are NetShield filtering level, Moderate NAT and VPN Accelerator. On the free plan, Proton says only VPN Accelerator is available [4]. On the router, use VPN, then WireGuard Client, then Add Manually. GL.iNet accepts zip, tar, gz, conf and txt files, or pasted text, and each manual setup creates a named group in the sidebar [1].
Step 2: run both side by side and test the same things
Leave the OpenVPN group in place. On GL.iNet firmware you connect a profile from the three-dot icon next to it, and a green dot marks the active one. That works the same way on the WireGuard Client and OpenVPN Client pages, and the VPN Dashboard shows the connection's status [1][2][3]. Run each test once on OpenVPN as a baseline, switch to WireGuard, then run it again on the same server country and the same upstream network.
| Test | How | WireGuard should |
|---|---|---|
| Connects | Three-dot icon, then watch for the green dot [1] | Connect without errors |
| Public IP | Any IP check page from a device on the router | Show the VPN server's country |
| DNS leak | Extended DNS leak test from a device | Show no hotel or ISP resolver |
| Speed | Same speed test, same server country, both protocols | Match or beat your OpenVPN baseline |
| Router reboot | Reboot and check the tunnel comes back | Reconnect on its own |
| Kill switch | Disconnect the tunnel and load a page [9] | Block traffic, as OpenVPN did |
Step 3: retire OpenVPN, but keep one TCP profile
Proton notes that WireGuard usually runs over a specific UDP port only, which makes it easy for governments to block. It also says OpenVPN keeps strong anti-censorship ability because it can run over TCP [6]. The same applies on smaller scale to hotel, school and office networks that filter UDP. Proton's OpenVPN download page recommends UDP, and suggests TCP, which uses port 443, if speeds are poor [5]. NordVPN's manual setup offers Download UDP or Download TCP per server [7].
So delete the UDP OpenVPN files you no longer use, and keep one TCP profile per provider in a clearly named group such as Fallback TCP. Be careful with bulk actions. On the NordVPN tab of the OpenVPN Client, Delete All removes every NordVPN configuration file at once [2]. On the WireGuard side, Delete All asks whether to keep the keys [1]. If you need something harder to detect than plain TCP, Proton offers its own Stealth protocol in its apps [6]. That is an app option, not a router config.
Dedicated IPs and multiple tunnels
NordVPN's dedicated IP page says OpenVPN (TCP or UDP) allows up to 10 simultaneous connections on a dedicated IP, NordLynx supports only one, and IKEv2 is not available [8]. GL.iNet's tutorial for a NordVPN dedicated IP uses an OpenVPN UDP or TCP file from NordVPN's OVPN download page, together with the service credentials [10]. If your dedicated IP is also used on a laptop or phone, moving the router to WireGuard can take that single NordLynx slot. Staying on OpenVPN for the dedicated IP is the simpler choice.
For Proton, running more than one WireGuard tunnel means downloading extra configs and editing each extra file's Address and DNS lines, for example Address = 10.3.0.2/32 and DNS = 10.3.0.1 for the second file [4].
If WireGuard misbehaves: roll back without a laptop
Because the OpenVPN profile still exists, rolling back is a tap, not a rebuild. Match the symptom to the first thing to try.
| Symptom after switching | First thing to try |
|---|---|
| NordVPN WireGuard servers fail to connect | Update Servers on the NordVPN WireGuard page to refresh the list [1] |
| Token rejected or expired | Generate a new access token in Nord Account; the old one cannot be shown again [1] |
| Connects at home, not on a hotel or office network | Switch to the TCP OpenVPN fallback profile [5][6] |
| Dedicated IP stops working on another device | Return the router to OpenVPN for the dedicated IP [8][10] |
| Traffic leaks when the tunnel drops | Check the tunnel's Kill Switch setting for the new WireGuard tunnel [9] |
Questions before you decide
Do I need new credentials for WireGuard?
For NordVPN on a GL.iNet router, yes: the built-in WireGuard page asks for an access token generated in your Nord Account, not the service credentials used for OpenVPN. The token is shown only once. For Proton, the downloaded .conf file carries what the router needs.
Why keep OpenVPN at all after switching?
Proton notes that WireGuard usually runs over a specific UDP port, which makes it easy to block. OpenVPN can run over TCP, and Proton's TCP configs use port 443. A single TCP profile gives you something to try on a network that blocks UDP.
Does WireGuard work with a NordVPN dedicated IP?
NordVPN's dedicated IP page says NordLynx supports only one simultaneous connection, while OpenVPN supports up to 10. GL.iNet's dedicated IP tutorial uses OpenVPN. If the dedicated IP is used on other devices too, OpenVPN may be the better fit on the router.
Can I run two Proton WireGuard tunnels on one router?
Proton says you can download two or more configs and edit each extra file's Address and DNS values, for example Address = 10.3.0.2/32 and DNS = 10.3.0.1 for the second file. The router must support multiple tunnels.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- GL.iNet Router Docs 4: WireGuard Client Accessed 30 Oct 2026
- GL.iNet Router Docs 4: OpenVPN Client Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Dashboard Accessed 30 Oct 2026
- Proton VPN: How to manually create WireGuard configurations Accessed 30 Oct 2026
- Proton VPN: How to download OpenVPN configuration files Accessed 30 Oct 2026
- Proton VPN blog: What is WireGuard Accessed 30 Oct 2026
- NordVPN Help Center: GL.iNet setup with NordVPN Accessed 30 Oct 2026
- NordVPN Help Center: Dedicated NordVPN IP addresses Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Block non-VPN traffic (kill switch) FAQ Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Connect to NordVPN with a dedicated IP Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.