VilaNet on OpenWrt, iStoreOS and KWRT has three routing modes. The default is transparent gateway: the whole LAN uses the tunnel, and phones, computers and TVs do not need their own client. The other two are transparent proxy (no TUN device; the firewall redirects traffic) and manual proxy (the LAN is not captured; only a device you point at the proxy uses it).
If you have not decided whether the router should run VilaNet, read Should I use VilaNet on OpenWrt or Merlin? first. If the packages are not installed yet, start with How do I install VilaNet on OpenWrt?
The three modes
| Mode | Name in the interface | UCI value | What happens on the LAN |
|---|---|---|---|
| Transparent gateway | Transparent gateway | tun | Default. TCP, UDP (including QUIC) and DNS from the whole LAN enter the tunnel, including devices behind the router and the router itself. Devices need no extra setup. |
| Transparent proxy | Transparent proxy | proxy | Does not use TUN. TCP is taken with REDIRECT and UDP with TPROXY. IPv4 only. Use it when TUN conflicts with another tool and you still want the LAN to use the proxy automatically. |
| Manual proxy | Manual proxy | manual_proxy | Does not capture LAN traffic. After you enable the listener, only devices you point at it use the proxy. This is the older behavior. |
Transparent gateway needs fw4/nftables, and it is not for use with mwan3 multi-WAN. When the whole LAN should carry both IPv4 and IPv6, use transparent gateway. Do not use transparent proxy for that.
These are VilaNet's own modes. Do not import a subscription link into PassWall or another plugin, and do not refresh nodes with an old subscription procedure. Sign in as described in the install article.
Where to switch
- In LuCI open Services or Network > VilaNet > Settings > Routing Mode.
- Save. The app restarts the service for you.
- The active mode is the Routing mode or Gateway routing line on Overview.
From the command line, this example selects transparent proxy. You restart the service yourself:
uci set vilanet.global.routing_mode='proxy'
uci commit vilanet
/etc/init.d/vilanet restartUse tun for transparent gateway and manual_proxy for manual proxy. Older names are accepted: redirect, tproxy and transparent_proxy mean proxy; manual, http, socks and mixed mean manual_proxy.
For manual proxy, turn on Enable manual HTTP/SOCKS proxy in Settings before a listener exists. A device uses VilaNet only when it points at that proxy. Use the listener shown on the router. Do not reuse a port from another client on the computer.
How to tell you picked the right mode
- The routing-mode line on Overview matches what you just saved.
- Transparent gateway or transparent proxy: a LAN device that is not running its own VPN can open an ordinary HTTPS site.
- Manual proxy: only the device you pointed at the proxy uses VilaNet. Other devices keep their previous network path.
On the first connection, leave the server choice on Auto - All Servers as the install article says. That chooses a server. It is not the routing mode.
Still not working?
Before you change mode, upgrade or remove VilaNet, read Recovery and rollback. If the router says connected and the LAN has no internet, read LAN devices have no internet and deal with flow offloading before you switch modes back and forth. Use the current install commands on openwrt.vilavpn.com. A Merlin router does not use these three OpenWrt modes. Whether Merlin fits your firmware is covered in the choice guide.