my SUPER secure Raspberry Pi Router (wifi VPN travel router)

A Raspberry Pi can be turned into a travel router that connects to public Wi‑Fi as a client while broadcasting its own secure Wi‑Fi for a family—then forces all traffic through a NordVPN connection. The payoff is straightforward: phones and laptops can use the Pi’s network anywhere (coffee shops, hotels, Airbnbs) without exposing their traffic to the risks of the original public hotspot.

The build starts with hardware choices and a key networking requirement: the Pi needs two Wi‑Fi interfaces. The onboard Wi‑Fi connects to whatever public network is available, while a USB Wi‑Fi adapter broadcasts the Pi’s own SSID for devices to join. For best performance, the project recommends a Raspberry Pi 4 (including the built-in Wi‑Fi and Ethernet), plus a compatible USB Wi‑Fi adapter that OpenWrt can support. After gathering the Pi, power supply, microSD (or a microSD reader), Ethernet cable, and a USB Wi‑Fi adapter, the next step is installing OpenWrt.

OpenWrt is flashed onto the microSD using Raspberry Pi Imager with a downloaded OpenWrt firmware image matched to the Pi model. Once the Pi boots, it can be accessed over SSH on the default address (commonly 192.168.1.1). The setup requires temporarily configuring the computer’s Ethernet interface to the same subnet so SSH works. Early access is intentionally insecure in the default state (no password prompt), so the root password is changed immediately.

Configuration then shifts into OpenWrt’s system files and later into its web GUI. The network settings are adjusted to use a non-default LAN IP range, and configuration files for network, wireless, and firewall are backed up before edits. The firewall is tweaked so the WAN zone accepts traffic (a necessary step for the router to function as intended). After rebooting, the Pi’s LAN IP changes, so the computer must return to DHCP (and matching DNS settings) to reconnect.

The USB Wi‑Fi adapter requires driver support and wireless radio tuning. The process includes updating package lists, installing a batch of packages/drivers, and then bringing up the new interface (e.g., via ifconfig). Wireless settings are corrected in /etc/config/wireless—changing channel, hardware mode, and HT/VHT parameters—so the adapter can actually broadcast. In the OpenWrt web interface, the onboard Wi‑Fi is scanned and joined to the user’s home (or any target) Wi‑Fi, using DHCP to obtain an address.

Once the router provides internet, the security layer is added: OpenVPN client configuration for NordVPN. A NordVPN OpenVPN UDP client profile is downloaded, uploaded to the Pi, and then used to generate the OpenVPN configuration with NordVPN credentials (username/email and password). The OpenWrt GUI is used to enable the OpenVPN client and verify that the public IP changes to a NordVPN IP range—confirming that traffic is being routed through the VPN. Finally, a hotplug-style restart hook is added so the VPN service comes back automatically if the WAN interface drops, which matters for travel.

By the end, the Pi acts as a “secure travel router”: devices connect to the Pi’s SSID, the Pi joins public Wi‑Fi upstream, and all traffic is tunneled through NordVPN for encryption and privacy while on the road. The tutorial also notes that the same OpenWrt Pi approach can replace a home router, though it won’t match the speed of higher-end dedicated router hardware.