NymVPN does not provide standalone WireGuard configuration files, so there is no .conf file to download for a router or firewall. The reason is architectural: NymVPN authenticates with rotating zero-knowledge credentials (zk-nyms) rather than the static keys a WireGuard config file relies on. If router-level NymVPN is what you are after, there is good news: a community-built OpenWRT package now runs the full NymVPN client directly on the router, no config files needed. Details below.
Why there are no standard config files
A traditional WireGuard config file contains static keys that grant permanent access. That is convenient, but it also creates a persistent identifier that can be linked to your network activity over time.
NymVPN instead uses zk-nyms, a zero-knowledge credential system that proves you have a valid subscription without revealing who you are. These credentials rotate regularly by design, so a static config file would expire at the next rotation and need to be regenerated each time. Credential rotation is what prevents persistent identifiers from being linked to your activity, and it is a privacy feature, not a limitation the team simply has not gotten to.
NymVPN on OpenWRT routers: the community package
Through a Nym community grant, the team at dial0ut has built and released an OpenWRT package that runs the nym-vpnd daemon directly on the router. Because the full client runs on the device, zk-nym credential rotation keeps working, and every device on your network (smart TVs, consoles, IoT devices) is protected automatically. The package includes:
- Pre-built binaries for a wide range of router architectures (x86_64, ARM64, ARM Cortex, MIPS, RISC-V)
- One-click IPK installation
- A LuCI web interface for login, mode selection (Fast or Anonymous), connection status, and diagnostics, found under LuCI > VPN > Nym VPN after install
Requirements: around 60 MB of free storage and WireGuard support on the router (opkg install wireguard-tools kmod-wireguard). Download the .ipk for your architecture from the releases page and install it via SSH or LuCI's System > Software upload.
Note that this is a community-built and community-maintained package, still in active development. For installation help, feedback, and known issues, use the OpenWRT thread on the Nym forum rather than the support form. Your router counts toward the 10-device limit like any other device.
Other routers and firewalls (pfSense and more)
Broader router and firewall support remains on the NymVPN public roadmap. The engineering challenge is delivering router-level WireGuard without compromising the zk-nym privacy system: the OpenWRT package solves this by running the full client on the router, and similar approaches are being explored for other platforms.
What you can do today
- On an OpenWRT router: install the community package described above.
- On everything else: install the NymVPN app per device. Windows, macOS, Linux, Android, and iOS are all supported, and one subscription covers up to 10 devices. See How many devices can I use with NymVPN?
- Advanced users on Linux can run NymVPN from the command line instead of the desktop app. See How to download and setup NymVPN CLI?
Related questions
Can I export a config from the app?
No. The apps manage zk-nym credentials and WireGuard keys internally, and there is no export option, for the privacy reasons above.
Is the OpenWRT package officially supported by Nym?
It is a community project, built through a Nym grant and maintained by its developers. Nym Support cannot troubleshoot router installations; the forum thread is the right place for help.
Would an OpenVPN file work instead?
NymVPN does not support OpenVPN, so there are no .ovpn files either. See Does NymVPN support OpenVPN or other protocols?
What does NymVPN's WireGuard setup look like under the hood?
A decentralized 2-hop, tunnel-in-a-tunnel design hardened with AmneziaWG. See How does NymVPN implement WireGuard?