Does anyone have a pre-configured backup of OpenWrt with OpenVpn properly configured for ExpressVPN ovpn files? I am trying to configure my Gl.iNet Beryl router to work with the ovpn files I downloaded from ExpressVPN but I can't get the darn thing to work. I am a newbie and all of this is making my head spin. I just want to be able to use the router when I travel so I can have privacy. Thanks!
It's not hard to install OpenVPN (or -- I'd recommend WireGuard if supported by ExpressVPN) on OpenWrt, and configuration shouldn't take all that much time.
Are you using official OpenWrt or the GL-inet vendor firmware?
ubus call system board
FYI, VPN doesn't really provide any additional privacy.
Unless you live in a country where internet is restricted (for whatever reason) or want to bypass geo blocks (streaming, or shopping at (for instance) usa.tommy.com while being in abroad, etc), it's pretty much useless.
Word of warning ExpressVPN does not seem to work on Master branch as compression is disabled there as it is unsafe and deprecated but ExpressVPN still seems to use it.
So better use WireGuard
See: Snapshot openvpn compression issue
Edit: not sure if it is still enabled in 25.12 branch but your log should show the problems.
Set verb 5 and share the openvpn log
Lzo compression and all old worthless chipers was deprecated in OpenVpn main source code when 2.6 was released if I remember right.
I factory reset my router and logged into OpenWRT. I downloaded Wireguard and started configuring it. Then I ran into an issue: Per Google Gemini:
ExpressVPN officially supports WireGuard, but you cannot manually use its WireGuard tunnel on a standard third-party router. While ExpressVPN includes a customized, post-quantum version of the WireGuard protocol in its official native apps, the provider does not supply manual WireGuard configuration files (.conf). This restriction severely impacts how you can deploy the protocol on networking hardware.
So, OpenVPN it is...
I was able to set up ExpressVPN on my router using OpenVPN and the ExpressVPN .ovpn config files with the help of Claude. I never would have been able to figure it out on my own. Thank you to all who gave suggestions!
I suggest you look for a VPN provider which supports WireGuard on the router.
Would you be willing to share how you did it with passwords etc removed?
Thanks
Honestly, I just followed the instructions from Claude, but ultimately I needed to make a few tweaks in the Luci dashboard and add/remove a few lines in the ovpn files to get the vpn to work. I ran several speed tests and now I have it where I think it'll be good for what I need it to do. As I stated earlier, I am just a newbie, so it was trial and error (and a lot of frustration) for me. I do recommend using Claude to configure it the way you want.
If you had shared your config and log with us (after setting verb 5 in the config) we might have been able to tell tell you what was wrong 
egc, verb 3 is in my current config. Should I change it to verb 5?
donhwy, apologies, I know what you meant now. Here's the config file as edited with the help of Claude:
dev tun
fast-io
persist-key
persist-tun
nobind
[vpn location string]
remote-random
pull
pull-filter ignore "comp-lzo"
comp-lzo no
tls-client
verify-x509-name Server name-prefix
ns-cert-type server
key-direction 1
route-method exe
route-delay 2
tun-mtu 1500
fragment 1300
mssfix 1400
verb 3
cipher AES-256-GCM
auth SHA512
auth-user-pass [Location of auth file containing username/password (e.g., /etc/openvpn/...auth)]
There are keys and certificates at the bottom that I skipped for brevity.
Does this at least look right?
Thanks again!
If you change verb 3 to verb 5 and then restart openvpn (from command line: service openvpn restart) wait about 20 sec and then from command line do :logread -e openvpn and post the output then we can say for sure.
There are some deprecated options like persist-key, ns-cert-type server, fast io, fragment and the the compression settings but those are normally no show stoppers.
cipher AES-256-GCM can be replaced with data-ciphers AES-256-GCM but also no show-stopper.
So bottom line this could work
Edit: key direction is used for a tls-auth key which is also outdated and replaced with tls-crypt if this is still used by ExpressVPN it show how much love OpenVPN gets form ExpressVPN.
TBH a lot of providers are silently phasing out OpenVPN, Mullvad actually stopped supporting it already
Which is a pity as there are perfectly fine use cases for OpenVPN e.g. L2 tap connections or obfuscated OpenVPN
Well, this has been quite an adventure! I think I'm going to use Wireguard with another VPN provider. Trying to configure OpenVPN using ExpressVPN's config files has been a total pain in the rump. I appreciate everyone's suggestions and support.
Proton has a free account which you can use for testing WireGuard see:
WireGuard Client Setup Guide