VPN Router recommendations

[elbertmai]

@Lummood

I’m bad with networking so please tell me what to buy and how to config it like i’m five years old.

What you're asking for can be tricky even for experienced power users, so if you're "bad with networking", you're definitely not going to have a good time. If you want to make this work, be prepared to implement this methodically, focusing on one thing at a time. This makes troubleshooting easier to do. Build up small successes before doing the whole thing, or you will cause yourself needless frustration.

@Lummood

1. Wireguard speed of 900mbps or higher (using protonvpn on the router itself)

Don't buy any new and expensive hardware until you know you can make your setup work. Do this on your existing router if OpenWrt supports it. If it doesn't, go buy a cheap and/or used but supported device so you can experiment. Don't worry if it's VPN performance sucks, you're just using it to confirm a working configuration.

@Lummood

2. Multi-VPN servers support (meaning i can pretend my tv to be on lets say Canada IP, phone on US IP, laptop on Norway IP, etc. (all using protonvpn)
3. Ability to use the internet without/bypassing VPN on some or all of my devices (to access websites which doesn’t work on VPN or if i feel VPN is slow).

Here's a sketch of a plausible implementation path for this kind of setup:

1. Create an IP addressing plan for your virtual LANs (VLAN). For example, you might come up with this:
   • VLAN 1: 192.168.1.0/24 to all your "non-VPN" devices.
   • VLAN 2: 192.168.2.0/24 to all your "Canadian" devices
   • VLAN 3: 192.168.3.0/24 to all your "American" devices
   • VLAN 4: 192.168.4.0/24 to all your "Norwegian" devices
2. Configure DHCP server to hand out addresses from one of the above subnets based on the VLAN the DHCP client is attached to.
3. For WiFi devices, set up per-passphrase WiFi VLANs so you can assign phones, tablets, etc. to a specific VLAN simply by giving them the correct passphrase.
4. Go to your Proton VPN account and generate a Wireguard configuration. Apply this configuration to a new Wireguard interface and see that you get a successful handshake.
5. Repeat step 4 to obtain multiple Wireguard interfaces, each configured for a different country.
6. Set up routes and firewall rules to "connect" each VLAN to the correct Wireguard interface.

Do not try to do everything at once, because each of the above steps can be time consuming to implement and troubleshoot. I would suggest learning about and figuring out VLANs first before even tackling the Wireguard part.