Configure the Tomato router as an OpenVPN client and use a dedicated client profile issued by your OpenVPN server. In FreshTomato, enter the server address, transport, routing choices and matching certificates under VPN > VPN Tunneling > OpenVPN Client, paste the complete key blocks, save, start the tunnel and verify the public IP, DNS and private routes. The server profile is authoritative: its address, port, protocol, certificates, cipher settings and control-channel protection must be matched exactly.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
What you need before configuring Tomato
This setup assumes an OpenVPN server is already running and reachable from the router’s WAN connection. The router does not become a server; it authenticates to the remote machine as a client and can then route traffic from its LAN through that tunnel.
As an Amazon Associate I earn from qualifying purchases.
- A Tomato-family router with an OpenVPN client. FreshTomato is the actively maintained community Tomato fork, although other forks expose similar functions with different labels and cipher lists.
- A server-generated client profile dedicated to this router. Do not reuse a profile issued to another device.
- The server’s remote hostname or IP address, port, transport (
udportcp-client) and tunnel type (normallyTUN). - The matching certificate authority (CA) certificate, client certificate and client private key.
- The complete
tls-authortls-cryptstatic key and its direction, if the server profile uses one. - A routing plan: send every LAN device through the VPN, send only selected networks through it, or reach a private server-side LAN without changing the normal internet route.
The safest source for every value is the complete .ovpn file exported by your own server administrator. OpenVPN 2.x certificate deployments begin with a public-key infrastructure (PKI); the CA signs certificates, while the client certificate and private key identify this router. A typo, a missing PEM marker or a key from a different profile prevents authentication.
Choose the routing design first
Routing determines what the router does after the tunnel is established. Decide this before enabling the client, because a full-tunnel change can affect every device on the LAN.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Design | Tomato choice | Traffic behavior | What the server must provide |
|---|---|---|---|
| Full tunnel | Redirect Internet Traffic: All | The router sends normal internet traffic from LAN clients through the VPN. Their public address should become the server’s egress address. | Forwarding, internet NAT, and a DNS service reachable through the tunnel. |
| Split tunnel | Leave redirect disabled or use policy routing | Only routes explicitly supplied by the server or selected by policy use the VPN; ordinary internet traffic keeps using the WAN. | Routes for each private destination and forwarding rules for those networks. |
| Private-LAN access without full tunnel | Redirect disabled, with server-pushed or manually defined private routes | LAN clients reach a remote subnet while their general web traffic remains on the normal connection. | A return route to the Tomato LAN and firewall rules permitting the traffic. |
OpenVPN’s redirect-gateway option changes the default route so all client IP traffic passes through the server. It also sends DNS queries through the VPN, which means the server must accept and answer those requests. A tunnel can therefore show as connected while web browsing fails because DNS or server-side forwarding was not configured.
Export a dedicated client profile from the server
Keep the identity unique
Create one client identity for the router. A unique certificate lets you revoke this device without disconnecting unrelated clients and makes troubleshooting unambiguous. Export the full profile, then either paste its inline blocks into Tomato or extract each directive into the corresponding field.
Map the profile’s authoritative values
Read the profile rather than choosing familiar defaults. The remote line supplies the hostname and port; proto udp differs from proto tcp-client; and the presence of tls-auth, tls-crypt, auth-user-pass, cipher or data-cipher directives changes what the router must send. The server’s settings win over Tomato’s defaults.
Protect the exported private key as you would a password. Anyone who obtains the client key and its matching certificate may be able to authenticate until that identity is revoked.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Open the Tomato OpenVPN client page
- Sign in to the router’s administration interface from the LAN.
- Open VPN > VPN Tunneling > OpenVPN Client.
- Use the Basic, Advanced and Keys tabs. Other Tomato forks may rename a tab or place the same controls in a different order.
Make a note of the existing WAN settings before changing routing. If a configuration mistake cuts off access, you can stop the client or restore those settings from the LAN.
Complete the Basic tab
Startup and interface
- Start with WAN: enable this when the tunnel should automatically start after the router has a working WAN connection. Leave it off while testing if you want manual control.
- Interface Type: choose
TUNfor routed IP networking unless the server explicitly requires a TAP bridge. TUN is the normal choice for site-to-site or remote-access routing. - Protocol: match the profile’s UDP or TCP setting exactly. UDP is common, but selecting it when the server expects TCP prevents a connection.
Remote endpoint and firewall
- Server Address/Port: copy the profile’s
remotehostname or IP and port without changing either value. - Firewall:
Automaticis appropriate for many Tomato installations. Use a custom policy only when your topology requires specific WAN, tunnel or LAN rules. - Authorization Mode: select
TLSfor certificate-based authentication unless the server profile specifies another supported mode.
Authentication and NAT
- Username/Password Authentication: enable it only when the profile contains
auth-user-passor the server administrator supplied separate credentials. Certificate-only servers do not need invented credentials. - Create NAT on tunnel: enable it when the router should translate LAN clients behind the VPN tunnel. This commonly allows full-tunnel internet access when the server is configured to NAT the VPN subnet. For routed access to a remote LAN, the administrator may instead require real client addresses and a return route; confirm that design before enabling NAT.
- TLS control-channel protection: select the mode matching the profile’s
tls-authortls-cryptdirective. Enter the key direction when the profile specifies one; the frequently used outgoing value is1, but the profile is the authority.
Set Advanced routing, DNS and validation
Redirect Internet Traffic
Choose All for a full tunnel. This applies the equivalent of redirect-gateway so LAN traffic uses the VPN default route. Leave it disabled for a split tunnel, or use Tomato’s policy-routing features if only particular clients or destinations should use OpenVPN. Check the router’s own management access after changing this setting; some networks need an explicit exception for local administration.
Accept DNS Configuration
Select the option that matches your DNS plan. If the server pushes resolver addresses, allow Tomato to accept them and verify that those addresses are reachable through the tunnel. If you intentionally use a resolver configured on the router, make sure it can reach that resolver after the default route changes. Do not assume that a connected tunnel automatically supplies working DNS.
Verify the server certificate
Enable the Tomato equivalent of remote-cert-tls server when available. This checks that the peer presents a certificate intended for a server, rather than merely accepting any certificate signed by the CA. If the profile specifies a server name or certificate-name check, copy that requirement as well.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Add only server-required directives
Use the Advanced field for directives such as persist-key, persist-tun, tls-client, auth, cipher or data-cipher settings, remote-cert-tls server, or an administrator-supplied mssfix. Provider-specific options copied from an unrelated profile can conflict with your server. Do not add a directive simply because another example includes it.
Paste certificates and keys exactly
Open the Keys tab and paste complete PEM blocks, including every BEGIN and END line. Preserve line breaks and do not add quotation marks.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Tomato field | Profile material | Important detail |
|---|---|---|
| Certificate Authority | The content inside <ca>...</ca>, or the CA certificate file |
This CA must be the one that signed the router’s client certificate and the server certificate. |
| Client Certificate | The client certificate block | Use the certificate issued specifically for this router. |
| Client Key | The client private-key block | It must pair with the client certificate; never substitute the server’s key. |
| Static Key | The <tls-auth>...</tls-auth> or <tls-crypt>...</tls-crypt> block |
Use the matching mode and direction from the profile. |
Some Tomato versions combine the client certificate and key into one text area, while others provide separate fields. Follow the labels shown by your firmware and keep each block intact. A truncated block or a pasted filename instead of its contents produces certificate or private-key errors.
Save, start and read the status
- Click Save and wait for the configuration to be written.
- Click Start Now.
- Open the client’s Status page and wait for an established session rather than repeated reconnect attempts.
- Record the tunnel address shown by the status page. The exact labels vary by Tomato fork, but a successful state normally includes a connected session and a virtual tunnel address.
If the client does not connect, inspect the log immediately after a failed attempt. The first TLS or authentication error is usually more useful than later timeout messages.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Verify the tunnel from a LAN device
1. Confirm the session
The status page should show a stable connection. Reconnect loops indicate a transport, certificate, static-key, authentication or reachability problem; do not proceed to routing tests until the session stays up.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches2. Check the public IP
From a computer or phone on the Tomato LAN, visit an IP-checking service or inspect the address returned by a trusted diagnostic site. In a full-tunnel design, it should match the OpenVPN server’s internet egress rather than the household WAN address. If it does not, check Redirect Internet Traffic, policy-routing rules and server-side forwarding.
3. Test DNS separately
Resolve an ordinary domain name from the same LAN device. If numeric IP connections work but names do not, inspect Tomato’s Accept DNS Configuration setting, the DNS addresses pushed by the server and firewall rules permitting DNS through the tunnel. Redirected DNS must be handled by the VPN server or by a resolver reachable through it.
4. Test private destinations
Connect to an address on the server-side private LAN that the design is supposed to expose. Full-tunnel internet access does not automatically create a route to every remote subnet. The server must push or otherwise install the private route, permit forwarding and have a return path to the Tomato LAN (unless NAT is deliberately providing that return path).
5. Test failback
Stop the OpenVPN client and confirm that LAN traffic returns to the ordinary WAN path. This verifies that you understand the router’s fallback behavior before enabling automatic startup on a production network.
Troubleshoot by symptom
TLS handshake, certificate or private-key errors
- Check the router’s date and time; an incorrect clock can make certificates appear expired or not-yet-valid.
- Re-paste the complete CA, client certificate and private key, including all PEM boundary lines.
- Confirm that the client certificate and private key are a matching pair issued by the server’s CA.
- Verify the server-name check or
remote-cert-tls serversetting when the profile requires it. - Compare
tls-authversustls-cryptand the key direction. A wrong static key cannot be repaired by changing DNS.
The tunnel connects but there is no internet
- For a full tunnel, confirm Redirect Internet Traffic: All is enabled or that an equivalent
redirect-gatewayoption is applied. - Check Create NAT on tunnel and the server’s forwarding and internet-NAT rules.
- Verify that the server permits the VPN client’s source subnet to reach the internet.
- Test an IP address first, then DNS; this separates forwarding problems from resolver problems.
Internet works but a private LAN does not
- Ensure the server pushes or installs a route for the private subnet.
- Check server and remote-LAN firewall rules.
- Provide a return route to the Tomato LAN, or use NAT only if hiding the LAN addresses is acceptable for the design.
- Make sure the private subnet does not overlap the Tomato LAN; overlapping address ranges cannot be routed reliably without redesign.
DNS fails while IP addresses work
- Review Accept DNS Configuration and the resolver addresses supplied by the server.
- Confirm that the resolver is reachable through the tunnel and that UDP or TCP port 53 is allowed as required.
- Check whether a local DNS interception or firewall rule is still sending queries to an unreachable WAN resolver.
Frequent reconnects or slow pages
- Match the router’s cipher, data-cipher and authentication settings to the server profile instead of relying on a generic example.
- Confirm that the selected UDP or TCP transport and port are permitted by the WAN network.
- Ask the server administrator for the correct MTU or
mssfixvalue if pages stall, large transfers fail or the tunnel resets under load. - Check router CPU utilization; encryption can be demanding on older hardware, especially when every LAN device uses a full tunnel.
Common configuration mistakes to avoid
- Using a profile from a commercial VPN service or another server instead of the profile generated by your own server.
- Choosing TCP or TAP because it is familiar when the server requires UDP or TUN.
- Pasting only the text between PEM markers and omitting the
BEGIN/ENDlines. - Enabling username/password authentication when the server expects certificate-only login, or omitting it when
auth-user-passis required. - Turning on full-tunnel routing without arranging server-side forwarding, NAT and DNS.
- Assuming that a connected status proves private-subnet reachability; routing and return paths are separate from authentication.
- Copying provider-only directives into a self-hosted configuration. Every extra option should have a documented purpose in your server profile.
When to use full tunnel, split tunnel or routed LAN access
Full tunnel for all household devices
Use this when the goal is one egress point for the entire LAN or centralized internet filtering. It is simple for clients because no device needs its own VPN software, but the server must carry all internet traffic and provide working DNS. A server outage or stopped client can change connectivity for every device, so test failback and consider an explicit policy for router-management traffic.
Split tunnel for selective destinations
Use this when only company, lab or home-server subnets should traverse OpenVPN. It preserves the normal WAN path for general browsing and reduces server bandwidth, but every required destination needs a route and firewall policy. Policy-routing controls may also be needed when only certain LAN hosts should use the tunnel.
Routed access to a remote private LAN
Use this when the important result is access to internal services rather than a changed public IP. Prefer routed addresses when the remote network can install a return route to the Tomato LAN. NAT can simplify return traffic, but it hides the original client addresses and may complicate access controls and logging.
Transport, authentication and control-channel choices
| Choice | Use it when | Trade-off |
|---|---|---|
| UDP | The server profile specifies UDP and the path permits it. | Usually efficient for a VPN tunnel, but it may be blocked or disrupted on restrictive networks. |
| TCP | The server explicitly provides a TCP listener or the network requires it. | Can traverse some restrictive paths, but TCP-over-TCP behavior may reduce performance. |
| Certificate only | The server authenticates the dedicated client certificate and key. | Fewer moving parts, but the private key must be protected and revoked if exposed. |
| Certificate plus username/password | The profile includes auth-user-pass and the server requires both factors. |
Adds credential management and another failure point, while retaining certificate identity. |
tls-auth |
The server profile names this static control-channel HMAC key. | Requires the exact key and direction. |
tls-crypt |
The server profile names this static control-channel encryption key. | Requires the exact key and matching mode; do not substitute a tls-auth key. |
These are not interchangeable preferences. The server profile determines which combination is valid; selecting a theoretically attractive option that the server does not support simply prevents a handshake.
Recommended Free Tools
Maintenance and security after it works
- Keep the router firmware supported by its Tomato fork and apply updates through the fork’s documented process.
- Store a backup of the working client configuration without exposing the private key unnecessarily.
- Revoke the router’s certificate on the server if the router is sold, reset, lost or suspected of compromise, then issue a new profile.
- Review server logs and Tomato status after WAN changes, certificate renewals or server reconfiguration.
- Document the intended routes, DNS behavior, NAT decision and failback procedure so another administrator can recover the network.
A successful connection is only the authentication phase. Reliable service requires the matching routes, forwarding rules, DNS path and return routes for the traffic you actually intend to carry.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
