Whole-home VPN sounds simple until the living-room TV and the work laptop share one broken tunnel. Prefer a bypass gateway: the main router still handles PPPoE/DHCP; a second box on the LAN runs Kuaimiao and only selected devices point their gateway to it. If the tunnel dies, flip those devices back to the main gateway and the house stays online.
Packages on our download page target phones and PCs, not magic OpenWrt plugins. If your firmware community has no maintained integration, do not flash random “VPN ROM” images. Options that actually work: leave a always-on PC sharing the tunnel to LAN, or export WireGuard/OpenVPN profiles into firmware that you already trust—and only when the client exposes export.
Pick a deployment shape
Bypass gateway: safest rollback. Main router DHCP can stay untouched if you set static gateways per device. Disable IPv6 on clients or the ISP modem; otherwise traffic skips your IPv4 gateway and geo tests still show the ISP.
Main-router transparent proxy: powerful, brittle. Keep a non-proxied escape path (phone hotspot or a spare SSID) before you experiment. One bad iptables rule plus Kill Switch equals a dark apartment.
Laptop ICS/hotspot: fine for an afternoon, terrible overnight—sleep/lid close kills the share. Long TV sessions belong on Android TV sideload instead.
Bring-up order
Stabilize Kuaimiao on the gateway box itself first. Only then point other devices at it. Force VPN DNS on the gateway and retest leaks with the same method as our DNS leak guide. If private LAN admin pages stop loading, you routed RFC1918 into the tunnel—exclude those prefixes.
Failure paths worth stopping on
Whole home offline: restore gateways to the main router before debugging. Single-device weirdness: check Private DNS, corporate always-on VPN, or TV vendor DoH. Slow 4K everywhere: gateway CPU may be saturated—run WireGuard if available, or proxy only the devices that need it.
Each gateway login consumes a device slot. Clean unused sessions before you add a router; details in the device limit article.
Acceptance checklist
Gateway shows the exit country; managed devices match; unmanaged devices still show the ISP; router admin UI remains reachable. Grab builds from the download page, account FAQs from FAQ, install flow from guides.