---
name: "OpenWrt VPN Setup"
description: "Plan and implement OpenWrt VPN with selective routing, DNS, GeoIP/ASN, and split tunneling using the OpenWrt VPN & Network Engineer agent."
argument-hint: "Router/OpenWrt version, VPN type (xray/sing-box/WireGuard/OpenVPN), which IPs/domains should go via VPN, DNS requirements"
agent: "OpenWrt VPN & Network Engineer"
---

Create a complete OpenWrt VPN plan and implementation guidance from the provided input.

Requirements:
- Support xray, sing-box, WireGuard, or OpenVPN (choose and justify)
- Configure DNS with leak prevention
- Configure split tunneling and policy-based routing
- Route VPN only for selected destination IPs and/or domain groups
- If requested, include GeoIP and ASN based routing policies
- Provide concrete OpenWrt config snippets and apply order
- Provide verification commands and rollback steps

Before integration work, request missing MCP/webhook details:
- MCP server IDs and intended actions
- webhook URL/method/auth/headers/payload
- secret handling and retry/error policy

Output in sections:
1. Discovery Summary
2. VPN Routing Plan
3. Hardening and Validation
4. Open Questions