VilaVPN for every device
on your network.
vilanet-cli for Asuswrt-Merlin / Koolshare is the router-class VilaVPN client.
One Koolshare package. One router. Every device covered.
VilaNet ships to Asuswrt-Merlin as a single Koolshare rogsoft package.
AES-256-GCM credential store
Your VilaVPN password is sealed with an AES-256-GCM envelope under /koolshare/configs/vilanet/.
Embedded sing-box, one binary
Every protocol the VilaNet app supports, in a single static 32-bit ARM binary.
Koolshare-native
A Software Center package with an on-router Web UI plus the vilanet-cli command.
Full-device TUN gateway
When the firmware exposes TUN + nftables, every LAN client's traffic enters the tunnel.
Kill-switch / fail-closed
When the tunnel drops, the iptables rules block LAN forwarding paths that would bypass it.
Nothing sensitive on disk
Runtime VPN config, exit endpoints, and node details live only in process memory.
Install from the Software Center
VilaNet for Merlin ships as a single Koolshare rogsoft package.
Not sure? Pick armv7 for a modern AC/AX router. Choose armv5 if you have an older router or armv7 won't run.
Download the rogsoft package
A static ARM build with the embedded sing-box, for the hnd firmware family. Install it online from the Software Center, or download it here for an offline install.
Software Center (online, recommended)
Open 软件中心 / Software Center → find VilaNet → install.
Offline / manual install
Download the .tar.gz above, then Software Center → offline install, or run sh install.sh.
More firmware families
axhnd / axhnd.675x / p1axhnd.675x are being added.
Choose a routing mode
Pick tun (whole-LAN gateway) or proxy (transparent / mixed).
From installed package to working tunnel
Package installed? These four steps take you from a fresh install to every LAN device exiting through VilaVPN.
1. Sign in
Sign in once. Your password is sealed into the encrypted store.
2. Browse your servers
List the servers on your account. They appear as opaque IDs / redacted names.
3. Enable, then connect
Enable the service once with vilanet-cli enable, then bring the tunnel up with vilanet-cli connect. (In the Web UI this is the Connect button.)
4. Verify on a LAN client
From any device on the LAN, check the public IP. It should be the VilaNet exit, not your ISP.
From LAN port to exit node
Every LAN client's packets are captured by the router, encrypted by the embedded sing-box, and sent to a VilaVPN exit node.
The Software-Center module
VilaNet's on-router Web UI is a Koolshare Software-Center module — a six-tab page: Overview, Account, Servers, Settings, Diagnostics, and Maintenance.
Overview
The landing tab: live VPN state, the selected server by opaque name, routing mode, TUN/proxy availability, the LAN proxy endpoint, and connect / disconnect controls.
Account
Sign in with your VilaVPN email and password — sealed into the encrypted store on the router — and see your account and subscription.
Servers
Your servers as opaque IDs / redacted display names, each with a Connect button. Real hostnames, IPs, and ports are never shown.
Settings
The config keys below as form fields. Saving writes them via vilanet-cli config and restarts the service when needed.
Diagnostics
Redacted runtime logs plus the connectivity self-test and a diagnostics dump for bug reports — endpoints and credentials scrubbed.
Maintenance
Service controls and package upkeep: enable / disable, restart, check for updates, and roll back.
vilanet-cli on the shell
Everything in the Web UI has a vilanet-cli equivalent over SSH.
login
Sign in and seal email + password into the encrypted store.
logout
Sign out and clear stored credentials. Idempotent.
enable
Enable the VilaNet service so it survives reboot — a prerequisite for connect.
disable
Disable the VilaNet service so it no longer starts on boot.
connect
Bring the tunnel up (alias start). Starts sing-box and applies firewall rules.
disconnect
Bring the tunnel down (alias stop). Idempotent.
restart
Restart the running connection — re-reads config and re-dials the selected server.
status
Live state: running/idle, selected server, routing mode, uptime, protocol.
servers
List the servers on your account as opaque IDs / redacted names.
config
Read or write config: show · get · set · reset.
logs
Tail the redacted service log (optionally the last N lines).
web
Print how to reach the on-router Web UI (the Software-Center module).
test
Run a connectivity self-test against the active tunnel.
debug
Dump verbose, redacted diagnostics for bug reports.
version
Print the package, binary, and sing-box versions.
Interactive terminal simulator
Type any vilanet-cli command below and see the (simulated) output.
vilanet-cli config — every knob
Every Web UI Settings field maps to a config key, persisted in nvram.
global
| Key | Values | Description |
|---|---|---|
global.auto_connect | 0 · 1 | Bring up the tunnel automatically when the service starts. |
global.auto_reconnect | 0 · 1 | Re-dial the selected server on transient failure. |
global.connection_mode | global · rule · pac | Traffic policy for traffic that enters sing-box: global sends it all through the VPN; rule (alias pac) enables smart China-bypass routing. |
global.log_level | error · warn · info | Verbosity of the redacted service log. |
network
| Key | Values | Description |
|---|---|---|
network.routing_mode | proxy · tun | tun = whole-LAN sing-box gateway (fail-closed if TUN/nft are missing). proxy = mixed + TPROXY-LAN inbounds — transparent capture when eligible, else a manual mixed HTTP/SOCKS listener. |
network.dns_mode | fakeip · real | sing-box DNS strategy — fake-ip is faster; real-DNS works with apps that don't honour DNS. |
network.bypass_china | 0 · 1 | Apply the geosite-CN / geoip-CN smart bypass rules. |
network.mtu | e.g. 1420 | Tunnel MTU. Lower if you see fragmentation on PPPoE / encapsulated uplinks. |
network.block_ads | 0 · 1 | Geosite-category-ads reject. |
network.block_porn | 0 · 1 | Geosite-category-porn reject. |
network.block_dot | default · 0 · 1 | Tri-state. Blocks DNS-over-TLS on the LAN to force resolution through the tunnel. |
network.block_quic | default · 0 · 1 | Tri-state. Blocks UDP/443 so HTTP/3 falls back to TCP/TLS, eliminating QUIC-path DNS leaks. |
network.block_stun | default · 0 · 1 | Tri-state. Blocks STUN endpoint discovery — useful for WebRTC IP-leak prevention. |
tun is the whole-LAN gateway; proxy is transparent / mixed capture. These are the only two routing modes.
proxy (LAN sharing)
| Key | Values | Description |
|---|---|---|
proxy.enabled | 0 · 1 | Expose a mixed HTTP/SOCKS endpoint on the LAN. Opt-in. |
proxy.port | 10081 | Mixed-inbound listen port on the router's LAN IP. |
auth
| Key | Values | Description |
|---|---|---|
auth.email | your VilaVPN email | Read-only here. Setting it is rejected with a redirect to vilanet-cli login; the password lives only in the encrypted credential store. |
vilanet-cli config set persists immediately; runtime-affecting changes apply after vilanet-cli restart.
What lives on the router
On-disk layout
VilaNet is a well-behaved Koolshare module: everything goes to predictable paths under /koolshare.
| Path | Purpose |
|---|---|
/koolshare/bin/vilanet | Service binary — single static ARM executable with embedded sing-box. |
/koolshare/scripts/vilanet-cli | The command-line tool documented above. |
/koolshare/scripts/vilanet_*.sh | Startup / config helpers (incl. S99vilanet-style boot hook). |
/koolshare/webs/Module_vilanet.asp | The Software-Center Web UI module page (+ vilanet_api.cgi). |
/koolshare/res/vilanet/ | Web UI assets (JS / CSS) for the module. |
/koolshare/configs/vilanet/ | Encrypted credential store (mode 0700). |
nvram vilanet_* | Persisted config keys (the tables above). |
/tmp/vilanet/ | Runtime scratch + redacted logs. Cleared on reboot. |
When something's off, start here
VilaNet doesn't appear in the Software Center
The installer needs a real Koolshare context. Confirm you're on Asuswrt-Merlin with the rogsoft software center, then re-run the install.
Status shows idle right after enabling
Check the log with vilanet-cli logs 200. The usual cause is a routing-mode mismatch.
LAN clients drop every few seconds
Almost always MTU. Lower network.mtu from 1420 to 1380 or 1280, then restart.
YouTube / Netflix slow but speedtest is fine
The browser is preferring QUIC. With network.block_quic on, sing-box rejects UDP/443 so it falls back to TCP.
TUN gateway won't come up
routing_mode=tun needs TUN + nftables. If missing, switch to routing_mode=proxy.
Login keeps failing — but the password is right
Probably a stale credential store. Run vilanet-cli logout then vilanet-cli login.
Need to ship a bug report
Run vilanet-cli debug and vilanet-cli logs. Both are redacted and safe to share.
vilanet-cli logs follows the redacted service log while you reproduce the problem.
Drive vilanet-merlin with your AI
vilanet-merlin ships a universal Agent Skill at ai/vilanet-merlin/SKILL.md.
Claude Code
Drop the skill file into ~/.claude/skills/vilanet-merlin/SKILL.md.
Gemini CLI ≥ 0.41
Use native Agent Skills support.
Codex CLI · Cursor · Cline · Aider · Copilot CLI
The skill content is identical across every tool — only the install path differs.
Once installed, here's how you talk to it
Describe what you want in plain language — these examples paste straight into your AI chat.
192.168.1.1 via the Software Center.network.dns_mode and switch connection_mode to rule, then restart.routing_mode to tun for a whole-LAN gateway, and reconnect.vilanet-cli debug bundle and tell me what's wrong.
Your AI translates the request into the right vilanet-cli invocation and explains the result back in plain language.