Edit!
For OpenWrt 21.02.3, here's a 4-step recipe;
1. Download an Airvpn config, selecting the Router Operating System. Select Resolved hosts in Advanced Mode.
2. Finish this how-to; https://openwrt.org/docs/guide-user/services/vpn/openvpn/client
To prevent DNS leaks,
3. Append the following to the /etc/dnsmasq.conf file of your WRT device;
server=10.4.0.1
4. On your WRT device, edit the WAN interface. On the Advanced Settings tab, disable "Use DNS servers advertised by peer" and enter 10.4.0.1 under "Use custom DNS servers"