Set Up a VPN on Your Router: WireGuard and AmneziaWG

To set up a VPN on a router you need three things: a router whose firmware supports WireGuard or AmneziaWG, a .conf configuration file from your account, and a few minutes in the router's web interface. After that, the traffic of every device at home — the TV, the game console, the laptops — goes through an encrypted connection, and none of them needs an app of its own.

This guide covers why to put a VPN on your router, which models fit, how WireGuard and AmneziaWG differ, and what to do when a server changes its address. The exact steps for each firmware are in the documentation: AmneziaWG on a router and WireGuard on a router.

Why put a VPN on your router

A VPN on a phone protects one phone. A VPN on a router gives every device at home a protected connection: everything connected to it over Wi‑Fi or cable goes online through one encrypted tunnel.

• Devices without VPN apps. Many TVs, game consoles and smart speakers won't let you install a VPN client — behind the router they get an encrypted connection with no setup on the device itself.
• One setup instead of ten. No app to install and update on every laptop and tablet: a new device that joins your home Wi‑Fi goes through the VPN straight away.
• One device on your plan. A config on the router uses one device on your plan, however many gadgets are connected to it.
• Encryption for the whole home. Traffic from every device travels to the VPN server encrypted, so its content is protected all the way across your provider's network.

There is a flip side. On a router the encryption runs on the router's own processor, so on budget models the speed through the VPN can be lower than a computer gets on the same connection. And the free plan has a traffic limit — behind a router the whole household uses it up.

Which routers are supported

Support depends not only on the vendor but on the model and firmware version — check your model, or the one you plan to buy. A short overview by platform is on the VPN for routers page; here is what matters for the setup.

Keenetic

Keenetic supports AmneziaWG natively from KeeneticOS 4.2 Alpha 2 — no extra package needed. On KeeneticOS 4.3.4 and newer the extra AmneziaWG parameters (ASC) are picked up from the .conf file automatically. On 4.2 through 4.3.3 you enter them once on the router's command line — the lines you need are already collected on the connection card, in the Router parameters (Keenetic ASC) section. Plain WireGuard works on Keenetic too.

OpenWrt

OpenWrt supports WireGuard. AmneziaWG needs the amneziawg-openwrt packages: kmod-amneziawg, amneziawg-tools and luci-proto-amneziawg. The official repository has no prebuilt packages, and the kernel module must match your exact OpenWrt build, so you get packages built for your version from community repositories. Not one-click, but documented in detail.

GL.iNet

GL.iNet supports WireGuard. Several models (Brume 3, Flint 3, Flint 2, Beryl AX) support AmneziaWG in select firmware; broader official support comes with firmware 4.9.

Asus, DD-WRT and pfSense

WireGuard also works on other routers that support it — Asus (including Asuswrt-Merlin), DD-WRT and pfSense, for example; support depends on the model and firmware version. We have no AmneziaWG instructions for these platforms — use WireGuard on them.

WireGuard or AmneziaWG on a router

Both protocols use the same encryption, and their speed is comparable. The difference is in how the traffic looks on the network.

• WireGuard is the most widespread option: it works on every platform in this guide, and setup is the simplest.
• AmneziaWG is WireGuard with traffic obfuscation: it adds an extra layer of traffic processing. The obfuscation overhead lowers its MTU slightly — 1280 versus 1420 for WireGuard. Choose AmneziaWG when you want extra connection stability.

Start with WireGuard — it works on every router listed here. If you have a Keenetic, which runs AmneziaWG natively, and stability matters to you, you can take AmneziaWG right away. On OpenWrt it needs packages, and on GL.iNet support depends on the model and firmware (see above). You can change the protocol at any time with Switch Protocol on the connection card — then import the new file into the router.

How to set up a VPN on a router, step by step

Step 1. Prepare the firmware

Open the router's web interface and look up the firmware version. On Keenetic it decides whether you enter the AmneziaWG parameters by hand. On OpenWrt, install the amneziawg-openwrt packages for your build first if you want AmneziaWG. If the firmware is old, update it: on Keenetic firmware 4.1.0–4.1.3 even restarting the connection does not pick up a new server address (more below).

Step 2. Create a connection in your account

1. Sign in to your account and open Connections.
2. Click New Connection, click Select on the A config per location card and pick a location.
3. Choose the protocol — WireGuard or AmneziaWG. The choice appears when the location offers both; otherwise the protocol is set for you.
4. Choose the method — A device from your plan or Activation code — click Next, then Create Connection.

The free plan includes one WireGuard or AmneziaWG config in the free locations and requires a linked Telegram account. Pro includes as many devices as your plan has.

Step 3. Download the .conf file

A router needs the file, not the QR code. On the connection card, click Download — or get the same file from the Telegram bot.

The Download with IP address button appears when the file uses a server name, and it is only for routers that don't accept one. That file has to be downloaded again after a server address change, so if your router takes the regular file, use that one.

Step 4. Import the file into the router

1. Open the router's web interface.
2. Import the .conf file into the router's WireGuard client, or create the interface manually from the file's parameters.
3. For AmneziaWG on Keenetic with firmware 4.2–4.3.3, enter the parameters from the Router parameters (Keenetic ASC) section, replacing WireguardN with the interface name from the show interface command.

Details for each platform are in the documentation: AmneziaWG on a router, WireGuard on a router.

Step 5. Turn the connection on and check it

Bring the interface up and route the traffic you want through it — all of it, or only selected devices if your firmware allows that. Then open whatismyip.com on any device at home: the address should match the location you chose.

What to do after a server address change

Sometimes a server changes its address — during maintenance, for example. A router does not reconnect by itself: the connection appears to be up, but no traffic passes.

• A regular file (with the server name) works again once you turn the connection off and back on.
• A file with the IP address never comes back by itself — download it again after the address change and import it.
• Keenetic on firmware 4.1.0–4.1.3 does not pick up the new address even after restarting the connection — update the firmware to 4.1.4 or 4.2+.
• OpenWrt can pick up the address by itself if the router's own DNS queries go outside the VPN. Set persistent_keepalive on the peer (for example, 25), add the matching line below to /etc/crontabs/root and run /etc/init.d/cron restart.

For WireGuard:

* * * * * /usr/bin/wireguard_watchdog

For AmneziaWG:

* * * * * /usr/bin/amneziawg_watchdog

A separate case is a change of the connection itself: if you change the location or protocol, or a server is taken out of service, a new file is issued, and the router stays without VPN until you import it. We send a notification when this happens.

Frequently asked questions

How many devices on my plan does a router use?

One. A config on a router is one device on your plan, however many phones, TVs and laptops are connected to it.

Is the free plan enough for a router?

To try it out, yes: the free plan has one WireGuard or AmneziaWG config with a 10 GB monthly limit in the free locations; it turns on once you link Telegram. But behind a router the whole household uses up that limit, and once it is gone the connection stops until the 1st of the next month. On Pro, traffic is unlimited, including on a router.

The router says "invalid H1 value". What do I do?

The firmware received an AmneziaWG 1.5 or 2.0 config it cannot parse. Load a 1.0-format file — the one RuSolv issues by default — or update the firmware: Keenetic supports 1.5 and 2.0 natively from KeeneticOS 5.1.

Can I put VLESS on a router?

Only manually, and we have no step-by-step guide for it. For a router, choose WireGuard or AmneziaWG.

Do I need to set anything up on phones and the TV?

No. If all of the router's traffic goes through the VPN, any device connected to your home Wi‑Fi or cable goes online through it automatically.

Bottom line

A VPN on a router is set up once: create a WireGuard or AmneziaWG connection, download the .conf file and import it into the firmware, and remember to reconnect after server maintenance. The whole home uses one device on your plan, and on Pro traffic is unlimited, on a router too.

Choose a plan →