You can put a VPN on a TP-Link router with its own tools, but only with the protocols its firmware knows: OpenVPN, L2TP/IPsec, PPTP and, on some models, plain WireGuard. Mayak runs on AmneziaWG, and TP-Link’s stock firmware does not have it. Below: what TP-Link can do according to its own help pages, when the way out is switching to OpenWrt, and when it is simpler not to touch the router at all. Everything here is as of 4 October 2026.
In short. Our file will not work on TP-Link’s stock firmware: there is no AmneziaWG in it. There is an option if your model and its hardware version are supported by OpenWrt: on OpenWrt 24.10.8 with the awg-openwrt package we tested our file with a live connection (in a virtual machine, not on a TP-Link) — seven steps. Rather not change the firmware? Put our app on your phone and Android TV, and a subscription link on your iPhone and computer.
We make Mayak. The router file and the subscription link are issued in your account area, a router takes one slot on the plan, and phones and Android TV have our app. 3 days free after you confirm your email, no card needed. The trial is free and needs no card; without an email it is 1 day.
🍎 On iPhone Mayak works with the subscription link from your account. The real Happ (publisher Flyfrog LLC) is not in the Russian App Store — look-alike apps from other publishers sit under that name. INCY (publisher LLC ITDEV) works instead: checked on 22 September 2026.
What TP-Link’s stock firmware can do
According to TP-Link’s help (the VPN client page, FAQ no. 3135 on the TP-Link site, updated 17 April 2026), the router connects to a VPN server under Advanced → VPN Client. The same page says what matters:
- Protocols: OpenVPN, PPTP, L2TP/IPsec and WireGuard.
- Not on every router. TP-Link states plainly that not all models have the VPN client, and WireGuard is only on select ones.
- A WireGuard file is loaded with an import button, but the router takes only the basic fields from it: keys, address, DNS, the server address and allowed addresses. IPv6 addresses and MTU, according to the WireGuard help page (FAQ no. 3772 in the same section), must be deleted before importing.
- AmneziaWG is not mentioned in TP-Link’s help at all.
TP-Link’s help also describes a WireGuard client for Deco mesh systems — by its title, the same kind. We have not had a single TP-Link router in our hands: everything in this section comes from the official help and is not checked on a real device.
Why plain WireGuard from us will not do
AmneziaWG is WireGuard with masking: besides keys and addresses, the file has parameters that change the shape of packets, and a header protection line (HeaderProtectionKey). All our lines run on AmneziaWG 3 with that protection.
- You cannot delete the extra lines. Header protection works only paired with the server: without it the tunnel will not come up. Those are exactly the lines TP-Link’s stock import does not accept.
- We do not issue plain WireGuard, OpenVPN or L2TP files. They have no masking, and without it the connection does not come up at some operators (our measurements).
What actually separates AmneziaWG from WireGuard is explained in a separate article. If AmneziaWG 3 appears in TP-Link’s stock firmware, our file will fit; the sign is the words “AmneziaWG 3” or “header protection” in the firmware’s change list.
How to find out what router you have
- Model and hardware version. The router’s label shows the hardware version next to the model (usually “Ver” and a number). For OpenWrt it matters as much as the model: different versions of one model can have entirely different hardware inside.
- What the stock firmware can do. According to TP-Link’s help, the router’s web page opens at tplinkwifi.net; the VPN client is under Advanced → VPN Client. No such section — your model has no VPN client.
- Whether the model supports OpenWrt. Look it up in the OpenWrt table of hardware — by model and hardware version together.
- How much memory. The same table lists flash and RAM. OpenWrt states that devices with 4 MB of flash and 32 MB of RAM were supported only up to the 19.07 release, and recommends at least 16 MB and 128 MB. We need release 24.10.8 — older low-memory models will not do.
OpenWrt on TP-Link: when it is an option
If the model and hardware version are in the OpenWrt table, there is enough memory and release 24.10.8 exists for it, the route is: install OpenWrt following your model’s page in the OpenWrt wiki, then the AmneziaWG package and our file.
- The steps for our file are the same seven we went through ourselves: version and platform, three awg-openwrt packages (built on 22 September 2026 or later), installation, the file from your account, import, MTU and the zone — in detail in the router article.
- Packages are built per platform. In an awg-openwrt release the files are sorted by platform (the Target Platform line in OpenWrt). Check that files for your platform are there before you change the firmware.
- Changing firmware is your risk. It replaces the stock firmware with a third-party one; a wrong image or a power cut while writing can leave the router not working. The install and the way back to stock differ per model and are described on its page in the OpenWrt wiki — we have not tried them on any TP-Link.
What we tested ourselves: OpenWrt 24.10.8 with awg-openwrt in a virtual machine on 24 September 2026 — our file loaded with the standard button, the tunnel came up, and after a restart it came up by itself. We have not repeated this on a hardware router, TP-Link included.
The second route on OpenWrt: a subscription link
On the same OpenWrt the router can take a subscription link instead of the file — through Passwall2 with Xray. In your account area you add “A device with its own link” for this. We tested Passwall2 with Xray 26.x in the same virtual machine: the router and the computer behind it went online through our server. Install Xray from the Passwall repository: the stock Xray from the OpenWrt repository did not start with Passwall2 for us (details).
When it is simpler not to touch the router
A router is there to cover devices you cannot install an app on. If you have none, apps on the devices themselves are simpler and more capable:
| Device | How to connect without a router |
|---|---|
| Android phone and tablet | Our app: Google Play or a file from the site (how to install) |
| Android TV set or box | The same app (which TVs can) |
| iPhone, Windows, Mac | A subscription link in Happ or INCY (in the help centre) |
| Linux | A settings file from your account |
| Samsung or LG TV | An Android TV box or a router (explained) |
The phone app also has what the router set up by our guide does not: Russian apps can go outside the tunnel, and when the network changes it looks for a working route by itself.
What about buying another router? We do not recommend models. There is one criterion: the router takes OpenWrt of the right release, or its stock firmware knows AmneziaWG 3. Keenetic’s main firmware, for example, still knows only AmneziaWG 2.0 and will not accept our file; the developer channel announces support for version 3.1, but we have not tested it live (version table).
What a router gives you and what it costs
- The whole home through one country. Everything goes through the tunnel, banks included: they will see the address of the country you chose.
- When access ends, the whole home is offline. That is what happened in our test after the device was removed in the account area (what to do).
- Speed depends on the router’s processor. We have not measured it on a hardware router.
- One slot on the plan, like a phone. Plans are in the help centre.
In Mayak a router is just another device on the same account. Create an account, take the file or link from your account area and load it into a router running OpenWrt — or start with the app on your phone. We ask for no payment details for the trial. A confirmed email opens the access — 3 free days. An email is optional: without one the trial is 1 day.
🍎 On iPhone Mayak works with the subscription link from your account. The real Happ (publisher Flyfrog LLC) is not in the Russian App Store — look-alike apps from other publishers sit under that name. INCY (publisher LLC ITDEV) works instead: checked on 22 September 2026.
What we checked
- TP-Link’s help — the VPN client and WireGuard import pages, both marked “updated 17 April 2026”, read on 4 October 2026.
- OpenWrt’s memory requirements — the OpenWrt page on older devices, read on 4 October 2026.
- Our file on OpenWrt 24.10.8 with awg-openwrt, and Passwall2 with Xray 26.x — a live connection in a virtual machine on 24 September 2026 (details).
What we do not know
- We have not tested a single TP-Link router — neither on stock firmware nor on OpenWrt. Menu paths come from TP-Link’s official help and are not checked on a real device.
- Which TP-Link models have WireGuard. TP-Link says “select models”; we have not compiled a full list.
- How to install OpenWrt on your model. Each model and version has its own procedure; we have not done it.
- Speed on a hardware router. Not measured.
- Whether AmneziaWG will appear in TP-Link’s stock firmware. We have no information on that.
Got Mayak running on a TP-Link with OpenWrt? Tell us the model, hardware version and how it went: we will add it to the article.
Quick answers
Can I put a VPN on a TP-Link router? With stock firmware, only with its protocols: OpenVPN, PPTP, L2TP/IPsec, and WireGuard on some models. Stock firmware will not accept our AmneziaWG file.
How do I set up a VPN on a TP-Link router? According to TP-Link’s help: Advanced → VPN Client, choose the protocol and load the service’s file. For Mayak the route is different: OpenWrt, if the model supports it.
Can I delete the extra lines from the file so TP-Link accepts it? No: without the masking parameters and header protection the tunnel to our server will not come up.
Which TP-Link is suitable for a VPN? One whose model and hardware version are in the OpenWrt table, with at least 16 MB of flash and 128 MB of RAM. We do not recommend specific models.
Do you have a router app? No. The router takes a file or a subscription link from your account area and takes one slot on the plan.
What is simpler if I do not want to change firmware? The app on your phone and Android TV, a subscription link on your iPhone and computer. A router is needed mainly for TVs without Android.