A VPN on a router: how to set it up on OpenWrt, and what about Keenetic

A VPN on the router puts the whole home through one tunnel: the TV, the game console, the laptop. We checked our file on OpenWrt with a live connection — so far in a virtual machine, not on a hardware router — and wrote the path down step by step. The stock firmware of Keenetic, TP-Link and others does not take it yet; why, and how to tell when your router is ready, is below.

What a VPN on the router gives you, and what it costs

Mayak on a phone covers one phone. A router covers everything connected to it by Wi-Fi or cable: Samsung and LG TVs, which cannot run our app, a game console, your guests’ laptops.

There is a price, and it is better to know it up front:

• The whole home goes through one country. The phone app has a switch that keeps Russian services outside the tunnel; a router set up this way does not — everything goes through the tunnel. Your bank and other Russian sites will see an address in the country you picked.
• When access ends, everyone loses internet. This is the main difference from the app, and it has its own section.
• Speed depends on the router too. Its processor does the encryption. We have not measured speed on a hardware router.
• The setup is yours. We have no app for routers: you install packages for your firmware and load our file into them.

Which router works with a VPN

It is not the brand that matters but the firmware: does it know AmneziaWG 3.0 or newer. All our lines run AmneziaWG 3 with header protection — in the file that is the HeaderProtectionKey line. Firmware that only knows AmneziaWG 1.x or 2.0 will not accept the file. And if you delete the line, the tunnel will not come up: the protection only works as a pair with the server. We do not keep lines on the older version — their disguise is weaker.

What we know as of 24 September 2026:

How to tell your router is ready: look for “AmneziaWG 3” or header protection in the changelog of its firmware (or of the AmneziaWG package for it). Once it is there, our file will fit. The right version can arrive with an ordinary firmware update, so keep an eye on them.

Choosing a router for a VPN? We do not recommend models and do not sell routers. There is one criterion: the router runs OpenWrt (see the OpenWrt table of hardware) or its stock firmware already knows AmneziaWG 3.

How to set up a VPN on an OpenWrt router: seven steps

These are exactly the steps we went through on 24 September 2026 on OpenWrt 24.10.8 in a virtual machine. Button names are as in the English LuCI interface (the router’s web settings page) we tested in. You will need a computer on the router’s network and SSH access to the router.

Step 1. Check the firmware version and platform

Open LuCI (usually 192.168.1.1) → Status → Overview. Firmware Version must say OpenWrt 24.10.8 — that is what we tested on. The packages are built for the kernel of a specific release and will not install on another; they exist for 25.12.5 too, but we have not tested that release. Older version — update the firmware first. The same page shows Target Platform, for example mediatek/filogic: you will need it in the next step.

Step 2. Download three AmneziaWG packages

Open the awg-openwrt releases on GitHub and pick the release numbered like your firmware: v24.10.8 (or v25.12.5, which we have not tested). You need the files whose names end with your platform (for mediatek/filogic, with _mediatek_filogic.ipk):

• kmod-amneziawg — the kernel module;
• amneziawg-tools — the tools;
• luci-proto-amneziawg — the LuCI settings screen;
• optionally luci-i18n-amneziawg-ru — a Russian translation of that screen.

Check the file date: no earlier than 22 September 2026. The release is still called “…amnezia wg v2.0…”, but its files were re-uploaded on 22 September and already contain AmneziaWG 3.1. Files downloaded earlier are 2.0 without header protection, and our file will not work with them. For OpenWrt 25.12 the files end in .apk, not .ipk.

Step 3. Install the packages and reboot the router

Copy the files to the router’s /tmp folder and install them. From a computer (Linux, Mac or Windows with OpenSSH), in the folder with the downloaded files:

scp -O *amneziawg*.ipk root@192.168.1.1:/tmp/
ssh root@192.168.1.1
cd /tmp
opkg update
opkg install ./kmod-amneziawg_*.ipk ./amneziawg-tools_*.ipk ./luci-proto-amneziawg_*.ipk

If you downloaded the translation, add it to the last line too: ./luci-i18n-amneziawg-ru_*.ipk. The -O flag for scp is needed: without it, recent scp versions get “sftp-server: not found” from OpenWrt — we checked. opkg pulls the remaining packages from the OpenWrt repository by itself; 192.168.1.1 is OpenWrt’s default address, yours may differ.

Now reboot the router: System → Reboot. Without a reboot the “AmneziaWG VPN” protocol does not appear in the list: in our test it showed up only after one.

On OpenWrt 25.12 packages are installed with apk, not opkg. We have not gone down that path; the command is in the awg-openwrt documentation.

Step 4. Get the file in your account

In your account open the “File for Linux” card, pick a country → “Get the file for Linux” → “Download .conf”. The card says “for Linux”, but it is the same file, and it suits a router.

• The file takes one slot on your plan.
• A new file for the same country switches off the previous one, and the same file cannot be downloaded twice: the key is not kept on the server.
• The file contains a secret key — keep it like a password.

Step 5. Create the interface and load the file

1. Network → Interfaces → “Add new interface…”.
2. Name — for example, mayak; protocol — “AmneziaWG VPN” → “Create interface”.
3. The interface window opens on the General Settings tab. Click “Load configuration…”, then “Select file…” and pick the downloaded file (or paste its text into the box) → “Import settings”.

Keys, addresses, DNS, disguise parameters and header protection load by themselves. Do not close the window yet — three fields are left.

Step 6. Fill in three fields by hand

The import does not carry everything over. In the same window:

1. Advanced Settings → MTU. Enter the number from the MTU line of your file (open the file in any text editor). The import loses this line, and without it the router uses 1420 instead of the number calculated for the line.
2. Firewall Settings → Create / Assign firewall-zone: choose wan. Otherwise computers and phones behind the router will not reach the internet through the tunnel.
3. Peers → “Edit” on the “Imported peer configuration” entry → tick “Route Allowed IPs” → Save. Without it the tunnel comes up, but traffic goes around it.

Step 7. Save in one go and check

Click Save in the interface window, then “Save & Apply” at the bottom of the page. All in one go: if you tick the peer box after the first “Save & Apply”, the change does not apply until you press “Restart” on the interface.

Check. In Network → Interfaces the RX and TX of mayak keep growing. On a computer or phone connected to the router, open our “What is my IP” page: the address should change to our server’s address in the country you picked. In our test the connection appeared a few seconds after “Save & Apply”, and after a router reboot the tunnel came up by itself.

When access ends, the whole home loses internet

We checked this on 24 September: after the device was deleted in the account, the link to the server broke off and the router was left without internet. With Passwall2 even site names stopped resolving. We have not tested access running out on a router separately: in that case our server stops letting the router’s key in the same way as after a deletion, so expect the same.

What to do:

• Access ended and you are renewing — renew. The router’s key stays the same, and the tunnel should come back by itself. We have not tested this case on a router; if it does not come back, press “Restart” on the interface.
• You are not renewing, or you deleted the router from “Devices” — turn the VPN off on the router as described in the next section.
• LuCI opens without internet too: you will be able to reach the router’s settings.

Tip: keep the access end date in mind — it is shown in your account — and renew ahead of time.

How to turn the VPN off on the router

1. Network → Interfaces → “Delete” on the mayak interface → “Save & Apply”.
2. Reboot the router (System → Reboot). In our test, after the interface was deleted the router was left without internet: the default route went away together with the tunnel, and the old one did not come back by itself. After a reboot internet came back.
3. Only then delete the device in your account (“Devices”) to free the plan slot. In the reverse order the home stays without internet until you get to the router.

We have not tested the “Stop” button on the interface — the tested path is the one above.

A VPN on a Keenetic or Netcraze router: why not yet

Stock firmware. KeeneticOS (and Netcraze) knows AmneziaWG 2.0 since version 5.1 — in its changelogs Keenetic calls its parameters “ASC”. Header protection is not there: the release notes for 5.1.1–5.1.6 (the latest came out on 24 September 2026) say nothing about it. So stock Keenetic will not accept our file, and it cannot be converted to 2.0: without the header protection line the tunnel will not come up.

How to tell it will work: “AmneziaWG 3” or header protection will appear in the KeeneticOS changelog. Then our file can be loaded by import, like any WireGuard file. If it is there and still does not work, write to us and we will sort it out together.

Keenetic with Entware. Entware is a set of third-party packages for Keenetic. One of them is awg-manager: according to its documentation, it supports AmneziaWG 3.0 since version 2.16.4, so it should accept our file. We have not tested this live: Keenetic cannot be run in a virtual machine, and we have no hardware one. For the subscription link there is the XKeen package on the Xray core — our servers let that core in, but XKeen on Keenetic is another thing we have not tested.

We decided against a separate line on the older AmneziaWG version “for Keenetic”: its disguise is weaker.

Passwall2: a VPN on OpenWrt with a subscription link

If your OpenWrt already runs Passwall2, or you prefer a link to a file, this is the second path. We tested it in the same virtual machine on 24 September: Passwall2 26.9.16 with Xray 26.9.9, and both the router itself and a computer behind it went out through our server. The link holds all countries at once, and you choose between them in Passwall2.

1. Add the Passwall package repository — how is described on the Passwall2 page on GitHub. The repository key is the ipk.pub file; the passwall.pub address from older guides returns a 404 error.
2. Replace dnsmasq with dnsmasq-full and install luci-app-passwall2 and xray-core from the Passwall repository, version 26.x. Xray from the stock OpenWrt 24.10 repository (25.1.30) does not start with Passwall2 26.9.16 — we saw this.
3. Get the link in your account: “Connecting by link” → “A device with its own link” → “Add a device”, name it, say, “router”. The “Shared link” will not suit a router: it expects the app to report which device it is on, and router software usually does not.
4. Add the link to Passwall2 as a subscription (Node Subscribe) and update it: nodes for each country appear. Pick a node and switch Passwall2 on. We added the subscription with a command — the same parser the Node Subscribe screen uses; we did not go through the screen itself.

The link is like a password: anyone who has it can connect to your access. And the same warning as above: when access ends, the whole home loses internet. Then switch Passwall2 off in its settings; we did not go through that step in our test.

TP-Link, ASUS, Xiaomi, MikroTik, GL.iNet and your ISP’s router

On their own firmware — not yet:

• TP-Link and Xiaomi. Their stock firmware has no AmneziaWG. Some models have other protocols, such as plain WireGuard or OpenVPN, but we do not issue those: they have no disguise.
• ASUS. No AmneziaWG in either the stock firmware or Asuswrt-Merlin.
• MikroTik. RouterOS 7 has no AmneziaWG.
• GL.iNet. The stock firmware knows AmneziaWG 2.0, but no header protection yet.
• A router from your ISP (Rostelecom, MTS and others). The firmware is their own, and we have no information about AmneziaWG 3 in it.

Third-party add-ons for these routers exist, but we have not tested them and do not promise them. If your router can run OpenWrt, the path above works for it too.

How many plan slots a router takes

A router takes one slot on your plan, like a phone.

• A file is issued for one country. Another country means another file and one more slot; delete the one you no longer need in “Devices”.
• “A device with its own link” also takes one slot, but it holds all countries.

As of 24 September 2026, “Start” covers up to 3 devices for 300 ₽ a month, “Family” up to 5 for 500 ₽, “Max” up to 10 for 700 ₽. The trial covers one device: if it is already running on your phone, free up a slot for the router (“Devices” in your account) or pick a plan.

What we tested

• OpenWrt 24.10.8 in a virtual machine (x86_64), 24 September 2026. awg-openwrt packages: kmod-amneziawg 3.1.20260906, amneziawg-tools 3.1.20260812, luci-proto-amneziawg 3.1.0. Our file was loaded with the “Load configuration…” button: keys, addresses, DNS, disguise parameters and header protection came across without errors; only the MTU was lost. On the Netherlands and Russia lines the connection came up right after “Save & Apply”, and the exit address — of the router itself and of a computer behind it — was our server’s address. After a router reboot the tunnel came up by itself.
• Passwall2 26.9.16 with Xray 26.9.9 from the Passwall repository, in the same place: Passwall2 got four nodes from our link, one per country; the router and a computer behind it went online through our server in the Netherlands. Xray 25.1.30 from the OpenWrt repository did not start with Passwall2.
• Deleting the device in the account — with the file and with Passwall2 alike, the router was left without internet along with everyone behind it.
• Deleting the interface — no internet until a reboot; after the reboot it came back.
• Copying files to the router: scp from OpenSSH 9.6 without the -O flag did not work on a clean OpenWrt 24.10.8; with the flag it did.

The virtual machine reached the internet through our server in Moscow. This test does not tell how your ISP will behave.

What we do not know

• How it works on a hardware router. We tested in a virtual machine: the same firmware and packages, but a computer’s processor. We have not measured speed on a router.
• OpenWrt 25.12.5. awg-openwrt has packages for it, re-uploaded on the same day, 22 September, but they install with apk, and we have not gone down that path.
• Keenetic with Entware (awg-manager, XKeen), MikroTik with containers, ASUS with Asuswrt-Merlin — not tested.
• Access running out on a router. We tested deleting the device; the server handles the end of access the same way, but we have not tested it on a router separately. Nor have we tested whether the tunnel comes back by itself after renewal.
• The “Stop” button on the interface and switching Passwall2 off — not tested either.
• Only some sites through the tunnel. This guide does not set that up: everything goes through the tunnel.
• Which router to buy. We do not recommend models.

Short answers

Can you install a VPN on a router? Yes, if its firmware knows AmneziaWG 3.0 or newer. Today that means OpenWrt 24.10.8 with the awg-openwrt package from 22 September 2026 — that is what we tested on. Packages for 25.12.5 exist too.

How do I put a VPN on a Keenetic router? On stock firmware there is no way yet: KeeneticOS knows AmneziaWG 2.0, and our file needs 3.0. Keep an eye on the firmware changelog.

And on TP-Link? Not on stock firmware. If your model is supported by OpenWrt, then through OpenWrt.

Can I delete the HeaderProtectionKey line from the file? No: header protection only works as a pair with the server, and without it the tunnel will not come up.

Which router is best for a VPN? One that runs OpenWrt, or one whose firmware knows AmneziaWG 3. We do not recommend models.

Do I need to buy a “VPN router”? No. We do not sell routers: yours will do if it has the right firmware.

Is there a free VPN for routers? We have no free plan. There is a trial with no card on one device, and after that a plan from 300 ₽ a month for several devices.

How many plan slots does a router take? One, like a phone. A file is issued for one country: another country means one more slot.

What happens when access ends? The whole home loses internet until you renew or turn the VPN off on the router. That is what happened in our test after the device was deleted; access running out on a router we have not tested.