VPN on an ASUS router: WireGuard in VPN Fusion, and AmneziaWG on Asuswrt-Merlin

A VPN for an ASUS router, out of the box, means plain WireGuard only: from firmware 3.0.0.4.388.23000, AX-series routers connect to a WireGuard server through the VPN Fusion section, and there is no AmneziaWG in the official firmware. So a VPN on an ASUS router is set up with the WireGuard variant of the file from your NvoVPN account — four steps, about ten minutes — where VPNs are not throttled. If you are in Russia, plain WireGuard does not work there: see the "Are you in Russia?" block below — an honest look at the route through Asuswrt-Merlin.

1. 1

   Download the WireGuard variant of the file from your account

   In your account → "Connection" → "Manual", choose a server, name the device "Router" and click "Create". Next to the AmneziaWG file is a plain WireGuard variant — download that one: the stock ASUS firmware only understands WireGuard. You need an active plan or trial.

2. 2

   Check your model and firmware

   WireGuard only exists on AX-series models (RT-AX, TUF-AX, GT-AX and GT-AXE, ZenWiFi XT/ET/XD) on firmware 3.0.0.4.388.23000 or later. RT-AC and RT-N do not have it. In the router's web interface, open "Administration" → "Firmware Upgrade" and install the latest version. The model list is in the "Models and firmware" section below.

3. 3

   Upload the file to VPN Fusion

   "VPN" → "VPN Fusion" → "Add profile" → type WireGuard → "Upload Config" → choose the downloaded file. To route the whole house through the VPN, turn on "Apply to all devices" and click "Apply" — the profile gets a "Default Connection" tag. Turn the profile on. To route only the TV through the VPN, click the device icon on the profile card and turn on the toggles for the devices you need.

4. 4

   Check that the VPN is working

   From a TV or laptop behind the router, open the "What is my IP" page: it will show the NvoVPN server's address, not your provider's. If a device is not marked in the profile and "Apply to all devices" is off, it goes to the internet directly — that is how VPN Fusion is designed, not a malfunction.

If it will not connect: ASUS pitfalls

• The wrong file. Your account has two variants — AmneziaWG and WireGuard. The stock ASUS firmware only accepts the WireGuard variant.
• The wrong model or firmware. RT-AC (Wi-Fi 5) and RT-N cannot do WireGuard on any official firmware — see "Models and firmware". On an AX model, update the firmware first.
• The device goes direct. Without "Apply to all devices", new devices on the network bypass the tunnel. Turn on that setting, or mark the device in the profile and click "Apply".
• One file, one device. You cannot use the router's configuration on a phone at the same time: the connection will drop on both. Create a separate one for the phone — a subscription covers up to five.
• DNS. Some firmware ignores the DNS = line in the file. If the tunnel is up but sites will not open, set the DNS manually — the same address as in the file. In Merlin, the WireGuard client forces the use of the DNS from the configuration (Exclusive mode).
• MTU. If heavy pages "hang" while small ones open, set MTU to 1420 on the VPN interface.
• AllowedIPs 0.0.0.0/0 sends all traffic into the tunnel. For selective routing, use device selection in VPN Fusion only; in Merlin, VPN Director manages WireGuard routing.
• Check from a device behind the router, not from a phone on mobile data: the "What is my IP" page will show the server's address.
• A kill switch on the router is not in every firmware. If it matters that devices do not go straight to the internet when the tunnel drops, check for that option in the profile settings. What it is: "Kill Switch".

ASUS models and firmware

Per the manufacturer's data as of September 2026. Before buying, check your model on the official VPN Fusion model list page.

• Stock WireGuard (VPN Fusion): GT-AXE16000, GT-AX11000 Pro, GT-AXE11000, GT-AX6000, GT-AX11000; ZenWiFi Pro XT12, Pro ET12, XT9, AX (XT8), ET8, XD6, XD5; RT-AXE7800, RT-AX88U Pro, RT-AX88U, RT-AX86U Pro, RT-AX86U and RT-AX86S, RT-AX68U, RT-AX82U, RT-AX58U, RT-AX3000, RT-AX59U, RT-AX92U, RT-AX5400, RT-AX57M, RT-AX52; TUF-AX5400, TUF-AX3000 and TUF-AX3000 V2, TUF Gaming AX6000, TUF Gaming AX4200, TUF-AX4200Q. RT-AC and RT-N models are not on the list; Wi-Fi 7 (BE) models are not listed on this page — check the VPN Fusion section in the interface.
• Firmware: 3.0.0.4.388.23000 or later, per the official ASUS guide; how to make a profile the default connection is a separate guide. The same can be done in the ASUS Router app: Settings → VPN Fusion.
• AmneziaWG through Asuswrt-Merlin: Merlin 388 and later is built for AX and BE models, while AC models stayed on branch 386 with no WireGuard (list on the project's wiki), and the AmneziaWG package is built for 64-bit ARM (a separate 32-bit build also exists): the two lists overlap on GT-AX11000, GT-AXE11000, GT-AX6000, RT-AX86U, RT-AX86U Pro, RT-AX88U, RT-AX88U Pro, RT-AX58U (V1). The package also claims RT-AX56U and TUF-AX5400, but they are not on Merlin's list.
• RT-AC and RT-N: Merlin for these stayed on branch 386 with no WireGuard, and most AC models (RT-AC68U, RT-AC88U, RT-AC66U, RT-N66U) are already out of support. For RT-AC68U, RT-AC88U, RT-AC58U, RT-AC57U and several others, OpenWrt is available, where AmneziaWG installs through third-party packages — see the OpenWrt section in the router overview guide. Or an app on your devices.

FAQ

Can I route only the TV through the VPN? Yes. On the VPN Fusion profile card, click the device icon, turn on the toggle for the TV, and click "Apply". The other devices will keep going out directly.

Why are there two files in my account, and which one should I take? AmneziaWG is WireGuard with traffic obfuscation, and it gets through where plain WireGuard is throttled. The stock ASUS firmware only understands WireGuard — take that variant. The full difference is in "AmneziaWG vs WireGuard: what is the difference".

Why did the speed drop after enabling WireGuard on Merlin? In Asuswrt-Merlin, turning on WireGuard disables hardware NAT acceleration — noticeable on fast plans. The AmneziaWG client from the third-party package runs in software — speed is limited by the router's CPU.

I have an RT-AC68U. What do I do? There is no stock WireGuard, and Merlin no longer supports this model. Options: OpenWrt with third-party AmneziaWG packages, a second router — a Keenetic — behind the ASUS, or an app on your devices.

Does the router count as one device on the subscription? Yes: to NvoVPN it is one configuration, no matter how many TVs and laptops sit behind it. Do not put the router's file on a phone — create a separate one.

Related guides: VPN on a router: an overview by firmware · VPN on Keenetic · AmneziaWG vs WireGuard: what is the difference · A second router behind a provider's router