VPN on a router: a file from your account, AmneziaWG or WireGuard, and brand guides

A VPN on a router protects everything connected to your home network at once: the TV, a streaming box, smart speakers, a guest's laptop — and for the subscription that is one device, no matter how many sit behind the router. There is no app for a router, and none is needed: NvoVPN connects with a configuration file from your account. Below is how to set up a VPN on a router in 4 steps, what your model supports, and links to guides by brand. If you are in Russia, there is a separate block below: there, only a router with AmneziaWG works.

1. 1

   Download a configuration file from your account

   Open your account → "Connection" → "Manual". Choose a server, name the device "Router" and click "Create". Download the .conf file for AmneziaWG. Next to it is a plain WireGuard variant — that one is for firmware without AmneziaWG support.

2. 2

   Check what your router supports

   Open the VPN section in the router's interface. Understands AmneziaWG (Keenetic, OpenWrt, GL.iNet) — take the AmneziaWG file. Only WireGuard (ASUS, MikroTik, some TP-Link models) — take the WireGuard variant. Neither one — you cannot bring up a VPN on this router; see the options in the brand section below.

3. 3

   Upload the file to the router's interface

   In your model's VPN client settings, choose to upload from a file, or paste in the configuration text — the "Copy" button is next to the QR code in your account. Turn on the connection and mark that internet traffic goes through it. Exactly where that button is for your brand is in the guides below.

4. 4

   Check the IP from a device behind the router

   On a TV, phone or laptop connected to this router, open the "What is my IP" page: it shows the NvoVPN server's address, not your provider's. That means the whole home network is already behind the VPN.

Guides by brand: what your router supports out of the box

• Keenetic — AmneziaWG "out of the box" in KeeneticOS: our file is the first AmneziaWG version, and importing it from a file is supported from KeeneticOS 4.3.4 onward (if your firmware is older, update it or take the WireGuard variant).
• OpenWrt — AmneziaWG through the kmod-amneziawg, amneziawg-tools and luci-proto-amneziawg packages from the amneziawg-openwrt releases page, matching your OpenWrt version and CPU architecture; install them via "System" → "Software" → "Upload Package…" in exactly this order. For plain WireGuard, the luci-proto-wireguard package is enough.
• GL.iNet — a WireGuard client plus AmneziaWG obfuscation as a separate toggle: "VPN" → "WireGuard Client" → "Add a New WireGuard Configuration" → paste in the configuration text from your account → turn on AmneziaWG obfuscation if your firmware version has it.
• ASUS — WireGuard only: a client under VPN Fusion from firmware 3.0.0.4.388.23000, no AmneziaWG in the official firmware — take the WireGuard variant of the file.
• MikroTik — WireGuard only (RouterOS 7 supports it natively), no AmneziaWG.
• TP-Link — a WireGuard client on some models only; check the VPN section in the interface.
• Xiaomi, Huawei, D-Link, Tenda, Netis — the stock firmware usually has neither AmneziaWG nor WireGuard. What to do with your model is in the brand guide.
• A router from your provider (Rostelecom, MTS, Beeline, Dom.ru) — there is usually no VPN client in the firmware; options are in a separate guide.

Do not see your model in the list? Message support: we will advise on your specific firmware.

What you need

• A router that supports AmneziaWG or WireGuard — the list by brand above.
• An NvoVPN account with an active plan or trial — a configuration is only created while access is active. No account? Sign up: you only need an email address.
• A .conf file from your account → "Connection" → "Manual" — step 1.

Pitfalls common to every router

• One file, one device. You cannot use the router's configuration on a phone at the same time: the connection will drop on both. Create a separate one for the phone — a subscription covers up to five.
• DNS. Some firmware ignores the DNS = line in the file. If the tunnel is up but sites will not open, set the DNS manually in the interface settings — the same address as in the file.
• MTU. If heavy pages "hang" while small ones open, set MTU to 1420 on the VPN interface.
• AllowedIPs 0.0.0.0/0 sends all of the router's traffic into the tunnel. For selective routing, use the firmware's policies (Keenetic, ASUS) or firewall rules (OpenWrt).
• Check from a device behind the router. Open the "What is my IP" page on a TV or laptop: it shows the NvoVPN server's address, not your provider's.
• A kill switch on the router is not in every firmware. If it matters that devices do not go straight to the internet when the tunnel drops, check for that option in your model's VPN client settings. What it is: "Kill Switch: what it is and how to turn it on".

A TV or streaming box through the router

For Samsung, LG and Apple TV, the router is the only way to route traffic through a VPN: there are no VPN apps for them. How to install the app on Android TV and Fire TV is in "How to install a VPN on a TV"; a breakdown by TV brand is in "VPN by TV brand".

FAQ

Will a VPN slow down the router? WireGuard encryption is light, but a weak router CPU becomes the bottleneck: budget models give tens of megabits through the tunnel, modern ones hundreds. That is enough for a TV and everyday use.

Can I route only the TV through the VPN? Yes — with connection policies (Keenetic), device selection in VPN Fusion (ASUS), or routing rules (OpenWrt, MikroTik).

My provider throttles WireGuard — what now? You need firmware with AmneziaWG: Keenetic, OpenWrt with the amneziawg packages, or GL.iNet. The other option is stealth mode on the devices that run the app, leaving the router without a VPN. From Russia, see the "Are you in Russia?" block above.

Does the router count as one device? Yes: to NvoVPN it is one configuration, no matter how many devices sit behind it.

Related guides: How to install a VPN on a TV · VPN by TV brand · AmneziaWG vs WireGuard: what is the difference