VPN on a Tenda router: WireGuard on the newer models

A VPN on a Tenda router installs in a few minutes — but only on newer models. A stock WireGuard client exists on Wi-Fi 6 models like the AX12 Pro V3.0 and RX12 Pro V2.0: you upload a file in the web interface, and the fields fill in on their own. WireGuard is a VPN protocol, the "language" the router and server use to encrypt traffic. AmneziaWG — the same WireGuard with obfuscation — is not in Tenda's firmware, so the stock route does not work in Russia: see the "Are you in Russia?" block. Older AC-series models (the AC21, for example) only do PPTP and L2TP, which NvoVPN does not offer.

1. 1

   Download the WireGuard file from your account

   Open your account → "Connection" → "Manual". Choose a server, choose "Router" in the device list and click "Create". The main file is AmneziaWG, which Tenda does not understand: download the plain WireGuard variant sitting next to it. You need an active plan or trial.

2. 2

   Check that your Tenda has "VPN Client"

   Open tendawifi.com in your browser and enter your router's password — this is the web interface, the settings page. Find the "VPN" → "VPN Client" section. Tenda states the path depends on the model, for example "More" → "VPN" → "VPN Client". If WireGuard is in the "VPN Type" list, your model qualifies. Per the manufacturer's data, a WireGuard client exists on the AX12 Pro V3.0 and RX12 Pro V2.0; the full list is in the "Models and firmware" section. No such section? Read the "Are you in Russia?" block and the models section.

3. 3

   Upload the file to "VPN Client"

   Turn on the "VPN Client" toggle. Click "Add", enter any name in the "Description" field, for example NvoVPN, and choose WireGuard in "VPN Type". Click "Select File" and upload the downloaded .conf file — the parameters fill in on their own. Click "OK". In "Server List", turn on the new rule: the "Status" field will show "Connected".

4. 4

   Check the IP from a device behind the router

   On a TV or laptop connected to the Tenda, open the "What is my IP" page: it should show the NvoVPN server's address, not your provider's. Seeing your provider's address? Go to the "If it will not connect" section.

If it will not connect: Tenda and general pitfalls

• Can't find "VPN Client". Tenda states plainly that the menu path depends on the model ("subject to the actual path"). Go through the menu sections and look for the word VPN; older AC-series models have no WireGuard client at all — see "Models and firmware".
• "Connecting" does not change to "Connected". Create a new file (a different server) in your account and upload it. Did not help? The network is throttling WireGuard: normal in Russia, see the "Are you in Russia?" block.
• "Connected", but sites will not open. On import, the router fills in fields from the file itself, but Tenda's guide does not list which ones. Open the rule and check the "DNS Server" field: enter the address from the file's DNS = line. DNS is the internet's "phone book" — it turns website names into addresses.
• Heavy pages hang, light ones open. The rule has an "MTU Size" field — set it to 1420. MTU is the maximum data packet size; one that is too large will not pass through the tunnel.
• The Tenda sits behind your provider's router. Set the "Persistent Keepalive" field to 25 — that is what WireGuard's official documentation recommends. The router reminds the server it is there once every 25 seconds, so the connection does not drop across your provider's network.
• "Allowed IPs" = 0.0.0.0/0 — Tenda itself recommends this value: all of the router's traffic goes into the tunnel. Selecting individual devices is not described in the guide.
• One file, one device. You cannot use the router's configuration on a phone at the same time: the connection will drop on both. Create a separate file for the phone — a subscription covers up to five.
• A kill switch — blocking direct internet access when the tunnel drops. Tenda's guide does not mention it. If it matters to you, turn it on in the app on your devices: how to do that.

Tenda models and firmware: where WireGuard exists

Per the manufacturer's data as of September 2026.

• AX12 Pro V3.0 — the spec sheet lists: PPTP VPN Server, PPTP VPN Client, L2TP VPN Client, OpenVPN Client, WireGuard VPN Client (specs page).
• RX12 Pro V2.0 — the product page lists: OpenVPN and WireGuard support, a 1.3 GHz dual-core CPU (product page).
• MX12, TX12 Pro V2.0, RX12 Pro V2.0 and later — these models are tied to Tenda's video guide "Access VPN Resources with WireGuard" from March 23, 2026 (material page).
• No WireGuard: the AC21 — only a PPTP server, and a PPTP and L2TP client. The AC23 and RX3 do not mention VPN at all on their support pages — check the "VPN Type" list in the interface.
• The firmware version where WireGuard first appeared did not turn up in Tenda's public materials — update your firmware to the latest from your model's support page and check the "VPN Type" list. The same model ships in different hardware versions (V2.0, V3.0) — check the full name.
• AmneziaWG — on no model: Tenda's site only has WireGuard.
• OpenWrt (free firmware where AmneziaWG installs through third-party packages) officially supports only the AC9 (stable release 24.10) and BE12 Pro (testing builds only) from Tenda. The AC6, AC8, AC10, AC23, RX3, RX9 Pro and AX12 Pro are not on the OpenWrt device list.

The official setup document is the "VPN User Guide — Dual-Band Wi-Fi Router" (PDF in English), section 4.1 "Use WireGuard client to access VPN resources".

FAQ

Can I install AmneziaWG on a Tenda? No. Stock firmware only has WireGuard, and OpenWrt only exists for the AC9 and BE12 Pro. In Russia, the options that work are the app on your devices, or a second router with AmneziaWG behind the Tenda.

Which file from my account should I take? The plain WireGuard variant. A Tenda router will not accept the AmneziaWG file — it has obfuscation parameters that WireGuard does not know.

Can I route only the TV through the VPN? Not in Tenda's guide: with the recommended "Allowed IPs" of 0.0.0.0/0, everything goes through the tunnel. If only some devices need the VPN, connect those to a second router with a VPN and leave the rest on the Tenda.

Will a VPN slow the router down? WireGuard encryption is light, but a weak router CPU becomes the bottleneck: budget models give tens of megabits through the tunnel, modern ones hundreds. The RX12 Pro V2.0 has a 1.3 GHz dual-core CPU; Tenda does not publish tunnel speed measurements.

Does the router count as one device? Yes: to NvoVPN it is one configuration, no matter how many devices sit behind it. A subscription covers up to five configurations.

Related guides: VPN on a router: general guide and pitfalls · VPN on Keenetic: AmneziaWG out of the box · AmneziaWG vs WireGuard: what is the difference · A router from your provider: how to add a VPN