VPN on TP-Link Archer or Mercusys: the WireGuard client, file from your account

A VPN on a TP-Link Archer or Mercusys router installs with the stock firmware, but with two catches. First: a WireGuard client only exists on some models — the official list has only Wi-Fi 6 and Wi-Fi 7 ones (Archer AX, AXE, BE, GE, Mercusys MR…X and MR…BE). Second: there is no AmneziaWG obfuscation in the firmware, so you take the plain WireGuard variant of the file — and in Russia this kind of router will not give you a working VPN, see the "Are you in Russia?" block. If your model is on the list, setup takes five minutes.

1. 1

   Download the WireGuard variant of the file

   Open your account → "Connection" → "Manual": choose a server, name the device "Router", click "Create". Next to the AmneziaWG file is a plain WireGuard variant — download that one: the stock TP-Link and Mercusys firmware only understands that kind. The file is only created while a plan or trial is active.

2. 2

   Check your model and firmware

   WireGuard is not on every model, and on some it only appears from a specific hardware version (V1, V2 — printed on the label underneath) and firmware build; TP-Link warns that availability also depends on the firmware region. Check your model against the official TP-Link list or the Mercusys list (they are also below), and update the firmware to the latest: Mercusys states plainly that the VPN client sometimes needs a recent firmware build.

3. 3

   Upload the file to VPN Client and choose devices

   Open the router's interface — tplinkwifi.net (Mercusys: mwlogin.net) → Advanced → VPN Client. Turn on "Enable VPN Client" and click SAVE. In Server List, click "Add", enter any name, set VPN Type to "WireGuard", click "BROWSE" and choose the file — but first remove the MTU and IPv6 lines from it, see below. Click SAVE and turn on the toggle next to the entry. Then "VPN Device List" (Mercusys: "Device List") → "Add" → tick the devices that should go through the VPN, and turn on the toggle for each.

4. 4

   Check the IP from a device on the list

   On a TV or laptop you added to Device List, open the "What is my IP" page: it should show the NvoVPN server's address, not your provider's. In Server List, the entry will show a connection status at the same time.

If the router will not connect: TP-Link and Mercusys pitfalls

• The file will not import. Remove the MTU and IPv6 lines from it, then any comments. Mercusys also suggests testing the file in the WireGuard app on a computer or phone — if it connects there, the file is fine — and updating the router's firmware.
• There is no WireGuard option in VPN Client. It does not exist on this model, hardware version, or regional firmware. Check the list below; if your model is not on it, see the options in the "Are you in Russia?" block — they work everywhere.
• The TV bypasses the VPN. Only devices in VPN Device List go through the tunnel. There is no separate "all traffic" switch — add every device to the list, including new ones.
• One file, one device. TP-Link explicitly advises against using one file on multiple clients at the same time. Create a separate configuration for the phone — a subscription covers up to five.
• Speed is lower than your plan. The router's CPU computes the encryption: budget models give tens of megabits through the tunnel, modern ones hundreds. MTU is not configurable on TP-Link — you removed that line from the file.
• Check from a device on the list, not in the router's interface: a "connected" status in Server List does not guarantee the device you need is in Device List.
• A kill switch (blocking internet access if the tunnel drops) is not in every router's firmware; it is more reliable to turn it on on the devices themselves — how to do that.

TP-Link and Mercusys models with WireGuard

Per the manufacturers' data as of September 2026: the TP-Link list was last updated April 17, 2026, and the Mercusys one on December 26, 2024. TP-Link notes that whether WireGuard is present depends on the firmware region, even for the same model.

• TP-Link Archer: AX1800, AX20, AX21, AX3000, AX3000 Pro, AX3200, AX4400, AX5400 Pro, AX55, AX55 Pro, AX72 Pro, AX73, AX80, AX10000, AXE75, AXE300, BE230, BE260, BE400, BE550, BE550 Pro, BE600, BE670, BE805, BE900, BE3200, BE3500, BE3600, BE3600 Pro, BE4600, BE4800, BE5000, BE6100, BE6500, BE9300, BE9500, BE9700, GE650, GX90. On some models WireGuard arrived with a specific firmware build: Archer AX20 V3, AX21 V3, AX1800 V3 — from 1.2.1 Build 20240809; AX55 V2 — from 1.2.2 Build 20250317; AX53 V1 — from 1.4.3 Build 20250314; AX12 V1 — from 1.1.28 Build 20250523. A TP-Link staff member keeps a table of hardware versions on the official forum.
• Mercusys: MR70X, MR80X, MR85X, MR1800X, MR3000X, MR60X, MR62X, MR25BE, MR25WBE, MR27BE, MR37BE, MR47BE, MR3600BE. On Mercusys's MB-series 4G/5G routers, the VPN client only does OpenVPN, PPTP and L2TP — no WireGuard there.
• No WireGuard in the stock firmware: every Wi-Fi 5 Archer C and A model (C6, C7, A7, C20, C50, C60, C80, C64 and others), plus Archer AX10 and AX1500 — none of these are on the official list. Some of them have OpenWrt 25.12.5 available: Archer A6 V3, A7 v5, A9 v6, AX21 v4, AX23 v1, AX80 v1, C2, C20, C25, C2600, C5, C50, C58, C59, C6 v2 and V3, C60, C6U, C7, MR200, MR600 v2, TL-WR841N v13, TL-WR1043N/ND; Mercusys MR70X/MR1800X, MR80X v3, MR85X, MR90X. With OpenWrt, AmneziaWG installs through third-party packages — steps are in the router overview guide. Archer AX10/AX1500, C80, C64 and TL-WR841N v14 do not support OpenWrt either — there is nothing to do with these: an app on your devices, or a different router.

FAQ

Is there a VPN on the TP-Link Archer C6 router? There is no WireGuard in the Archer C6's stock firmware — the model is not on the official list. Archer C6 v2 (EU/RU/JP) and C6 V3 have OpenWrt 25.12.5 available: you can reflash the router and install third-party AmneziaWG packages, but that route is for a confident user. Simpler options: the NvoVPN app on your devices, or a Keenetic.

Can I upload an AmneziaWG file to TP-Link? No. The stock firmware only understands plain WireGuard — take the WireGuard variant from your account. There will be no traffic obfuscation, so this route does not suit Russia.

How do I route every device through the VPN? Add each one to VPN Device List and turn on the toggle. There is no separate "all traffic" option in the firmware; a new device on the network goes direct by default.

Does Mercusys work the same way? Yes: mwlogin.net → Advanced → VPN Client → WireGuard → "BROWSE" → the file; then Device List → "Add" → the devices. Mercusys adds: do not change the file's parameters unless you need to.

Does the router count as one device on the subscription? Yes — no matter how many devices are in Device List, to NvoVPN it is one configuration.

Related guides: How to set up a VPN on a router: an overview by firmware · AmneziaWG vs WireGuard: what is the difference · VPN on a Keenetic router · VPN on an ASUS router · VPN when your provider gave you the router