VPN on a Xiaomi or Redmi router: why not with stock firmware, and what to do instead
The stock Xiaomi and Redmi firmware only does PPTP and L2TP — no WireGuard or AmneziaWG. An honest breakdown: which models have OpenWrt, what you risk, and how to get by with no reflashing — an app on your devices, or a second router.
A VPN for a Xiaomi or Redmi router — the honest answer: not with the stock firmware. The built-in VPN client only understands the old PPTP and L2TP protocols; there is no WireGuard or AmneziaWG in it, so you cannot load the file from your NvoVPN account onto this kind of router. Below is how to find out whether the free OpenWrt firmware exists for your model, what that risks, and how to get by with no reflashing at all: an app on your devices, or a second router. If you are in Russia, there is a separate block below.
-
Find out whether OpenWrt exists for your model
OpenWrt is free router firmware that lets you install AmneziaWG on top. Check the exact model name on the label underneath and look it up in the official OpenWrt table. Release 25.12.5 has Xiaomi AX3000T, AX3200, AX3600, AX6000, AX9000, Redmi AX6, AX6S and Redmi AX6000, Mi Router 3G, 3 Pro, 4, 4A (100M and Gigabit), 4C, 4Q, AC2100 and Redmi AC2100, MiWiFi 3A, 3C, Mini, Nano, CR6606/6608/6609, WR30U, AIoT AC2350. There is not a single model from the BE series (BE3600, BE5000, BE6500 Pro, BE7000, BE10000), nor the Redmi AX3000 and AX1800.
-
Weigh the risk: this is an exploit, and it can "brick" the router
OpenWrt installs on a Xiaomi through a vulnerability in the stock firmware, tied to specific versions of it — newer stock firmware closes it, and a rollback is needed. On the AX3000T, revisions RD03 and RD23 work; RD03v2 is different hardware, with no OpenWrt for it. The AX3200 and Redmi AX6S have newer bootloaders (devices made after December 2023): flashing without editing U-Boot turns the router into a "brick". If none of these words mean anything to you, this route is not for you — skip to step 3.
-
With no reflashing: the app, or a second router
The first way is the NvoVPN app on every device: Windows, macOS, Android, iPhone, Android TV. A subscription covers up to five devices, and you do not need to touch the Xiaomi router. The second way is a router that understands AmneziaWG natively: Keenetic. Put it in place of the Xiaomi, or add it as a second router behind it — that way Samsung and LG TVs get the VPN too, since there are no apps for them.
-
Check that the VPN is working
Whichever route you took — the app, OpenWrt, or a second router — open the "What is my IP" page from the device that needs the VPN: it should show the NvoVPN server's address, not your provider's. Check a router from a device behind it, not in its interface.
Why won't the built-in PPTP and L2TP work?
These are previous-generation protocols: they are easy to recognize and block, and they have no traffic obfuscation. NvoVPN does not issue them — only AmneziaWG and WireGuard. So the Additional settings → VPN → Add service menu in the Xiaomi router will not be any use for our VPN.
Are you in Russia? Stock Xiaomi will not help — here is what works
In Russia, plain WireGuard is throttled; only AmneziaWG works. On a Xiaomi router there is no AmneziaWG either in the stock firmware or in the official OpenWrt packages — there, AmneziaWG installs through third-party builds. So for Russia there are two routes.
Option 1 — the NvoVPN app on your devices
When the network throttles the VPN, the app switches to stealth mode by itself — there is nothing to turn on. The Xiaomi router stays as it is. For an iPhone in Russia, use TestFlight — see the iPhone guide.
NvoVPN appsOption 2 — a router with AmneziaWG in place of the Xiaomi, or next to it
Keenetic reads the AmneziaWG file from your account natively — set up in ten minutes. If your AmneziaWG router connects but no traffic gets through, message support: we will prepare a configuration with a route for Russia.
Contact supportIf you decide on OpenWrt: pitfalls
- AmneziaWG packages do not come from OpenWrt. They are not in OpenWrt's official repositories (checked against the 25.12.5 release indexes). They install following the Amnezia guide for OpenWrt: you need OpenWrt 23.05.0 or later, 22.03 is not supported. Setting up the AmneziaWG interface in LuCI is in the router overview guide.
- Stock firmware revisions and versions. AX3000T: revisions RD03 (CN) and RD23 (Global) are the same MT7981B hardware, supported from OpenWrt 23.05.4, with 25.12 recommended; stock firmware 1.0.47–1.0.104 is vulnerable, and 1.0.106 needs a rollback. Redmi AX6000: access only opens up on stock 1.0.48, 1.0.60 and 1.0.67; the install variant that repartitions U-Boot has no way back to the stock firmware.
- DNS. If the tunnel is up but sites will not open, set the DNS manually in the interface settings — the same address as in the file's
DNS =line. - MTU. If heavy pages "hang" while small ones open, set MTU to 1420 on the VPN interface.
- AllowedIPs 0.0.0.0/0 sends all of the router's traffic into the tunnel. Selective routing needs rules in OpenWrt's firewall.
- One file, one device. You cannot use the router's configuration on a phone at the same time: the connection will drop on both. Create a separate one for the phone — a subscription covers up to five.
- A kill switch (blocking internet access if the tunnel drops) is not in every firmware; it is more reliable to turn it on on the devices themselves — how to do that.
OpenWrt on Xiaomi and Redmi: models and firmware
Per Xiaomi and OpenWrt data as of September 2026.
- Stock firmware. The VPN client is the same on every model: only PPTP and L2TP (Xiaomi's official FAQ). The Xiaomi Mesh System BE3600 Pro does not support a VPN client or VPN server at all. WireGuard, OpenVPN and AmneziaWG are not mentioned for any model in Xiaomi's official documentation.
- OpenWrt 25.12.5 — 33 profiles: Xiaomi AX3000T (RD03/RD23), AX3200 and Redmi AX6S, AX3600, AX6000, AX9000, Redmi AX6, Redmi AX6000, Xiaomi AIoT AC2350, Mi Router AC2100 and Redmi AC2100, Mi Router 3 Pro, 3G and 3G v2, Mi Router 4, 4A 100M (CN, International, International V2), 4A Gigabit (and v2), 4C, 4Q, MiWiFi 3A, 3C, Mini, Nano, CR6606, CR6608, CR6609, WR30U, and the Range Extender AC1200 RA75.
- No OpenWrt: the entire BE series (BE3600, BE5000, BE6500 Pro, BE7000, BE10000), Redmi AX3000, AX1800, AX3000T revision RD03v2. For these — only an app on your devices, or a different router.
FAQ
Is there WireGuard on a Xiaomi router with no reflashing? No. Per Xiaomi's official data, the built-in VPN client only understands PPTP and L2TP — neither WireGuard nor AmneziaWG. Claims of "WireGuard on Xiaomi with no reflashing" are not confirmed by the manufacturer.
Xiaomi AX3000T and OpenWrt — which one should I get? Revisions RD03 (Chinese) and RD23 (global): the same hardware, and OpenWrt supports both. RD03v2 has a different processor, with no OpenWrt for it. The revision is printed on the label underneath.
What do I do with a Xiaomi BE3600, BE5000 or BE7000? There is no OpenWrt for the BE series, and the Mesh System BE3600 Pro does not even have a stock VPN client. On these routers, there is nothing to do: the NvoVPN app on your devices, or a router with AmneziaWG, such as Keenetic.
Can I route only the TV through the VPN? On Android TV and Fire TV, with the app — see "VPN on a TV". There are no apps for Samsung and LG, they need a router with a VPN — on Xiaomi that only means OpenWrt, and it is simpler to get a Keenetic.
Does a router with OpenWrt count as one device on the subscription? Yes — to NvoVPN it is one configuration, no matter how many devices sit behind the router.
Related guides: How to set up a VPN on a router: an overview by firmware · AmneziaWG vs WireGuard: what is the difference · VPN on a Keenetic router · VPN on a TP-Link or Mercusys router · VPN when your provider gave you the router
Ready to connect?
Download the app and sign in — you are protected. The free trial starts by itself, no card needed.