In short: ASUS routers running ASUSWRT support VPN out of the box — no custom firmware, no command line. Models on firmware 388+ get fast WireGuard, everything else gets OpenVPN; either way the setup is “download the config file → import it → switch it on”, about 10 minutes. The ASUS bonus is VPN Fusion: selective routing, where only the devices you pick go through the connection. The stock firmware does not support the VLESS protocol — we’ll be honest about that case too. Here is the whole thing, step by step. If your model is not on the official lists, setting up a VPN on a router: three groups of models shows which group your box lands in and what to do with it.
For the wider picture across devices and platforms, see the guide on where you can install a VPN.
Supported protocols
| Protocol | ASUSWRT | Merlin | Speed |
|---|---|---|---|
| WireGuard | ✓* | ✓ | Very high |
| OpenVPN | ✓ | ✓ | Medium |
| PPTP | ✓ | ✓ | High (not secure) |
| L2TP | ✓ | ✓ | Medium |
*WireGuard is available on models running firmware 3.0.0.4.388.23000 and newer (per the official ASUS documentation); the full list of supported models lives on the official ASUS page: asus.click/vpnfusionmodel
The practical steps are below; if you'd rather skip the setup, Tainet connects in a couple of minutes - through the Telegram bot or in your account on this site.
Which models do what
WireGuard (recommended)
- RT-AX86U / RT-AX86U Pro
- RT-AX88U / RT-AX88U Pro
- GT-AX11000 / GT-AX11000 Pro
- RT-AX89X, GT-AXE11000
- and others — ASUS keeps the full official list at asus.click/vpnfusionmodel (our list may lag behind, the official one does not)
OpenVPN (every model)
Any ASUS on ASUSWRT supports OpenVPN — if your model isn’t in the list above, this is your path.
Method 1: WireGuard
Step 1: check the firmware
- Open router.asus.com or 192.168.1.1
- Administration → Firmware Upgrade
- The version should be 3.0.0.4.388.23000 or newer — update if needed
Step 2: create a connection
- VPN → VPN Fusion (on some firmware versions — VPN Client)
- Add Profile → pick WireGuard
Step 3: import the configuration
Get the .conf file from your provider — with Tainet it sits in your account, in the subscription section.
[Interface] section — everything that follows depends on what is written there.Jc, Jmin, Jmax, S1, S2 and H1–H4, and the values in them are always real ones. The stock ASUS client reads only the basic fields and trips over those lines: the log complains about a version, and the tunnel either never comes up or falls apart a couple of minutes later.
⚠️ If you edit the file, save it as UTF-8 without BOM (Notepad++ and VS Code let you pick the encoding explicitly). The invisible BOM mark at the start keeps the
[Interface] section from being recognised, and the router answers Public key none and setconf failed while the file looks correct — after which the cause gets hunted in the keys. Line endings do not matter: the WireGuard parser reads Windows and Unix ones alike.
Those lines cannot be removed: without them you are left with the classic WireGuard they were added to move away from. So the way forward is Merlin firmware and an add-on — see the "ASUSWRT-Merlin" section below.
From here it is business as usual. Option 1: the Upload Config button (Import in older interface versions) → pick the file. Option 2: fill the fields in by hand from the file:
[Interface]
PrivateKey = private_key_from_your_account
Address = 10.0.0.2/32
[Peer]
PublicKey = server_public_key
Endpoint = server_address:51820
AllowedIPs = 0.0.0.0/0
Allowed IPs = 0.0.0.0/0 means “all traffic through the connection”.
⚠️ Check that the [Peer] section carries PersistentKeepalive = 25. Without it the connection comes up and stops answering a few minutes later: the router sits behind the ISP NAT, and with no regular packets the far side closes the session. The failure is delayed, which is why people usually look for it in the keys and the server country.
Step 4: switch it on
Save the settings, flip the profile toggle to ON, and check the IP on any device at home — it should change to the server address.
Method 2: OpenVPN
Works on every ASUS.
- Download the
.ovpnfile from your provider - VPN → VPN Client → Add Profile → OpenVPN → upload the file (username/password — if the provider issues them)
- Turn on Automatic start at boot time (the connection comes back up after a router reboot) and set Accept DNS Configuration: Strict — this is the “send DNS queries through the tunnel” setting: without it some sites may not open
- Apply → activate → wait for the Connected status
Tainet - a stable connection with no complicated setup. Sign up through the Telegram bot or in your account on this site, support is real people, from $0.10 a day.
Try it →VPN Fusion: selective routing
The signature ASUS feature: only the devices you pick go through the connection, the rest go direct.
- VPN → VPN Fusion → create a connection
- Open the Exception List
- For each device pick a route: VPN (through the tunnel) or WAN (direct)
A typical layout:
| Device | Route | Why |
|---|---|---|
| TV | VPN | Streaming — all of it, steadily |
| Work laptop | WAN | No conflict with the corporate VPN |
| Game console | VPN | A stable route to the game servers |
| Smart speaker | WAN | It doesn’t need the connection |
How the connection affects games and ping is covered in the article on VPN for gaming, and TVs in the guide on setting up a VPN on a TV.
What about VLESS on ASUS? The honest answer
There’s no stock way: neither ASUSWRT nor Merlin supports VLESS — the protocol that masks traffic as ordinary HTTPS and stays the steadiest on finicky networks (what VLESS is and how it works is covered separately). If WireGuard is unstable on your ASUS and you specifically need VLESS for the whole house, the options are: a router that supports it — setting up a VPN on a Keenetic router via XKeen, setting up a VPN on an OpenWRT router (including a VPN on a Xiaomi router flashed with OpenWRT) or setting up VLESS on MikroTik in a container; or VLESS clients on the devices themselves (setting up Happ, setting up INCY — it even runs on Apple TV) with the router on WireGuard. Tainet has configurations for both worlds in a single subscription: WireGuard-compatible AmneziaWG for the router (on ASUS — through Merlin with an add-on, see below) and VLESS for everything else.
ASUSWRT-Merlin
Merlin is an improved ASUS firmware from a third-party developer: better VPN support, rule-based routing (by device address, domain, and port), an advanced kill switch, and fast updates. It installs through the stock update menu: download the file for your model from the project’s official site → Administration → Firmware Upgrade → Upload.
Merlin + the AmneziaWG add-on: when the stock client will not take the configuration
This is the case Merlin is here for. If the file from your account carries real S1, S2 and H1–H4 values (see step 3), the stock ASUS client will not take it with any amount of editing — while Merlin with the add-on takes it as it is.
The order is:
- Install Merlin for your model — as described above.
- Prepare a USB drive. The add-on lives on it: plug a drive into the router, enable SSH (Administration → System → Enable SSH) and connect to the router over SSH.
- Install Entware. Run
amtmon the router — format the drive and install Entware from its built-in menu. - Install the add-on as one line:
curl -sfL https://raw.githubusercontent.com/r0otx/asuswrt-merlin-amneziawg/main/install-online.sh | sh
- Import the
.confunedited — the add-on reads the masking lines itself. - Check the counters for sent and received: both should grow. Only the sent one moving means packets are not reaching the server — try a configuration for another country.
⚠️ This is a third-party project, not an official part of Merlin: a firmware update may require reinstalling the add-on. If that path does not suit you, there are two working alternatives — VLESS clients on the devices themselves, or a router with VLESS support out of the box (options in the section above).
Performance
| Model | WireGuard | OpenVPN |
|---|---|---|
| RT-AX58U | ~200 Mbps | ~50 Mbps |
| RT-AX86U | ~500 Mbps | ~100 Mbps |
| RT-AX88U | ~600 Mbps | ~120 Mbps |
| GT-AX11000 | ~800 Mbps | ~150 Mbps |
Actual speed depends on the server and your internet plan; the takeaway from the table is simple — if your model can do WireGuard, there’s no reason to turn on OpenVPN.
Troubleshooting
| Problem | Fix |
|---|---|
| No WireGuard entry | Update the firmware to 3.0.0.4.388.23000+ |
| OpenVPN won’t connect | Check the username/password and that the .ovpn file is intact |
| Low speed | Switch from OpenVPN to WireGuard |
| Drops after a reboot | Turn on “Automatic start at boot” |
| The connection keeps dropping | A sign the protocol is being recognised on a finicky network — see the VLESS section above |
| The log complains about a version, “Error: setconf failed”, “Public key none” | The stock client did not understand the masking lines, or the file was not read in full. See step 3; for real values the path is Merlin with the add-on |
| Connected, then dropped a couple of minutes later | No PersistentKeepalive = 25 in the [Peer] section — add the line and import the file again |
| The router substituted keys of its own | Do not press “Generate key pair”: PrivateKey comes from the file, otherwise the server does not recognise the connection |
| The file will not import | Check the extension: browsers append .txt, so config.conf is saved as config.conf.txt |
| Worked for days, then the handshake disappeared | The cause is that particular server. Download a configuration for another country — on a router it does not refresh itself |
Checking the connection: open any IP lookup service from a device on the network — the address should match the connection server.
Still stuck — start with the setup instructions in your account: they carry step-by-step settings for your subscription and router configurations.
Still didn’t work? Write to us — via a ticket in your account or in the Telegram bot. We’ll advise on your model and firmware, and if this is your first router setup, we’ll walk you through it. Attach the S1, S2 and H1–H4 values from your file and the error line from the router log: together they show at once whether the add-on is needed.
Frequently asked questions
WireGuard or OpenVPN?
WireGuard is 3–5x faster — pick it everywhere it’s available. OpenVPN is the fallback for models that can’t run firmware 388.23000+. For a comparison of all the protocols, see our VPN protocol overview.
Can I use several VPNs at once?
Yes — VPN Fusion supports multiple connections split across devices: the TV through one, the set-top box through another.
Does ASUS support the VLESS protocol?
Not out of the box, Merlin included. The options are in the VLESS section above: another router for that job, or VLESS clients on the devices.
My ASUS sits behind the ISP’s router — will the VPN work?
Yes, and it’s a very common setup (ISP router → cable → ASUS). The fear of “my IP is private, nothing will work” doesn’t apply here: a private IP and double NAT only get in the way of a VPN server — when you need to reach your home network from outside. The VPN client from this guide opens an outbound connection — it doesn’t need a public IP, and the ISP router in front of the ASUS changes nothing. Follow the steps above as they are.
How do I update the configuration?
Delete the old profile and create a new one from the updated file — with Tainet the current configurations are always in your account.
One subscription for the router and the phone — possible?
Yes: a Tainet subscription is multi-device — WireGuard on the router and the same subscription in Happ on your phone when you’re out.
Summary
ASUS is an excellent choice for a home VPN without custom firmware: WireGuard out of the box on newer models, OpenVPN on all of them, VPN Fusion for flexible per-device routing. If you need VLESS, see the guides on a VPN for Keenetic routers and a VPN on OpenWRT; for everything else the ASUS closes the job in 10 minutes.
If this article describes your situation, Tainet handles it without the technical hassle: connect through the Telegram bot or in your account on this site, the first 7 days are free, then from $0.10 a day. Questions go to support — we answer fast.
