VPN on Keenetic Router: VLESS and WireGuard Setup

Keenetic routers are among the best for setting up VPN in your home network. They support modern protocols and allow protecting all devices simultaneously. Let’s go through the setup step by step - and see an overview of all devices and platforms that support VPN in the general guide.

If you have a Netcraze — this guide is entirely yours: it is the same system under a different name, the web interface sections and the order of steps match. They share one firmware line — 3.x → 4.x → 5.x — and the version depends on the model and update channel, not on the name on the case.

Advantages of VPN on Router

The practical steps are below; if you'd rather skip the setup, Tainet connects in a couple of minutes - through the Telegram bot or in your account on this site.

Supported Protocols

*VLESS requires installing Entware; from there you choose between the automatic route via XKeen and the manual one via sing-box.

An important practical detail in 2026: WireGuard is the fastest of them all, but its traffic is easy to recognise and on some networks it works unreliably. VLESS is masked as an ordinary HTTPS connection and stays stable everywhere - how that masking is built is covered in an article on VLESS and REALITY. The practical takeaway: start with WireGuard as the simple option, and if the connection acts up, move to VLESS via method 2.

Method 1: WireGuard (Simple)

WireGuard is the fastest protocol. Suitable for protecting your home network.

⚠️ One clarification that saves an evening: for routers we hand out an AmneziaWG configuration. It is the same WireGuard — same keys, same client in the firmware — only masked: next to the familiar fields the file carries Jc, Jmin, Jmax, S1, S2 and H1–H4. Those are what keeps the connection alive in Russian networks, where classic WireGuard is recognised from the first packet. KeeneticOS only learned to read them straight from an uploaded file in version 5.1 (5.1.2+ is better). On 4.2–4.3.x and 5.0.x — which is most routers — they are entered by hand with a single command, that is step 3.1 below.

Step 1: Enable WireGuard

1. Open my.keenetic.net
2. Management → General settings → Change component set
3. Find WireGuard VPN → Install
4. Reboot router

Step 2: Create Connection

1. Internet → Other connections → WireGuard
2. Click Add connection
3. Enter name (e.g., “VPN”)

Step 3: Import Configuration

Get WireGuard configuration from provider (with Tainet the ready-made configuration file is available in your account, in the subscription section).

The most reliable path is loading the whole file: in the WireGuard section press “Load from file” and pick the downloaded .conf. The router fills in the keys and the address itself — there is nothing to get wrong. The masking parameters come along only on firmware 5.1 and newer; on 4.x they are added by step 3.1.

If you are filling the fields in by hand, the configuration looks like this:

[Interface]
PrivateKey = your_private_key
Address = 10.0.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = server_public_key
Endpoint = server.example.com:51820
AllowedIPs = 0.0.0.0/0

Fill in Keenetic fields:

• Private key: from [Interface] PrivateKey
• Address: from [Interface] Address
• Peer public key: from [Peer] PublicKey
• Peer address: from [Peer] Endpoint
• Allowed subnets: 0.0.0.0/0
• Keepalive: 25 (that is PersistentKeepalive = 25 in the file)

⚠️ “Keepalive” looks like an optional field, yet without it the tunnel comes up, runs for a few minutes and quietly stops answering: the router sits behind the ISP NAT, and with no regular packets the far side closes the connection. The failure is delayed, which is why people look for it in the keys and the server country.

Step 3.1: Enter the masking parameters (firmware below 5.1)

On these versions the router does not read the Jc, Jmin, Jmax, S1, S2 and H1–H4 lines from the file: the connection is created but stays plain WireGuard — it either never comes up or falls apart within minutes. The cause is usually hunted in the keys and in the server country, while it is here.

No need to enable Telnet. In the web UI address replace dashboard with a to open the web console (e.g. http://192.168.1.1/a). Run two commands:

interface Wireguard0 wireguard asc <Jc> <Jmin> <Jmax> <S1> <S2> <H1> <H2> <H3> <H4>
system configuration save

Take the values from your own .conf — the order in the command is exactly this one. The interface name (Wireguard0) is shown in the card of the connection you created. In your account, on the router setup step, this command is assembled ready-made with your values — you only copy it.

Step 4: Configure Routing

There is no need to add routes: our file already carries AllowedIPs = 0.0.0.0/0, which is exactly “all traffic through the tunnel”. Tick “Use for internet access” on the connection and move on to step 5.

What is worth doing here is clearing out the old:

1. Internet → Other connections: delete, or at least disable, the previous VPN profile if there was one. Exactly one connection should stay active.
2. Network rules → Routing: delete static routes tied to the old tunnel. Old routes take traffic before the new connection does, and it stays empty while showing green.

💡 A manual 0.0.0.0/0 route is only needed in the opposite case — if you deliberately narrowed AllowedIPs to specific subnets. For our configuration it is not.

Step 5: Make the VPN your priority connection

1. Internet → Connection priorities
2. Drag the profile with your WireGuard connection to the top, above your ISP

The “Use for internet access” checkbox only adds the tunnel to this list — it does not move it up: priority stays with the ISP, and traffic keeps going through it instead of the VPN. The step looks optional precisely because the connection shows as active — while device IPs stay unchanged.

Step 6: Enable and Verify

1. Activate connection
2. Check IP on network devices (should change)

⚠️ Check with a service outside Russia, 2ip.io for one: Russian sites go direct by design, so there the address stays the same — that is not a fault. If the address is unchanged everywhere, go back to step 5.

Step 7: Check DNS and IPv6

Two settings that make a working connection look broken:

• DNS. Network rules → Internet filters: if “Ignore ISP DNSv4” is on, set your own servers — 8.8.8.8 and 1.1.1.1. With that option on and the list empty the router has no DNS at all, and sites stop opening both through the tunnel and directly.
• IPv6. Turn it off in the ISP connection: Internet → your connection → IPv6 = “Not used”. The tunnel runs over IPv4, while IPv6 requests go around it — most visibly on YouTube: the page opens, the video does not play.

Step 8: Prepare a spare connection

A configuration on the router does not refresh itself — unlike a subscription in an app, where new servers arrive automatically. If the handshake is gone and the receive counter has frozen, the cause is usually that particular server: download a configuration for another country from your account and load it the same way.

Better to do it in advance: add two or three connections to different countries and keep them in the priority list. Then switching is dragging a row, not setting things up from scratch.

Method 2: VLESS (Stable Masking)

VLESS provides the best traffic masking and stays stable on any network. It needs a Keenetic with a USB port, a flash drive of 4 GB or more, and the Entware environment. From there you have two routes - automatic (XKeen) and manual (sing-box).

Common step: install Entware

1. Format flash drive to ext4
2. Insert into router
3. Management → General settings → Change component set
4. Install Entware package environment
5. Reboot router

Route A: XKeen (simpler, recommended)

XKeen is a popular installer that deploys the xray core on Keenetic and sets up autostart on its own: the command line is only needed for a couple of commands.

1. Connect via SSH: ssh admin@192.168.1.1
2. Install XKeen following the project’s instructions (a single install command from the official xkeen page)
3. In the setup wizard, paste the VLESS link from your subscription - with Tainet it is copied with one button in your account or in the bot
4. Pick a server marked VLESS from the subscription. A caveat: the Tainet subscription contains both VLESS and XHTTP configurations - use VLESS for a router: XHTTP variants are not yet supported by every router core, and this is the most common reason for “set it up and it doesn’t work”
5. Grab a second country as a spare right away. Xray talks to the server written into the configuration and never changes it on its own: when that server falls silent, access disappears with nothing to show for it, while the router keeps reporting everything as configured. A configuration downloaded in advance reduces the swap to replacing a file and restarting — the same trick as the spare connection in step 8 above

Route B: sing-box by hand (for those who like control)

1. Connect via SSH: ssh admin@192.168.1.1
2. Install sing-box:

opkg update
opkg install sing-box

3. Create the configuration: nano /opt/etc/sing-box/config.json

A VLESS configuration example (take your own values - server address, uuid, keys - from the connection parameters in your account):

{
  "inbounds": [
    {
      "type": "tun",
      "interface_name": "tun0",
      "inet4_address": "172.19.0.1/30",
      "auto_route": true,
      "strict_route": true
    }
  ],
  "outbounds": [
    {
      "type": "vless",
      "server": "server-address-from-your-account",
      "server_port": 443,
      "uuid": "your-uuid-from-your-account",
      "flow": "xtls-rprx-vision",
      "tls": {
        "enabled": true,
        "server_name": "server-address-from-your-account",
        "reality": {
          "enabled": true,
          "public_key": "key-from-your-account",
          "short_id": "id-from-your-account"
        }
      }
    }
  ]
}

4. Start it: /opt/etc/init.d/S99sing-box start - autostart after installation through Entware is configured automatically.

A similar setup works differently on other firmware - if your router runs OpenWRT, there is a dedicated OpenWrt guide for it, and ASUS has its own ASUS guide. If your brand is not in that short list, which other routers work for a connection is covered in the general overview.

Selective Routing

You can route only specific devices or sites through VPN.

Only Specific Devices

1. Internet → Connection priorities → Internet access policies: create a policy
2. Inside the policy, move the VPN connection above your ISP
3. Assign the policy to the devices you want

A typical scenario: the TV and the set-top box go through the connection, while the work laptop goes direct.

Only Specific Sites

Built-in KeeneticOS features are enough here — neither Entware nor sing-box is required. Two conditions, without which the routes will not work:

• the «Use for accessing the internet» checkbox on the connection stays enabled. Without it routes through this connection do not work at all — that is how the firmware behaves;
• in Internet → Connection priorities the connection sits below your ISP. Ordinary traffic then goes directly, and only what the routes send goes through the tunnel.

By domain — requires KeeneticOS 5.0.4 or newer:

1. Network rules → Internet filter → «Domain names» tab: create a list and add the domains, up to 300 lines
2. Network rules → Routing → «DNS routes» tab → add a rule: «Domain/List» — your list, «DNS server address» — the server you want, «Interface» — your connection, and tick «Add automatically»

By address — works on any firmware:

Network rules → Routing → «IPv4 routes» tab → «Route to host» for a single address or «Route to network» for a subnet. Fill in «Destination network address», set «Interface» to your connection and tick «Add automatically». Uploaded as a file — up to 1024 lines.

⚠️ A new route does not apply immediately — reconnect the tunnel.

The «DNS routes» tab does not exist before firmware 5.0: only address routes are available there, and they have to be updated by hand because the addresses of large services change. DNS routes also apply to the default access policy only and do not affect a policy assigned to specific devices.

If VLESS is already set up through sing-box (method 2), selective rules are easier to keep in its own configuration:

{
  "route": {
    "rules": [
      {
        "domain_suffix": [".example.com", ".example.org"],
        "outbound": "vless"
      }
    ]
  }
}

Performance

Problems and Solutions

Didn’t work? Don’t fight it for more than ten minutes — write to us via a ticket in your account or in the Telegram bot. Real people answer, and we will advise on your model and configuration. Attach a screenshot of the connection card and your KeeneticOS version — those two nearly always show the cause.

FAQ

Which Keenetic supports VPN?

All modern models. For VLESS (XKeen/sing-box), a USB port is needed (Viva and above).

Netcraze routers are the same system under a different name, and this guide covers them fully: the firmware, the web interface and the order of steps match, and both brands share one version line.

WireGuard or VLESS?

WireGuard is faster and simpler to set up, but its traffic is recognisable and unstable on some networks. VLESS is masked as ordinary HTTPS and works reliably everywhere. In practice: start with WireGuard, and move to VLESS if you run into connection problems.

XKeen or manual sing-box setup?

XKeen is the choice for most people: it installs with a couple of commands, updates itself, and the subscription is added by a link. Manual sing-box is for when you need full control over the configuration and the routing rules.

Will internet speed drop?

Yes, by 10-50% depending on protocol and router model - the reference numbers are in the performance table above. Even the entry-level models are enough for video and work.

One subscription for the router and the phone - is that possible?

Yes: a Tainet subscription works on several devices - the router covers the home, and the same link in Happ on your phone works outside it.

Summary

Keenetic is an excellent choice for VPN on router. WireGuard is easy to set up, VLESS via XKeen takes 15 minutes and gives maximum stability, and sing-box by hand gives full control. Choose based on your needs.