Published May 22, 2026
VPN on a Router in 2026: WireGuard and AmneziaWG for the Whole Home
How to set up a VPN directly on your router (Keenetic, MikroTik, OpenWRT, ASUS) to cover every device at home at once. Why router-native WireGuard is a key advantage, how policy routing works, and the status of AmneziaWG on routers in 2026.
A VPN on a router means the tunnel runs on the router itself instead of on each device separately. As a result, every gadget in your home goes through the VPN automatically: phones, laptops, TVs, consoles, smart speakers — even devices that can't run a VPN app at all. In 2026 the most convenient and stable approach is firmware-native WireGuard on Keenetic, MikroTik, OpenWRT and ASUS routers, and where plain WireGuard stops getting through blocks, obfuscated AmneziaWG.
In short: install WireGuard right on the router and the whole home is under VPN with no per-device setup. On Keenetic and ASUS this takes a couple of minutes via the web interface; on MikroTik and OpenWRT it's a bit harder but far more flexible. With policy routing you can send only chosen devices through the VPN and keep the rest direct. If your ISP throttles plain WireGuard, switch to AmneziaWG — on routers it's mainly available on OpenWRT and some Keenetic models today, while on other devices AWG runs on a separate box.
Why put a VPN on the router at all
The main reason is whole-home coverage in one move. You don't install and update an app on a dozen devices — you configure the router once and everything just works. This is especially valuable for devices that have no VPN client: smart TVs, game consoles, IoT gear, media players, and TVs with geo-blocked streaming services.
The second benefit is stability. A tunnel on the router stays up permanently, never drops when your phone screen locks, survives reboots and runs 24/7. The third is flexibility: on a capable firmware you decide which traffic goes through the VPN and which stays direct. This is exactly what the Fiery architecture enables.
RU-direct: why it matters on a router
Fiery uses a split-routing approach: you connect to a Moscow hub on a Russian IP, Russian sites and services go direct (banks, government portals and marketplaces work without lag), and only foreign traffic is forwarded to an overseas exit node. On a router this is doubly convenient: the whole home gets access to blocked foreign resources, yet banking apps on phones and online payment terminals keep working, and latency to Russian services stays low.
WireGuard on a router — why it's a Fiery advantage
WireGuard is built into the firmware of most modern routers and works out of the box. That means no third-party apps, hacks or port forwards — you simply load a config or enter the peer parameters in the web interface. Fiery issues a ready WireGuard config that works on both a router and a phone, so setup takes minutes.
WireGuard runs at the kernel level, so it's very fast and light on resources — even a budget router handles it without a noticeable speed drop. That's the key reason router-native WireGuard became Fiery's baseline scenario: one protocol, one config, any device in the home.
What is policy routing (selective routing)
Policy routing is a set of rules that decide which traffic goes into the VPN tunnel and which goes direct through your ISP. On a router this gives powerful control:
- By device: for example, the TV and your work laptop go via VPN, while a family phone and a smart speaker stay direct.
- By site or subnet: only foreign addresses enter the tunnel, Russian ones stay direct — that's RU-direct, and Fiery applies this split automatically on the server side.
- By interface: on Keenetic you can bind a whole connection profile to the VPN and assign devices to it in a couple of clicks.
Thanks to this, the whole home doesn't have to sit under the VPN entirely — you decide precisely who needs it and lose no speed where it isn't required.
Routers: which to choose and how hard it is
Below is a comparison of popular router families by WireGuard support, AmneziaWG support and setup difficulty. Treat it as a guide — exact capabilities depend on the model and firmware version.
| Router family | WireGuard | AmneziaWG | Difficulty |
|---|---|---|---|
| Keenetic | Built-in, via web UI | Partial (entware/repo, not all models) | Low |
| ASUS (Merlin/stock) | Built-in on many models | Not natively | Low–medium |
| MikroTik (RouterOS 7) | Built-in, via config | Not natively | Medium–high |
| OpenWRT | Via package (luci-proto-wireguard) | Yes, amneziawg package | Medium |
| ISP-supplied stock routers | Usually none | None | — |
Keenetic
The friendliest option for a beginner. WireGuard is configured through the web panel: create a connection, paste the data from your Fiery config, add a routing rule — done. Keenetic has handy access profiles that make it easy to assign which devices go through the VPN. We cover the details in our dedicated guide on router VPN and in the Keenetic walkthrough.
MikroTik
A powerful option for those who aren't afraid of the console. RouterOS 7 has built-in WireGuard, and MikroTik's firewall and routing flexibility is practically unlimited — you can build any policy-routing logic. The learning curve is steeper, so we broke the setup down step by step in a dedicated MikroTik guide.
OpenWRT
An open firmware you can flash onto hundreds of models. It offers both WireGuard (via a package) and, importantly in 2026, AmneziaWG as a separate package. If your hardware is supported by OpenWRT, this is currently the best path to obfuscated VPN at the whole-home level.
ASUS
Many ASUS models, especially with Asuswrt-Merlin firmware, have a built-in WireGuard client with a convenient interface and per-device selective routing. There's no native AmneziaWG, so if plain WireGuard gets blocked the path is the same as for other non-AWG models (see below).
AmneziaWG on a router: status in 2026
In May 2026 Roskomnadzor escalated to ASN- and subnet-level blocking and disrupted plain WireGuard and VLESS in places. AmneziaWG is an obfuscated version of WireGuard that disguises the traffic and stays resilient to such blocking, which makes it the most reliable choice right now. For the difference, see AmneziaWG vs WireGuard.
On routers, AWG support is still uneven:
- OpenWRT — there's a full AmneziaWG package; this is the most workable "AWG for the whole home" option.
- Keenetic — AWG is available on some models via third-party repositories/entware; there's no native button in the web panel yet.
- MikroTik and ASUS — no native AmneziaWG support.
If you can't run AWG on your router, there's a proven workaround: keep plain WireGuard on the router (while it still works with your ISP) and use AmneziaWG via the AmneziaVPN app on critical devices. Alternatively, add a separate box (a mini-PC, Raspberry Pi, or a second OpenWRT router) as an "AWG gateway" and route the needed traffic through it. To pick the right protocol for your situation, see how to choose a VPN in 2026.
FAQ
Do I still need a VPN on each device if it's on the router?
No. That's the point: a VPN on the router covers every device on the home network at once. Separate apps are only needed in two cases — if you want the VPN away from home (on mobile data), or if your router can't run AmneziaWG and you specifically need obfuscation on a particular device.
Will a VPN on the router slow down the internet for the whole home?
WireGuard is very lightweight, so on a modern router the drop is minimal. Speed is mainly limited by the router's CPU and the link to the exit node. Budget models may hit a ceiling on gigabit plans, but for most use (streaming, gaming, work) there's plenty of headroom.
Can I route only some devices through the VPN?
Yes — that's what policy routing is for. On Keenetic it's access profiles, on MikroTik it's firewall and routing rules, on OpenWRT and ASUS it's per-device/subnet binding. You can send, say, only the smart TV into the tunnel and leave everything else direct.
Will banking apps work with a VPN on the home router?
With the Fiery architecture, yes. Russian traffic goes direct through a Moscow hub on a Russian IP, so banks, government portals and marketplaces don't see a "foreign" connection and work normally. Only foreign traffic leaves through the overseas node.
What if my ISP blocked WireGuard on the router?
First check whether switching the exit node or port helps. If the block is at the protocol level (DPI), move to AmneziaWG: as a native package on OpenWRT, or via an app on the device / a separate AWG gateway on other routers. For more on DPI, see when your ISP throttles VPN and DPI.
Bottom line
A VPN on the router is the most convenient way to protect the whole home at once: one tunnel, any number of devices, including those that can't run an app. WireGuard built into Keenetic, ASUS, MikroTik and OpenWRT firmware makes setup fast, and policy routing gives precise control over who goes where. Under the 2026 blocking landscape, keep AmneziaWG in mind: on OpenWRT it's available home-wide, and on other routers via separate devices or apps.
Fiery issues a ready WireGuard config for your router and supports AmneziaWG (AWG 2.0) and VLESS Reality, while RU-direct routing keeps banks working and latency low. Get a subscription and your config at vpn.fiery.host or right inside Telegram — @fiery_VPN_bot.