Published June 7, 2026
VPN on a Keenetic Router: WireGuard and AmneziaWG Setup
Step-by-step VPN setup on a Keenetic router: import the Fiery config, run WireGuard and AmneziaWG in KeeneticOS, and route specific devices with connection policies.
To set up a VPN on a Keenetic router, install the WireGuard system component in KeeneticOS, import your provider's configuration file (.conf) on the WireGuard page, and move that connection to the top of your priorities. From then on your entire home network goes through the VPN with no app needed on each device. Keenetic runs native WireGuard out of the box, and since KeeneticOS 4.2 it also understands obfuscated AmneziaWG.
In short: the WireGuard component is built into KeeneticOS. Import the .conf, set the connection first in Connection Priorities, and the whole home is covered. With connection policies you can send only selected devices through the tunnel. To bypass the 2026 blocks, use an AmneziaWG config: Keenetic brings it up as ordinary WireGuard but with traffic masking.
Why a router instead of an app on every device
A VPN on the router covers your whole home network at once: TVs, set-top boxes, smart speakers, consoles, laptops and phones. Devices that can't run a VPN app (smart TVs, game consoles, IoT) still send traffic through the secure tunnel. Configure once, and it works for everyone.
Keenetic is especially convenient here: WireGuard support is built into the firmware, so no custom builds are required. That is exactly Fiery's advantage β our WireGuard config works on Keenetic, MikroTik and OpenWRT with stock tools. We cover the broader approach in our router guide.
What you'll need
- A Keenetic router on a current KeeneticOS (WireGuard since 3.3, AmneziaWG since 4.2 and later).
- Access to the router web interface: my.keenetic.net or its IP (usually 192.168.1.1).
- A .conf configuration file from Fiery β exported in the Telegram bot @fiery_VPN_bot or the mini-app.
Where to get the Fiery config
Open @fiery_VPN_bot, choose the device type "Router / Keenetic" and a protocol. Pick WireGuard for stock performance, or AmneziaWG (AWG 2.0) to bypass blocks. The bot returns a .conf file β download it to the computer you use to access the router web interface.
Step 1. Update KeeneticOS and install the WireGuard component
- Log in to the router web interface.
- Open "General settings" β "Updates and component options".
- First update to the latest KeeneticOS (AmneziaWG needs 4.2 or later; automatic import of masking parameters needs 4.3.4 or later).
- In "Change set of components", find and install the WireGuard VPN component if it isn't already there. The router will reboot.
Step 2. Import the configuration (WireGuard or AmneziaWG)
- Go to "Internet" β "Other connections".
- In the WireGuard block, click "Add connection".
- Click "Import from a file" and select the .conf you downloaded from Fiery.
- Keenetic fills in the interface address, keys, endpoint and allowed IPs automatically. Save the connection.
An AmneziaWG config is imported the same way β Keenetic brings it up as a WireGuard interface. On KeeneticOS 4.3.4 and newer the obfuscation parameters (Jc, Jmin, Jmax, S1, S2 and so on) are read from the file automatically; on earlier versions you may need to enter them manually in the interface's advanced settings. For the difference between the protocols, see AmneziaWG vs WireGuard.
Step 3. Make the VPN your main connection
- Open "Internet" β "Connection Priorities".
- Drag the new WireGuard connection to the very top of the list β it becomes the primary connection.
- Save. All home traffic now flows through the VPN.
Verify it: on any device open an IP-check site β it should show the country and address of the VPN server, not your ISP.
Step 4. Connection policies: choose which devices use the VPN
You often don't need the whole home on the VPN: a TV with local services and your online bank are easier to keep on the direct line, while a phone and laptop go through the tunnel. Keenetic handles this with connection policies.
- Open "Internet" β "Connection Priorities" and create a new policy, e.g. "Via VPN".
- In that policy, move the Fiery WireGuard connection to the top and enable it. In the "Default Policy", keep this same connection at the bottom so unassigned devices go direct.
- Go to the device list ("My Networks and Wi-Fi"), select a device, and assign it the "Via VPN" policy.
This way your phone and work laptop use Fiery while the smart TV and console stay direct. It reduces load on the tunnel and avoids friction with regional services.
A separate Wi-Fi for the VPN (optional)
A handy trick is to create a separate guest or additional Wi-Fi network and assign it the "Via VPN" policy. Then simply connecting a device to that SSID routes it through the tunnel automatically, with no per-device assignment.
Protocol comparison on Keenetic
| Aspect | WireGuard | AmneziaWG (AWG 2.0) | VLESS Reality |
|---|---|---|---|
| Native KeeneticOS support | Yes (since 3.3) | Yes, imported as WireGuard (since 4.2) | No (needs a proxy / extra software) |
| Speed | Very high | High (small overhead) | High |
| Resilience to 2026 blocks | Medium β filtered in places | High β traffic is masked | High |
| Setup complexity on the router | Minimal | Minimal | High |
| When to choose | Max speed where not blocked | Best when WireGuard is throttled | Alternative for single devices |
For a full comparison with all the nuances, see VPN protocols compared.
What to do if WireGuard stops working on the router
In May 2026 Roskomnadzor moved to ASN- and subnet-level blocking, and in some regions plain WireGuard and VLESS became unstable. If the tunnel comes up but there's no internet, or speed drops to zero, that's a classic sign of protocol filtering.
The fix on Keenetic is simple: grab an AmneziaWG config in @fiery_VPN_bot and import it the same way. From the outside that traffic doesn't look like a VPN, which is why AmneziaWG is the most reliable option right now. For the reasons behind the outages, read why VPN is blocked in Russia.
FAQ
Does Keenetic support AmneziaWG?
Yes. Since KeeneticOS 4.2 the router imports an AmneziaWG config as a regular WireGuard interface. On 4.3.4 and newer the masking parameters are read from the file automatically β no separate package required.
Do I need a VPN app on every device?
No. That's the point of a router VPN: configure once and the whole home network goes through the tunnel. With connection policies you choose which devices use the VPN and which stay on the direct line.
Will speed drop?
WireGuard loses almost no speed and runs well even on entry-level Keenetic models. AmneziaWG has a small overhead due to masking, but on modern routers the difference is unnoticeable for streaming and video calls. Your final speed also depends on the router model and your ISP plan.
Can I run two tunnels at home at once?
Yes. You can import several WireGuard/AmneziaWG connections and assign them to different devices or Wi-Fi networks via connection policies. For example, the laptop via one server and the media box direct.
How do I confirm the VPN is actually working?
From a device on the VPN network, open an IP-check site. It should show the country and IP of the Fiery server, not your ISP. If it shows your own address, check the order in Connection Priorities and the policy assigned to that device.
Set up Fiery on Keenetic
Get a router config in a couple of minutes: open the mini-app vpn.fiery.host or the Telegram bot @fiery_VPN_bot, choose "Router / Keenetic" and a protocol (WireGuard for speed or AmneziaWG to bypass blocks), download the .conf and import it with the steps above. Pay by MIR card, SBP or crypto, no logs β and cover your whole home with a single tunnel.