WireGuard VPN on MikroTik with Your Own VPS

Для настройки **VPN on your router via your own server** and providing VPN coverage for your entire home, including TVs and gaming consoles, you'll need a VPS with at least 1 vCPU, 1 GB RAM, and a router supporting OpenWrt, Keenetic, or Mikrotik, capable of handling tunnel traffic up to 100-200 Mbps. This solution centralizes protection and geo-restriction bypassing for all devices in your home network, eliminating the need to install a VPN client on each gadget. Deploying your own VPN server on a VPS and integrating it with your home router is an advanced yet highly effective solution for ensuring security, privacy, and access to blocked resources. Unlike installing a VPN client on every device, setting up a tunnel directly on the router allows you to cover your entire home network: from smartphones and laptops to Smart TVs, gaming consoles, smart lights, and other IoT devices that often lack built-in VPN support. This provides a **whole-home VPN** without hassle, centrally managing all outgoing traffic.

Why use a VPN on your router with your own VPS? Benefits of a whole-home VPN solution

Using a VPN server deployed on your own VPS, in conjunction with your home router, solves several fundamental problems that are not addressed by the classic client-side application approach. First, it offers universality. Many devices, such as Smart TVs, Apple TV, Chromecast, gaming consoles (PlayStation, Xbox, Nintendo Switch), or some IP cameras, do not support direct VPN client installation. Setting up your **router via a VPN server** allows all these devices to automatically access the VPN tunnel as soon as they connect to your home Wi-Fi network or via Ethernet. Second, it provides convenience and centralized management. Instead of configuring and launching VPN on every laptop, phone, or tablet, you do it once on the router. All new devices connecting to your network automatically become part of the VPN tunnel. This significantly simplifies administration and reduces the likelihood of forgetting to enable VPN on any device. For those who want to delve deeper into the capabilities and advantages of their own VPN on a VPS, we recommend reading our VPN on your own VPS: a complete guide 2026, which describes all aspects of such a solution in detail.

Advantages of a Centralized VPN on Your Router

* Covers all devices: No need to install clients on every gadget. Smart TVs, consoles, IoT devices that lack built-in VPN support automatically gain access to the tunnel. * Bypass geo-restrictions: Easy access to content available only in specific regions for all devices on the network. * Enhanced security and privacy: All outgoing traffic from your home network is encrypted and obfuscated, protecting against ISP monitoring and potential attacks. * Saves device resources: A VPN client on the router does not burden the CPU and RAM of individual gadgets, which is especially relevant for low-power devices. * Flexible configuration: Ability to implement policy-based routing – sending some traffic through the VPN and some directly, based on rules, IP addresses, or domains.

Choosing the Best VPS for your VPN Server: Critical Specifications

The foundation of your router VPN is, of course, the VPS itself. The right choice of virtual server directly impacts speed, stability, and the number of concurrent connections. Key characteristics to consider include the processor (vCPU), amount of RAM, type and size of disk storage, and network port bandwidth.

For 50 concurrent users actively consuming content (streaming, gaming), 4 vCPU, 8 GB RAM, and an 80 GB NVMe disk are sufficient.

Users	vCPU	RAM	Disk	Port	Price (approx.)
1-5 (light traffic)	1	1 GB	20 GB SSD	1 Gbps	$3-5/month
5-15 (active browsing)	2	2 GB	40 GB SSD/NVMe	1 Gbps	$5-10/month
15-30 (streaming, torrents)	2-4	4 GB	60 GB NVMe	1 Gbps	$10-15/month
30-50 (intensive traffic)	4	8 GB	80 GB NVMe	1 Gbps	$15-25/month
50+ (corporate use)	6+	16+ GB	100+ GB NVMe	1-10 Gbps	From $25/month

Critical VPS Parameters for VPN

* Processor (vCPU): The more cores and higher clock speed, the faster the server will process encryption and decryption of traffic. For most home scenarios, 1-2 vCPU is sufficient, but for high speeds (hundreds of Mbps) and a large number of concurrent connections, it's better to choose 2-4 vCPU. * RAM: For WireGuard or OpenVPN, 512 MB - 1 GB RAM is enough. However, for more complex protocols like VLESS/Xray-core or when using a control panel (e.g., Hiddify), 2 GB RAM or more is recommended. * Disk (SSD/NVMe): Disk speed is not as critical for the VPN server itself as for other tasks, but NVMe SSDs will provide faster OS boot times and log handling, which can be important for debugging. A volume of 20-40 GB is usually more than sufficient. * Network Port: This is the most important parameter. Make sure your VPS has a gigabit (1 Gbps) network port. Many providers offer 10 Gbps ports, which provides a huge reserve of bandwidth. Not only the port, but also the actual throughput of the channel to the provider and the VPS provider itself, is important. For scenarios where 100 Mbps is no longer enough, consider more powerful solutions, as we discussed in detail in the article VPS or Dedicated Server for VPN: When 100 Mbps Isn't Enough. * VPS Location: Choose a VPS in a geographically close region to minimize latency (ping) or in a region from which you want to access content.

OpenWrt: Powerful VLESS and WireGuard Tunnels on Your Router

OpenWrt is an open-source operating system for routers that provides an unprecedented level of control and flexibility. It transforms an ordinary router into a powerful network gateway with the ability to install thousands of packages, including advanced VPN clients. **OpenWrt VLESS setup** and WireGuard on this platform open up vast possibilities for creating a secure and efficient network.

Installing and Basic Configuration of WireGuard Client on OpenWrt

WireGuard is a modern, fast, and secure VPN protocol that is ideal for routers due to its lightweight nature and high performance. 1. Install packages: Connect to your OpenWrt router via SSH and install the necessary packages:

opkg update
opkg install wireguard-tools luci-app-wireguard

`luci-app-wireguard` will add a convenient graphical interface to the LuCI web interface. 2. Generate keys: If you haven't already generated keys on the server, you can do so on the router:

wg genkey | tee privatekey | wg pubkey > publickey

Save `privatekey` for the router and `publickey` for the server. 3. Configure via LuCI: * Go to the LuCI web interface (usually `http://192.168.1.1`). * `Network` -> `Interfaces` -> `Add new interface...` * `Name of the new interface:` `wg0` (or any other). * `Protocol:` `WireGuard VPN`. * Click `Create interface`. * In the `General Settings` section: * `Private Key:` Paste the router's private key. * `Listen Port:` Leave empty or specify a port if the router will be the server. * `IP Addresses:` The router's IP address in the WireGuard network (e.g., `10.0.0.2/24`). * In the `Peers` section: * `Add peer` * `Public Key:` Your VPS server's public key. * `Allowed IPs:` `0.0.0.0/0` (to route all traffic through VPN) or specific subnets. * `Endpoint Host:` Your VPS's IP address or domain name. * `Endpoint Port:` WireGuard port on the VPS (usually `51820`). * `Persistent Keepalive:` `25` (recommended for NAT stability). * Click `Save` and `Save & Apply`. 4. Firewall Configuration: * `Network` -> `Firewall` -> `Zones`. * Create a new zone for `wg0` or add `wg0` to the existing `wan` zone (if you want the VPN to act as WAN). * If creating a new `vpn` zone: * `Input:` `Accept` * `Output:` `Accept` * `Forward:` `Accept` * `Masquerading:` Enable * `Covered networks:` `wg0` * Allow forwarding from `lan` to `vpn` and from `vpn` to `wan` (if VPN is used for internet access).

Configuring VLESS Client on OpenWrt with Xray-core

VLESS with Reality or XTLS/Vision is an advanced protocol that provides high performance and resistance to blocking. Setting it up on OpenWrt requires installing `xray-core`. A detailed guide on deploying VLESS Reality on a VPS can be found in our article Your Own VPN on VPS: VLESS Reality + Xray-core in 10 Minutes. 1. Install Xray-core:

opkg update
opkg install xray-core

You may need to compile packages yourself or use unofficial repositories, as `xray-core` is not always available in standard OpenWrt repositories for all architectures. 2. Xray-core Configuration: Create a configuration file for the Xray client on the router, for example, `/etc/xray/config.json`.

{
  "inbounds": [
    {
      "port": 1080,
      "listen": "0.0.0.0",
      "protocol": "socks",
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls"]
      },
      "settings": {
        "auth": "noauth",
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "ВАШ_IP_VPS",
            "port": ВАШ_ПОРТ_VLESS,
            "users": [
              {
                "id": "ВАШ_UUID",
                "encryption": "none",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "fingerprint": "chrome",
          "dest": "Яндекс.ru:443",
          "publicKey": "ВАШ_ПУБЛИЧНЫЙ_КЛЮЧ_REALITY",
          "shortId": "ВАШ_SHORT_ID"
        }
      }
    },
    {
      "protocol": "freedom",
      "tag": "direct",
      "settings": {}
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "ip": ["geoip:private"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "outboundTag": "proxy"
      }
    ]
  }
}

Replace `ВАШ_IP_VPS`, `ВАШ_ПОРТ_VLESS`, `ВАШ_UUID`, `ВАШ_ПУБЛИЧНЫЙ_КЛЮЧ_REALITY`, `ВАШ_SHORT_ID` with your server's data. 3. Start Xray-core:

/etc/init.d/xray enable
/etc/init.d/xray start

4. Traffic Routing: Configure the router to direct traffic through the SOCKS5 proxy provided by Xray-core (port 1080 in the example). This can be done using `redsocks2` or `Dante` on OpenWrt. For more in-depth configuration of complex protocols like VLESS Reality and creating a universal server, we recommend reading the article sing-box on VPS: a universal server for VLESS, Reality, and Hysteria.

Keenetic: Simple VPN Client for Your Home Network with a VPS

Keenetic routers are known for their ease of setup and powerful built-in capabilities. They offer an intuitive web interface and support popular VPN protocols, making them an excellent choice for those who want to set up a **Keenetic VPN client on a VPS** without deep knowledge of the Linux console. Keenetic supports WireGuard, OpenVPN, L2TP/IPSec, and PPTP as clients.

Configuring WireGuard Client on Keenetic

WireGuard configuration on Keenetic is done entirely through the graphical web interface. 1. Firmware Update: Ensure your Keenetic has the latest firmware version, as WireGuard support was added relatively recently. 2. Install WireGuard Component: * Access the Keenetic web interface (usually `my.keenetic.net` or `192.168.1.1`). * Go to `System settings` -> `General settings` -> `Change component set`. * Find and install the `WireGuard VPN` component. * Apply changes and wait for the router to reboot. 3. Create WireGuard Connection: * After rebooting, go to `Internet` -> `VPN client`. * Click `Add connection` -> `WireGuard`. * Fill in the fields: * `Description:` Name of your VPN connection (e.g., `Valebyte_VPN`). * `Private key:` Paste the router's private key, generated earlier (or generate it directly in Keenetic). * `IP address:` The router's IP address in the WireGuard network (e.g., `10.0.0.2/24`). * `Server parameters (Peer):` * `Public key:` Your VPS server's public key. * `Allowed IP addresses:` `0.0.0.0/0` (for all traffic) or specific subnets. * `Server address:` Your VPS's IP address or domain name. * `Port:` WireGuard port on the VPS (usually `51820`). * `Persistent Keepalive:` `25` seconds. * Save settings. 4. Routing Configuration: * By default, Keenetic can automatically route all traffic through the VPN if it is the only active WAN connection. * For selective routing, go to `Internet` -> `Access policies`. Here you can configure which traffic (by device IP address, MAC address, or traffic type) will go through the VPN and which will go directly. Keenetic offers a convenient way to get a whole-home VPN, but its functionality for advanced protocols like VLESS is limited. For those, OpenWrt or Mikrotik are better suited.

Mikrotik: Flexible and High-Performance WireGuard VPN with a VPS for Advanced Users

Mikrotik RouterOS is a powerful and flexible operating system for network equipment, providing extensive capabilities for routing, firewall, and VPN. Mikrotik routers are often chosen by advanced users and network administrators for their functionality and performance. Setting up **Mikrotik WireGuard VPS** allows you to create a high-performance and customizable VPN tunnel.

Installing and Configuring WireGuard Client on Mikrotik RouterOS

WireGuard configuration on Mikrotik is done via WinBox or the SSH terminal. 1. RouterOS Update: Ensure RouterOS is updated to version 6.45 or newer, as WireGuard was introduced in that version. 2. Install WireGuard Package: * If the `wireguard` package is not installed, download it from the official Mikrotik website for your architecture and upload it via WinBox (`Files`) or SCP. * Drag the file to `Files` and reboot the router. 3. WireGuard Interface Configuration:

/interface wireguard
add name=wg0 listen-port=13231 private-key="[ВАШ_ПРИВАТНЫЙ_КЛЮЧ_РОУТЕРА]"
/ip address
add address=10.0.0.2/24 interface=wg0
/interface wireguard peers
add interface=wg0 public-key="[ВАШ_ПУБЛИЧНЫЙ_КЛЮЧ_VPS]" endpoint="ВАШ_IP_VPS:51820" allowed-address=0.0.0.0/0 persistent-keepalive=25

Replace `[ВАШ_ПРИВАТНЫЙ_КЛЮЧ_РОУТЕРА]`, `[ВАШ_ПУБЛИЧНЫЙ_КЛЮЧ_VPS]`, `ВАШ_IP_VPS` with the corresponding values. `listen-port` is usually not needed for a client but can be specified. 4. Routing and NAT Configuration: * Add a default route through the WireGuard interface so all traffic goes through the VPN. Make sure you have a rule that excludes the route to the VPS itself to avoid a loop.

/ip route
add dst-address=0.0.0.0/0 gateway=wg0 distance=1 check-gateway=ping
# Rule to exclude the route to the VPS from the VPN tunnel (important!)
add dst-address=ВАШ_IP_VPS/32 gateway=ВАШ_ШЛЮЗ_ПРОВАЙДЕРА distance=0

* Configure NAT for outgoing traffic:

/ip firewall nat
add chain=srcnat action=masquerade out-interface=wg0

5. Firewall Configuration: * Ensure firewall rules allow outgoing connections from the WireGuard port and traffic forwarding through `wg0`. * Pay special attention to `forward` and `input` chain rules to allow traffic from `lan` to pass through `wg0`. Mikrotik also allows for WireGuard obfuscation using third-party solutions, such as AmneziaWG, to improve resistance to DPI. You can learn more about this in the article AmneziaWG on VPS: WireGuard Obfuscation Against DPI in 2026.

Router Hardware Requirements for VPN: Where Will Your CPU Bottleneck?

The performance of a VPN tunnel on a router is primarily determined by the power of its central processing unit (CPU). Encrypting and decrypting traffic are resource-intensive operations, and even the fastest internet connection will be useless if the router's CPU cannot process traffic at high speeds.

CPU — The Primary Bottleneck for VPN

* Low-performance routers (1-2 cores, up to 800 MHz): Devices like TP-Link TL-WR841N, Xiaomi Mi Router 3C, or older Keenetic Lite models can provide VPN speeds of up to 10-30 Mbps for WireGuard and 5-15 Mbps for OpenVPN. They are suitable for basic browsing and occasional SD-quality video streaming. * Mid-range routers (2-4 cores, 800 MHz - 1.5 GHz): Most modern mid-range routers (e.g., Keenetic Speedster, Mikrotik hAP ac3, TP-Link Archer C6/C7 with OpenWrt) are capable of handling WireGuard at speeds of 50-200 Mbps. OpenVPN will run at 20-50 Mbps. This is sufficient for most home scenarios, including 4K streaming on one or two devices. * High-performance routers (4+ cores, 1.5+ GHz): Powerful routers (e.g., Mikrotik RB5009UG+S+IN, Netgear Nighthawk, ASUS ROG Rapture with OpenWrt, or high-performance Keenetic models) can achieve 300-800 Mbps for WireGuard and 100-200 Mbps for OpenVPN. These devices are suitable for high-speed internet connections (500+ Mbps) and a large number of active users.

For comfortable VPN usage on a router with a 200-300 Mbps connection, you'll need a CPU with at least 1 GHz frequency and hardware acceleration, or a 4-core 1.5+ GHz processor without hardware acceleration.

Router CPU (approx.)	Protocol	Expected VPN Speed (Mbps)	Router Examples
Single-core 600-800 MHz	WireGuard	10-30	Keenetic Start, Xiaomi Mi Router 3C
Single-core 600-800 MHz	OpenVPN	5-15	TP-Link TL-WR841N (OpenWrt)
Dual-core 800 MHz - 1 GHz	WireGuard	50-100	Keenetic Viva, Mikrotik hAP ac2
Dual-core 800 MHz - 1 GHz	OpenVPN	20-30	TP-Link Archer C6/C7 (OpenWrt)
Quad-core 1 GHz - 1.5 GHz	WireGuard	100-300	Keenetic Speedster, Mikrotik hAP ac3
Quad-core 1 GHz - 1.5 GHz	OpenVPN	30-80	ASUS RT-AC86U (OpenWrt)
Quad-core 1.5+ GHz (with/without HW offload)	WireGuard	300-800	Mikrotik RB5009UG+S+IN, Netgear Nighthawk (OpenWrt)
Quad-core 1.5+ GHz (with/without HW offload)	OpenVPN	80-200	High-performance Keenetic, ASUS ROG Rapture (OpenWrt)

* Hardware Offloading: Some routers have hardware modules to accelerate cryptographic operations (e.g., AES-NI). This significantly reduces CPU load and allows for higher VPN speeds. Before purchasing a router for VPN, it's worth checking if its processor supports hardware acceleration. * RAM and Flash: OpenWrt requires sufficient RAM (minimum 128 MB for basic installation, 256 MB+ for VLESS/Xray and other packages) and Flash memory (16 MB+). Keenetic and Mikrotik have their own OS, and their memory requirements are usually already optimized by the manufacturer.

Selective Routing: How to Route Some Traffic Through Your VPS VPN and Some Directly

Selective routing, or Policy-Based Routing (PBR), allows you to flexibly manage which traffic from your home network goes through the VPN and which goes directly through your ISP. This is especially useful for optimizing speed (e.g., for local resources or streaming services that block VPNs) and saving traffic on your VPS.

Examples of Selective Routing Configuration on OpenWrt and Mikrotik

OpenWrt: Selective Routing

On OpenWrt, PBR is implemented via firewall rules and ip-tables (ip rules / ip route). 1. Create a new routing table:

ip rule add fwmark 1 table 100
ip route add default via 10.0.0.1 dev wg0 table 100 # VPN server's IP address in the tunnel

2. Marking traffic via Firewall (iptables): For example, to route traffic from a specific IP address (e.g., 192.168.1.100) through the VPN:

iptables -t mangle -A PREROUTING -s 192.168.1.100 -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -s 192.168.1.100 -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT

Or for traffic going to a specific domain (requires DNSmasq with ipset):

# Add to /etc/dnsmasq.conf
# ipset=/example.com/vpn_bypass_domains
# ipset=/another.net/vpn_bypass_domains

# In iptables
iptables -t mangle -A PREROUTING -m set --match-set vpn_bypass_domains dst -j MARK --set-mark 2
# Then create a rule for mark 2 to go directly, not through the VPN

For persistence, these rules need to be added to `/etc/firewall.user`.

Mikrotik: Selective Routing

On Mikrotik, PBR is implemented using `routing marks` and `routing rules`. 1. Create a new routing table:

/ip route
add dst-address=0.0.0.0/0 gateway=wg0 routing-mark=vpn_mark distance=1 check-gateway=ping

2. Marking traffic via Firewall (Mangle): For example, to route traffic from IP address `192.168.88.100` through the VPN:

/ip firewall mangle
add chain=prerouting src-address=192.168.88.100 action=mark-routing new-routing-mark=vpn_mark passthrough=no

To make traffic going to a specific IP address (e.g., a streaming service IP) bypass the VPN:

/ip firewall mangle
add chain=prerouting dst-address=1.2.3.4 action=mark-routing new-routing-mark=no_vpn_mark passthrough=no

And then create a route for `no_vpn_mark` through the main ISP gateway.

/ip route
add dst-address=0.0.0.0/0 gateway=ВАШ_ШЛЮЗ_ПРОВАЙДЕРА routing-mark=no_vpn_mark distance=1 check-gateway=ping

It's important to remember that the order of rules in `mangle` matters. Rules that mark traffic should be above rules that might intercept that traffic earlier.

Frequently Asked Questions

Which VPN protocols are best suited for a router?

For a router, WireGuard and OpenVPN are the optimal protocols. WireGuard stands out for its speed, lightweight nature, and ease of setup, making it ideal for routers with limited CPU resources, providing up to 200-300 Mbps on mid-range devices. OpenVPN is more versatile but more CPU-intensive, achieving 20-80 Mbps. For advanced scenarios and DPI circumvention, VLESS with Reality/XTLS on OpenWrt offers excellent stealth and performance.

Which router should I choose for a VPN server on a VPS?

The choice of router depends on your desired speed and budget. For speeds up to 100 Mbps, a Keenetic Speedster or Mikrotik hAP ac2/ac3 (priced from $50 to $100) will suffice. If you need OpenWrt, look for devices with MediaTek MT7621 or Qualcomm IPQ40xx/IPQ80xx chipsets with 512 MB RAM. For speeds of 200-500 Mbps and higher, consider the Mikrotik RB5009UG+S+IN or more powerful Keenetic models, as well as routers with hardware cryptography acceleration (AES-NI) and 4-core 1.5+ GHz processors.

Can I use a VPN on my router to bypass streaming service blocks?

Yes, a VPN on your router is ideal for bypassing geo-restrictions of streaming services (Netflix, Hulu, Disney+, etc.) for all devices on your network, including Smart TVs and gaming consoles. However, some services actively block known VPN provider IP addresses. Using your own VPS with a unique IP and setting up selective routing (so only streaming traffic goes through the VPN) can help circumvent such blocks.

How much traffic will a VPN on my router consume?

The amount of traffic consumed by a VPN on your router directly depends on the activity of all devices in your home network. If you have multiple devices actively streaming 4K video, playing online games, and downloading files, you can easily use anywhere from 500 GB to several TB of traffic per month. Ensure your VPS plan includes sufficient traffic volume or offers unlimited traffic to avoid additional costs.

How do I check if the VPN on my router is working?

You can check if the VPN on your router is working in several ways. The simplest is to open a website like `whatismyip.com` or `2ip.ru` in a browser on any device connected to your home network. If the displayed IP address matches the IP address of your VPS server, then the VPN is working correctly. You can also check the routes on the router (e.g., `ip route show` in OpenWrt or `/ip route print` in Mikrotik) and the VPN client logs for connection errors.

Conclusion

Setting up a VPN on your router via your own VPS is a powerful and flexible solution that provides protection and accessibility for all devices in your home network. The choice between OpenWrt, Keenetic, and Mikrotik depends on your technical skills and desired level of control, but each is capable of providing a **whole-home VPN**. For optimal performance and stability, it is recommended to choose a VPS with 2-4 vCPU and 4+ GB RAM, as well as a router with a powerful processor (1 GHz or higher) and hardware acceleration, capable of handling WireGuard at speeds up to 200-300 Mbps.