VPN on your router — whole home behind VPN

Requirements: KeeneticOS 3.x+ · Built-in OpenVPN client («Other connections»)

Setup

1. In your openvpn.pro cabinet download the «Router — Keenetic» config (login/password already embedded).
2. Router web UI → Internet → Other connections → Add connection → type OpenVPN.
3. Paste the .ovpn file contents into the configuration field, save.
4. Enable the new connection (toggle).
5. Connection priorities → move OpenVPN to the top so all traffic goes through the VPN.

💡 To route only some devices — use Keenetic access policies instead of raising the priority.

Requirements: ASUSWRT or ASUSWRT-Merlin firmware · VPN → VPN Client section

Setup

1. Download the «Router — ASUS / Merlin» config from the cabinet.
2. Web UI → VPN → VPN Client → «Add profile» → OpenVPN tab.
3. «Import .ovpn file» → pick the downloaded file. Login/password already embedded.
4. «Redirect Internet traffic through VPN» → Yes (whole home via VPN).
5. Click «Activate» — status turns Connected.

💡 On Merlin the «Redirect Internet traffic» field has a Policy Rules mode — route only selected devices/subnets via VPN.

Requirements: RouterOS 6.x/7.x · AES-capable CPU for acceptable speed (hAP ac² and up)

Setup

1. Download the «Router — Mikrotik» config — the file header has ready CLI commands and data (remote/login/password, ca/cert).
2. Import the certificates from the file's inline blocks (System → Certificates → Import).
3. Create the ovpn-client: /interface ovpn-client add name=openvpn-pro connect-to=<remote> user=<login> password=<pass> certificate=<cert> add-default-route=yes
4. Enable whole-home: /ip firewall nat add chain=srcnat out-interface=openvpn-pro action=masquerade
5. Verify: /interface ovpn-client monitor openvpn-pro — status should be connected.

💡 RouterOS 6.x supports OpenVPN-TCP only — pick an OpenVPN TCP order. RouterOS 7.x also does UDP.

Requirements: OpenWRT 21.02+ · ≥8 MB free flash for openvpn-openssl + LuCI plugin

Setup

1. Install packages: opkg update && opkg install openvpn-openssl luci-app-openvpn
2. Download the «Router — OpenWRT» config and place it at /etc/openvpn/openvpn-pro.ovpn
3. LuCI → VPN → OpenVPN → enable the profile (or from shell: /etc/init.d/openvpn enable && /etc/init.d/openvpn start).
4. Firewall: make sure the zone with the ovpn interface forwards lan→vpn with masquerade (usually the wan zone is masq — add the tun to it).
5. Verify: from a LAN device open any «what is my IP» — the address should be the server's.

💡 A weak router (single-core, no AES) yields 10–30 Mbps on OpenVPN. For gigabit you need an AES-NI CPU or switch to WireGuard.

Requirements: pfSense CE/Plus or OPNsense · x86 host with AES-NI (nearly any mini-PC)

Setup

1. Download the «Router — pfSense» config — the header has remote/port, login/password and inline CA/cert blocks.
2. VPN → OpenVPN → Clients → Add. Server host/port from the remote block; Auth = User/Pass (embedded).
3. Upload the CA and Client Certificate (System → Cert Manager) from the file's inline blocks and select them in the client.
4. Interfaces → Assignments → add the OpenVPN interface, enable it.
5. Firewall → NAT (Outbound) + Rules: send LAN traffic to the OpenVPN gateway (policy routing) for whole-home.

💡 Policy-routing lets you send only selected devices/VLANs through the VPN and the rest directly.

Requirements: Any router with an OpenVPN client · Ability to enable NAT/masquerade on the VPN interface

Setup

1. Download the «Router — other / generic» config — login/password embedded, redirect-gateway already on.
2. Import the .ovpn into your router's OpenVPN client.
3. Enable NAT/masquerade on the VPN interface so LAN devices egress through the tunnel.
4. Activate the connection and check the IP from a device on the network.

💡 Model not listed? The generic config works with any OpenVPN-compatible router.

Set it up once and the whole home is behind the VPN: Smart TVs, set-top boxes, consoles, IoT and any device without VPN support. No client needed on every gadget.

The router shares the VPN with all home devices via NAT — the server sees a single connection. The number of home devices is not limited by the plan.

OpenVPN speed is CPU-bound. Routers with hardware AES (ASUS ac/ax, MediaTek-based Keenetic, x86 pfSense) reach 100+ Mbps. Weak single-core units without AES do 10–30 Mbps.

The router config enables redirect-gateway — all traffic, including DNS, goes through the tunnel. IoT devices can't leak around the VPN.

The router reconnects automatically (the link stays up 24/7). On pfSense/OpenWRT/Mikrotik you can set a kill-switch to block egress until the tunnel is back.