Skip to contentWireGuard on MikroTik, OpenWrt and Keenetic routers
Putting the VPN on your router protects every device on the network at once — including ones that cannot run a VPN app. Here is how to add a WireGuard peer on the three most common prosumer router platforms.
Why put the VPN on the router
Running WireGuard on your router instead of on each device tunnels the whole network through one exit. Every phone, laptop, TV and IoT gadget behind it inherits the VPN without any per-device app — which is the only way to cover devices that cannot run VPN software at all. It also means the tunnel is always on for the LAN, with no one forgetting to connect. The trade-off is that router config is lower-level than a desktop app, and the concepts (peers, AllowedIPs, routing) matter more.
All three platforms below act as a WireGuard client (peer) connecting to a server — either the managed s4m VPN or your own WireGuard VPS. You will need the server's public key, endpoint and the address it assigns you.
Add a WireGuard peer per platform
The core commands. On each platform you create a WG interface, set your private key and address, then add the server as a peer with AllowedIPs = 0.0.0.0/0 for a full tunnel.
# ===== MikroTik (RouterOS 7+) =====
/interface/wireguard/add name=wg-s4m listen-port=51820
# set the auto-generated private key aside; add the server as peer:
/interface/wireguard/peers/add interface=wg-s4m \
public-key="SERVER_PUBKEY" endpoint-address=VPN_HOST \
endpoint-port=51820 allowed-address=0.0.0.0/0 \
persistent-keepalive=25s
/ip/address/add address=10.8.0.2/24 interface=wg-s4m
# route LAN out via the tunnel + NAT (masquerade) on wg-s4m
/ip/firewall/nat/add chain=srcnat out-interface=wg-s4m action=masquerade
# ===== OpenWrt (LuCI or CLI) =====
opkg update && opkg install wireguard-tools luci-proto-wireguard
# In LuCI: Network > Interfaces > Add > protocol WireGuard, then set
# private key, address 10.8.0.2/24, and a peer with:
# public key SERVER_PUBKEY, endpoint VPN_HOST:51820,
# Allowed IPs 0.0.0.0/0, "Route Allowed IPs" checked.
# Add the new iface to the 'wan' firewall zone so LAN is NATed out.
# ===== Keenetic =====
# Web UI: Other connections > VPN connections > Add WireGuard.
# Import a .conf, or enter private key, address 10.8.0.2/24, DNS,
# and peer: public key, endpoint VPN_HOST:51820, allowed 0.0.0.0/0.
# Then in "Priorities of connections" set the WG tunnel as the route
# for the devices/policies you want tunnelled.Routing, MTU and honest scope
Two things decide whether it works. AllowedIPs on the peer is the routing rule: 0.0.0.0/0 sends all traffic through the tunnel (full network VPN); a narrower list is split tunneling, useful if you want only some devices or destinations routed. And the router must NAT/masquerade LAN traffic onto the WireGuard interface, or packets go out but replies never return. If speeds are poor or some sites hang, lower the MTU — routers often need ~1420 or less; see WireGuard MTU.
Keenetic in particular has a large user base in the RU/UA region and a friendly UI for this, while MikroTik and OpenWrt give you the most control. Whichever you use, point it at the s4m managed VPN (no-logs, RAM-first) for a maintained exit, or your own VPS if you prefer to run the server. A dedicated IP is available when you want the router's exit to be a stable private address rather than a shared one.
Questions, answered
Why route the VPN through my router instead of each device?
A router-level tunnel covers every device on the LAN at once — including smart TVs and IoT gadgets that cannot run a VPN app — and is always on. The trade-off is lower-level configuration involving peers, AllowedIPs and NAT rather than a one-tap app.
My router tunnel connects but devices have no internet — why?
Two usual causes: the router is not masquerading (NAT) LAN traffic onto the WireGuard interface, so replies never return; or the MTU is too high and large packets hang. Add a masquerade rule on the WG interface and try lowering MTU to around 1420.
One tunnel for the whole network
Point your MikroTik, OpenWrt or Keenetic router at the no-logs s4m WireGuard VPN and cover every device at once — with a dedicated IP option for a stable private exit.
People found this page by searching for
- WireGuard on MikroTik, OpenWrt and keenetic routers
- proxy for scraping settings
- proxy for scraping provider
- IP reputation and fraud scores explained
- openvpn settings
- using HTTP_PROXY / HTTPS_PROXY environment variables
- bypassing DPI
- socks5 proxy
- free proxy list
- how to set up openvpn
- what is a reverse proxy
- proxy authentication
- how to check socks5 proxy
- how proxy authentication works
Real search phrases this page answers — the linked ones open the page that covers them in depth.