In short: A VPN on an ASUS router is configured natively through VPN Fusion: Advanced Settings → VPN → VPN Fusion → Add profile → Upload Config → assign devices → enable. Supports WireGuard (firmware later than 3.0.0.4.388.23000) and OpenVPN. A single tunnel encrypts traffic from your entire home network — including Smart TVs, game consoles, and IoT devices that have no VPN apps of their own.
Why set up a VPN on an ASUS router
A router-level VPN encrypts traffic from every device on your home network at once — no separate app needed on each device. Set up the tunnel once and every smartphone, laptop, Smart TV, game console, and smart gadget is automatically protected. This is especially important for devices that can't run a VPN app at all: IoT gadgets, Tizen/webOS smart TVs, game consoles. For a deeper look at why network-wide protection matters: how to protect your home network with a VPN.
ASUS routers stand out from the competition with native support for multiple simultaneous VPN tunnels and per-device routing. For comparison, see the equivalent guides for other brands: TP-Link, Keenetic, Huawei.
What is VPN Fusion and why ASUS stands out
VPN Fusion is ASUS's proprietary feature that lets you run multiple VPN tunnels simultaneously and assign each home network device to a specific tunnel or a direct (unencrypted) connection. It works like split tunneling but at the device level: your Smart TV goes through the VPN, your banking app on your phone goes direct. More on how traffic splitting works: split tunneling in VPN.
Most other manufacturers offer a single VPN client with one shared tunnel for the entire network. ASUS gives you per-device routing control and support for multiple active tunnels simultaneously — a level of flexibility no other mass-market consumer router offers out of the box.
ASUSWRT vs ASUSWRT-Merlin: which firmware to use
ASUS routers run on one of two firmware builds. ASUSWRT is the official factory firmware: VPN Fusion, WireGuard, and OpenVPN are built in natively with a standard web interface. ASUSWRT-Merlin is a community-maintained build on top of ASUSWRT: it preserves all native features and adds advanced VPN tools, scripting support, and fine-grained tuning. For most users, the official firmware is sufficient; Merlin is for those who want maximum control.
VPN client or VPN server — do not mix them up
The ASUS admin panel has two VPN modes with similar names but fundamentally different purposes.
- VPN client (this guide) — the router itself connects to an external VPN provider server. All home network traffic exits to the internet through an encrypted tunnel. Requires a VPN service subscription with a config file.
- VPN server — the ASUS router becomes an entry point for remote access to your home network from outside. Used to connect to home resources from the road. Does not encrypt outbound traffic and does not address the privacy use case.
This article covers only the VPN client mode: the ASUS router connects to a LiMP VPN server and encrypts all outbound home network traffic.
What you need before configuring: checklist
Prepare everything before opening the admin panel — otherwise the setup will stall halfway through.
- Up-to-date firmware. WireGuard requires firmware later than 3.0.0.4.388.23000. Open Administration → Firmware Upgrade and check for an available update.
- A supported model. The list of models with VPN Fusion support is published on the ASUS support page. Typically these are AX, GT, and ZenWiFi series from recent generations.
- A config file from your VPN provider:
.conffor WireGuard or.ovpnfor OpenVPN. Download it from your VPN service account dashboard. - Access to the router web panel: open
http://www.asusrouter.comor enter the router's LAN IP (usually192.168.1.1). - A device on the same network. You can only configure the router from a device connected to it over Wi-Fi or a LAN cable.
How to set up WireGuard on an ASUS router: step-by-step
WireGuard is a modern protocol with a lean codebase and current cryptography (Curve25519, ChaCha20). On ASUS routers it is faster than OpenVPN at equivalent security. More on the protocol: what is WireGuard.
- Log in to the web panel at
http://www.asusrouter.comor192.168.1.1. - In the left menu, go to Advanced Settings → VPN, then select the VPN Fusion tab.
- Click Add profile.
- In the Protocol field, select WireGuard. If the option is missing, the firmware is too old — update it via Administration → Firmware Upgrade.
- Click Upload Config and select the
.conffile from your VPN provider. The fields (Public Key, Endpoint, AllowedIPs) will populate automatically from the file. - Click the device icon next to the profile and assign the devices that should route through this tunnel.
- Click Apply all settings, then activate the profile using the toggle next to it.
- Verify: on an assigned device, check your external IP — it should match the VPN server's IP.
How to set up OpenVPN on an ASUS router
OpenVPN is supported on the vast majority of ASUSWRT and ASUSWRT-Merlin versions — choose it if your firmware predates WireGuard support or your provider supplies only an .ovpn file. OpenVPN is slower than WireGuard due to its heavier architecture, but works on virtually any ASUS router. Protocol comparison: WireGuard, OpenVPN and IKEv2 — which to choose.
The setup path is identical: Advanced Settings → VPN → VPN Fusion → Add profile → select OpenVPN in the Protocol field → Upload Config (.ovpn) → assign devices → Apply → activate. If your provider requires a separate username and password (not embedded in the config), fill in the Username and Password fields in the profile.
Per-device routing: which devices to send through the VPN
VPN Fusion's key strength is flexible per-device routing. The right split protects privacy while keeping location-dependent services working correctly.
- Smart TVs and game consoles — through the VPN. They have no VPN apps; the router is the only way to protect their traffic. More: VPN for Smart TV and Apple TV.
- IoT devices (smart bulbs, cameras, plugs) — through the VPN. They are weakly protected at the firmware level and easily become attack entry points.
- Banking and payment apps — direct. Some banks' anti-fraud systems flag VPN IPs and block transactions; a direct connection prevents false positives.
- Work laptop with a corporate VPN — direct. The corporate VPN manages its own routing; a double tunnel creates conflicts.
- Streaming devices (Chromecast, Fire TV Stick) — your call. Want a different regional library — through the VPN; otherwise direct.
The principle is the same as app-level split tunneling: how split tunneling works.
Making the VPN the default internet connection
By default, VPN Fusion applies the tunnel only to assigned devices. To route all router traffic through the VPN, enable the option "Use as internet default connection" in the VPN Fusion profile settings (documented in the official ASUS FAQ 1048507). After that, all devices without an individual tunnel assignment will automatically go through the encrypted tunnel.
Pros: maximum protection without manually assigning every device. Cons: location-dependent services — online banking, streaming in the right region, some game servers — may behave incorrectly. Use VPN Fusion exceptions to route these direct. More about the service: LiMP VPN features and plans.
Verifying the result and common problems
A "Connected" status in the panel means only that the tunnel is established — not that traffic is flowing without leaks. Check both points below.
- External IP: from an assigned device, check your external IP. It should match the VPN server's IP (country = server country).
- DNS leaks: confirm DNS queries are routed through the tunnel, not leaking to your ISP. Guide: how to check for DNS leaks.
- Kill switch: if the tunnel drops, it blocks all traffic so no data escapes unencrypted. Details: what is a VPN kill switch.
| Symptom | Cause | Fix |
|---|---|---|
| WireGuard not in Protocol list | Firmware older than 3.0.0.4.388.23000 | Update via Administration → Firmware Upgrade |
| Tunnel fails to connect | Invalid config or expired keys | Download a fresh .conf/.ovpn from your provider; verify date/time on the router |
| Low speed over VPN | Distant server or OpenVPN instead of WireGuard | Pick the nearest server; switch to WireGuard if available |
| Device bypasses the tunnel | Not added to VPN Fusion profile | Open the profile, click the device icon, add the device |
| Internet gone for all devices after enabling VPN | VPN server unreachable or wrong endpoint | Disable the profile, verify the config, try a different server |
Comparison: ways to connect a home network to a VPN
| Method | What it protects | Complexity | Best for |
|---|---|---|---|
| VPN on ASUS router (VPN Fusion) | Whole network; per-device routing | Medium — upload a .conf | ASUS users with up-to-date firmware |
| VPN app on each device | That device only | Minimal | No VPN-capable router or need for flexibility |
| Second VPN router in cascade | All devices behind it | Medium | When the main router lacks a VPN client |
| Sharing VPN from a laptop or phone | Devices behind the hotspot | Medium | Temporary solution or testing |
Guides for other brands: TP-Link, Keenetic, Huawei, Rostelecom.
Frequently asked questions
Answers to the most common questions about setting up a VPN on an ASUS router.