WireGuard on a TP-Link Router: Supported Models, Config Gotchas, and a Working Setup

TP-Link has been adding a WireGuard VPN client to Archer routers through firmware updates, but support depends on the model and hardware version, and the importer only accepts a subset of the standard WireGuard config format. This post covers which models are confirmed, how to tell if yours qualifies, and how to get a provider config to import cleanly.

Disclosure: this page contains an affiliate link.

→ NordVPN is what we run on the router and the TV → this VPN

Why WireGuard on the router at all

A router VPN client gives you a tunnel for devices that can't run one themselves: smart TVs, consoles, Roku. The bottleneck is the router's CPU. OpenVPN does its encryption in user space and is notoriously heavy on embedded ARM chips. WireGuard is a far smaller codebase built on ChaCha20-Poly1305, which runs efficiently on CPUs without AES acceleration, and on Linux it lives in the kernel. On the same hardware, that usually means noticeably more throughput and lower CPU load. How much more depends on the chip, so measure on yours rather than trusting anyone's number, including ours.

Which TP-Link models support it

TP-Link's own knowledge base says WireGuard client support is "being added to Archer Routers via a firmware update" and that more models may follow. As of October 2026, these are documented in TP-Link's knowledge base, its community announcements or its firmware release notes:

Things to watch:

• Hardware version matters. An AX21 V1 and an AX21 V3 are different boards with different firmware. Check the label on the bottom of the router ("Ver: 3.0").
• Some upgrades are one-way. TP-Link notes that the AX20/AX21/AX1800 V3 firmware can't be downgraded once installed.
• AX58 quirk. Community reports say some AX58 V1 units shipped on firmware without the VPN Client menu, and that the AX53 V1 build adds it (the two have historically shared firmware). That's a community workaround, not an official TP-Link instruction, so take it at your own risk.
• Not every Archer has it. One user on an Archer AX1100 with 2023 firmware reported that only L2TP/IPSec, PPTP and OpenVPN were available. Older or budget models may have no VPN client at all.

How to check yours in 30 seconds: log in at http://tplinkwifi.net, go to Advanced > VPN Client, click Add, and open the VPN Type dropdown. If WireGuard is listed, you're good. If it isn't, update the firmware and check again before you give up.

Step 1 — Get a WireGuard config from your provider

You need a standard .conf file with an [Interface] and a [Peer] section. Most large providers now offer these for manual setups. NordVPN added downloadable WireGuard configs to its manual setup options. Sign in to your Nord Account, open NordVPN, then go to Advanced settings > Set up NordVPN manually, pick a server, choose WireGuard, and click Download config. Proton VPN has offered downloadable WireGuard configs for a while too, from its account dashboard.

A typical file looks roughly like this (keys and addresses redacted):

[Interface]
PrivateKey = <redacted>
Address = 10.5.0.2/32
DNS = 103.86.96.100

[Peer]
PublicKey = <redacted>
AllowedIPs = 0.0.0.0/0
Endpoint = <server-hostname-or-ip>:51820
PersistentKeepalive = 25

Treat the private key like a password. Don't commit it, paste it into an issue, or share it.

Step 2 — Strip what TP-Link won't accept

This is the bit that trips people up. TP-Link's own guide says the router supports only "some basic parameters" of the WireGuard config format, and tells you to edit the file and delete IPv6 addresses, MTU, and similar extra settings before importing.

In practice that means:

1. Remove IPv6 entries. If Address contains an IPv6 address after a comma (10.x.x.x/32, fd00::.../128), delete the IPv6 part. Do the same with AllowedIPs (delete ::/0).
2. Delete MTU = if it's there.
3. Remove anything else non-basic, such as PreUp/PostUp hooks or Table =. These are Linux wg-quick options a router importer won't understand anyway.
4. Keep PrivateKey, Address, DNS, PublicKey, AllowedIPs, Endpoint and PersistentKeepalive.

Save it as plain text with a .conf extension. Some editors silently add .txt.

Step 3 — Import and enable

1. http://tplinkwifi.net > Advanced > VPN Client.
2. Toggle VPN Client on and save.
3. Add a server: give it a description, set the type to WireGuard, Browse to your edited .conf, then Save.
4. Tick the profile in the Server List to enable it.
5. Under the device access list, add the devices that should use the VPN. TP-Link's client is per-device, not whole-network by default, and this is the step people skip before wondering why nothing changed.

Step 4 — Verify from a client device

From a laptop on the list:

curl -s https://ipinfo.io/json

The country and org fields should reflect the VPN server, not your ISP. Then run a DNS leak test in a browser. If your ISP's resolvers show up, your client's DNS isn't going through the tunnel. Check that the DNS = line survived the import, and set the client's DNS to automatic.

From a device not on the list, the same command should show your normal ISP. That confirms the per-device rule is working, which is useful when only the TV should be on the VPN.

Gotchas we've hit or seen reported

• One config, one active tunnel. TP-Link warns against using the same config on several clients at once. A WireGuard config is one keypair, and the server only tracks one live endpoint per key. If you import the file into your phone and the router and run both, they'll keep stealing the session from each other. Generate a separate config per device.
• IPv6 leaks. Once you've stripped IPv6 from the config, the tunnel is IPv4-only. If your ISP gives clients native IPv6, those devices can still reach IPv6-capable services directly, outside the tunnel. Turn off IPv6 on the LAN side (Advanced > IPv6) for a clean result.
• Handshake but no traffic. Usually a wrong AllowedIPs (it should be 0.0.0.0/0 for a full tunnel) or a stale config from a server that's been retired. Download a fresh config for a different server.
• No handshake at all. Some networks block UDP 51820. There's not much to do on stock TP-Link firmware except try another network or fall back to OpenVPN over TCP.
• Performance ceiling. WireGuard is lighter, but a budget dual-core router still has limits. If a 4K stream on a TV behind the router buffers, compare a wired speed test with the VPN on and off before blaming the server.

Why we went this route

We run a VPN on a router for streaming devices that have no app, and we use NordVPN. Getting WireGuard configs from Nord Account means we no longer have to fall back to OpenVPN on the router, which was the main reason our older setup felt slow. Nord's no-logs policy has been independently audited, and the 30-day money-back guarantee meant we could check throughput on our own hardware before committing.

Honest limits

• A router VPN doesn't stop detection. Streaming services block VPN server IPs whether the tunnel starts on a router or a laptop.
• Legal vs permitted. Running a VPN is legal in most countries, but some services' terms restrict reaching them through one.
• It's not anonymity. It changes the source IP the world sees and encrypts traffic to the VPN server. Accounts you're logged in to still identify you.
• Firmware support can change. Re-check TP-Link's release notes for your exact model and hardware version before you buy a router for this.

Checklist

• [ ] Confirmed model and hardware version; WireGuard appears in VPN Client > VPN Type
• [ ] Firmware updated (and noted whether it's one-way)
• [ ] Downloaded a provider .conf per device
• [ ] Stripped IPv6, MTU and non-basic lines; kept the core fields
• [ ] Imported, enabled, and added devices to the access list
• [ ] curl ipinfo.io shows the VPN; DNS leak test clean
• [ ] IPv6 disabled on the LAN if not tunnelled