How to set up a VPN on your ASUS router (a step-by-step guide)

Setting up a VPN on your ASUS router encrypts traffic for every connected device at once — phones, laptops, smart TVs, and IoT gadgets — without installing separate apps on each one. This guide walks you through configuring Surfshark on compatible ASUS routers using OpenVPN or WireGuard, plus explains how to use VPN Fusion for per-device routing.

What you’ll need before starting

Router-based VPN (Virtual Private Network) configuration is straightforward, but having the correct firmware, files, and credentials ready beforehand will make the process much smoother.

ASUS routers run either ASUSWRT (official firmware) or ASUSWRT-Merlin (community firmware with enhanced VPN tools). Common VPN-compatible models include the RT-AX86U, RT-AX88U, RT-AC68U, and most newer Wi-Fi 6/7 routers. 

Before starting, gather the following:

• A VPN-compatible ASUS router with VPN Client support;
• The latest ASUSWRT or ASUSWRT-Merlin firmware;
• An active Surfshark subscription;
• VPN configuration files (.ovpn for OpenVPN or .conf for WireGuard);
• Your VPN service credentials;
• Access to the router’s admin dashboard.

Update your router firmware

Running the latest firmware ensures access to current security patches, protocol support, and features like VPN Fusion.

1. Log in to your ASUS router dashboard.
2. Go to Administration in the left menu.
3. Select Firmware Upgrade.
4. Click Check to search for updates.
5. If an update’s available, follow the prompts to install.

Generate a key pair (WireGuard only)

This step is only required if you plan to use WireGuard. To generate a key pair:

1. Log in to your Surfshark account.
2. Go to the Manual Setup section.
3. Select Router as the device type and WireGuard as the protocol.

Expand

4. Click on I don’t have a key pair.

Expand

5. Enter a name for your key pair.

Expand

6. Select Generate a new key pair.

Expand

Surfshark will generate a public and private key used to authenticate your VPN router. You don’t need to save these keys separately — they are automatically included in the WireGuard configuration file you’ll download next.

Generate credentials (OpenVPN only)

OpenVPN uses a username and password for authentication instead of cryptographic key pairs. These credentials are separate from your Surfshark account login.

To generate OpenVPN credentials:

1. Log in to your Surfshark account.
2. Go to the Manual Setup section and select OpenVPN as the protocol.

Expand

3. Generate or copy the provided username and password.

Expand

Save these credentials securely. You’ll be prompted to enter them when importing the .ovpn file or when activating the VPN client on your router.

Choose a VPN server location and download the configuration file

From Surfshark’s manual setup page, select the VPN server location and download the configuration file for your router:

1. Log in to your Surfshark account and go to the Manual setup section.
2. Select Router as the device type and choose the VPN protocol you want to use (OpenVPN or WireGuard).
3. Select Choose a location.

Expand

4. Select a server location from the list and download the configuration file:

• OpenVPN uses .ovpn files;
• WireGuard uses .conf files.

Expand

Choose a location close to your physical position to minimize latency and improve performance, or select a specific country if you need an IP (Internet Protocol) address from that region.

The downloaded file contains the connection settings for the chosen server, and you’ll be uploading it to your ASUS router.

Access your router’s dashboard

In order to change the configuration, you will need access to your router’s admin panel. The required credentials are usually found on a sticker underneath the router.

1. Open a browser on a device connected to your router’s network.
2. Go to http://192.168.1.1 or http://router.asus.com.
3. Enter your router’s admin username and password.

Expand

How to set up OpenVPN on your ASUS router

OpenVPN is the most widely supported protocol on ASUS routers — it works on nearly all ASUSWRT and ASUSWRT-Merlin firmware versions. It’s slightly slower than WireGuard due to heavier encryption overhead, but it offers broad compatibility. If you’re unsure about which method to use, start here.

Go to the VPN Client section

The VPN Client section is where you’ll add and manage all VPN profiles on your router:

1. Log in to your ASUS router dashboard.
2. Click VPN in the left menu.

Expand

3. Open the VPN Client tab.

Expand

Add a new OpenVPN profile

Once you’re in the VPN Client menu, upload your Surfshark configuration file:

1. Click Add Profile.

Expand

2. Select OpenVPN.
3. Enter a custom profile name.
4. Click Choose File and upload your .ovpn file.

Expand

Enter your credentials and connect

After uploading the profile, activate it to start the VPN connection:

1. Enter your Surfshark credentials when prompted.
2. Click OK or Apply.

Expand

3. Find the profile in the VPN list.
4. Toggle Activate.

Expand

The status should change to Connected. All devices on your network now route traffic through the VPN tunnel (unless you configure VPN Fusion for per-device control — more on that later).

How to set up WireGuard on your ASUS router

WireGuard is a newer protocol designed for speed and efficiency — it typically outperforms OpenVPN, especially on routers with limited processing power. The trade-off is compatibility: WireGuard requires newer firmware and isn’t available on all ASUS models. But, if your router supports it, WireGuard is usually the better choice.

Check if WireGuard is available on your router

First, confirm your router supports WireGuard:

1. Log in to the ASUS router dashboard.
2. Go to VPN in the left menu.
3. Look for a WireGuard tab or option.

If you can’t find WireGuard settings anywhere, you’ll need to update your firmware or stick to OpenVPN instead.

Add a WireGuard profile

If WireGuard is available, set it up using your Surfshark configuration file:

1. Open the WireGuard section.
2. Click Add Profile or Import Configuration.
3. Upload your .conf file.
4. Name the profile.
5. Save.

Confirm and test your connection

After importing the profile, activate it and verify the connection:

1. Enable the WireGuard profile.
2. Click Apply.
3. Check that the status shows an active connection or handshake.

How to use VPN Fusion for per-device routing

VPN Fusion lets you route traffic on a per-device basis — you choose which devices use the VPN and which connect directly through your ISP (Internet Service Provider). This is useful when you need encrypted browsing on personal devices but want others (like a gaming console or network-attached storage) to connect directly for speed or local network access.

For more details, see our guides: one for setting up OpenVPN on Asus VPN Fusion and one for WireGuard on Asus VPN Fusion.

Enable VPN Fusion

Start by turning on the feature in your router settings:

1. Log in to your router dashboard.
2. Go to VPN in the left menu and select VPN Fusion.

Expand

3. Toggle to Enable and click Apply.

If VPN Fusion doesn’t appear, your router model or firmware may not support it.

Add VPN profiles to VPN Fusion

VPN Fusion uses the OpenVPN or WireGuard profiles you’ve already created:

1. Open the VPN Fusion interface.
2. Click Add Profile and upload your VPN configuration.

Expand

3. Save.

If your router supports concurrent connections, you can upload multiple profiles.

Assign devices to either a VPN or a standard connection

Once VPN Fusion is enabled and profiles are available, decide which devices use each connection.

1. In VPN Fusion, find the device assignment section.
2. Click on the pencil icon next to a device on the list.

Expand

3. Assign it to either a VPN profile or the regular connection.
4. Click Apply.

How to verify your VPN connection is working

After setup, confirm everything works as expected.

Check the connection status in the router dashboard

Start by verifying the VPN profile is active in your router dashboard:

1. Go to VPN, then VPN Client (or the WireGuard section).
2. Locate your enabled profile.
3. Verify the status shows Connected.

Confirm your IP address has changed

The easiest way to verify VPN routing is to check your external IP address:

1. On a connected device, visit an IP-check website.
2. Compare the displayed IP with your regular ISP-provided address.

A working VPN shows the VPN server’s IP instead of your ISP’s.

Verify VPN Fusion is routing devices correctly

If you followed the VPN Fusion method, confirm that only assigned devices route through the VPN:

• Devices assigned to the VPN profile should show the VPN server IP;
• Devices on the standard connection should show your regular ISP-issued IP.

Run a DNS leak test for extra assurance

A DNS leak test confirms your DNS (Domain Name Service) requests also route through the VPN. Your ISP’s DNS servers shouldn’t appear in the results.

Troubleshooting common ASUS router VPN issues

Even with a straightforward setup, occasional issues can arise — especially with incorrect credentials, outdated firmware, or unsupported features.

VPN won’t connect

If your VPN profile won’t connect or keeps disconnecting, check the following:

1. Verify credentials: VPN service credentials may differ from your main account login.
2. Re-download the configuration file: corrupted or outdated files cause connection failures.
3. Update firmware: older versions may lack support for certain encryption settings.
4. Try a different server: some locations may be temporarily unavailable.
5. Confirm the correct protocol: ensure the profile type matches your configuration file.

Slow or unstable VPN speeds

VPN encryption increases CPU load, which can reduce speeds — especially on entry-level routers. To improve performance:

1. Switch to WireGuard: it’s faster and less CPU-intensive than OpenVPN.
2. Choose a closer server: shorter distance means lower latency.
3. Limit VPN-routed devices: use VPN Fusion to limit encryption to devices that need it.
4. Check router hardware: entry-level routers struggle with encryption overhead. Mid- to high-end models like the RT-AX86U or RT-AX88U handle VPN traffic more efficiently.

VPN Fusion not available in settings

If VPN Fusion doesn’t appear in your settings, it’s usually due to one of these three reasons:

1. Model limitation: VPN Fusion is available only on certain mid- to high-end ASUS routers.
2. Outdated firmware: updating may enable the feature for your model.
3. Firmware variant: some features differ between standard ASUSWRT and ASUSWRT-Merlin.

If VPN Fusion is not available, the standard VPN Client setup will encrypt your entire network.

Conclusion: should you set up a VPN on your ASUS router?

A router-level VPN encrypts traffic for your entire network through a single configuration. With Surfshark and protocols like OpenVPN or WireGuard, you can route all devices through a secure tunnel — or use VPN Fusion to apply encryption only where you need it. For most users, the 10–20 minute setup is worth the network-wide coverage, especially if you have devices that don’t support VPN apps natively.

Take control of your home internet privacy

Use Surfshark on your router to keep your connection more secure at all times

Get Surfshark