TasVPNTas VPN

Use TasVPN on your router

Run the tunnel on your router and everything behind it is protected: smart TVs, game consoles, streaming sticks, and guests. This is the way to use TasVPN on Samsung, LG and Hisense (VIDAA) televisions, which cannot run a VPN app of their own. It also works for Sony and other Google TV sets until the TasVPN app for Android TV is published.

1. Get a profile for the router

  1. Sign in and open Devices. Add a device named after the router (for example “Living room router”) with type “Router”. It uses one of your plan’s device slots like any other device.
  2. Choose the location you want the router to connect through and click “Download profile”.
  3. Keep the file private: it contains the router’s private key. If it ever leaks, remove the device on the Devices page and create a new one — the old key stops working immediately.

2. Import it on the router

OpenWrt (23.05 or newer)

  1. System → Software: install wireguard-tools and luci-proto-wireguard, then reboot.
  2. Network → Interfaces → Add new interface, protocol "WireGuard VPN". Paste the [Interface] PrivateKey and Addresses from the profile.
  3. Peers tab → Add peer: PublicKey, Endpoint host and port, Allowed IPs 0.0.0.0/0 and ::/0, Persistent keepalive 25, tick "Route allowed IPs".
  4. Firewall Settings: put the new interface in the "wan" zone (or a new zone with masquerading on). Set the DNS from the profile under Advanced → Use custom DNS servers.
  5. Save & Apply. The Status → WireGuard page shows a recent handshake when it is up.

GL.iNet (GL-MT3000, GL-AXT1800, Flint and others)

  1. Open the router admin page → VPN → WireGuard Client → Add configuration.
  2. Choose "Upload" and select the downloaded .conf, or paste its text.
  3. Enable the client. Under VPN Dashboard, turn on "Block non-VPN traffic" if you want a kill switch for the whole network.

ASUS routers with ASUSWRT-Merlin or stock firmware 388+

  1. VPN → VPN Client → WireGuard → Add profile → Import config, choose the .conf.
  2. Set "Interface" to the profile you imported and turn "Enable" on.
  3. VPN Director (Merlin) or the client list (stock) lets you send only the TV to the tunnel: add a rule with the TV's IP as source and the WireGuard client as the interface.

MikroTik RouterOS 7

  1. WireGuard → Add interface; set Private Key from the profile.
  2. IP → Addresses: add the Address from the profile on the new interface.
  3. WireGuard → Peers: Public Key, Endpoint, Endpoint Port, Allowed Address 0.0.0.0/0, Persistent Keepalive 25s.
  4. IP → Routes: a route for 0.0.0.0/0 via the WireGuard interface (use a routing table and a mangle rule if only some devices should use it). IP → Firewall → NAT: masquerade out of the WireGuard interface.

pfSense / OPNsense

  1. VPN → WireGuard → Instances (OPNsense) or Tunnels (pfSense): create one with the profile's private key and address.
  2. Add a peer with the public key, endpoint, allowed IPs 0.0.0.0/0, keepalive 25. Assign the interface and add an outbound NAT rule through it.
  3. Add a gateway on the new interface and a LAN firewall rule that sends the TV (or the whole LAN) to that gateway.

AVM Fritz!Box (FRITZ!OS 7.50 or newer)

  1. Internet → Permit Access → VPN (WireGuard) → Add connection → "Connect networks or establish special connections" → "Has the WireGuard connection already been set up at the remote site?" → Yes.
  2. Upload the .conf. Fritz!OS sends every device on the network through it once enabled.

Good to know

  • A router counts as one connection for your plan’s concurrent-connection limit, however many devices sit behind it.
  • Most routers let you send only certain devices through the tunnel (policy routing). Use that for the TV if the rest of the house should stay on the normal connection.
  • The profile routes both IPv4 and IPv6 into the tunnel and sets the DNS servers TasVPN operates, so the TV cannot leak DNS lookups around it.
  • Changing location means downloading a new profile for that location and importing it again; routers do not switch servers on their own.
  • Router VPN throughput is limited by the router’s CPU. Entry-level ISP routers often manage 20–60 Mbps over WireGuard; dedicated units reach several hundred.

Stuck on a model that is not listed?

Contact us