Prioritizing Privacy
Change your Merlin FlashRouter’s WiFi Network Name to different names for the 2.4GHz and 5GHz bands so they can be joined separately.
Login to Asus Merlin firmware settings in a browser on any computer or smart device.
1. Under General select Network Map.
2. In the Network name (SSID) field enter two different names for the 2.4GHz and 5GHz bands.
3. Click Apply and then rejoin the new wireless network.
Once you have OpenVPN connected on your Merlin FlashRouter you can manage your VPN connections by device or by VPN servers or even VPN providers. This is a major advantage of Asus Merlin firmware as it allows up to 5 VPN connections at the same.
Login to Asus Merlin firmware settings in a browser on any computer or smart device.
1. Under Advanced Settings select VPN.
2. Click the VPN Client tab.
3. In the Select Client instance dropdown select a new client instance to setup and follow your VPN providers setup guide.
4. Name the client in the Description field for more clarity for which server or provider is being setup.
5. Set the Redirect Internet traffic through tunnel dropdown to VPN Director.
1. Under Advanced Settings select VPN.
2. Click the VPN Director tab.
3. With multiple VPN clients connected you can start and stop them as needed from this page.
1. On the VPN Director page click the + symbol next to Add new rule.
2. Select the Interface that you want to add the device to.
3. Click the Local IP dropdown and a full list of devices connected to the Merlin FlashRouter should appear. Select the device you want to assign to this VPN client.
4. Click OK and click Apply.
StrongVPN Wireguard DD-WRT setup is now officially supported by FlashRouters. Follow the steps below to gather all the required information to complete your Wireguard router setup.
Navigate to Security > Firewall
Set SPI Firewall to Disable.
Click Save at the bottom of the page.
Select your actual time zone for you physical location from the dropdown and enter 1.pool.ntp.org in the Server IP/Name dropdown.
Click Apply Settings at the bottom of the page.
If you are not already a StrongVPN user Sign Up Now.
1. Log in to your account on the StrongVPN website.
2. Select Router icon as the Platform
3. Select the Advanced Options dropdown and then check Exclude LAN Traffic and set any value between 52000 and 60000 in the Custom Port field.
4. Select the Server Location from the dropdown that you would like to connect to.
5. Select the Generate at the bottom of the page.
6. Click the DD-WRT installer script box to copy.
Navigate to Administration > Commands
Paste the StrongVPN Script that was copied in the empty Commands Shell.
Delete the very last line sleep 8 && reboot.
Click Save Custom (or Save Custom Script may appear depending on your firmware build, they are the same thing)
Copy the line below and paste into the empty Commands Shell.
sh /tmp/.rc_custom
Click Run Commands.
Wait two minutes and then power the FlashRouter off and back on. Reconnect to the FlashRouter’s network when it has booted back up.
Navigate to Setup > Tunnels
Navigate to Administration > Backup
It can be very useful to setup static local IP addresses for devices on your FlashRouter network. By assigning specific IP’s to specific devices you can better control and manage how your network and the internet interacts with each device.
Once you setup a static IP you can set access restrictions, monitor and control bandwidth, as well as bypass a router VPN connection or setup a device specific Kill Switch. Without a static IP assignment you may lose device specific settings when the DHCP lease to the router expires.
Navigate to Services > Services
If a device has wireless and ethernet capabilities the MAC Addresses will be different for a wireless connection and an ethernet connection. Make sure to set a static IP for both MAC Addresses in this case.
If you are not already an NordVPN user Sign Up Now.
1. Log in to your account on the NordVPN website.
2. Click NordVPN on the left hand side and then click Setup NordVPN manually.
3. Enter in the verification code that was sent to your email.
4. Copy and paste your NordVPN manual username and password to a secure location. This is the username and password you will enter into the router settings to connect to NordVPN.
1. There are two options for obtaining the .ovpn file. The first and recommended is to navigate to NordVPN’s server recommendation page. Click Recommended Server to display the fastest server based on your actual location. You can adjust the country if you don’t want to connect to the recommended country.
Then click Show Available Protocols. Click Download Config next to OpenVPN UDP. This will download the .ovpn file to your computer for this server. Do not open this file.
The second method to obtain a server is for connecting to a specific server number that you know you want to use. This applies to NordVPN Dedicated IP servers if you are signed up for that service. Go to NordVPN’s .ovpn file page. Then search for the server number that you want to use and click Download UDP.
Login to TP-Link firmware settings in a browser on any computer or smart device connected to the FlashRouter’s network.
1. Navigate to the Advanced tab.
2. Navigate to the VPN Client tab.
3. Check the Enable box next to VPN Client. Then click Save at the bottom of the page.
4. Click the Add button in the Server List area.
5. In the Description field enter in the name you’d like to use for this OpenVPN Client profile. We typically advise entering in the location or server number here. Our example server was us6821 so I have entered in NordVPN us6821.
Set the VPN Type to OpenVPN.
In the Username and Password fields paste in the NordVPN username and password we obtained earlier.
Click Browse and select the .ovpn file you downloaded earlier. Then click Save.
By default no devices will be assigned to the VPN Tunnel. With TP-Link firmware you must manually assign the devices that you want connected to the VPN tunnel. Proceed with the next steps to do so for all devices you want connected to VPN.
6. Click the Add button in the Device List area.
7. A list of devices connected to the FlashRouter’s network will appear. Check the devices that you want to connect to VPN. Then click OK.
8. Now that the devices have been assigned to the VPN connection click the Enable toggle in the Server List area.
In some cases you may notice that the location is not showing the same location as the server you have input in your router settings; this is because geo tracking tools are often tricked by VPN connections. As long as you see an IP address that is not the same as your normal Internet IP address then you are indeed connected to NordVPN.
If you are not already a NordVPN user Sign Up Now.
1. Log in to your account on the NordVPN website.
2. Click NordVPN on the left hand side and then click Setup NordVPN manually.
3. Enter in the verification code that was sent to your email.
4. Copy and paste your NordVPN manual username and password to a secure location. This is the username and password you will enter into the router settings to connect to NordVPN.
1. Login to the Roqos Core web app in a browser on any computer or smart device.
2. Click VPN from the navigation menu and then click VPN OUT.
3. Click the Connect to box.
4. In the Connect dropdown choose 3rd Party VPN Providers and for the VPN Provider dropdown choose NordVPN.
In the Username and Password field enter the NordVPN OpenVPN Username and Password that you obtained.
Navigate to NordVPN server recommendation page. Click Recommended server and select the country you want to connect to and note the server number that appears.
Click the Location dropdown and type in or scroll to the preferred server country.
Click the Server dropdown and type in or scroll to the server number that was recommended. Select the UDP version of the server.
Click the Save button.
Once you click Save you will be returned to the VPN OUT menu.
Click the Connect button to start your NordVPN connection. Please be patient as the router connects your entire network through VPN.
By default there are no devices assigned to the VPN tunnel. Click Included Devices. From this page you can choose if all devices should connect to NordVPN or only certain devices.
From the dropdown select Include all devices if you want every device that connects to the Roqos to connect to NordVPN. Then click Save.
If you only want specific devices to connect to NordVPN while others bypass the VPN connection select Include selected devices from the dropdown and then toggle the sliders for the devices you want connected to VPN. Click Save.
Make sure you are connected to the Roqos network via WiFi or ethernet connection on your device.
Visit NordVPN’s website to verify your new IP Address and Protected Status at the top of the page.
You should see Connected at the top of the page underneath NordVPN.
To change your server click Disconnect on the VPN OUT page then return to the Connect To section to select a new server from the Server dropdown and click Save. Now click Connect once again on the VPN Out page.
To disconnect from NordVPN click the Disconnect button.
Privacy Hero supports NordVPN using both NordLynx and OpenVPN.
NordLynx is recommended for most users. OpenVPN is also available and may be required for NordVPN Dedicated IP connections. Some Dedicated IP configurations require a private OpenVPN file imported as a Custom VPN.
Privacy Hero is cloud-managed, so you can complete the setup from any device with an internet connection. You do not need to be connected to Privacy Hero WiFi to change these settings.
NordLynx uses a NordVPN access token, not your regular NordVPN website email and password.
Important: Treat your NordVPN token as a password. Do not share it publicly.
Use OpenVPN if you prefer the OpenVPN protocol or if your configuration requires it. OpenVPN requires NordVPN Manual Service Credentials, which are different from your website login email and password.
Important: Do not enter your normal NordVPN website email and password into Privacy Hero’s OpenVPN fields.
Privacy Hero can select a NordVPN server automatically, or you can choose a country or specify a server hostname.
Use NordVPN’s server recommendation tool if you need a hostname. NordVPN servers can be retired or taken offline for maintenance; if your specific server stops working, choose another server or return to country selection.
NordVPN Dedicated IP can require either the regular NordVPN OpenVPN connection or a private .ovpn file imported as a Custom VPN.
Try this first if your Dedicated IP works with the standard NordVPN OpenVPN setup.
If connected and the public IP matches, no additional configuration is needed.
Some Dedicated IP servers require a private OpenVPN configuration file. If Method 1 does not connect, follow NordVPN’s Manual Dedicated IP Server Setup instructions.
Important: Use the private configuration file for your actual Dedicated IP, not a public NordVPN server file.
These are NordVPN’s separate manual service credentials, not your regular website login.
Running a VPN application directly on the device at the same time as the router VPN can produce double-VPN conflicts and unexpected IP or location results.
If Streaming Relocation is enabled for a supported service, that service may use the Streaming Relocation region instead of your VPN server region. See Privacy Hero Streaming Relocation.
If the VPN displays Failed, Connecting, or a timeout error, check for:
Follow Privacy Hero NordVPN Not Connecting or Showing Timeout Errors for troubleshooting.
If internet access stops when the VPN disconnects, the VPN Kill Switch may be blocking normal traffic as intended. See Privacy Hero VPN Kill Switch: No Internet or WiFi Troubleshooting.
If other devices show the correct VPN IP, check the affected device’s VPN apps, Private Relay, Private DNS, antivirus, and browser settings. See Device Settings That Can Interfere With Your Router VPN.
If you are not already an PIA user Sign Up Now.
1. Visit PIA’s website login page.
2. Successfully log in with your account information.
1. Login to the Roqos Core web app in a browser on any computer or smart device.
2. Click VPN from the navigation menu and then click VPN OUT.
3. Click the Connect to box.
4. In the Connect dropdown choose 3rd Party VPN Providers and for the VPN Provider dropdown choose Private_Internet_Access.
In the Username and Password field enter the PIA Username and Password that you logged in with.
Click the Server dropdown and type in or scroll to your preferred server location.
Click the Save button.
Once you click Save you will be returned to the VPN OUT menu.
Click the Connect button to start your PIA connection. Please be patient as the router connects your entire network through VPN.
By default there are no devices assigned to the VPN tunnel. Click Included Devices. From this page you can choose if all devices should connect to PIA or only certain devices.
From the dropdown select Include all devices if you want every device that connects to the Roqos to connect to PIA. Then click Save.
If you only want specific devices to connect to PIA while others bypass the VPN connection select Include selected devices from the dropdown and then toggle the sliders for the devices you want connected to VPN. Click Save.
Make sure you are connected to the Roqos network via WiFi or ethernet connection on your device.
Visit PIA’s IP Check to verify your new IP Address and virtual location.
You should see Connected at the top of the page underneath Private_Internet_Access.
To change your server click Disconnect on the VPN OUT page then return to the Connect To section to select a new server from the Server dropdown and click Save. Now click Connect once again on the VPN Out page.
To disconnect from PIA click the Disconnect button.
Privacy Hero supports Private Internet Access (PIA) with WireGuard (recommended) and OpenVPN. You need an active PIA subscription and your PIA VPN username and password.
Important difference: PIA WireGuard has a built-in provider integration in Privacy Hero. Choose Private Internet Access from the VPN provider list—not Custom WireGuard. No WireGuard configuration file or key generation is needed.
By default, Privacy Hero can automatically select an optimal available PIA server based on your location and server conditions. Alternatively, use Advanced Options to enter a specific PIA server hostname from the regional list below.
Privacy Hero is cloud-managed. You can configure your router from any device with an internet connection, whether or not you are on the Privacy Hero WiFi network.
Unlike most other providers, PIA WireGuard does not use Custom VPN file uploads in Privacy Hero. The built-in PIA integration connects using your PIA account credentials and handles the WireGuard configuration for you.
Privacy Hero offers two ways to select the PIA WireGuard server:
us-newyorkcity.privacy.network or uk-london.privacy.network.
Use these hostnames in PIA > Advanced Options when you prefer a specific location. Expand a region below and copy the complete hostname, including .privacy.network. This list is retained from the existing FlashRouters guide.
Server availability can change. Some hostnames, particularly those ending in -pf or marked for streaming, are specialized locations and may not be available for every connection. If a hostname no longer works, use automatic selection or check PIA’s current location list for available locations. PIA’s location list names regions; it does not necessarily provide matching hostnames.
bahamas.privacy.networkca-ontario.privacy.networkca-toronto.privacy.networkca-vancouver.privacy.networkca-montreal.privacy.networkgreenland.privacy.networkgt-guatemala-pf.privacy.networkmexico.privacy.networkpanama.privacy.networksanjose.privacy.networkus-alabama-pf.privacy.networkus-alaska-pf.privacy.networkus-arkansas-pf.privacy.networkus-atlanta.privacy.networkus-california.privacy.networkus-chicago.privacy.networkus-connecticut-pf.privacy.networkus-denver.privacy.networkus-florida.privacy.networkus-houston.privacy.networkus-idaho-pf.privacy.networkus-indiana-pf.privacy.networkus-iowa-pf.privacy.networkus-kansas-pf.privacy.networkus-kentucky-pf.privacy.networkus-lasvegas.privacy.networkus-louisiana-pf.privacy.networkus-maine-pf.privacy.networkus-massachusetts-pf.privacy.networkus-michigan-pf.privacy.networkus-minnesota-pf.privacy.networkus-mississippi-pf.privacy.networkus-missouri-pf.privacy.networkus-montana-pf.privacy.networkus-nebraska-pf.privacy.networkus-new-hampshire-pf.privacy.networkus-new-mexico-pf.privacy.networkus-newyorkcity.privacy.networkus-north-carolina-pf.privacy.networkus-north-dakota-pf.privacy.networkus-ohio-pf.privacy.networkus-oklahoma-pf.privacy.networkus-oregon-pf.privacy.networkus-pennsylvania-pf.privacy.networkus-rhode-island-pf.privacy.networkus-seattle.privacy.networkus-siliconvalley.privacy.networkus-south-carolina-pf.privacy.networkus-south-dakota-pf.privacy.networkus-texas.privacy.networkus-tennessee-pf.privacy.networkus-vermont-pf.privacy.networkus-virginia-pf.privacy.networkus-washingtondc.privacy.networkus-west-virginia-pf.privacy.networkus-wisconsin-pf.privacy.networkus-wyoming-pf.privacy.networkus3.privacy.networkus-baltimore.privacy.networkus-honolulu.privacy.networkus-newjersey.privacy.networkus-saltlakecity.privacy.networkus-streaming-2.privacy.networkus-streaming.privacy.networkus-wilmington.privacy.networkar.privacy.networkbo-bolivia-pf.privacy.networkbogota.privacy.networkbr.privacy.networkec-ecuador-pf.privacy.networkpe-peru-pf.privacy.networksantiago.privacy.networkuy-uruguay-pf.privacy.networkvenezuela.privacy.networkal.privacy.networkad.privacy.networkaustria.privacy.networkbrussels.privacy.networkba.privacy.networksofia.privacy.networkzagreb.privacy.networkczech.privacy.networkde-berlin.privacy.networkde-frankfurt.privacy.networkdenmark.privacy.networkdenmark-2.privacy.networkspain.privacy.networkes-valencia.privacy.networkee.privacy.networkfi.privacy.networkfi-2.privacy.networkfrance.privacy.networkgr.privacy.networkhungary.privacy.networkitaly.privacy.networkitaly-2.privacy.networkis.privacy.networkireland.privacy.networkman.privacy.networklv.privacy.networkliechtenstein.privacy.networklt.privacy.networklu.privacy.networkmalta.privacy.networkmd.privacy.networkmonaco.privacy.networkmontenegro.privacy.networknl-amsterdam.privacy.networkmk.privacy.networkno.privacy.networkpoland.privacy.networkpt.privacy.networkro.privacy.networksweden.privacy.networksweden-2.privacy.networkrs.privacy.networksk.privacy.networkslovenia.privacy.networkswiss.privacy.networktr.privacy.networkuk-london.privacy.networkuk-manchester.privacy.networkuk-southampton.privacy.networkuk-2.privacy.networkua.privacy.networkae.privacy.networkbangladesh.privacy.networkcambodia.privacy.networkchina.privacy.networkcyprus.privacy.networkgeorgia.privacy.networkhk.privacy.networkin.privacy.networkisrael.privacy.networkjakarta.privacy.networkjapan.privacy.networkjapan-2.privacy.networkkazakhstan.privacy.networkkr-south-korea-pf.privacy.networkkualalumpur.privacy.networkmacau.privacy.networkmongolia.privacy.networknp-nepal-pf.privacy.networkphilippines.privacy.networkqatar.privacy.networksaudiarabia.privacy.networksg.privacy.networksrilanka.privacy.networktaiwan.privacy.networkvietnam.privacy.networkyerevan.privacy.networkau-adelaide-pf.privacy.networkau-australia-so.privacy.networkau-brisbane-pf.privacy.networkaus-melbourne.privacy.networkaus-perth.privacy.networkau-sydney.privacy.networknz.privacy.networkdz.privacy.networkegypt.privacy.networkmorocco.privacy.networknigeria.privacy.networkza.privacy.networkOpenVPN is the alternative when you need a manually uploaded connection or if the built-in PIA WireGuard method does not work on your network. OpenVPN uses Custom in Privacy Hero, unlike the built-in PIA WireGuard setup.
PIA also provides pre-made OpenVPN configuration bundles; see PIA’s OpenVPN file instructions.
Note: If OpenVPN UDP cannot connect, try a TCP profile from PIA or another server. When switching protocols, make sure you upload a matching PIA configuration file.
Privacy Hero VPN settings can be changed remotely, but the device used to verify the VPN IP must be connected to the Privacy Hero network.
If Streaming Relocation is enabled for a supported service, that service may use the Streaming Relocation location instead of your PIA VPN server location. See Privacy Hero Streaming Relocation.
If Privacy Hero reports Failed, stays on Connecting, or connected devices lose internet access, try these checks:
The Privacy Hero VPN Kill Switch may intentionally block internet access if the VPN goes down. See Privacy Hero VPN Kill Switch: No Internet or WiFi Troubleshooting.
If other devices show the expected VPN address, review device VPN apps, iCloud Private Relay, Private DNS, and security settings.
If you are not already a PIA user Sign Up Now.
1. Log in to your account on the PIA website.
2. Successfully log in with your account information then go to PIA’s OpenVPN Config Generator.
3. On the OpenVPN Configuration Generator select the following:
OpenVPN Version: OpenVPN 2.4 or newer
Select Platform: Linux
Select Region: Choose the server location you’d like to connect to
Select Port: Typically we recommend UDP/1198 RSA-2048 AES-128-CBC SHA1 for best speeds but feel free to select the one you want to use.
4. Click Generate to download the .ovpn file. Do not open this file once it is downloaded.
Login to TP-Link firmware settings in a browser on any computer or smart device connected to the FlashRouter’s network.
1. Navigate to the Advanced tab.
2. Navigate to the VPN Client tab.
3. Check the Enable box next to VPN Client. Then click Save at the bottom of the page.
4. Click the Add button in the Server List area.
5. In the Description field enter in the name you’d like to use for this OpenVPN Client profile. We typically advise entering in the location. Our example server was New York so I have entered in PIA New York.
Set the VPN Type to OpenVPN.
In the Username and Password fields paste in the PIA username and password you use to successfully login to your PIA website account.
Click Browse and select the .ovpn file you downloaded earlier. Then click Save.
By default no devices will be assigned to the VPN Tunnel. With TP-Link firmware you must manually assign the devices that you want connected to the VPN tunnel. Proceed with the next steps to do so for all devices you want connected to VPN.
6. Click the Add button in the Device List area.
7. A list of devices connected to the FlashRouter’s network will appear. Check the devices that you want to connect to VPN. Then click OK.
8. Now that the devices have been assigned to the VPN connection click the Enable toggle in the Server List area.
In some cases you may notice that the location is not showing the same location as the server you have input in your router settings; this is because geo tracking tools are often tricked by VPN connections. As long as you see an IP address that is not the same as your normal Internet IP address then you are indeed connected to PIA.
If you are not already an IPVanish user Sign Up Now.
1. Log in to your account on the IPVanish website.
2. Successfully log in with your account information then go to IPVanish .ovpn file page.
3. Click on the .ovpn file for the server location you want to use to dowloand the .ovpn file. Do not open this file.
Login to TP-Link firmware settings in a browser on any computer or smart device connected to the FlashRouter’s network.
1. Navigate to the Advanced tab.
2. Navigate to the VPN Client tab.
3. Check the Enable box next to VPN Client. Then click Save at the bottom of the page.
4. Click the Add button in the Server List area.
5. In the Description field enter in the name you’d like to use for this OpenVPN Client profile. We typically advise entering in the location. Our example server was New York so I have entered in IPVanish New York.
Set the VPN Type to OpenVPN.
In the Username and Password fields paste in the IPVanish email and password you use to successfully login to your IPVanish website account.
Click Browse and select the .ovpn file you downloaded earlier. Then click Save.
By default no devices will be assigned to the VPN Tunnel. With TP-Link firmware you must manually assign the devices that you want connected to the VPN tunnel. Proceed with the next steps to do so for all devices you want connected to VPN.
6. Click the Add button in the Device List area.
7. A list of devices connected to the FlashRouter’s network will appear. Check the devices that you want to connect to VPN. Then click OK.
8. Now that the devices have been assigned to the VPN connection click the Enable toggle in the Server List area.
In some cases you may notice that the location is not showing the same location as the server you have input in your router settings; this is because geo tracking tools are often tricked by VPN connections. As long as you see an IP address that is not the same as your normal Internet IP address then you are indeed connected to IPVanish.
If you are not already a Surfshark user Sign Up Now.
1. Log in to your account on the Surfshark website.
2. Click VPN Manual Setup.
3. Select Router as the Setup method.
4. Select WireGuard as the Protocol.
5. Select I don’t have a key pair.
6. Enter FlashRouter as the name of the connection and click Next.
7. Click Generate a new key pair.
8. Click Choose a location.
9. Select the server location you want to connect to. Unless you need a specific location we recommend using Surfshark’s recommended Fastest server. Click Download to download the .conf file for this Surfshark server location.
Login to TP-Link firmware settings in a browser on any computer or smart device connected to the FlashRouter’s network.
1. Navigate to the Advanced tab.
2. Navigate to the VPN Client tab.
3. Check the Enable box next to VPN Client. Then click Save at the bottom of the page.
4. Click the Add button in the Server List area.
5. In the Description field enter in the name you’d like to use for this WireGuard Client profile. We typically advise entering in the location. Our example server was New York so I have entered in Surfshark New York.
Set the VPN Type to WireGuard.
Click Browse and select the .conf file you downloaded earlier. Then click Save.
By default no devices will be assigned to the VPN Tunnel. With TP-Link firmware you must manually assign the devices that you want connected to the VPN tunnel. Proceed with the next steps to do so for all devices you want connected to VPN.
6. Click the Add button in the Device List area.
7. A list of devices connected to the FlashRouter’s network will appear. Check the devices that you want to connect to VPN. Then click OK.
8. Now that the devices have been assigned to the VPN connection click the Enable toggle in the Server List area.
In some cases you may notice that the location is not showing the same location as the server you have input in your router settings; this is because geo tracking tools are often tricked by VPN connections. As long as you see an IP address that is not the same as your normal Internet IP address then you are indeed connected to Surfshark.
If you are not already a Surfshark user Sign Up Now.
1. Log in to your account on the Surfshark website.
2. Click VPN Manual Setup.
3. Select Router as the Setup method.
4. Select OpenVPN as the Protocol.
5. Copy and paste your Surfshark manual username and password to a secure location. This is the username and password you will enter into the router settings to connect to Surfshark.
6. Click Location and select the server location you want to connect to. Unless you need a specific location we recommend using Surfshark’s recommended Fastest server. Click Download to download the UDP .ovpn file for this Surfshark server location.
Login to TP-Link firmware settings in a browser on any computer or smart device connected to the FlashRouter’s network.
1. Navigate to the Advanced tab.
2. Navigate to the VPN Client tab.
3. Check the Enable box next to VPN Client. Then click Save at the bottom of the page.
4. Click the Add button in the Server List area.
5. In the Description field enter in the name you’d like to use for this OpenVPN Client profile. We typically advise entering in the location. Our example server was New York so I have entered in Surfshark New York.
Set the VPN Type to OpenVPN.
In the Username and Password fields paste in the Surfshark username and password we obtained earlier.
Click Browse and select the .ovpn file you downloaded earlier. Then click Save.
By default no devices will be assigned to the VPN Tunnel. With TP-Link firmware you must manually assign the devices that you want connected to the VPN tunnel. Proceed with the next steps to do so for all devices you want connected to VPN.
6. Click the Add button in the Device List area.
7. A list of devices connected to the FlashRouter’s network will appear. Check the devices that you want to connect to VPN. Then click OK.
8. Now that the devices have been assigned to the VPN connection click the Enable toggle in the Server List area.
In some cases you may notice that the location is not showing the same location as the server you have input in your router settings; this is because geo tracking tools are often tricked by VPN connections. As long as you see an IP address that is not the same as your normal Internet IP address then you are indeed connected to Surfshark.
If you are not already an ProtonVPN user Sign Up Now.
1. Log in to your account on the ProtonVPN website.
2. Click Downloads.
3. Scroll down to WireGuard configuration and name the device FlashRouter.
4. Select Router as the platform.
5. Select the VPN options that best fit your needs. We typically use the settings as seen in the screenshot here if you are unsure.
6. Next select the server that you would like to connect to and click Create. At the top of the page you’ll see ProtonVPN’s recommended server which we recommend using unless you need to connect to a specific location.
If you need a specific server location find it in the list and click Create.
7. After clicking Create a new window will appear. Click Download to download the .conf file to your computer.
Login to TP-Link firmware settings in a browser on any computer or smart device connected to the FlashRouter’s network.
1. Navigate to the Advanced tab.
2. Navigate to the VPN Client tab.
3. Check the Enable box next to VPN Client. Then click Save at the bottom of the page.
4. Click the Add button in the Server List area.
5. In the Description field enter in the name you’d like to use for this WireGuard Client profile. We typically advise entering in the location. Our example server was New York so I have entered in ProtonVPN New York.
Set the VPN Type to WireGuard.
Click Browse and select the .conf file you downloaded earlier. Then click Save.
By default no devices will be assigned to the VPN Tunnel. With TP-Link firmware you must manually assign the devices that you want connected to the VPN tunnel. Proceed with the next steps to do so for all devices you want connected to VPN.
6. Click the Add button in the Device List area.
7. A list of devices connected to the FlashRouter’s network will appear. Check the devices that you want to connect to VPN. Then click OK.
8. Now that the devices have been assigned to the VPN connection click the Enable toggle in the Server List area.
In some cases you may notice that the location is not showing the same location as the server you have input in your router settings; this is because geo tracking tools are often tricked by VPN connections. As long as you see an IP address that is not the same as your normal Internet IP address then you are indeed connected to ProtonVPN.
If you would like to prevent visitors from connecting to your main WiFi network then you can create a Bridged Guest Network that will prevent access to the main router. This setup also allows you to create different rules for different WiFi SSID’s in your home ranging from QoS controls, access restrictions, VPN network segmentation, and more.
If you have a Dual-band or Tri-Band router you can setup a WiFi Guest Network, creating a separate VLAN (virtual local area network) for your visitors, or in order to segment your VPN networks on any band you like. We recommend using the 2.4GHz network for your DD-WRT Guest Wireless Network so it is compatible with the most possible WiFi devices. Setting up a guest network for visitors in your home allows you to keep them off of your main WiFi network.
We recommend performing this setup while connected to the FlashRouter via ethernet cable. If your computer does not have an ethernet port and you must proceed via wireless connection to the FlashRouter pay attention to the wireless connection as you may need to rejoin the FlashRouter’s network after making changes.
Navigate to Wireless > Basic Settings
Navigate to Wireless > Wireless Security
Navigate to Setup > Networking
Depending on the router model and WiFi band you are using, the wireless interfaces will be labelled differently.
This setting can be labelled wl1.1, ath0.1, wl2.1, and so on. Make sure when you get up to the bridge assignment section that you are using the correct guest network Virtual Interface.
Navigate to Administration > Commands
iptables -I FORWARD -i br1 -o br0 -m state –state NEW -j DROP
iptables -I FORWARD -i br0 -o br1 -m state –state NEW -j DROP
iptables -I INPUT -i br1 -p tcp –dport telnet -j REJECT –reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp –dport ssh -j REJECT –reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp –dport www -j REJECT –reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp –dport https -j REJECT –reject-with tcp-reset
You will now have a working Bridged Guest Network on the FlashRouter. By inputting the firewall rules, this will also prevent any guests on your network from gaining access to your router settings.
Navigate to Administration > Backup
If you are not already a ProtonVPN user Sign Up Now.
Log in to your account on the ProtonVPN website.
1. On the left hand side select Downloads.
2. Then select WireGuard Configuration.
3. Enter the Device Name to assign the FlashRouter to identify it among your ProtonVPN connections.
4. Set the Device platform as Router.
5. Select the VPN Options that you would like to connect with.
6. ProtonVPN will recommend the ideal server for you to connect to based on your location. Click Create or scroll down and select the server you wish to connect to and click Create next to the server number.
7. Click Download to download the .conf file of the server you selected.
Navigate to Setup > Tunnels
1. Click Import Config and then select Choose file. Select the .conf file that was downloaded earlier.
2. All settings will be loaded into the DD-WRT firmware the only field that needs to be adjusted is setting Persistent Keepalive to 25.
3. Click Apply Settings at the bottom of the page.
4. After 30 seconds or so refresh the page until you see the WireGuard Status on the page is populated as seen below.
Navigate to Setup > Tunnels
Navigate to Administration > Backup
If you are not already a PIA user Sign Up Now.
1. Log in to your account on the PIA website.
2. Successfully log in with your account information then go to PIA’s OpenVPN Config Generator.
3. On the OpenVPN Configuration Generator select the following:
OpenVPN Version: OpenVPN 2.4 or newer
Select Platform: Linux
Select Region: Choose the server location you’d like to connect to
Select Port: Typically we recommend UDP/1198 RSA-2048 AES-128-CBC SHA1 for best speeds but feel free to select the one you want to use.
4. Click Generate to download the .ovpn file. Do not open this file once it is downloaded.
Login to AsusWRT firmware settings in a browser on any computer or smart device connected to the AsusWRT FlashRouter’s network.
1. Navigate to the VPN tab.
2. Navigate to the VPN Fusion tab.
3. Click Add profile.
4. In the Connection Name field enter in the name you’d like to use for this OpenVPN Client profile. We typically advise entering in the location or server number here. Our example server was in New York so I have entered in PIA New York.
5. In the VPN Type dropdown select OpenVPN.
6. Click Import .ovpn file and select the .ovpn file you downloaded earlier. Then click Upload.
7. In the Username and Password fields paste in the PIA username and password you use to successfully login to your PIA website account.
8. Click Apply and Enable at the bottom of the page.
If you only want certain devices to connect to the OpenVPN Client profile you are setting up instead of all the devices connected to the FlashRouter’s network click into the profile and disable Apply to all devices. Then click Devices and select the devices that you want to connect to VPN.
9. At the top of the page set the Service State toggle to ON to activate the VPN connection.
In some cases you may notice that the location is not showing the same location as the server you have input in your router settings; this is because geo tracking tools are often tricked by VPN connections. As long as you see an IP address that is not the same as your normal Internet IP address then you are indeed connected to PIA.