Skip to main content

Router setup

One install on your router protects every device behind it — no per-device apps, no manual reconnects.

The right answer for: Smart TVs, Apple TV, Roku, Fire TV, game consoles, smart-home gadgets, guests on your wifi, and anyone in the household who doesn’t want to think about VPNs.

OpenWRT

FOSS, runs on hundreds of router models. The default for tinkerers.

Easy if you already run OpenWRT — copy/paste UCI block, restart network. ~5 min.

→ official docs

ASUS Merlin

Custom firmware for ASUS routers. WireGuard GUI built in.

GUI-driven. Open VPN → WireGuard → fill 12 fields. ~10 min.

→ official docs

GL.iNet

Travel routers and home routers, OpenWRT-based with friendly GUI.

Easiest path. Upload .conf via Admin Panel → VPN → WireGuard Client. ~3 min.

→ official docs

pfSense / OPNsense

Enterprise-grade open-source firewalls.

More involved — install WireGuard package, create tunnel + peer + interface + firewall rules. ~30 min.

→ official docs

MikroTik RouterOS 7+

Pro/SOHO routers with deep CLI. WireGuard added in v7.

CLI/GUI. Translate .conf into RouterOS syntax — see MikroTik wiki.

→ official docs

Generic WireGuard router

Anything with a 'paste .conf' or 'upload .conf' option.

Find your router's WireGuard import page, paste the .conf below. ~5 min.

→ official docs

Get your config

Already a CHIMERA subscriber? Run this from any terminal — you’ll get all four router-formatted blocks (generic WireGuard .conf, OpenWRT UCI, ASUS Merlin fields, pfSense fields) ready to paste into the matching firmware.

curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.chimera.tw/v1/config/router | jq .

The response contains:

  • wireguard_conf — generic wg-quick .conf, works everywhere
  • openwrt_uci — paste into /etc/config/network
  • asus_merlin_fields — labelled values for ASUS GUI inputs
  • pfsense_fields — values for pfSense Tunnel + Peer GUI tabs

Pick the format that matches your router. Apply, restart network, verify with wg show or your firmware’s WireGuard status page. If anything doesn’t connect, the troubleshooting flow on the methodology page walks through the common firewall-rule pitfalls.

New to router VPN? Read this first

Will my router work?

Look up your model + “WireGuard support”. If the answer is yes, follow the matching firmware section above. If your router is locked-down (most ISP-issued routers and cheap consumer mesh systems), the answer is no — you’ll need to either flash custom firmware or buy a second router that does support it.

Recommended starter router

GL.iNet GL-MT6000 (~$170) or GL-MT3000 (~$70). OpenWRT-based, WireGuard out-of-box, dedicated GUI for VPN clients, ~600 Mbps WireGuard throughput on the MT6000. We don’t earn affiliate commission — this is what we recommend our friends.

Speed expectations

Router-VPN throughput is bounded by the router’s CPU. Cheap routers (~$30) do ~50 Mbps; mid-range (~$100) do 200-400 Mbps; high-end (~$300) approach the gigabit ISP cap. If you’re paying for 1 Gbps internet and bottle-necking on a $30 router, that’s the bottleneck, not us.

DPI evasion at router level

Routers run plain WireGuard, which works in most networks but can be blocked in heavily-censored regions (China, Iran, Russia in some periods). We don’t ship our DPI-evading protocols (Reality, V2Ray) on routers because they need a userspace daemon consumer routers don’t run. If you’re behind such a network, install CHIMERA on each device with the per-device clients (/android, desktop) for the Reality fallback path.

One subscription, one router (for now)

One subscription token issues one WireGuard client keypair. Today we recommend installing CHIMERA on either your router OR your device, not both with the same token — the WireGuard handshakes can conflict. Multi-device-per-token is on the roadmap.