Setting up a VPN on a Keenetic router
A router isn't necessarily the most convenient place for a VPN, but it's sometimes the right one: set it up once and it works for every device on the network, including TVs and set-top boxes where installing an app isn't an option.
Two different scenarios
The first is routing all router traffic through the VPN. Simple to set up, but it loads the connection and tunnels things that don't need it (local services, in-region sites). The second is split-tunneling: only traffic for selected domains or services goes through the VPN, everything else goes direct. On Keenetic this is done through routing policies and static routes, not DNS-based rules — DNS-based routing on Keenetic assigns a route based on the IP in the DNS response, but many services return different IPs to different users and change them without notice, so static routes to a provider's/service's actual IP ranges are more reliable.
Why the protocol matters
ISPs and DPI systems can recognize VPN traffic by signature — not by the fact that it's encrypted, but by characteristic patterns of specific protocols. Classic WireGuard is relatively easy to detect this way, which is why some networks throttle or block it. Protocols that disguise traffic as ordinary HTTPS (like VLESS Reality on top of Xray) or WireGuard forks with obfuscation (AmneziaWG) make that kind of detection harder — see our glossary for more on these terms.
What you can do yourself, and what's harder
Keenetic's firmware supports a WireGuard client out of the box — basic setup with one server can be done yourself through the web interface. It gets harder when you need to: (1) set up your own server with a protocol that's harder to block, (2) configure split-tunneling at the static-route level targeting specific services rather than manually entering IP ranges that then change, (3) make sure none of this breaks when the router's firmware updates or a service's IP changes.
If you'd rather set it up once and forget it
We set up your own VPN server (WireGuard, Xray/VLESS Reality, or AmneziaWG — depending on the task) and, if needed, split-tunneling on the router itself, including Keenetic.
"Set up your own VPN" serviceAlready a client? Open a ticket.