📡

Asus Merlin WireGuard Setup Guide

Asus Merlin firmware adds WireGuard client support on WiFi 6/6E/7 (HND platform) routers since firmware 386.4. Older models need Entware. The Merlin UI does not fully support PostUp — use hook scripts instead.

Check your router is supported

Native WireGuard is available on: RT-AX86U, RT-AX88U, RT-AX58U, GT-AX6000, RT-AX68U, and other WiFi 6+ models. Check asuswrt-merlin.net for your model.

Older ARM models (RT-AC86U etc.) need Entware: install wireguard-tools via opkg.

Create a tunnel in ProxyLink

Go to Devices → + Add → Router / LAN site, select Home / LAN Router, enter your LAN subnet (e.g. 192.168.1.0/24), download your .conf file.

Import the config in Merlin UI

In the Asus router UI go to VPN → VPN Client → WireGuard tab.

Click Add profile and import your .conf file. The profile will be named wg21, wg22, etc.

Add NAT masquerade rule (router mode)

The Merlin UI ignores PostUp. Add a persistent rule via JFFS scripts. Enable JFFS scripts in Administration → System first, then SSH in:

cat >> /jffs/scripts/nat-start << 'EOF'
iptables -t nat -A POSTROUTING -s 10.100.0.0/16 -o br0 -j MASQUERADE
EOF
chmod +x /jffs/scripts/nat-start

Enable the VPN client

Back in the VPN Client tab, set the profile to ON. The tunnel connects and your LAN devices become reachable via ProxyLink.

Good to know

Asus Merlin uses br0 (not br-lan) as the LAN bridge. Use br0 in all iptables rules.

JFFS scripts in /jffs/scripts/nat-start run on every NAT table initialization — they survive reboots and firmware updates (as long as JFFS is enabled).

What you get once the tunnel is up

Browser RDP, VNC, and SSH — open a terminal or remote desktop to any device behind the tunnel straight from the ProxyLink dashboard. No client software, no open ports on your side.
Proxy links — share an HTTPS URL that forwards to any internal web interface (NAS, NVR cameras, PBX admin panels, router UIs) with ProxyLink login in front of it.
No public exposure — the device keeps zero open ports and needs no static IP. The tunnel is outbound-only WireGuard to EU-hosted infrastructure. Read more about agentless remote access and NIS2 compliance.

Ready to connect?

Create a free account and set up your first tunnel in minutes. Free during early access — no card required.

Start free → Other platforms

Setup guides for other platforms

🐧Linux Server 🪟Windows 🍎macOS 🤖Android 📱iPhone / iPad 🔧OpenWrt 🌐GL.iNet 🗄️Synology NAS ⚙️MikroTik RouterOS 7 📶TP-Link 🛡️OPNsense 🔒pfSense 🔵Ubiquiti UniFi Gateway 🔷Ubiquiti EdgeRouter 📻Netgear 🔌Zyxel