TP-Link WireGuard Setup Guide
Select TP-Link models support WireGuard in stock firmware (Archer AX55 V1/V2, AX20/AX21 V3, AX53, Deco X/BE series). The firmware handles NAT automatically — PostUp lines are stripped and should be removed before importing.
Check your router is supported
WireGuard is available in stock firmware on: Archer AX55, AX20, AX21 V3, AX53, AX3000, and Deco X/BE series (varies by region and firmware version).
Update to the latest firmware at tp-link.com/support/download.
Create a tunnel in ProxyLink
Go to Devices → + Add → Router / LAN site, select Home / LAN Router, enter your LAN subnet, and download your .conf file.
Edit the config before importing
TP-Link stock firmware strips unsupported fields. Open the .conf in a text editor and remove these lines:
# Remove these lines: PostUp = ... PostDown = ... DNS = ...
Only keep: PrivateKey, Address, PublicKey, AllowedIPs, Endpoint, PersistentKeepalive.
Import in TP-Link admin panel
Open your router admin panel → Advanced → VPN → VPN Client.
Enable VPN Client, click Add, select WireGuard, and import your edited .conf file.
Enable and test
Toggle the VPN client ON. TP-Link handles NAT automatically — no manual iptables rules needed. Your LAN devices are now reachable via ProxyLink proxy links.
Good to know
What you get once the tunnel is up
- Browser RDP, VNC, and SSH — open a terminal or remote desktop to any device behind the tunnel straight from the ProxyLink dashboard. No client software, no open ports on your side.
- Proxy links — share an HTTPS URL that forwards to any internal web interface (NAS, NVR cameras, PBX admin panels, router UIs) with ProxyLink login in front of it.
- No public exposure — the device keeps zero open ports and needs no static IP. The tunnel is outbound-only WireGuard to EU-hosted infrastructure. Read more about agentless remote access and NIS2 compliance.
Ready to connect?
Create a free account and set up your first tunnel in minutes. Free during early access — no card required.