Router
VPN on a router
One tunnel for the whole home. TV, consoles, smart bulbs — everything goes through the VPN, with nothing to install per device.
Who gets it
One router is included in the Premium plan at no extra cost. On other plans the router is an add-on at 249 ₽ a month: the price is prorated for the remainder of the paid period, then it renews together with the plan; the dashboard shows the amount right on the button.
Several routers. For a country house, an office or your parents you can add more routers, up to three in total. Each additional one costs 249 ₽ a month, on Premium too, there is no long-term discount on routers.
Server country. Germany or the Netherlands, you can change it at any time. How to add a router and change the country is explained below.
Exception — the weekly period: the router isn't sold on it, you need a monthly plan or longer.
If you cancel the router early, the remaining paid days burn and money isn't returned — the dashboard warns with the exact number. When the subscription itself ends, router access ends with it.
It's a separate access with its own key and doesn't take slots from your plan — no matter how much hardware sits behind it.
Important: that's true of the dedicated router access from the Router block. If you paste your regular subscription link into a router instead, it will consume a slot like an ordinary device.
Two methods — pick by firmware
The method depends on what your router supports, not on taste. In the “VPN on your router” window pick your model in the Your router list: the window shows what you need, a file or a key, and the steps for that model. The badge shows how easy the router is to set up.
| Method | What you get | For whom |
|---|---|---|
| AmneziaWG 2.0 | a ready config file | Keenetic and Netcraze with firmware 5.1+ easy GL.iNet with firmware 4.9+ easy MikroTik with RouterOS 7 advanced ASUS with Merlin firmware advanced |
| AmneziaWG 3.1 | a ready config file | Keenetic and Netcraze with firmware 5.2+, a test release for now easy MikroTik with RouterOS 7 advanced |
| VLESS Reality | a vless:// key link |
Reality-capable firmware — e.g. OpenWrt with Podkop advanced |
A router isn't “press one button”: you'll open its admin panel, and the second method also needs a package installed. With two or three devices at home, per-device apps are simpler.
How to connect
No third-party software is needed on Keenetic and Netcraze: AmneziaWG is built into the firmware. You need KeeneticOS 5.1 or newer.
-
In the dashboard, on the home page, open the router VPN row. In the VPN on your router window the Your router list should say Keenetic, Netcraze. Press Download file. Right after purchase the file takes about a minute to prepare: if the button is not there yet, wait and refresh the page.
The “VPN on your router” window: router, country, “Your router” and the download button. Open the router admin panel in a browser:
my.keenetic.netor192.168.1.1. If the address differs, it is printed on the sticker underneath the router.-
In the left menu open Internet, then Other Connections. In the Wireguard section press Import from a file and choose the downloaded file. Nothing to type: all parameters are inside.
The Wireguard section: the import button, the connection appears below. No Wireguard section or no Import from a file button?
Then the WireGuard component is not installed on the router. You add it in the router's own settings.
-
In the left menu open Management, then System Settings. Press Component options.
System Settings: the Component options button. The screenshot is from the Russian interface. -
In the window that opens, type WireGuard into the search box and tick WireGuard VPN. You do not need the WireGuard VPN server item.
The component window: the WireGuard VPN row with its checkbox on the right. At the bottom of the window press Update KeeneticOS (on Netcraze, Update NDMS) and confirm. The router installs the component and reboots, so the internet drops for a few minutes.
After the reboot go back to Internet, Other Connections: the Wireguard section will be there.
-
A SafeMoney-router connection appears in the list. Turn it on with the switch left of its name. A green dot in the Peer column means the connection is up.
Set up routes: without them the router sends nothing to the VPN. In the builder you tick the services you need and load the ready file into the Routing section.
Router requirements
| Requirement | Details |
|---|---|
| Model | Keenetic or Netcraze |
| Firmware | KeeneticOS 5.1 or newer — older versions won't load our config |
| For version 3.1 | KeeneticOS 5.2 or newer |
| Where to check | Router panel: System Dashboard, the About the System tile, the OS version line. Or Management, System Settings, the Installed version line |
The admin panel usually opens at my.keenetic.net or 192.168.1.1. Some models differ — e.g. 192.168.0.1; the right address is printed on the sticker underneath the router.
Almost always the firmware: versions older than 5.1 simply don't load this config. Update KeeneticOS and try again.
AmneziaWG 3.1
In the “VPN on your router” window, in the file card, there is a Version button: it shows which version is on and opens a list of the two versions. AmneziaWG 3.1 is a newer version of the same method: the file is loaded into the router the same way.
Who it is for. Keenetic and Netcraze with firmware 5.2 or newer. Right now 5.2 is a test release, installed from the developer update channel in the router settings. Version 3.1 won't work on firmware 5.1, keep using 2.0 there.
How to turn it on. Press Version 2.0, pick AmneziaWG 3.1 in the list, read the note and press Switch to 3.1. Then download the new file.
Only one version works at a time. After you switch, the 2.0 file keeps working for one more day so you can test the new one. After that only 3.1 remains. To go back, pick AmneziaWG 2.0 in the same list and press Back to 2.0. The one-day window is given once a week: if you switch more often, the previous file stops working right away.
If you are moving from 2.0. Load the new file as a new connection and turn it on. Routes are tied to a connection, so load them again and pick the new connection. Remove the old connection once you have checked the new one.
This path is for Reality-capable firmware — first of all OpenWrt with the Podkop package. There's no file here: the dashboard gives a key link you paste into the package settings.
Install Podkop on the router following the package's own docs. Nothing is needed on the VPN side — we only issue the key.
In the dashboard open the same VPN on your router window and pick Other, with VLESS Reality in the Your router list.
-
Press Copy key: a
vless://…key goes to the clipboard. After purchase the key appears within a minute.Instead of a file, a key link and the Copy key button. Add the key to Podkop as an outbound connection and apply the config.
Router access is limited to a single device. If you also paste this key into a phone, the second connection simply won't come up. Use the regular subscription for phones.
Podkop keeps its own list of what goes into the tunnel. Our route builder is made for Keenetic's Routing section and doesn't apply here.
MikroTik has no built-in AmneziaWG support, so a small third-party app, awg-proxy, is installed on the router. A ready set of commands does all the setup: a generator page builds it from your file. We tested this method on RouterOS 7.24 with our 2.0 and 3.1 files.
| Requirement | Details |
|---|---|
| System | RouterOS 7, preferably updated to a recent version |
| CPU | ARM, ARM64 or x86. The method does not work on MIPS models |
| Where to check | System, Resources: the Version and Architecture Name lines |
In the dashboard, on the home page, open the router VPN row, pick MikroTik in the Your router list and press Download file. Both versions work: 2.0 and 3.1.
-
Open the router terminal: the Terminal button at the top of the web interface or New Terminal in WinBox. Install the container package by running two commands one after another:
/system/package/enable container/system/package/apply-changesThe router downloads the package and reboots. After that System, Packages shows yes next to container. If the command says there is no such package, update RouterOS and try again.
After the reboot the container package shows yes. -
Allow the router to run apps. In the terminal run:
/system/device-mode/update container=yes fetch=yes scheduler=yesThe router waits five minutes for confirmation: switch its power off and on. On many models a short press of the Mode or Reset button is enough instead, the router itself says what it is waiting for.
The command is entered, the router waits for confirmation. -
Open the command generator (the EN button switches its language). Open the downloaded file in Notepad, copy everything and paste it into the .conf file contents field. Keep the mode MikroTik + Container (Docker).
The file contents go here. -
Below, choose what goes through the VPN. DNS-based routing for services: only the ticked services, this is the default. All non-RU traffic through tunnel: everything foreign, while Russian sites go directly. Then press Generate commands.
-
Two blocks of commands appear. In the Step 1: Install AWG Proxy block press Copy all and paste the commands into the router terminal. Wait for the line Installation complete! and the ping replies.
Two blocks of commands, each with its own copy button. Setup finished: the Installation complete! line and ping replies. Copy and paste the Step 2: Routing Setup block into the terminal the same way.
-
Check: in the Container menu awg-proxy has the R flag, and the chosen services open on devices connected to the router.
The app is running: the R flag.
awg-proxy and the command page are maintained by an independent author, not SafeMoney, the code is open on GitHub. In our check the page works right in the browser and does not send the file contents anywhere. The Check for container updates daily box turns on auto-update of the app: untick it before generating if you prefer to update it yourself.
The file and key go on one router. If you put them on another router too, both will be disconnected. For a second location add another router in the dashboard, and use the regular subscription for phones and computers.
In the services mode the router recognises a site by the request for its address. Turn off Secure DNS in the browser and Private DNS on the phone: with them the router does not see such requests.
The command /system/script/run awg-proxy-1-uninstall removes the app and every setting the command set added. Our route builder is made for Keenetic and is not needed for MikroTik.
GL.iNet. You need firmware 4.9 or newer: it includes an AmneziaWG client. The 2.0 file is imported in the router's VPN section. GL.iNet documentation.
ASUS. Stock firmware does not support AmneziaWG. You need Asuswrt-Merlin firmware, a USB drive for Entware and the third-party AmneziaWG add-on: it adds a page to the router panel where the 2.0 file is imported.
We have no step-by-step guides for these routers, the setup is up to you.
Several routers and changing the country
Every router has its own file and key, its own name and its own country. You can connect up to three routers in the dashboard.
Add a router
In the VPN on your router window press the Another router card next to your routers.
-
Pick the server country and, if you like, type a name such as “Country house”. Below you can see how many days are left in your subscription and what the router costs after that.
The “Another router” window: country, name, term and the Connect button. Press Connect: the price for the rest of the period is taken from your balance. If the balance is short, the button says Top up and opens the balance with the right amount already filled in.
Within a minute the new router gets its own file and key. Load them into the router the same way as the first one.
Change the country
-
Under the router cards press the country button, pick another country and press Change to ….
The country button: picking another country and “Change to the Netherlands”. There is nothing to download: the file and key stay the same. After switching, turn the VPN connection in your router off and on or restart the router so that it moves to the new country.
If the window says there will be a new file and key after the change (this happens with routers connected earlier), download the new file and load it instead of the old one. This is needed only once, after that the country changes without a new file. You can switch back to the previous country at any time.
Rename
Press the pencil next to the router name, type your own and press Save. Only you see the name, it helps to tell routers apart.
If you put the file or key somewhere else too, both routers lose the connection. For a second location add another router: it gets its own file. Use the regular subscription for phones and computers.
Reissue if the file got into the wrong hands
In the dashboard, in Profile (the person icon at the top), there is a Reissue router access block. It gives the router a new file and key, and the old ones stop working right away. If you have several routers, the dashboard asks which one to reissue. You can reissue no more than once every 15 minutes. After reissuing, load the new file into the router.
Next — routes
On Keenetic and Netcraze the connection alone changes nothing: only the services you loaded routes for go through the VPN. Banks, government sites and the rest of the internet stay on the regular channel.
On MikroTik this is chosen right away, in the command generator.
Still stuck? Message support or email support@safemoneyvpn.com
Page updated: 12 October 2026