Supported ASUS WireGuard-server firmware and a reachable home endpoint.
Check the exact device
Menu names and behavior can vary by US hardware revision and firmware. This guide was researched from official material, not tested on a physical router.
Applies to: Supported ASUS WireGuard-server firmware and a reachable home endpoint.
Checked: 2026-11-01 · Risk: high-impact · Status: source-grounded editorial draft; not hands-on tested.
Version gate: Supported ASUS 388-family implementation; exact model and firmware required.
Before you begin
Confirm the WAN reachability required by the vendor. CGNAT and upstream routing are separate from local Wi-Fi. Keep keys private and do not expose router administration to the internet.
Procedure
- Connect locally and open VPN > VPN Server > WireGuard.
- Enable the server and add a dedicated client/peer according to the official page.
- Apply the settings; export the peer profile or QR code directly to the intended private client.
- Test from a different network, such as cellular, rather than only from the home Wi-Fi.
- Check that the peer can reach only the resources you intended to expose.
Verify the result
The remote peer establishes a tunnel and reaches an explicitly allowed service. Test again after the client disconnects/reconnects.
Undo or recover
Disable the server or revoke the peer; remove only the related upstream forwarding rule if one was deliberately created.
Stop and escalate
Ask the ISP about reachability when public-WAN requirements are not met. Changing DNS is not a replacement for a reachable endpoint.
The steps above combine paraphrased official instructions with an original safety and test workflow. They are not a verbatim manual, a guaranteed fix, or evidence of a common hardware defect.
Official sources
- ASUS WireGuard server setup —
asus-wireguard-server; access: full_text.
Try the right tool
Did this fix it?
Select an outcome, then open a correction email draft if the steps need attention. Nothing is posted automatically.
Do not enter passwords, keys, full MAC addresses, IP addresses or configuration files. Text is checked and redacted before opening your email app.