TP-Link WireGuard Site-to-Site VPN Setup Guide

Related Reading: WireGuard Mesh VPN for Remote Teams: Secure Employee Access to Office Networks

Related Reading: WireGuard Mesh VPN for Home Networks: Zero Port Forwarding Guide (2026)

TL;DR

• LAN-to-LAN Connectivity: A site-to-site VPN routes two local networks together so devices on both sides can reach each other as if they were on the same LAN, without exposing public ports.
• Not Just Remote Access: Unlike remote-access VPNs (one user to one network) or host-to-host VPNs, site-to-site VPNs handle routing for entire subnets talking to each other.
• Tunnels and Routing: Every setup requires both the encrypted tunnel (WireGuard, IPsec) and the routing decision ("send traffic for that subnet down the tunnel"). Both must be correct for pings to work.
• The AllowedIPs Fix: A common mistake is bringing the tunnel up but forgetting the routing. In WireGuard, configuring `AllowedIPs` correctly fixes this every time.
• The 2026 Default is WireGuard: While older guides used IPsec, WireGuard is now the standard for TP-Link due to fewer config knobs, superior NAT handling, and a much faster setup time.

Yes — you can connect two, three, or thirty TP-Link branches with a single [site-to-site VPN](/blog/wireguard-site-to-site-vpn-how-it-works-2026/), and you don't need to throw out the routers you already own, run two static public IPs, or learn IPsec to do it. MeshWG turns the TP-Link Archer, Deco, ER, or Omada gear sitting on your branch desks into nodes on a cloud-managed mesh, using the WireGuard support already in your firmware.

A 20-branch deployment runs around ₹7,000 per month against the ₹30 lakhs of hardware plus ₹30,000 per month of licensing a traditional SDWAN setup costs for the same job. Pilot it on two machines free, forever — no credit card, no trial countdown, no card required to test on real branches before the third machine turns the meter on. Setup is under two minutes per branch. Below is exactly how this works in 2026, with the WireGuard configuration paths for Archer, ER, and Omada gear, the multi-branch numbers from real rollouts, and the parts the vendor documentation tends to skip.

Can I put a VPN on a TP-Link router?

Short answer: yes, on every TP-Link product line whose current firmware speaks WireGuard or IPsec. That covers more hardware than people assume.

• Archer (consumer, AX-series) — WireGuard server and client support landed in firmware released from late-2022 onward. The Archer AX73 is among the most commonly seen models at small branches that began with home-grade equipment and never had reason to replace it.
• Deco (mesh kits, X-series) — WireGuard server and client were added in 2024 firmware on most X-series mesh nodes. The “satellite” units inherit the configuration from the main node, so you configure once.
• ER SafeStream gateways (ER605, ER7206, ER8411) — these are TP-Link’s small-business router line, and they run the most complete VPN stack in the catalogue. Full WireGuard, full IPsec, both at the same time if you want. The ER605 is the de-facto reference branch router for MeshWG deployments — about ₹6,500 retail, dual-WAN, runs WireGuard with no add-on modules.
• Omada controller-managed gear — IPsec via the controller, WireGuard on individual gateways. The controller mode is fine if your whole estate is Omada; for mixed estates, work directly with each gateway’s local WireGuard panel.

The one gotcha worth naming honestly: a handful of older Archer C-series boxes from before 2022 don’t support WireGuard server mode, even on the latest available firmware. They can still join a MeshWG mesh as a client peer if the firmware ships WireGuard client support at all — but if it doesn’t, the move is either a firmware upgrade (if available) or retiring that unit. Before you commit to a particular model across all branches, open Firmware → About in one router’s admin UI, and look for the WireGuard module version. If it’s there, you’re set.

How to setup a VPN server on a router?

Five steps. Most branches complete all five inside two minutes; the slowest part is typically waiting for the router admin interface to load. The numbers cited below reflect representative onboardings on the TP-Link ER605 — typically under two minutes from clicking Add Machine in the MeshWG dashboard to the first successful ping across the tunnel.

Pick the central peer

Choose the router that will act as the central peer — the one most other branches will dial. Typically this is the head-office gateway, or whichever site has the most stable upstream. Any peer can play this role, and MeshWG calls it the hub, but the role is logical, not physical. If the head-office router dies you can re-elect any branch as the new hub in a few clicks.

Open the router’s WireGuard panel

In the TP-Link admin UI, the path depends on the product line. On Archer and Deco it’s Advanced → VPN Server → WireGuard. On the ER series it’s VPN → WireGuard. On Omada-managed gear, log into the controller and go to Settings → VPN → WireGuard. The post on /quickstart has screenshots of all three paths if you’d rather see them side by side.

Generate the keypair, then add the machine in MeshWG

Hit “Generate keypair” on the router — TP-Link’s UI does this in one click. The private key stays on the router and never leaves it. Copy the public key the router prints, then go to the MeshWG dashboard and click Add machine. Paste the public key. Name the machine something you’ll recognise three months from now — branch-mumbai-er605 or hq-router both work.

MeshWG returns the rest of the wg-quick configuration in the dashboard: the Endpoint (always vpn.meshwg.com:51820), the Address for this machine on the overlay, the AllowedIPs that point at the other branches, and a PersistentKeepalive = 25 that keeps the NAT mapping alive through any ISP-edge firewall.

Paste the wg-quick block back into the router

Back in the TP-Link UI, paste the configuration block into the WireGuard peer section. Save. No firmware update, no reboot, no separate certificate file to upload. The router applies the change immediately.

Verify the tunnel from a LAN client

The tunnel comes up within about ten seconds. From a laptop on the branch LAN, ping the head-office overlay IP — by default that’s 10.100.0.1. If the ping answers, the tunnel is up, the routing is right, and you can move on to the next branch.

The single most common first-time failure is forgetting to put the remote LAN subnet in AllowedIPs. The tunnel comes up, you can ping the overlay address, but you can’t reach 10.10.20.0/24 on the other side because the kernel doesn’t know to send those packets down the tunnel. MeshWG’s Add machine dialog has a field for the LAN subnet behind this router; fill it in, the dashboard builds the AllowedIPs for every peer accordingly, and the routing just works.

WireGuard vs IPsec for TP-Link site-to-site

Both protocols work. The question is which one fits your branches better — and the answer in 2026 is mostly about three things: NAT, vendor mix, and how much config you want to maintain.

Where IPsec on TP-Link is excellent

IPsec on the ER series and Omada is mature, well-documented in TP-Link’s own Omada pages, and the right pick when you have two static public IPs at both ends and you need to interoperate with a non-WireGuard endpoint — for example a Cisco ASA at a partner’s data centre, or an AWS Site-to-Site VPN gateway. IPsec is the lingua franca of inter-vendor tunnels and that’s a real advantage. If those constraints describe your setup, follow TP-Link’s own auto-IPsec guides and you’re done.

Where WireGuard on TP-Link earns its place

WireGuard is the right pick when:

• One or both branches don’t have static public IPs. ISP CGNAT is now the default for most fibre plans in India. WireGuard with PersistentKeepalive handles this cleanly because every peer dials outbound. IPsec without NAT-T configuration tends to struggle.
• You want fewer config knobs per branch. A WireGuard peer entry is about eight lines. An IPsec peer with full IKEv2 phase 1 and phase 2 policy is around thirty.
• Your branches run a mix of router vendors. WireGuard speaks the same dialect on TP-Link, MikroTik RouterOS 7, OpenWrt 19.07+, Ubiquiti UDM, and OPNsense. IPsec is also cross-vendor in theory, but in practice the IKE policy details bite a lot.
• You want fast failover. WireGuard re-handshakes in a few seconds when an upstream IP changes. IPsec’s IKE rekey timers are typically longer.

MeshWG picked WireGuard because most branch offices in 2026 look like the first three bullets above. If your setup looks more like the IPsec scenario, IPsec is a perfectly good answer. Pick the protocol by the branches you have, not by the protocol’s marketing.

How to add VPN client to TP-Link router?

The distinction between “VPN server” and “VPN client” on a router is mostly a mental model — under the hood, the configuration on both sides looks the same. The router with a static public address (or one acting as the hub) listens on a UDP port; the router behind ISP NAT dials out to it. Both call themselves WireGuard peers and exchange the same handshake.

On TP-Link gear, the path to add a client is:

• On Archer: Advanced → VPN Client → WireGuard.
• On the ER series: VPN → WireGuard → Peer.
• On Deco: More → Advanced → VPN → WireGuard Client.

In every case, the wg-quick block MeshWG hands you in the dashboard is the same — you don’t generate a separate “client config” versus “server config.” Paste it, save, watch the tunnel come up.

Connecting three or more TP-Link branches

Almost every guide on the public web stops at two routers. The moment you add a third branch, the textbook approach demands a three-router full mesh, which is three separate tunnel pairs. Add a fourth and you’re at six pairs.

The mesh-VPN model collapses the math. Every branch’s TP-Link router has exactly one WireGuard peer entry — the MeshWG cloud hub. When the Mumbai branch wants to talk to the Bangalore branch, packets ride Mumbai-router → hub → Bangalore-router, and the routing and access policy are decided in one place: the hub’s rules table.

From the branch router’s perspective, none of this is visible. The router has one peer, talks to one endpoint, and routes overlay-IP packets through that single tunnel. Adding the fifth branch to an existing four-branch mesh is a four-minute job at the fifth branch and zero changes at the other four.

When neither branch has a static public IP

This is the central reality in every branch-networking conversation in India today. Most independent retail chains, franchise pharmacies, and small clinic groups operate on a single Reliance Jio or Airtel Xstream fibre line per store. None of those lines come with a static public IP — they come with CGNAT.

Cloud control planes fix this without anyone at the branch having to upgrade their internet plan. Both branches dial outbound to a stable hostname — vpn.meshwg.com. The cloud peer forwards encrypted packets between the two branches. Neither branch opens an inbound port.

The WireGuard mechanic that makes this work is PersistentKeepalive = 25. Every twenty-five seconds the router sends a small encrypted heartbeat outbound to the cloud hub, which keeps the NAT mapping alive at the ISP edge.

Site-to-site VPN options for TP-Link branches in 2026

Here is a brief comparison of three honest answers for connecting TP-Link branch routers.

Feature	Native IPsec on TP-Link	Omada SDWAN (controller mode)	MeshWG WireGuard
Branches with no static public IP	Hard — needs NAT-T plus workarounds at the ISP edge	Supported in Omada v5+ when both sides are TP-Link	Native — every branch dials outbound only, works through CGNAT
Mixed-vendor branches	IPsec interop varies between firmware versions	TP-Link Omada-only	Any router that speaks WireGuard joins the same mesh
Configuration per branch	About thirty lines of IPsec plus IKE phase 1 and 2 policy	Controller-managed, firmware-bound	One paste, around eight lines of wg-quick
Adding the Nth branch	Add N more IPsec tunnel pairs across existing branches	Controller pushes the config to all sites	One paste at the new branch; no other branches touched
Monthly cost (20 branches)	Software is free; admin time and the IPsec licence stack are not	Controller licensing plus Omada hardware refresh cycle	Around ₹7,000 per month, no new hardware, no controller licence
Time to first tunnel	Hours per pair once IKE policy is dialled in	Hours per site, depending on controller setup	Under two minutes per site

What 20 branches actually cost

The reason we built MeshWG the way we did is that the economics of small-fleet branch networking have been broken for a long time.

Here’s what twenty branches looks like when the routers you already own do the work:

• Hardware — ₹0 new spend. The TP-Link routers already at each branch handle the WireGuard endpoint role.
• Software — ₹349 per machine per month.
• Monthly total for twenty branches — around ₹7,000.
• Setup labour — about two minutes per branch on average.

Common questions

How to setup site to site VPN on TP-Link router?
Open the router’s admin UI, navigate to Advanced → VPN Server → WireGuard (Archer/Deco) or VPN → WireGuard (ER series) or Settings → VPN → WireGuard (Omada). Generate the keypair on the router, copy the public key into MeshWG → Add Machine, paste the wg-quick block MeshWG returns back into the router’s WireGuard peer section, and save. The tunnel comes up within about ten seconds.

Can I put a VPN on a TP-Link router?
Yes — on every TP-Link product line whose firmware supports WireGuard or IPsec. That covers Archer (consumer) from late-2022 firmware onward, Deco (mesh) from 2024 firmware, the entire ER SafeStream gateway range (ER605, ER7206, ER8411), and Omada-managed business gear.

Does TP-Link ER605 support VPN?
Yes. The ER605 supports both WireGuard and IPsec natively in current firmware. It’s effectively the reference branch router for MeshWG deployments — affordable, dual-WAN capable, and runs WireGuard with no add-on modules.

What is site to site VPN in networking?
A site-to-site VPN is an encrypted tunnel that routes two local networks together, so devices on either side reach each other as if they were on one LAN. It’s different from a remote-access VPN, which connects one user to one network, and from a host-to-host VPN, which connects one device to one device.

How to set up site-to-site Auto IPsec VPN Tunnels on Omada Gateway?
Auto IPsec on Omada is set up in the Omada controller under Settings → VPN → Auto IPsec. It’s a fine choice if all your branches use TP-Link Omada gear and have static public IPs. For mixed-vendor branches, branches behind ISP CGNAT, or three-or-more-site topologies, WireGuard with a cloud control plane like MeshWG removes the IKE-policy and static-IP requirements. Both are legitimate paths; pick by what your branches actually look like.

How to add VPN client to TP-Link router?
The path is Advanced → VPN Client → WireGuard on Archer, VPN → WireGuard → Peer on the ER series, and Network → WAN → VPN Client on some Deco firmware. Paste the wg-quick configuration block MeshWG generates for that machine. The configuration is identical whether the router is in ‘client’ or ‘server’ mode — same keys, same endpoint, same allowed-IPs. The only practical difference is whether the router initiates the handshake or accepts it.

What is the best site to site VPN router?
Any router that speaks WireGuard. For a single SafeStream box at one site, the TP-Link ER605 is the most common pick at this price point. For a consumer router doubling as branch CPE, the Archer AX73 covers it. For maximum configuration flexibility — packet filtering, BGP, multiple WAN — OpenWrt-based hardware or MikroTik RouterOS gear gives the most headroom. MeshWG works on all of these because the underlying protocol is plain WireGuard, the same on every vendor.

Frequently Asked Questions (FAQ)

How does a [mesh VPN](/blog/how-to-set-up-a-wireguard-mesh-vpn/) differ from a traditional VPN?

A traditional VPN routes all traffic through a central gateway, creating a bottleneck. A [mesh VPN](/blog/how-to-set-up-a-wireguard-mesh-vpn/) establishes direct, peer-to-peer connections between all devices (like branch offices or cloud servers), reducing latency and eliminating a single point of failure.

Does MeshWG require installing software on every device?

No. MeshWG can be deployed directly on your existing edge routers (like TP-Link, MikroTik, or OpenWrt). This provides agentless, site-wide protection for all devices behind the router without installing VPN clients on individual laptops or IoT devices.

How does WireGuard [NAT Traversal](/blog/wireguard-nat-traversal-behind-cgnat-2026/) work?

WireGuard doesn't have native [NAT traversal](/blog/wireguard-nat-traversal-behind-cgnat-2026/), which is why MeshWG provides a cloud coordination plane. It handles UDP hole punching, PersistentKeepalives, and automatic endpoint discovery to seamlessly connect peers behind CGNAT or strict enterprise firewalls.

---