| Family | TP-Link Deco |
| Firmware floor for WireGuard | Deco X60 firmware 1.5.0 or later (mid-2023) |
| WireGuard throughput (single tunnel) | ~300 Mbps single tunnel |
| Maximum peers per tunnel | 5 |
| CPU | Quad-core ARM (Wi-Fi 6 SoC) |
| Approx Indian retail (2026) | ~₹25,000 (3-pack) |
| WireGuard menu path | Deco app → More → Advanced → VPN → WireGuard Server |
Who the TP-Link Deco X60 is for
Home office or single-site small office with Wi-Fi 6 mesh + WireGuard. The Deco X60 sits in TP-Link's Deco family — alongside other models that share the same firmware UI and configuration patterns but differ in CPU, throughput, and peer caps.
Setting up WireGuard on the Deco X60
The six steps below match what the dashboard's vendor-template picker generates for the Deco X60:
- Confirm firmware. Log in to the admin interface (typically
http://192.168.0.1) and verify the installed firmware is Deco X60 firmware 1.5.0 or later (mid-2023) or later. Update via Advanced → System → Firmware Upgrade if needed. - Open the WireGuard page. Navigate to
Deco app → More → Advanced → VPN → WireGuard Server. - Create a tunnel. Click Add. Generate a keypair. Set Listen Port to
51820. Set Tunnel IP to 10.100.0.1/24 for a hub or 10.100.0.2/32 for a spoke. - Add a peer. Paste the remote public key. Set Allowed IPs to the remote tunnel /32 plus the remote LAN subnet. Set Endpoint Host and Endpoint Port if the remote has a stable public address. Persistent Keepalive:
21 if behind NAT. - Enable and save. Toggle Enable and Save.
- Verify. The peer row should show a recent handshake timestamp within seconds of the remote side being configured.
Deco X60-specific gotchas
- Configuration is via the Deco mobile app, not the same web UI as Archer or Omada ER.
- Maximum 5 peers per tunnel; sufficient for road-warrior remote access but not for multi-branch HQ.
- Only the primary Deco node runs the WireGuard endpoint; satellite Decos extend the LAN but don't terminate tunnels.
What changes at multi-branch scale
The Deco X60 handles 1-5 sites cleanly. Past that, the configuration burden grows quadratically — five sites in a full mesh = ten peer relationships, each configured on both ends. The practical pattern past 3 sites is hub-and-spoke (every branch peers with one central router) plus a managed mesh layer that generates the per-router peer lists. MeshWG generates paste-ready configuration in the exact format the TP-Link UI accepts, including for the Deco X60 specifically.
Frequently asked questions
Does the TP-Link Deco X60 support WireGuard?
Yes, on firmware Deco X60 firmware 1.5.0 or later (mid-2023) or later. The Deco X60 runs on Quad-core ARM (Wi-Fi 6 SoC) and achieves ~300 Mbps single tunnel on a single WireGuard tunnel. WireGuard is configured under Deco app → More → Advanced → VPN → WireGuard Server in the admin interface, with up to 5 peers per tunnel on current firmware.
How fast is WireGuard on the TP-Link Deco X60?
~300 Mbps single tunnel single-tunnel on the stock firmware, measured iperf3 over a stable LAN. The Deco X60's Quad-core ARM (Wi-Fi 6 SoC) runs WireGuard without hardware acceleration, so the CPU is the binding constraint. For typical Indian SMB fibre uplinks (100-300 Mbps) the router is well above the WAN limit.
What is the firmware version with WireGuard on the TP-Link Deco X60?
Firmware Deco X60 firmware 1.5.0 or later (mid-2023) is the minimum that includes WireGuard. Confirm by visiting Advanced → System → Firmware Upgrade in the admin interface; if your installed version is below this floor, update via the same page first. Most Deco X60 units shipped after the firmware floor date arrive with WireGuard available out of the box.
How do I find WireGuard in the TP-Link Deco X60 admin UI?
Deco app → More → Advanced → VPN → WireGuard Server. If the option isn't visible, the most likely cause is firmware below Deco X60 firmware 1.5.0 or later (mid-2023) — update first, then revisit. On Deco devices specifically, the WireGuard configuration lives in the Deco mobile app, not the web admin.
How many WireGuard peers can the TP-Link Deco X60 support?
5 peers per tunnel on current firmware. This is the cap on devices connecting into this router as a WireGuard server (or peers this router has configured outbound). For deployments larger than this cap, the practical pattern is hub-and-spoke with a higher-capacity device (Omada ER7206 or ER8411) at HQ.
Can I run WireGuard between the TP-Link Deco X60 and a different router brand?
Yes. WireGuard is the same protocol on every implementation — your Deco X60 interoperates with WireGuard on MikroTik, OpenWrt, OPNsense, pfSense, Ubiquiti, Asus, GL.iNet, and the official Linux/Mac/Windows/iOS/Android clients. Configuration is the same set of fields (public key, endpoint, allowed IPs); only the UI for entering them differs per vendor.
Next steps
Add your Deco X60 to MeshWG's free tier and have the configuration generated, paste-ready into the Deco admin UI.