TP-Link's Archer user guides describe a VPN Server for reaching your home network from outside. To enable OpenVPN, go to Advanced, VPN Server, OpenVPN and tick Enable, choose UDP or TCP as the service type and a service port between 1024 and 65535, then set the subnet, choose home-network-only or internet and home access, generate a certificate if needed and export the configuration file for your client. TP-Link says to configure Dynamic DNS or assign a static IP to the router's WAN port and synchronize the system time with the internet before enabling the server.
PPTP and IPSec VPN servers are also offered on some models. Install an OpenVPN client on each remote device, and import the exported file. VPN Server does not work in Access Point mode, and behind another router the double NAT will block inbound connections.
The checks in more detail
If a client cannot connect, check the WAN address is public, the port is open, the certificate matches, the system time is right and the client is current. A VPN running on a device passes through the router as ordinary traffic, called passthrough. Keep firmware current. Set up dynamic DNS or a static WAN address before you enable the VPN server, since the remote device needs something stable to connect to, and test from a network outside your home.
Keep the router's firmware current, since a VPN server is reachable from the internet and needs patching more than most features. Test the VPN from a phone on mobile data, not from inside your home, because a connection from inside can appear to work while telling you nothing about the route from outside. Write down the port, protocol and address you chose, and keep the exported configuration file somewhere safe, because losing it means regenerating certificates for every client.
Differential
Likely causes of “TP-Link Archer routers VPN client or server will not connect”, and how to tell them apart
- 1
A private WAN address
What separates it The inbound VPN fails because the WAN address is a private one, which means a double NAT
How to confirm Fix the double NAT first, since inbound connections cannot pass through two routers
- 2
No dynamic DNS
What separates it The VPN address keeps changing because there is no dynamic DNS name for your home
How to confirm Use a DDNS name or a static IP address, so that clients always find your router
- 3
AP mode
What separates it The VPN Server is unavailable because the router is running in AP mode
How to confirm Use router mode, since the VPN Server is not available while the router is in AP mode
- 4
A wrong system time
What separates it There are certificate errors because the router's system time is wrong
How to confirm Sync the system time, since the certificates depend on the correct date and time
- 5
An old client
What separates it The client cannot connect because the VPN client software is old
How to confirm Update the client software to the newest version, and then try again
Before you touch a setting
Record this first — changing settings destroys the evidence
- The type of VPN and the port that it uses
- The WAN address of the router and whether you use DDNS
- The exact error message that the client shows
Try in this order
0 of 7 completedSet DDNS or a static IP
ReversibleSet up DDNS or a static IP address before you enable the VPN, so that clients can find you.
Sync the system time
ReversibleSync the system time on the router, since the certificates need the correct date and time.
Enable OpenVPN
ReversibleEnable OpenVPN under Advanced and then VPN Server, and tick the Enable option, and then test again to see whether it helped.
Choose type and port
ReversibleChoose the type and the port, and use a port number between 1024 and 65535.
Export the config
ReversibleExport the configuration file, which each client needs in order to connect to your VPN server.
Install the client
ReversibleInstall the client on each device that will connect, such as the OpenVPN app on a phone.
Test outside
ReversibleTest from outside your home, using another network such as a phone hotspot, and then test again to see whether it helped.
Model-specific
What is true of this model and not of its siblings
- Support
- Not every Archer model has a VPN server; check the user guide for your model.
- Deco
- TP-Link also publishes a Deco VPN supported list.
- Other models this page answers
- These steps also fit the Archer BE550 Wi-Fi 7 router, Archer AXE75 router, Archer AX73 router, Archer AX55 router.
Stop boundary
When this stops being a self-service repair
- !If the VPN works on other networks but not this one, check NAT and ports
- !If the server will not enable, contact TP-Link support
- !If the model has no VPN server, use another approach
Evidence ledger
Sources behind this answer
VPN questions.
VPN server types for comparison.
Features lost in AP mode.
Internet IP, MAC clone and LAN IP.
The company and its products.
Exact questions
Common questions
Where is VPN Server?+
The VPN Server is under Advanced, and then VPN Server, in the router's menu.
Which port range?+
The port range for OpenVPN is 1024 to 65535, so choose a number inside that range.
Do I need DDNS?+
You need DDNS, or a static WAN IP address, so that clients can always find your router.
Does double NAT matter?+
Yes, double NAT blocks inbound VPN connections, so it must be fixed first.
Do I need a client?+
Yes, you need a client on each remote device that will connect to the VPN.
Does system time matter?+
Yes, sync the system time, since a wrong clock can cause certificate errors.
What is passthrough?+
Passthrough is when a VPN on a device passes through the router to reach its server.
Do all models have it?+
No, not all models have a VPN server, so check the specifications of yours.