Keenetic router
How to connect a Keenetic router to CreateYourVPN through XKeen — so every device in your home uses the VPN, and your panel's split-tunneling rules reach the router automatically.
You need a Keenetic with a USB port. All the extra software (Entware + the Xray core) is installed onto a USB flash drive, so without a USB port you can't set up our VPN on a Keenetic — the stock firmware doesn't understand our protocol. Models with USB: Viva, Giga, Ultra, Peak, Hopper and similar; models without USB (for example Speedster) won't work. Easiest check: if there's no physical USB socket on the router, this method isn't for it.
Connecting a router means every device in your home — phones, TVs, consoles, laptops — uses the VPN without installing anything on each one. And with the setup below, the split-tunneling rules you configure in your panel travel to the router automatically: change them in the panel, and the router picks them up on its own.
Keenetic is a special case. Its stock firmware can't read a VPN subscription link, so we run a real Xray core on it through a project called XKeen, and add a tiny auto-updater that keeps the router in sync with your account.
What you'll need
- A Keenetic with a USB port.
- A USB flash drive (about 4 GB or more), which we'll format to ext4.
- A few minutes and access to your router (web interface + SSH).
Step 1. Turn on OPKG and connect the USB drive
In the Keenetic web interface, open General settings → Updates and component options → Component options (the exact wording depends on your firmware version) and enable Open Package support (OPKG) and Ext filesystem. The router will reboot to add them.
Format your USB flash drive to ext4 and plug it into the router.
Step 2. Install Entware and XKeen
Entware is the package system that lets you install extra software (like Xray) onto the USB drive; XKeen manages Xray for you.
Follow the official step-by-step guides — they keep the exact commands up to date for the current firmware:
Connect to the router over SSH (the login is the same as the web interface). Install the basics: opkg update, then opkg install curl.
Install XKeen following the guide above. When it's done, xkeen -v should report a version.
XKeen uses port 443. If your router's web interface uses HTTPS on 443, move it to another port first (for example 8443) so the two don't clash — the XKeen guide shows how.
Step 3. Get the command from your account
Everything you need is already prepared in your account: the Keenetic tab has an install command with your personal subscription link baked into it. Nothing to compose or hunt for — just copy it.
Turn on the Router support switch and select the Keenetic tab.
A ready-made install command appears. The part in quotes inside it is your personal subscription link for the router, shaped like https://your-host/sub/your-token/xray — this is what the router uses to pull your VPN together with the rules from your panel. Press Copy: the whole command is copied, with the link already filled in:
curl -fsSL https://createyourvpn.com/xkeen-install.sh | sh -s -- 'https://<your-host>/sub/<your-token>/xray'<your-host> and <your-token> here are just example placeholders; in your account they're already your real values. There's nothing to type or change by hand.
Paste the copied command into the router's SSH session and run it. It downloads our setup script, hands it your subscription link, installs a small auto-updater with a scheduled task, applies your configuration right away, and restarts XKeen.
The link in that command is a secret — anyone who has it can use your VPN. Don't share it or post it anywhere.
Step 4. Check that it works
On any device connected through the router, open a site that should go through the VPN and confirm your visible location changed. Sites you set to bypass the VPN in the panel should still open directly. From now on, when you change split-tunneling rules in the panel, the router updates itself on a schedule — no need to touch it again.
IPv6 note. The VPN runs over IPv4. If your provider gives you IPv6, disable IPv6 on the router (or don't route it into XKeen) so your real address can't leak around the tunnel.
Helpful references
- XKeen (Corvus-Malus) — detailed Russian-language walkthrough.
- XKeen install order (jameszeroX wiki) — step-by-step with screenshots.
- Xkeen-UI — an optional web panel for XKeen.