This guide was verified on the model and firmware above. A different model, a different firmware version or a different menu layout can need different steps.
ASUS router guides · All router guides · Device setup guides
Verified means the workflow was tested by L2TPX on the firmware listed above. Available, unverified means this firmware offers the option but the workflow has not been tested. Not available means this firmware has no client for that method.
This guide configures the VPN Client built into an ASUS ZenWiFi AX (XT8) so the router itself connects to L2TPX. Devices that join that router’s Wi-Fi or LAN then use the VPN connection without installing a VPN app on each device.
This guide was verified against ASUS ZenWiFi AX (XT8) running firmware 9.0.0.4.386_9794 in Wireless router mode, using the router’s own L2TP client.
ASUS interface options can vary by model and firmware version. If your screen looks different, check your exact model and firmware before following the steps.
This guide describes only the interface of the configuration above. It is not a statement that other ASUS routers, other ZenWiFi models or other firmware versions offer the same L2TP client or the same fields.
Have these details ready before you open the router’s settings:
Your L2TPX account shows your VPN username, VPN password and the available servers by country, including server IP addresses and hostnames. The available VPN server locations page explains what that list contains; the connection address itself always comes from your account. Your website login can be different from your VPN credentials.
Because the verified L2TP screen has no Pre-Shared Key field, you do not need the L2TP/IPsec Pre-Shared Key (PSK / Secret) for this setup.
In the VPN Client area this firmware offers three profile types: PPTP, L2TP and OpenVPN. The L2TP tab shows four fields, Description, VPN Server, Username and Password, and no Pre-Shared Key (PSK / Secret) field.
So the profile you create here is an L2TP client profile without a pre-shared key. L2TPX supports plain L2TP on compatible devices and routers, and a plain L2TP profile uses the server address, your VPN username and your VPN password only.
Plain L2TP without IPsec does not add the IPsec protection layer. L2TP/IPsec adds that layer using a pre-shared key; this screen does not offer that field, so this guide documents plain L2TP and does not add a PSK anywhere. For the technical background, see how L2TP and IPsec work together.
Follow the order below. The labels in bold are the labels shown in the verified interface; use them to find the same controls on your own screen.
Connect a device to the router’s Wi-Fi or LAN, open a browser and enter the router’s admin address. The interface used for this guide showed the router’s own LAN address as 192.168.50.66 on its Network Map page; use the address your router actually shows. Sign in with the router’s admin credentials.
The header of the admin interface shows Operation Mode: Wireless router and Firmware Version: 9.0.0.4.386_9794, next to the network name. If yours shows a different mode or firmware version, do not assume that the steps below match your unit.
In the left menu, scroll to Advanced Settings and select VPN. The VPN page opens with two tabs, VPN Server and VPN Client.
Select VPN Client. The page explains the VPN Client feature and lists the three steps ASUS asks you to follow: add a profile, select a VPN connection type, then enter the VPN authentication information provided by your VPN provider.
Under VPN Server List, select Add profile. A dialog opens above the list with three tabs: PPTP, L2TP and OpenVPN.
Select L2TP. The dialog shows four fields: Description, VPN Server, Username and Password.
Fill in the four fields using the values in the field mapping table below, then select OK to save the profile. Cancel closes the dialog without saving. There is no Pre-Shared Key field in this dialog, so nothing else is entered here.
After you select OK, the profile appears in the VPN Server List with its description and VPN type in the matching columns. Use the control in the Connection column of that row to activate the profile, and read the Connection Status column to see the state of the connection.
| ASUS field | What to enter |
|---|---|
| Description | L2TPX, or any name you will recognise in the profile list. |
| VPN Server | The server IP address or hostname shown in your L2TPX account. |
| Username | Your L2TPX VPN Username. |
| Password | Your L2TPX VPN Password. |
The verified screenshots show VPN Server as an empty text box without hints or validation messages, so it is not verified whether this firmware accepts a hostname, an IP address or both. Enter the value exactly as your account shows it; if one form is rejected, try the other address listed for the same server.
No Pre-Shared Key (PSK / Secret) field is shown on this screen, so no PSK value is entered in this guide.
A changed public IP address shows that web traffic is being routed through the VPN server. That is a routing check, not a complete privacy or leak test.
Reopen the profile with Edit in the VPN Server List and check all four fields. Remove spaces that may have been pasted before or after a value. Confirm that the router itself has an internet connection, and that the server address is the one listed in your L2TPX account now.
The VPN username and VPN password are the values in your L2TPX account panel, and they can differ from your website login. The router’s admin password is not a VPN credential. Copy the values again instead of retyping them.
It is not verified whether this firmware accepts a hostname, an IP address or both. If one form does not work, enter the other address listed for the same server in your account.
That is expected on this firmware’s L2TP tab and it is not an error. A missing PSK field can mean the profile is plain L2TP rather than L2TP/IPsec. Do not search for a hidden PSK field or add one elsewhere; enter only the four fields the screen shows.
Use the control in the Connection column of the profile’s row and check the Connection Status column. If nothing changes, edit the profile and confirm the four fields again before changing anything else.
This guide covers one model and firmware version. Another model, another ZenWiFi model or a newer firmware can show different tabs, fields and buttons. If your L2TP screen does include a Pre-Shared Key (PSK / Secret) field, that profile is L2TP/IPsec and the PSK from your account is entered there as well. If you are unsure, contact support with your model and firmware version before changing settings.
The same VPN menu also contains VPN Server. On the verified firmware that area offers PPTP, OpenVPN and IPSec VPN server options, and in the supplied screenshots the PPTP VPN server option is switched off.
A VPN server accepts incoming connections from outside into your home network. The VPN Client configured in this guide does the opposite: it connects your router out to L2TPX. Configure only the VPN Client for this setup, and leave the VPN Server area off unless you are deliberately running a separate server.
This guide was verified only against the ASUS ZenWiFi AX (XT8) running firmware 9.0.0.4.386_9794. Other ASUS models, other ZenWiFi models and other firmware versions can present different tabs and fields, so check your own model and firmware first.
No app is needed on devices that use this router: they use the router’s VPN connection. That is the practical benefit of configuring the VPN on the router instead of on every device.
Not for this screen, because the L2TP tab has no PSK field. The Pre-Shared Key (PSK / Secret) is an L2TP/IPsec field and is entered only where the device asks for it.
L2TP provides the tunnel; it does not encrypt traffic by itself. Plain L2TP without IPsec does not add the IPsec protection layer that L2TP/IPsec provides with a pre-shared key.
Yes. The VPN username and VPN password are the same across supported connection methods; the guide for each device shows which fields that device needs.
Keep your VPN username, VPN password and the L2TP/IPsec Pre-Shared Key private. Do not post screenshots of the profile dialog with real values in them, and do not send credentials in a support message.
Setting up a phone or computer as well? Use the guide for that device, because the connection method and the fields it needs can differ from this router profile.
Every subscription includes IKEv2/IPsec and L2TP connection options, and the guide for your device tells you which one to configure.
Some routers show an L2TP option under their WAN or internet settings. That screen is for an ISP connection where the router itself dials an L2TP tunnel to the provider. It is not the VPN client you need for L2TPX, and a profile saved there will not connect you to a VPN service.
On this firmware the WAN area also offers an L2TP option for an internet connection supplied by an ISP. That is a different feature from the VPN Client profile used for L2TPX.
Use the VPN Client screen instead: Advanced Settings > VPN > VPN Client.
ASUS router guides · All router guides · Device setup guides
