Skip to main content

XKeen

XKeen is a utility for Keenetic routers that configures VLESS XRay to bypass site blocking. It's effectively a VPN at the router level: a secure connection to a server is established, through which all traffic bypasses your provider's restrictions.

XKeen's main advantage is flexible routing: you choose which sites open directly and which go through the VPN. Modern encryption protocols are supported, including VLESS with XTLS and Reality.

The guide is long, but it's structured step by step: prepare a USB drive → configure the router → install Entware → connect via SSH → install XKeen → configure Xray with your access key → launch.

Supported Router Models

The utility can only be installed on routers with a USB port — models without one don't have enough internal memory to run it properly.

Netcraze Ultra (NC-1812), Keenetic Peak (KN-2710), Keenetic Ultra (KN-1811, KN-1810), Keenetic Giga (KN-1012, KN-1010/1011), Keenetic Hopper (KN-3811, KN-3810), Keenetic Hopper SE (KN-3812), Keenetic 4G (KN-1212), Keenetic Skipper 4G (KN-2910), Keenetic Omni (KN-1410/1411), Keenetic Extra (KN-1710/1711/1713), Keenetic Viva (KN-1910/1912/1913), Keenetic Giant (KN-2610), Keenetic Hero 4G (KN-2310/2311), Keenetic Ultra SE (KN-2510), Keenetic Giga SE (KN-2410), Keenetic DSL (KN-2010), Keenetic Skipper DSL (KN-2112), Keenetic Duo (KN-2110), Keenetic Hopper DSL (KN-3610), Zyxel Keenetic II/III, Zyxel Keenetic Extra/Extra II, Zyxel Keenetic Giga II/III, Zyxel Keenetic Omni/Omni II, Zyxel Keenetic Viva, Zyxel Keenetic Ultra/Ultra II, Zyxel Keenetic DSL, Zyxel Keenetic LTE, Zyxel Keenetic VOX.

Preparing the USB Drive​

XKeen needs a USB drive connected to the router — don't disconnect it once installed.

Windows​

  1. Download and install MiniTool Partition Wizard Free Edition (or any other disk partitioning tool): choose English → Continue installing free edition → MiniTool Partition Wizard Free.
  2. Plug the USB drive into your computer and launch the program.
  3. Select the drive, delete all volumes, then create an EXT4 partition and a SWAP partition of 512 MB — 1 GB (see Keenetic's site for more on SWAP).
  4. Name the EXT4 volume OPKG.
  5. Safely eject the drive.

macOS​

  1. Install ExtFS for Mac (a 10-day free trial is available), restart your Mac and grant the app the required permissions.
  2. Plug the USB drive into your computer.
  3. In the left panel, select the drive itself (not a partition) and click "Erase".
  4. Set the name to OPKG, format to EXTFS4, scheme to GUID Partition Map, then click "Erase".

Preparing the Keenetic Router​

Creating a Backup​

Before installing OPKG and XKeen, we recommend backing up the router's firmware and settings.

  1. Log in to the router's web interface — usually 192.168.1.1 or my.keenetic.net (more details on the manufacturer's site).
  2. Management → System Settings → download the firmware and startup-config files.

Installing Required Components​

Plug in the USB drive, then in Management → System Settings → "Change component set" install:

  • USB Interface
  • Ext File System
  • File and Printer Sharing over SMB
  • Open Package Support
  • DNS-over-TLS Proxy Server
  • DNS-over-HTTPS Proxy Server
  • IPv6 Protocol
  • Netfilter Subsystem Kernel Modules

Configuring DNS​

Adding DNS records. Click the gear icon at the top right of the configurator page and select the command line. Enter the following one at a time (type the command in the Command field, then Send request):

dns-proxy
tls upstream 8.8.8.8 sni dns.google
tls upstream 8.8.4.4 sni dns.google
tls upstream 1.1.1.1 sni cloudflare-dns.com
tls upstream 1.0.0.1 sni cloudflare-dns.com
https upstream https://cloudflare-dns.com/dns-query dnsm
https upstream https://one.one.one.one/dns-query dnsm
https upstream https://dns.google/dns-query dnsm
exit
system configuration save

Reboot the router: Management → System Settings → System Reboot → Reboot.

Disabling IPv6. Internet → Ethernet Cable → Internet Connections over Ethernet Cable → Ports and VLANs → switch IPv6 to "Not used".

info

Before ignoring your provider's DNS, make sure the settings don't contain domain names of servers that authorize your connection — see Keenetic's site for details.

Configuring Keenetic for XKeen​

Setting Up an Internet Access Policy​

XKeen works as a proxy client bound to a dedicated access policy, so devices can selectively use the VPN.

  1. Internet → Connection Priorities → "Internet Access Policies" → create a new policy named XKeen.
  2. With multiple providers, you can enable multi-path transmission for reliability. Enable the checkbox for the Ethernet connection and save.
  3. Connection Priorities → "Policy Application" → add the devices (individual clients) or networks you need to the policy, and save.

Moving Keenetic Services Off Port 443​

Port 443 is usually taken by Keenetic services — moving it avoids a conflict with XKeen.

  1. Management → Users and Access → "HTTPS Management Port".
  2. Change the port from 443 to one of the recommended ones: 5083, 5443, 8083, 8443, or 65083. Save.

After moving, services (such as KeenDNS) will be available on the new port.

Installing Entware​

Entware is a software repository for resource-constrained devices like Keenetic routers. XKeen (and Xray itself) is installed on top of Entware.

Preparing the Installer Files​

Download the installer archive matching your router's architecture:

  • aarch64 (newer models with KeeneticOS 4.0+): aarch64-installer.tar.gz — Keenetic Peak, Ultra (KN-1811), Giga (KN-1012), Hopper (KN-3811), Hopper SE
  • mipsel: mipsel-installer.tar.gz — Keenetic 4G, Skipper 4G, Omni, Extra, Giga (KN-1010/1011), Ultra (KN-1810), Viva, Giant, Hero 4G, Hopper (KN-3810), most Zyxel Keenetic models
  • mips: mips-installer.tar.gz — Keenetic Ultra SE, Giga SE, DSL, Skipper DSL, Duo, Hopper DSL, Zyxel Keenetic DSL/LTE/VOX

On Keenetic Skipper 4G and Keenetic 4G models, the kernel needs to be replaced manually — contact support and we'll help.

Create an install folder on the drive (via the "Disks and Printers" app in the web configurator) and put the downloaded .tar.gz archive there.

Installing Entware​

  1. Go to the OPKG section of the web configurator.
  2. In the "Drive" field, select the USB drive. Leave the "initrc script" field empty — it will be filled in automatically (/opt/etc/init.d/rc.unslung).
  3. Click "Save" and wait for all Entware packages to install [5/5] (progress is visible in the router's system log).

Connecting to Entware via SSH​

Windows (PuTTY)​

  1. Download and install PuTTY.
  2. Set Host Name to your router's IP (default 192.168.1.1), Port to 22 (or 222 if the "SSH Server" component is installed), Connection type to SSH.
  3. Click Open, then confirm adding the security key (Accept).

macOS (Terminal)​

  1. Open Terminal (Cmd+Space → Terminal, or Finder → Applications → Utilities → Terminal).
  2. Run:
ssh root@192.168.1.1 -p 22
  1. On first connection, confirm the key fingerprint — type yes.

Changing the Password​

After connecting (login root, default password keenetic), change the password:

passwd

Enter the new password twice (characters won't be shown while typing — that's normal). Remember the login and new password — you'll need them for future connections.

Installing XKeen​

In the open SSH session, run one after another:

opkg update && opkg upgrade && opkg install curl tar
curl -OL https://raw.githubusercontent.com/jameszeroX/XKeen/main/install.sh
chmod +x ./install.sh
./install.sh

In the installer menu, choose:

  1. Xray proxy core — 1
  2. The latest core version — 1
  3. 1. Install missing GeoSite
  4. 1. Install missing GeoIP
  5. GeoFile updates — 1. Enable task, then a schedule (for example, 1 → 23 → 30)
  6. Add XKeen to autostart — 1
tip

Don't close the SSH window — after configuring the config files, you'll need to enter one more command.

Configuring Xray with Your Access Key​

XKeen uses three Xray configuration files:

  • 03_inbounds.json — defines how incoming traffic reaches Xray
  • 04_outbounds.json — configures the connection to the VPN server
  • 05_routing.json — contains traffic routing rules

Incoming Traffic [inbounds]​

Download the ready-made 03_inbounds.json — there's nothing to change in it.

Connecting to the Server [outbounds]​

Routing [routing]​

Use the XKeen Routing generator to build a 05_routing.json file: pick the "VPN for sites in the blocklist database" preset, or configure the rules yourself (domains, IPs — the "More" button opens advanced settings, "Preview" shows the resulting file), then download it.

Replacing the Files​

  1. In the web configurator: Management → Applications → Disks and Printers → your USB drive.
  2. Go to OPKG/etc/xray/configs/.
  3. Upload the three downloaded files to this directory, confirming the replacement of the existing templates.
info

Every time you replace 03_inbounds.json, 04_outbounds.json, or 05_routing.json, restart XKeen with xkeen -restart so the changes take effect.

Optimization​

To reduce CPU load, limit XKeen to ports 80, 443, and 50000:50030:

xkeen -ap 80,443,50000:50030

Launch​

xkeen -start

Conclusion​

Done — your router now runs a network-level VPN, configured for your personal access key. The full list of XKeen console commands is in the project's documentation on GitHub. If you have any questions or issues, please contact support.