Building a Home WireGuard VPN with an AT&T Gateway and TP-Link AX5400

I wanted a VPN that I controlled instead of relying entirely on a commercial VPN provider. The goal was practical: connect four phones on the Mint Mobile network back to my home network, keep their WireGuard tunnels available all the time, and give the rest of the house a cleaner network layout.

This post documents the setup as I built it. It is a record of one home network, not a universal configuration guide. Router menus and firmware features can change, so verify the current documentation for your exact hardware before applying settings.

What WireGuard is

WireGuard is VPN software and a modern VPN protocol. It creates an encrypted tunnel between two devices: in this setup, the WireGuard app on a phone and the WireGuard server built into the TP-Link router. The tunnel protects traffic while it travels between the phone and home network and gives the phone a controlled path to permitted home resources.

WireGuard is not a separate internet connection, antivirus product, or magic privacy shield. It is a secure connection between configured devices. Because my router is the VPN endpoint, a phone using the tunnel can send its internet traffic out through my home AT&T connection, while also reaching services on the home network when those routes are allowed.

Each phone needs its own WireGuard profile. A profile contains the cryptographic keys and connection settings that identify that device to the router. That is why I created four profiles instead of sharing one profile across all four phones.

The starting point

My internet service uses an AT&T BGW320-500 gateway and a TP-Link AX5400-class router. In the TP-Link lineup, the specific router I used is the Archer AX72 Pro; AX5400 describes its wireless speed class rather than the model name.

The AT&T gateway does not provide the WireGuard server features I wanted. The AX72 Pro became the device responsible for routing, wireless access, DNS, and the home WireGuard server.

The physical layout is simple:

AT&T fiber
    |
AT&T BGW320-500
    | Ethernet LAN-to-WAN cable
TP-Link Archer AX72 Pro / AX5400
    |
    +-- Home network and PCs
    +-- WireGuard clients
    +-- Guest network for Roku TVs and other devices

The gateway remains in the path because it terminates the AT&T connection. The TP-Link is connected by Ethernet from a gateway LAN port to the TP-Link WAN/Internet port.

Why IP Passthrough mattered

The BGW320 does not offer a traditional bridge-mode switch. Instead, I configured IP Passthrough so the gateway would hand its public address to the TP-Link. This avoids putting the WireGuard server behind two layers of routing and NAT.

The important steps were:

Open the BGW320 administration page.
Go to Firewall > IP Passthrough.
Set the allocation mode to Passthrough.
Under Passthrough Fixed MAC Address, select the MAC address of the Archer AX72 Pro.
Save the change, entering the gateway Device Access Code if prompted.
Go to Home Network > Wi-Fi and turn off the gateway's 2.4 GHz and 5 GHz radios.
Reboot the BGW320, then reboot the TP-Link.

IP Passthrough does not automatically turn off the gateway's wireless radios. I had to disable Home SSID Enable and save that change separately. After that, the TP-Link supplied the Wi-Fi network and the gateway stopped competing for the airwaves.

A useful check is the TP-Link WAN status page. After the reboot, it should show the public AT&T address rather than an ordinary private address such as 192.168.1.x. The exact status display depends on the router firmware, so treat this as a diagnostic check rather than a promise about the UI wording.

Configuring the TP-Link

Once the TP-Link was online, I used its local administration page at 192.168.0.1. The local administrator password created during setup is separate from the wireless password. The admin password protects the router dashboard; the wireless password authenticates devices joining Wi-Fi.

I also enabled the router's DNS feature. DNS is the service that translates names such as example.com into IP addresses. Keeping DNS under the router's control gives the home network one place to apply the selected resolver and makes the behavior consistent for PCs, phones, and other clients.

I enabled Dynamic DNS as well, because a residential public IP can change. A TP-Link DDNS hostname gives the WireGuard clients a stable name to contact instead of requiring me to update every phone whenever the ISP address changes.

Hosting WireGuard at home

Because IP Passthrough put the TP-Link directly on the public side of the home connection, I hosted WireGuard on the router. That choice keeps the path straightforward:

The phones connect to the WireGuard server on the TP-Link.
Their VPN traffic exits through my AT&T home connection.
The phones can reach permitted devices on the home network while away from home.
Websites see the home's public address when full internet tunneling is enabled.

Creating the four phone profiles

In the TP-Link interface, I opened Advanced > VPN Server > WireGuard and enabled the server. For the client access type, I chose Internet and Home Network so the phones could use the tunnel for internet traffic and reach resources on the home LAN.

I created four separate client accounts, one for each phone. Each profile has its own keys and tunnel address. I did not reuse a profile between phones; separate profiles make it possible to revoke one phone without replacing the configuration on every other device.

On each Android phone, I installed the official WireGuard application, chose the option to scan a QR code, and scanned that phone's profile from the TP-Link account list. I repeated the process for all four phones.

When a phone leaves home Wi-Fi and moves to Mint cellular service, I can open WireGuard and turn its tunnel on. In this setup, the tunnel can remain enabled continuously. WireGuard is lightweight, and the phone can roam between networks while maintaining the encrypted connection when the underlying network permits it.

Separating the Roku TVs

I also enabled a guest network for the Roku TVs and other devices that do not need access to my PCs. The purpose is isolation: guest clients should have internet access without being able to initiate connections to the primary home LAN.

For older or simpler smart-home hardware, I used the 2.4 GHz guest network. That band generally offers better range and broader compatibility than 5 GHz, and many inexpensive devices only support 2.4 GHz. The guest network password is separate from the router's admin password, and the Allow Guests to Access My Local Network option should remain disabled.

There is an important trade-off. Isolation can interfere with local casting, printing, discovery, or control. A Roku that needs to be controlled from a phone on the main network may require careful testing, a permitted management path, or placement on a network where the required local discovery works. Security boundaries are useful only when they still support the devices' intended workflow.

The TP-Link may also show an IoT Network option. I treated that as a compatibility-focused SSID, not automatically as a security boundary. The Guest Network is the setting to verify when the requirement is actual separation from the primary LAN. Firmware behavior can vary, so I tested client-to-LAN access rather than trusting the label alone.

Hardening checklist

After the main setup worked, I reviewed these settings:

Install current firmware updates on the TP-Link and AT&T gateway.
Use a long, unique router administrator password.
Use unique wireless and guest-network passwords.
Keep WPS disabled.
Use a reputable DNS resolver or a local filtering resolver such as Pi-hole.
Keep one WireGuard profile per phone and revoke lost devices promptly.
Confirm that guest clients cannot reach PCs or router administration pages.
Test the VPN from cellular data, not only while connected to home Wi-Fi.
Do not publish private keys, QR codes, public IP addresses, or passwords in screenshots or blog posts.

What I ended up with

The final setup uses the AT&T BGW320-500 as the fiber gateway, with IP Passthrough handing the public connection to the TP-Link Archer AX72 Pro. The TP-Link supplies DNS and the primary Wi-Fi network, hosts the WireGuard server, and routes the four phone profiles. The Roku TVs use a separate guest network, preferably on 2.4 GHz for compatibility and with local-network access blocked.