Set up Surfshark on FRITZ!Box—and check which traffic uses it

To connect a compatible FRITZ!Box to Surfshark, download a Surfshark WireGuard configuration file and import it into the router. You are configuring the router as a VPN client, not installing the Surfshark app or creating a remote-access VPN back to your home. Surfshark’s setup guide documents this method.

Instructions dated October 25, 2026. The current FRITZ instructions below apply to FRITZ!OS 8.50 or later; older versions use different labels and may lack some options.

Check compatibility before changing anything

Open the router interface from a device on your home network by entering fritz.box in the browser’s address bar. Record the model and FRITZ!OS version shown on Overview.

• Check the model, not just the firmware. FRITZ says the 7490 and 6820 LTE cannot connect to VPN providers, while the 6590 Cable and 6490 Cable do not support WireGuard. A router supporting remote-access VPN does not necessarily support this setup.
• Save a settings backup and record existing VPN profiles. FRITZ requires existing WireGuard connections to be deleted before creating the provider connection. Removing one can interrupt someone’s remote access; do not delete it without a recovery plan.
• Have an active Surfshark subscription and router administrator access.

These restrictions come from FRITZ’s provider-connection guide, rather than a blanket claim that every WireGuard-capable FRITZ!Box will work. If yours is unsupported, use Surfshark on individual devices instead.

Before enabling the router VPN, confirm that ordinary websites load and note your public IP addresses using the tests below. Also record the DNS test result for comparison. Pause any VPN on the test device so it does not obscure the router’s result. This baseline check uses your normal ISP connection.

1. Download the Surfshark WireGuard file

In your Surfshark account:

1. Open VPN → Manual setup → Set up manually.
2. Select WireGuard.
3. Choose I don’t have a key pair, name it, select Next, then Generate new key pair.
4. Save the keys securely. These are manual-setup credentials—not your account email and password.
5. Open Locations, choose a server, and download its WireGuard configuration file.

These steps follow Surfshark’s FRITZ!Box instructions. Treat the downloaded file and private key as secrets: do not post them in screenshots or support forums.

2. Prepare MyFRITZ! and import the file

Follow FRITZ’s preparation step: under Internet → MyFRITZ! Account, enter your email address, select Apply, and use the confirmation email to register the router. If it is already registered, continue.

Then, in the FRITZ!Box interface:

1. Open Internet → Permit Access → VPN (WireGuard).
2. Select Add WireGuard Connection → Link Networks → Next.
3. Answer Yes to Has this WireGuard connection already been set up at the remote connection?, then select Next. Surfshark has supplied that configuration.
4. Name the connection, for example Surfshark, and continue.
5. At DNS domains of the WireGuard remote site, select Next.
6. Under Upload Configuration File, select Choose File, upload the Surfshark file, and continue.
7. Enable Send all network traffic via the VPN connection.

This is the FRITZ!OS 8.50+ procedure. If your interface instead shows Add Connection → User-defined setup, follow that path, answer Yes to the same remote-connection question, and import the file. That is the menu sequence in Surfshark’s guide. Some model-specific instructions label the routing option Send all IPv4 network traffic via the VPN connection, as in FRITZ’s 6660 Cable guide.

3. Choose devices and failure behavior

Before completing the wizard, review these settings:

• Selected devices: To limit the VPN to particular home-network devices, enable Only certain devices in the home network are to be accessible over this WireGuard connection and select them. Despite the wording, FRITZ documents this as the device-selection control for provider routing. Availability varies by model/version.
• Kill switch: If available, enable Allow internet access only via the VPN connection (kill switch) to block internet access when the tunnel is disrupted. This favors privacy over availability: a VPN outage can become an internet outage for affected devices.
• IP telephony: If calls become unreliable, FRITZ recommends Do not route IP telephony over the VPN connection. That restores a direct route for calls, excluding them from the VPN.

Complete the wizard with Next or Finish and approve any additional confirmation. These controls are described in FRITZ’s current guide. Do not assume Surfshark’s app kill switch also controls this manual router connection.

Check the result from a covered device

With the device’s own VPN still paused:

1. Load a website. A configured tunnel is not enough if browsing fails.
2. Check public IPv4. Use Surfshark’s IP checker. The IPv4 result should be the VPN exit address, not your recorded ISP address. If the checker displays only IPv6, use the separate test below to check both address families.
3. Check IPv6 separately. Use Test your IPv6 to check IPv4 and IPv6 connectivity. Surfshark currently says it does not support IPv6. A changed IPv4 address does not prove IPv6 is covered. If an ISP IPv6 address remains visible, do not treat that device as fully VPN-routed; ask support about blocking IPv6 for the affected clients.
4. Run a DNS leak test. Compare the resolver results with your baseline. Investigate unexpected ISP resolvers, but do not treat a passing test as proof of anonymity.

Repeat the check on each device you intend to cover. Do not assume guest Wi-Fi uses the tunnel: FRITZ’s 6660 Cable guide explicitly excludes guest-network internet traffic.

If something fails

Observation	Smallest useful check	What it indicates
No provider-import option	Check the exact model’s support and available firmware update	Remote-access support alone is insufficient; do not substitute an IPsec setup for this WireGuard procedure.
Configuration import fails	Check for existing WireGuard profiles and confirm the file came from Surfshark’s WireGuard manual setup	Resolve the documented profile restriction or wrong file before editing routes.
Browsing works, but IPv4 stays with the ISP	Check the traffic-routing option, selected-device list and whether the device is on guest Wi-Fi	The device may not be using the provider route.
VPN enabled, but websites fail	Record kill-switch state; temporarily disable the router VPN and, if necessary, its kill switch for a baseline check	If browsing returns, the problem is VPN-specific. This check removes VPN protection; avoid sensitive activity and restore the settings afterward.

For the last symptom, continue with the ordered checks in VPN connected but no internet, rather than changing DNS, protocol and MTU together. If support is needed, send the router model, FRITZ!OS version, server location and exact error—not your private key or full configuration file.