VPN on Your Router
A VPN on the router protects every device in your home with one connection — including smart TVs, consoles and other devices that cannot run a VPN app. Below: how to check whether your router can do it, how to set it up and what to expect.
Updated October 9, 2026
VPN on the router or on each device?
| VPN on the router | VPN app on each device | |
|---|---|---|
| Which devices are covered | Everything on your Wi-Fi and cables, including TVs, consoles, smart speakers | Only devices where the app is installed and turned on |
| Always on | Yes, nobody can forget to switch it on | Depends on each person and device |
| Changing country | In the router settings — slower | One tap in the app |
| Speed | Limited by the router’s processor | Usually higher: phones and computers encrypt faster |
| Extra features | Ad blocking, split tunnelling and similar app features are often not available | All features of the service |
A router VPN makes sense when you want the whole home behind the VPN, or need it on devices without apps. If only one or two people need a VPN, the apps are simpler and faster.
Does your router support a VPN client?
The router needs a VPN client — a function that connects the router itself to a VPN service. Many routers only have a VPN server, which lets you connect to your home network from outside but does not send your home traffic through a VPN service. Check which one your router has:
- ASUS — VPN client in the stock firmware (VPN Fusion): OpenVPN, PPTP, L2TP and, on supported models with firmware 3.0.0.4.388 or later, WireGuard. You can choose which devices use the VPN.
- TP-Link — selected Archer models have Advanced → VPN Client with OpenVPN, PPTP, L2TP/IPSec and, on some models, WireGuard. Only the devices you add to the list use the VPN. Not every TP-Link router has this menu.
- Netgear — the built-in “VPN Service” is a VPN server for remote access. Stock Nighthawk firmware cannot connect the router to a VPN provider; ExpressVPN offers its own router app for some Netgear models.
- GL.iNet — OpenVPN and WireGuard clients preinstalled, with built-in profiles for several providers, a kill switch and per-device VPN policies. These routers are often bought specifically for VPN use.
- Keenetic — WireGuard client that can connect to any provider offering WireGuard.
- Routers from your internet provider — usually no VPN client, and settings are often locked. Put your own router behind it or ask the provider about bridge mode.
- OpenWrt, DD-WRT, FreshTomato, Asuswrt-Merlin — alternative firmware with full OpenVPN and WireGuard support. Flashing it takes care: a mistake can make the router unusable and it may void the warranty.
Not sure what your router is? Log in to its admin page — find your router’s address — and look for a menu named VPN, VPN Client or VPN Fusion.
How to set up a VPN on a router
- Check that the VPN service allows manual setup. You need configuration files, not just an app. Most large services publish them; look for “router” or “manual setup” in your account.
- Download a configuration for the server you want. For WireGuard this is a .conf file, often after generating a key pair in your account (save the key: some services show it only once). For OpenVPN it is an .ovpn file plus service credentials, which at many providers differ from your account login.
- Open the router’s admin page — usually 192.168.1.1 or 192.168.0.1 — and go to the VPN client section.
- Add a profile: choose the protocol, import the file, enter the service credentials for OpenVPN, save and connect.
- Choose devices, if the router allows it: put the TV or console through the VPN, and leave out devices where VPN causes problems, such as banking or work laptops.
- Turn on the kill switch, if available, so devices lose internet instead of silently going out without the VPN when it drops.
- Check the result: on a device behind the router, open What Is My IP. You should see the VPN server’s address and country, and the ISP check should show the VPN’s hosting company instead of your provider.
Speed: what to expect
On a router VPN, the router’s processor encrypts all traffic. Older and cheaper routers can top out well below your plan speed, and the limit is shared by every device. WireGuard is usually much faster than OpenVPN on the same router, so use it when both the router and the service support it. Pick a server close to you, and do not run a VPN app on a device that is already behind the router VPN: double encryption only slows it down. To measure, run a speed test with the router VPN off and on.
VPN services that document router setup
We do not rank VPN services. This list shows what each service itself documents for routers, checked in October 2026. Before paying, make sure the service has instructions for your router or firmware.
| Service | Router protocols | What they document |
|---|---|---|
| Proton VPN | OpenVPN, WireGuard | Guides for Asuswrt, Asuswrt-Merlin, DD-WRT, OpenWrt, pfSense, OPNsense, MikroTik, GL.iNet. Router connections are allowed on all plans, including the free one; the router counts as one connection. |
| NordVPN | OpenVPN | Tutorials for ASUS, TP-Link, DD-WRT, OpenWrt, pfSense, GL.iNet, MikroTik and others; the router must support an OpenVPN client. GL.iNet firmware has NordVPN built in. |
| Surfshark | WireGuard, OpenVPN | Manual WireGuard setup with a key pair generated in the account; recommends GL.iNet, OpenWrt or DD-WRT. Built into GL.iNet firmware. |
| ExpressVPN | Own router app, OpenVPN | Router app for selected ASUS, Linksys and Netgear models, its own Aircove routers, and manual OpenVPN for ASUS, DD-WRT, pfSense and Tomato. |
VPN client vs VPN server on the router
These are two different things. A VPN client sends your home traffic out through a VPN service — that is what this guide is about. A VPN server on the router lets you connect to your home network from outside, for example to reach a NAS or cameras. A VPN client works behind any connection, but a VPN server needs a public IP address: if your provider uses CGNAT, it will not be reachable from outside. Check your public IP and compare it with the router’s WAN address.
Common problems
- No internet after connecting — wrong service credentials (not your account password), an outdated configuration file or a blocked port. Download a fresh file and try another server or protocol.
- Very slow — the router’s processor is the limit. Switch to WireGuard, choose a closer server, or route only some devices through the VPN.
- A site or bank blocks you — some services block known VPN addresses. Exclude that device from the VPN if the router supports per-device rules.
- The VPN menu is missing — update the firmware; on ASUS and TP-Link the feature depends on model and firmware version.
VPN on a router: frequently asked questions
Can I put a VPN on any router?
No. The router needs a VPN client function. Many ASUS, GL.iNet, Keenetic and selected TP-Link models have one; routers from internet providers and stock Netgear firmware usually do not.
Does a VPN on the router slow down the internet?
Yes, the router has to encrypt all traffic. How much depends on its processor and the protocol: WireGuard is usually much faster than OpenVPN.
Can I use a free VPN on my router?
Proton VPN states that its free plan can be used on a router. Many free services do not offer manual configuration files at all, which a router needs.
Do all devices get the same VPN country?
Yes, unless the router supports several VPN profiles with per-device rules, as ASUS VPN Fusion and GL.iNet do.
Is using a VPN on a router legal?
In most countries it is legal, just like a VPN app. A few countries restrict VPN services, and the terms of streaming and other services still apply.
