How to Set Up a VPN on a Router (2026 Walkthrough)

To set up a VPN on a router you load your VPN provider's configuration into the router's VPN-client settings, connect to a server, and confirm the change with an IP and DNS-leak check. The catch is that your router must be able to run a VPN client in the first place — many cannot — so the real first question is which of three starting points you are at.

First, check whether your router can run a VPN client

Before anything else, find out if your router has a VPN client at all. Log into its admin page (commonly 192.168.1.1 or 192.168.0.1) and look for a "VPN" or "VPN Client" section. If it's there, you can set up directly. If it isn't, you have two choices: flash open firmware onto a supported router, or buy a router that already supports a VPN — both covered in our guide to what a VPN router is and how to set one up.

A quick way to know in advance: Asus and GL.iNet routers usually have a client built in; most ISP-supplied and budget routers do not. Do not confuse a "VPN Server" option (for dialling into your home from outside) with a "VPN Client" (for routing your traffic out through a provider) — you want the client.

The six-step setup on a VPN-capable router

Once your router has a VPN client, the process is consistent across brands. Take it in order and test at the end rather than trusting the status light alone.

1. Choose a provider that publishes router guides and supports WireGuard on routers — WireGuard is dramatically lighter on a router's CPU than OpenVPN.
2. In the provider's dashboard, generate or download the config for the server you want: a WireGuard config file, an OpenVPN file, or a set of manual credentials.
3. In the router's VPN-client section, create a new profile and import the file or enter the credentials.
4. Select the server country and connect. Wait for a genuine "connected" state, not just "enabled."
5. From a device behind the router, verify your public IP has changed and run a DNS-leak test to confirm queries aren't escaping the tunnel.
6. Optionally set exceptions — many routers let you route only some devices through the VPN, which is handy for a work laptop or a TV that blocks VPNs.

The snags that trip people up

Most router-VPN problems come from a short list of issues. Knowing them in advance saves an evening.

DNS leaks

A DNS leak means your device is still asking your ISP's DNS servers to look up sites, revealing your activity even while the tunnel is up. Fix it by enabling the router's "use VPN DNS" or "force DNS" option, or by setting the provider's DNS manually. Always finish setup with a leak test.

Double NAT and no connection

If your VPN router sits behind another router (common when you keep the ISP box), you can end up with double NAT, which breaks some connections. The clean fix is to put the ISP box in bridge or modem mode, or to run the VPN on the main router instead of a second one.

The tunnel drops silently

Consumer routers sometimes drop the tunnel and fail open, sending traffic unprotected. Check whether your router has a kill switch or "block traffic if VPN disconnects" setting and turn it on; if it doesn't, that is a reason to prefer firmware like OpenWRT or Asuswrt-Merlin that does.

If your router can't do it

Plenty of routers simply won't run a VPN client, and that's fine — you have three routes. Flash supported open firmware (see flashing DD-WRT, Tomato or OpenWRT); buy a router with a client already built in (our best routers for a VPN); or, if you'd rather not tinker, buy one pre-configured. The point is the same: get the tunnel onto the router so every device behind it is covered.

Whatever route you take, keep the honesty in view — a router VPN protects everything on your network but it is one shared exit, not anonymity, and your speed will lean on the router's processor. Set realistic expectations and it is one of the most useful things you can do for a whole household at once.

Main router or a dedicated second router?

You can run the VPN on your main router or add a second router behind it that runs the tunnel. Running it on the main router is simplest and covers everything automatically, but it means the whole house is always on the VPN. A second router creates two networks — a VPN Wi-Fi and a normal one — so you connect a device to whichever you want.

The two-router approach is popular for exactly that flexibility: your console and TV join the VPN network, while a work laptop or a service that blocks VPNs stays on the normal one. The cost is more kit and a little more setup, plus the double-NAT caveat above if you don't put one router in bridge mode. If your main router can already run a VPN client, selective routing usually achieves the same split without a second box.

Wired devices, guest networks and the kill switch

A few settings are worth checking once the tunnel is up. Wired devices are covered the same as wireless ones as long as they're behind the VPN router, so a console on Ethernet is protected too. If your router has a guest network, confirm whether it also routes through the VPN — on some firmware it bypasses the tunnel by default.

Finally, turn on the kill switch if your router has one, so the network blocks traffic rather than failing open if the VPN drops. Routers without this quietly leak when the tunnel dies, which is a strong reason to prefer firmware like OpenWRT or Asuswrt-Merlin that includes it. Re-run a leak test after any change.

One last habit worth keeping: write down which server and settings you used, and re-run a leak test whenever your provider updates its configs or your router updates its firmware. A router VPN is set-and-forget until something upstream changes, and a two-minute recheck is cheaper than discovering weeks later that the tunnel had quietly dropped.