Router VPN guide
What a VPN router is, and how to set one up
A VPN router runs the VPN itself, so every device on your network is protected without installing an app on each one. Here is what that gets you, the four ways to do it, a plain setup walkthrough, and the trade-offs to weigh first.
On this page
A VPN router is a router that runs a VPN client of its own, so the encrypted tunnel starts at the router instead of on each device. Anything connected to it — laptop, phone, smart TV, games console, NAS — travels through that one tunnel automatically. A router install also counts as a single device against your VPN plan's simultaneous-connection limit, which is handy when you have more gadgets than allowed slots (CyberInsider, read 2026-09-10).
It is the most complete way to run a VPN at home, and for some devices the only practical way. It is also the option with the most trade-offs, so it pays to understand what you are signing up for before you buy hardware.
What a VPN router actually is
It is a normal Wi-Fi router with one extra job: holding your VPN login and keeping a tunnel open to a server you choose. Ordinary routers cannot do this — the feature has to be in the firmware. You get it one of three ways: buy a router whose firmware already includes a VPN client, flash open-source firmware that adds one, or buy a router someone has already set up for you.
Because the tunnel lives on the router, you manage it from the router's admin page rather than a phone app. Changing country means logging into the router and switching the server, and the change applies to the whole house at once. That single detail — one exit for everyone — shapes almost every trade-off below.
Which devices a router VPN covers, and which still need an app
A router VPN covers every device that connects to it, full stop. The point is that it covers the devices that can't help themselves: a PS5 or Xbox (no native VPN app in 2026), a Roku, Samsung Tizen or LG webOS smart TV (no VPN apps), and anything else that only knows how to reach the internet through your Wi-Fi (Security.org, GamesRadar, read 2026-09-10).
Devices that *can* run their own app — phones, laptops, Android TV boxes, a Fire TV Stick — are still covered by the router, but you may prefer their own app when you want a different country on that one device without moving the whole network. The two approaches stack: many people run a router VPN for the awkward devices and an app on the phone that travels with them.
The four ways to get a VPN on your router
There are four realistic routes, in rough order of least to most effort. The right one depends on your current router and how much fiddling you enjoy.
| Method | How it works | Effort | Covers every device? | Speed note |
|---|---|---|---|---|
| Built-in VPN client | Buy a router whose firmware already has a VPN client (Asus, GL.iNet) | Low | Yes | Best if it supports WireGuard |
| Flash open firmware | Install OpenWRT/DD-WRT/Tomato on a supported router to add a VPN client | High | Yes | OpenWRT does WireGuard natively |
| Pre-configured router | Buy a router pre-flashed and set up for your provider | None | Yes | You pay to skip the work |
| Travel router in front | Put a small VPN router upstream of your main router | Medium | Devices on that router | Limited by the small router's CPU |
| Aircove VPN router | ExpressVPN's own hardware router with a built-in app | Low | Yes | Tied to one provider |
Built-in VPN client (the easy default)
The least painful route is a router that already has a VPN client in its firmware. Asus routers include a basic VPN client in stock Asuswrt, and the free Asuswrt-Merlin firmware adds a VPN Director for routing specific devices through OpenVPN or WireGuard. GL.iNet routers (the Flint and Beryl lines) ship with WireGuard and OpenVPN set up through a simple web panel, which is why they are a common first VPN router (CyberInsider; read 2026-09-10).
Flash open firmware (the enthusiast route)
If your router isn't VPN-capable but is on the supported list, you can flash open firmware. OpenWRT has shipped WireGuard natively since 2020 and exposes it in its web interface on current builds, which makes it the pick for a fast, modern tunnel. DD-WRT and Tomato exist too but lean on OpenVPN. Flashing an unsupported model can brick it, so check the project's hardware table for your exact revision first — this is covered in our guide to flashing DD-WRT, Tomato or OpenWRT.
Pre-configured router (pay to skip the work)
Vendors such as FlashRouters sell routers already flashed and set up for a named provider. You pay a premium over the bare router, and you are trusting someone else's build, but you avoid the flashing risk entirely. It is the sensible choice if you want the coverage without the project — more in our look at pre-flashed VPN routers.
How to set up a VPN on a router, step by step
The exact screens differ by router, but the shape is always the same. Here is the process on a router that already supports a VPN client:
- Pick a provider that publishes router instructions and, ideally, supports WireGuard on routers — it is far faster than OpenVPN.
- Log into the router's admin page (often 192.168.1.1) and find the VPN client section.
- Download the configuration for your chosen server from the provider (a WireGuard or OpenVPN config file, or manual credentials).
- Enter or import it, choose the server country, and connect. Watch for the connected status.
- Confirm it works: on a device behind the router, check your IP has changed and run a DNS-leak test.
- Decide what should bypass the tunnel — some routers let you exclude devices, which is useful for a work laptop or a TV that blocks VPNs.
If your router has no VPN client at all, insert a step zero: either flash supported open firmware, buy a router that has a client, or put a small travel router in front of it. The full walkthrough with the common snags lives in how to set up a VPN on a router.
Which VPNs work best on a router in 2026
Router support varies more than the marketing suggests, and it changed in 2026. Some links below are affiliate links: if you buy through them we may earn a commission, at no cost to you, and it never changes what we recommend.
ExpressVPN: strong router heritage, with a 2026 catch
ExpressVPN built its reputation partly on routers, and it still sells its own Aircove hardware routers with the VPN built in. The catch: from 31 March 2026 the dedicated ExpressVPN *router app* runs only on Aircove hardware; on other routers you now configure ExpressVPN manually (Tom's Guide; FlashRouters, read 2026-09-10). If you want a plug-in box, an Aircove is the least-effort route; if you already have a good router, factor in manual setup.
Affiliate link. We may earn a commission — it never moves a ranking.
NordVPN: no router app, but clear manual guides
NordVPN has no dedicated router app and never really did; instead it publishes step-by-step manual setup guides and is one of the easier providers to configure by hand. Its apps use the fast WireGuard-based NordLynx, and it is the provider currently supported on the newest Fire TV Stick, which matters if you mix router and on-device coverage. NordVPN is a safe pick if you are comfortable with a manual router config.
Affiliate link. We may earn a commission — it never moves a ranking.
Surfshark and Proton VPN: manual, WireGuard-friendly
Surfshark also has no router applet but documents manual setup, and like Proton VPN and NordVPN it uses WireGuard, which performs far better on routers that support it. Surfshark allows unlimited simultaneous connections, which is moot once you are on a router but nice as a backup. Proton VPN is the pick if you value its Swiss base and audited no-logs posture and are happy to configure it by hand.
The honest unpaid answer: a plain WireGuard config
If you flash OpenWRT, you don't strictly need a big-brand app at all. Mullvad and Windscribe hand you a plain WireGuard configuration you drop straight into the router, and Mullvad runs no affiliate program, so recommending it earns us nothing — which is rather the point. For a technical user with a WireGuard-capable router, that is often the cleanest, cheapest setup going.
Speed: will a router VPN slow your whole network?
Usually yes, to some degree, because the router's processor has to encrypt every packet and consumer routers have modest CPUs. The single biggest factor is the protocol: WireGuard (and provider light protocols like ExpressVPN's Lightway) are far lighter than OpenVPN, and reviewers consistently report the largest drops on OpenVPN-only routers — one setup guide cites 60–75% loss on OpenVPN-only hardware (encapsulated.network, read 2026-09-10; a third-party figure, not our own test).
Three things help: a router with a faster CPU or crypto acceleration, a nearby server, and WireGuard over OpenVPN. If speed matters more than whole-house coverage, keep the router VPN for the awkward devices and use apps on the fast ones — see does a router VPN slow your network.
Router VPN versus an app on each device
A router VPN wins on coverage and loses on flexibility. It reaches devices that can't run an app and never leaks around them, but everything shares one server and country, and changing that means logging into the router. A per-device app is the opposite: instant per-device control, nothing to flash, but zero help for a console or a Roku. Most homes are best served by both — the full comparison is in VPN router vs app.
Three honest caveats before you buy
A router VPN is genuinely useful, but go in with eyes open. Three things catch people out, and none are dealbreakers if you expect them:
- One exit for the house. Everyone shares the router's server and country until you change it, so per-device country switching needs selective routing or an on-device app.
- Speed leans on the router. A weak router or an OpenVPN-only setup can throttle a fast line hard; WireGuard and a capable CPU are what keep it healthy.
- It's not anonymity. A router VPN closes coverage gaps, but your trust moves to the provider — treat a "no-logs" claim as meaningful only when it's independently audited and dated.
Weigh those against the payoff — every device covered, including the ones that can't help themselves — and for most homes the answer is still yes. When you're ready, the step-by-step is in how to set up a VPN on a router.