Setting up a VPN on your router

Why put a VPN on your router?

Normally you install a VPN app on each phone or laptop. A router VPN works differently: the router itself connects to the VPN server, so everything that uses your home Wi-Fi or Ethernet goes through the tunnel. Your devices don't need any app.

• Devices without VPN apps. Samsung and LG smart TVs, most game consoles and many smart-home gadgets can't run VPN apps. See VPN on a smart TV.
• Always on. Nobody in the house has to remember to switch the VPN on.
• Device limits. Many VPN plans limit how many devices can connect at once. A router usually counts as one connection, though check the provider's terms.
• Hiding activity from your ISP. Your internet provider sees encrypted traffic going to the VPN server, not the sites each device visits. This doesn't make copyright infringement legal.

The downsides

• Speed. Encryption takes processing power. Many consumer routers have modest processors, so a router VPN can be much slower than the same VPN on a laptop. Router makers and VPN providers publish their own figures; real results depend on your model.
• One location for everyone. Unless your router supports routing per device, every device uses the same VPN server and country.
• Some services break. Banking apps, streaming services and sites that block VPN addresses may refuse connections for the whole household. See why streaming services block VPNs.
• Harder to see what's happening. There's no app on your phone showing whether the tunnel is up. If the router's VPN drops and the router has no kill switch, devices may fall back to your normal connection.
• Maintenance. You have to keep router firmware updated and replace VPN configuration files when the provider changes servers.

What you need

1. A router that supports a VPN client Look for VPN client support in the specs, not only a VPN server. A VPN server lets you reach your home network from outside, which is a different job. ASUS, for example, documents a VPN client in its router firmware. Many ISP-supplied routers have no such feature, so check your model.
2. A protocol both sides support Most routers support OpenVPN, and newer firmware often supports WireGuard too. WireGuard tends to be lighter on router hardware. See WireGuard vs OpenVPN.
3. Configuration files from your VPN provider Most providers let you download WireGuard or OpenVPN configuration files from your account. Some proprietary protocols only work in the provider's apps. TechRadar notes, for example, that NordVPN's NordLynx configuration can't be exported to third-party routers.

Example: ASUS routers (VPN Fusion)

ASUS documents its router VPN client under the name VPN Fusion. Its support FAQ says WireGuard client support needs firmware newer than 3.0.0.4.388.23000 on supported models, and lists OpenVPN, IPsec, PPTP and WireGuard as protocol options. The steps it describes are, in short:

1. Log in to the router Open the router's web interface in a browser and go to the VPN section.
2. Add a VPN Fusion profile Choose WireGuard (or OpenVPN) and use Upload Config to load the configuration file from your VPN provider.
3. Choose devices Pick which devices use the tunnel, or apply it to all devices. ASUS says VPN Fusion can run several VPN profiles at once and assign devices to different tunnels.
4. Turn it on and check Enable the profile, then check from a device on the network with our What is my IP tool.

If the menu offers PPTP, skip it. It's the oldest option on the list; choose WireGuard or OpenVPN instead.

Example: OpenWrt

OpenWrt is free, open-source router firmware that runs on many models. Its official documentation has a WireGuard client guide. In outline, you install the WireGuard packages (for the web interface, luci-proto-wireguard), add a WireGuard interface using the keys and addresses from your provider's configuration, add the provider's server as a peer, and set up the firewall so traffic leaves only through the tunnel. The guide suggests checking for a recent handshake under Status and using traceroute to confirm that traffic is going through the VPN.

Flashing third-party firmware can void a warranty or, if it goes wrong, leave a router unusable. Check that your exact model and hardware version are supported first.

Add a kill switch on the router

On a router, a kill switch means firewall rules that stop devices reaching the internet through your normal connection when the VPN interface is down. In OpenWrt you do this with firewall rules; in other firmware, look for an option such as blocking internet access when the VPN is down. Then test it: disconnect the tunnel and check that devices lose their connection rather than falling back. More on this in our kill switch guide.

Check that it's working

• From a phone or laptop on your Wi-Fi with no VPN app running, open What is my IP. You should see the VPN server's address.
• Run a leak test, especially for DNS. Some routers keep handing out your ISP's DNS servers to devices even when the tunnel is up.
• If you only want some devices on the VPN, use per-device routing such as VPN Fusion, or set up a second Wi-Fi network for the VPN.

Alternatives to a full router VPN

If you only need a VPN on one TV, a streaming stick with a VPN app may be simpler. Many providers have apps for Android TV, Google TV and Fire TV, and Apple TV has supported VPN apps since tvOS 17. Some providers also sell or recommend pre-configured routers. Our smart TV guide covers those options.