How to Set Up a VPN on Your Router: A Plain-English Walkthrough

As of October 2026, you need a router whose firmware has a VPN client (ASUS, GL.iNet, TP-Link, OpenWrt, DD-WRT) or a provider-built router: upload your VPN's WireGuard or OpenVPN file to its VPN client page and switch it on.

Done once, that single connection covers every device on the router's Wi-Fi: phones, laptops, smart TVs and game consoles included. There are three ways to get a VPN client onto a router: use the one already built into its firmware, flash open-source firmware such as DD-WRT, FreshTomato or OpenWrt onto a router that lacks one, or buy hardware that arrives with the VPN set up. Typing server details into the router by hand still works on most firmware, but importing your provider's file has largely replaced it. Every menu path, file location and speed figure below was read in October 2026 from the router maker's, firmware project's or VPN provider's own documentation, or from the standard behind it, and anything we could not verify is left out.

A router VPN covers every device on its Wi-Fi, including the ones that can't run an app

A router-level VPN moves the encryption from individual apps to the single point every device connects through. That means everything on your Wi-Fi is covered the moment it joins the network — no app to open, no toggle to forget, and no per-device limit to hit. It's the difference between protecting five gadgets and protecting your whole home.

• One connection covers everything. Most VPN plans cap simultaneous device connections, but a router counts as a single connection while shielding the devices behind it. Proton VPN's router page says the router "only counts as one connection" on its Free plan, "no matter how many devices you connect to it", and ExpressVPN's router FAQ says you can connect as many devices as you want to the router.
• It reaches devices that can't run an app. Smart TVs, older streaming sticks, and gaming consoles rarely have a VPN app — but they all connect through the router, so they inherit its protection automatically.
• It's always on. Because the tunnel lives on the router, there's nothing to remember to switch on. Guests, IoT gadgets, and every new device get encrypted traffic by default.
• Consistent geography. Everything on the network appears in the same location, which is handy when you want a whole household watching from one region.

The trade-offs are real, though, and Proton VPN lists four of them on its own router page: speeds "depend on your router's processing power"; changing location means updating the router configuration rather than tapping a server; app features such as NetShield or split tunneling "may not be available"; and the router's settings apply to every device on it. Setup is also more involved than tapping a button. If you mainly want to check what's available in another region on one device now and then, an app is simpler; the router shines when you want blanket, hands-off coverage. Our best VPN routers guide ranks the providers and hardware, and the five-minute video walkthrough shows the setup on screen.

Your router needs a VPN client, and a VPN server menu is the wrong feature

Before you touch a setting, find out whether your router can act as a VPN client, the role that connects out to a provider. Many routers ship only a VPN server, which does the opposite job: it lets you reach your home network from outside. NETGEAR's stock VPN Service, under ADVANCED › Advanced Setup › VPN Service, is that kind of feature: NETGEAR documents it as a way to access your home network securely while you are away, connecting from the OpenVPN app on your phone. NordVPN's router page is blunt about the other common case: if your router was issued by your ISP, "it probably does not support VPN configurations".

1. 1VPN client support. Look in the admin panel for a menu called VPN Fusion, VPN Client, WireGuard Client or OpenVPN Client; the firmware table below shows where each one lives. One ASUS-specific catch from its own FAQ: a router can be a VPN server and a VPN client at once, but not of the same VPN type at the same time.
2. 2Processing power and memory. Encryption is CPU-intensive, and the router's processor does it for every device behind it. For custom firmware, OpenWrt describes 8 MB of flash as "barely enough" and recommends at least 16 MB of flash and 128 MB of RAM if you want to add packages such as a VPN client; underpowered units will bottleneck your whole connection.
3. 3Protocol support. WireGuard is usually much faster than OpenVPN on router hardware. GL.iNet's published figures show WireGuard at two to five times OpenVPN's ceiling on chips without OpenVPN DCO, and close to level on newer models that have it (see the speed section). If your router or firmware supports WireGuard, use it.
4. 4Your provider's router files. Confirm your VPN publishes router instructions and files for your firmware. Most of the nine we track do, but the details differ: NordVPN hands out OpenVPN configuration files plus separate service credentials, Surfshark and Proton VPN let you download WireGuard files, and TotalVPN publishes no router guide at all.

If your current router falls short, you don't necessarily need to flash anything — a router with a built-in client, or one sold with a provider already set up, may cost less than an afternoon of troubleshooting. It's also worth running a quick baseline on our VPN speed test page so you know what "normal" looks like before and after.

There are three ways to get a VPN client onto a router

Which path you take depends on the router you already own and how much risk you will accept. The first costs nothing if your router qualifies, the second costs money but no effort, and the third costs time and carries a real chance of breaking the router.

Path 1: the VPN client already in your firmware (the easy way)

Many current ASUS routers, GL.iNet's routers, supported TP-Link models and anything running Asuswrt-Merlin or OpenWrt already contain a VPN client. Two vendors go a step further and build named providers into the firmware. ASUS's VPN Fusion lists NordVPN as a VPN type that you sign into with an access token (firmware 3.0.0.6.102.34713 or later; 3.0.0.6.102.44669 on the ExpertWiFi series) and Surfshark as a type that uses WireGuard with a private key from your Surfshark account (ASUS lists firmware later than 3.0.0.4.388.23000 or 3.0.0.4.388.31900). GL.iNet's WireGuard client has built-in profiles for ten providers, five of which are in our database: IPVanish, NordVPN, Private Internet Access, PureVPN and Surfshark.

Path 2: hardware sold with the VPN already inside

ExpressVPN stands out here: it's the provider best known for a genuine router app, and it also sold its own Aircove routers — Wi-Fi 6 AX1800 units managed from expressvpnrouter.com and the ExpressVPN app — with the VPN preinstalled. You can sort devices into up to five groups on a router running ExpressVPN and point each group to a different VPN location, no VPN or no internet, so the TV can appear in one country while the laptop appears in another; all groups share one VPN protocol.

That line has now changed. On 16 September 2026 ExpressVPN said Aircove and Aircove Go "are being retired from sale" and that it "will not produce additional units". Existing Aircove (AX1800) routers get security updates through 2027 and Aircove Go (AXG1800) through 2028. The replacement is Fortify, which is GL.iNet's GL-MT6000 (the Flint 2 platform) running GL.iNet firmware rather than AircoveOS, sold at a $199.99 MSRP with 12 months of ExpressVPN's Advanced plan, and which "connects to ExpressVPN using WireGuard" at launch. Aircove owners are offered 20% off. Other providers take the partner route: IPVanish and Private Internet Access point buyers to pre-configured routers from FlashRouters, and NordVPN recommends FlashRouters' Privacy Hero 2 for its "exclusive NordLynx integration".

Path 3: flashing DD-WRT, FreshTomato or OpenWrt

If your router runs locked-down stock firmware with no VPN client, you can replace that firmware with an open-source alternative that adds one. This is called flashing. The mainstays are DD-WRT, Tomato (now maintained as FreshTomato) and OpenWrt, and all of them add OpenVPN and WireGuard clients that much factory firmware omits. It's more advanced, but it unlocks routers that otherwise couldn't do the job.

• DD-WRT gives complete control over nearly every router setting and supports a huge range of models — but the interface is dense and can be intimidating if you're new to networking. For WireGuard support you'll want build 43045 or higher, the minimum Surfshark's DD-WRT guide specifies.
• FreshTomato is prized for its clean interface and is excellent for getting OpenVPN running quickly. The catch: its own site describes it as firmware "for Broadcom based routers", and its hardware compatibility list is dominated by Asus, Linksys and Netgear models, so your exact router may not be covered. Release 2026.4 (14 September 2026) lists a built-in OpenVPN client and "full Wireguard support with PBR (ARM)".
• OpenWrt runs on the widest range of hardware, but you install the VPN packages yourself: openvpn-openssl for OpenVPN, wireguard-tools for WireGuard (plus luci-proto-wireguard if you want it in the web interface).

A serious warning: flashing the wrong firmware image for your exact model and hardware revision can permanently brick the router. IPVanish's router page says it plainly: "Incorrect flashing by choosing the wrong firmware can permanently damage your router." Always match the firmware to your precise model number, follow the project's own instructions, and read them twice. If that risk makes you nervous, buy a router that's already been flashed and configured by a specialist service, or take the built-in path instead.

• Fastest to set up: a provider-built router (Fortify, or an Aircove you already own) or a preconfigured unit from a flashing service.
• Best balance: a WireGuard-capable router paired with a provider that publishes ready-made router files.
• Most control: your own hardware running custom firmware.

Each firmware puts the VPN client behind a different menu

The setting you need exists on most modern routers; the hard part is finding it, because every firmware names and files it differently. The table gives the exact path for each, read from the firmware maker's own documentation, and the last column says what a "yes" does not guarantee. If you own the router already, find its row first and only then pick a provider file to match.

Two rows are worth a second look. The two ASUS rows are the same brand on either side of a firmware line: on 3.0.0.4.388 and earlier the feature is called VPN Client and has no WireGuard, while later firmware calls it VPN Fusion. And Fortify, ExpressVPN's new router, is GL.iNet hardware running GL.iNet firmware, so the GL.iNet row describes the platform it is built on.

Every VPN provider hands out its router file from a different place

A router can't show a sign-in screen, so it needs either a configuration file, separate manual credentials or a login token from your VPN account. Each of the nine providers we track puts these somewhere different, and some don't offer them at all. The table records where each provider's own documentation says to look, and which router products it supports. For which provider performs best on a router, see the router ranking; this table is only about getting the file.

The pattern matters more than any single row. A provider that publishes only OpenVPN files can still run over WireGuard on a router whose firmware has that provider built in: GL.iNet does this for IPVanish, NordVPN, Private Internet Access and PureVPN, and ASUS does it for NordVPN and Surfshark. So check your firmware's built-in list before you conclude a provider is "OpenVPN-only" on routers.

On an ASUS router, VPN Fusion imports a provider's file in seven steps

ASUS is the most common router brand in provider guides, and on firmware later than 3.0.0.4.388 the whole job happens on one page. These steps follow ASUS's own FAQs for the WireGuard and OpenVPN clients, with the account paths from each provider's guide.

1. 1Get the file from your VPN account. For WireGuard: Proton VPN under Downloads › WireGuard configuration with the platform set to Router; Surfshark under VPN › Manual setup › Router › WireGuard. For OpenVPN: NordVPN under Advanced settings › Set up NordVPN manually; ExpressVPN under Applications › Advanced setup › Manual Configuration. Note the separate username and password that OpenVPN files need.
2. 2Open the router's settings. Connect a laptop by cable or Wi-Fi and go to http://www.asusrouter.com or the router's LAN address (Proton VPN's guide gives 192.168.50.1), then sign in.
3. 3Go to VPN › VPN Fusion and click Add profile.
4. 4Name the connection and pick the VPN type: WireGuard or OpenVPN. ASUS notes the client must use the same VPN type as the server.
5. 5Import the file. WireGuard: Upload Config (Proton's guide calls the button Import config file) and choose the .conf file. OpenVPN: Import .ovpn file, wait for the "Complete" hint, then enter the provider's manual credentials, not your website login.
6. 6Choose devices. Leave Apply to all devices on to cover the whole home, or turn it off and use Edit Device to pick only the TV, console or streaming stick.
7. 7Click Apply and Enable (Apply all settings on some versions). When the profile shows Connected, test from a device as described further down.

If you use NordVPN or Surfshark, step 5 can be skipped: choose the provider itself as the VPN type, then paste a NordVPN access token or a Surfshark WireGuard private key and pick a region. Both are shown only once when you create them, so copy them before closing the page. ASUS also notes that some regions may not offer these built-in types.

Asuswrt-Merlin needs a few OpenVPN settings that stock firmware hides

Merlin exposes the full OpenVPN client, which means more fields to get right. Proton VPN's guide uses Advanced settings › VPN › VPN Client › OpenVPN and sets Accept DNS Configuration to Exclusive, Redirect Internet traffic to Yes (all), Compression to Disabled and Automatic start at boot time to Yes. NordVPN's Merlin guide recommends Strict for a whole home and Exclusive for specific devices, and adds the optional kill switch, Block routed clients if tunnel goes down. Merlin's WireGuard clients have fewer choices: since 388.1 their DNS handling is identical to OpenVPN's Exclusive mode, and their routing always runs through VPN Director rules.

On GL.iNet, OpenWrt and DD-WRT, WireGuard is a file upload or a pasted config

These three firmwares cover most of the remaining provider guides. GL.iNet is closest to ASUS in effort; OpenWrt and DD-WRT expose the raw WireGuard fields, so a single wrong character in a key stops the tunnel.

GL.iNet, firmware 4.9 and later

1. 1Sign in at 192.168.8.1, GL.iNet's default address.
2. 2Go to VPN › VPN Client Profile. For a built-in provider, sign in from its entry; otherwise click Add Manually under WireGuard (or OpenVPN) and upload the file. GL.iNet accepts zip, tar, gz, conf and txt uploads.
3. 3Click the three-dot icon next to the server and connect. A green dot appears once the tunnel is up.
4. 4Open the VPN Dashboard to switch on Kill Switch, which cuts internet for the local network if the VPN drops, and to choose All Clients or Specified Devices.

On firmware 4.7 and 4.8 the same controls sit under separate pages, VPN › WireGuard Client and VPN › OpenVPN Client; PureVPN's GL.iNet guide follows that older layout, using VPN › WireGuard Client › Set up WireGuard Manually. GL.iNet merged them into the single VPN Client Profile page in v4.9.

OpenWrt, using the LuCI web interface

1. 1System › Software, then Update lists, and install luci-proto-wireguard.
2. 2Network › Interfaces › Add new interface: give it a name and choose WireGuard VPN as the protocol.
3. 3Import configuration › Load configuration and paste the contents of your provider's .conf file.
4. 4On the Peers tab, edit the peer and tick Route Allowed IPs. OpenWrt's own client guide recommends a persistent keepalive of 25 seconds.
5. 5Network › Firewall › Zones: Proton VPN's guide adds a VPN zone with masquerading on, allows forwarding to it from lan, and turns on MSS clamping in the lan zone. OpenWrt's guide takes the shorter route of adding the VPN interface to the wan zone.
6. 6Network › Interfaces › wan › Edit › Advanced Settings: untick Use DNS servers advertised by peer and enter your VPN's DNS server (Proton VPN's is 10.2.0.1). Then Save & Apply.

DD-WRT, with WireGuard or OpenVPN

1. 1Log in to the router admin panel. Open a browser on a device connected to the router and go to the router's address — commonly 192.168.1.1 — then sign in with your admin credentials.
2. 2Grab the config from your VPN. In your provider's dashboard, generate a manual router configuration for your chosen protocol and server location. This gives you the keys, addresses, and port you'll need.
3. 3Open the tunnels section. On build 43045 or later, go to the Setup tab, select Tunnels, click Add Tunnel and enable it with WireGuard as the protocol.
4. 4Enter the connection details. Paste in the private key, peer public key, endpoint address, port, and allowed IPs exactly as your provider supplied them. Surfshark's DD-WRT guide also sets MTU 1420, listen port 51820 and a persistent keepalive of 30, and switches on the inbound firewall and Kill Switch.
5. 5Save and apply. Commit the settings and let the router reboot or reload the interface.
6. 6OpenVPN instead: Proton VPN's guide uses Services › VPN › OpenVPN Client › Import Configuration, the separate OpenVPN credentials, then Status › OpenVPN, which should read Client: CONNECTED SUCCESS. It also disables IPv6 under Setup › IPV6.
7. 7Confirm it's working. From a connected device, check that your public IP now shows the VPN server's location, and run a leak check. Our glossary explains what a DNS leak and a WebRTC leak are and why you should test for both.

If the connection fails, the usual culprits are a mistyped key, the wrong port, or firmware that's too old for WireGuard. Roll back to OpenVPN to isolate the problem, or update your firmware build and try again; our VPN won't connect guide covers the checks that apply on any device.

The router's processor caps VPN speed for the whole house, and GL.iNet publishes the ceilings

Every byte that crosses the tunnel is encrypted by the router's own processor, which is far weaker than a laptop's, and that one chip works for every device in the house. Proton VPN's router page puts it simply: "routers with weaker processors may experience slower speeds". GL.iNet publishes VPN throughput on each of its product pages, which makes it the clearest public evidence of how much the chip and the protocol matter.

Two things stand out. On the four models whose OpenVPN runs without DCO, WireGuard's published ceiling is two to about five times OpenVPN's, from 300 against 150 Mbps on the Beryl AX to 65 against 12 on the Opal. On the five with OpenVPN DCO (Data Channel Offload), the two protocols land within about a quarter of each other, and on the Slate AX OpenVPN is slightly ahead. GL.iNet's Flint 3 page explains why: DCO "uses kernel-level acceleration to handle encryption and decryption across multiple CPU cores". The blanket rule that WireGuard is several times faster holds for routers without OpenVPN DCO, not for every router sold in 2026.

Firmware can cost speed too. When Asuswrt-Merlin added WireGuard in 388.1, its changelog noted that "enabling WireGuard will disable hardware NAT acceleration due to compatibility reasons", so on a fast line the router's ordinary routing may slow down once a WireGuard client is on. GL.iNet's own footnote is the other caveat: its figures come from "tests conducted on a local network" in client mode, and real-world speeds may differ. They describe the chip, not your ISP line or how far away your VPN server is.

Practical rule:Choose WireGuard unless your router's maker publishes an OpenVPN DCO figure close to it, and treat any published ceiling as the most your whole household will share, not what each device gets.

For the protocol differences beyond routers, see what WireGuard is and our WireGuard vs OpenVPN vs IKEv2 guide; the fastest VPN comparison covers provider speeds.

Behind an ISP modem-router, double NAT is the first thing that breaks

Most homes can't replace the ISP's box, so the VPN router plugs into it: ExpressVPN's router guide describes exactly that, an Ethernet cable from the VPN router's Internet port to a LAN port on your modem or existing router. The tunnel usually connects fine this way. What breaks is everything around it, because both boxes now translate addresses (NAT) and your network is split in two.

• Inbound features stop. ASUS's WAN guide says a router with a private WAN address sits in a multi-layer NAT network where "DDNS service and Port Forwarding will not function properly".
• Devices on the two halves can't see each other. ASUS says two routers in series "can divide your private network into two", so a phone still on the ISP's Wi-Fi may not find the TV on the VPN router. Put both on the VPN router's Wi-Fi.
• Address clash. If both routers use the same range, GL.iNet shows "LAN subnet is in conflict with the WAN subnet. Please Change LAN Subnet to a different address." The fix is to change the third number of 192.168.8.1, for example to 192.168.10.1. ASUS has a sibling case: an OpenVPN client "will not work" when the router's LAN IP equals the VPN server's IP.

The fixes belong on the ISP box. ExpressVPN lists two: put the ISP modem-router into bridge mode ("also known as 'bridging', 'transparent bridging' or 'modem only' mode"), or put the VPN router in the ISP box's DMZ. ASUS's usual cure for double NAT, switching the second router to Access Point mode, doesn't fit here: in AP mode "the firewall, IP sharing, and NAT functions are disabled by default", and routing is the job the VPN router is there to do. PureVPN's router page adds a related check: make sure the router you are configuring "is not working as a modem".

DNS is where a working router VPN still leaks

A router can carry all your traffic through the tunnel and still send name lookups somewhere else, usually to the ISP's resolver that it learned on its WAN port. A leak test then shows your ISP even though the tunnel is up. Each firmware has a specific setting that decides this, and the provider guides tell you what to choose.

• Asuswrt-Merlin, OpenVPN: set Accept DNS Configuration to Exclusive (Proton VPN) or Strict (NordVPN, which also sets the WAN DNS to its own servers, 103.86.96.100 and 103.86.99.100, with Connect to DNS Server automatically set to No). Since 388.1, an OpenVPN client that redirects all traffic in Exclusive mode "will now force redirect ALL DNS traffic".
• OpenWrt: untick Use DNS servers advertised by peer on the wan interface and enter the VPN's DNS. OpenWrt's OpenVPN guide suggests confirming the result with a DNS leak test afterwards.
• GL.iNet: leave Allow Custom DNS to Override VPN DNS off unless you mean it; when on, tunnel traffic is resolved by your custom DNS "instead of the DNS server settings from the VPN connections".
• DD-WRT: Proton VPN's guide disables IPv6 under Setup › IPV6 so nothing travels outside an IPv4-only tunnel.

Some devices also ignore the router's DNS because they have their own servers configured. Two firmwares can force them back: Asuswrt-Merlin's DNS Director (in the LAN section) can make specific devices or the whole network use a chosen resolver, though its wiki warns it "will interfere with resolution of local hostnames"; and GL.iNet's Override DNS Settings for All Clients overrides "unencrypted DNS settings". Encrypted DNS set inside a device's own browser or system is outside what either feature covers. After any change, check from a device with no VPN app using our VPN status and leak check.

Router-specific failures have documented symptoms and fixes

Most router VPN problems announce themselves in a recognisable way, and the router or provider documentation already describes the fix. The table pairs each symptom with its documented cause and remedy, and says what the symptom does not prove, so you don't fix the wrong layer.

Why 1420 and 1412 are the MTU numbers that matter

Ethernet carries 1,500-byte packets, and RFC 2516 caps PPPoE lines, which many ISPs use, at 1,492 because PPPoE adds 8 bytes of header. WireGuard's own wg-quick tool sets the tunnel MTU to the underlying link's MTU minus 80, which gives the familiar 1420 on ordinary Ethernet and 1412 on PPPoE. A router config that hard-codes 1420 on a PPPoE line sends packets 8 bytes too large, and a common symptom is that small pages load while large ones stall. Lowering the tunnel MTU, or enabling MSS clamping as Proton VPN's OpenWrt guide does, removes the problem.

A router can come back from a power cut with the wrong time

Routers set their clocks over the internet with NTP after they boot, and until that sync completes the time can be wrong. Both VPN protocols notice. OpenVPN checks the server's certificate against a validity window defined in RFC 5280, using the router's own clock. WireGuard's protocol page says the server "discards packets containing timestamps less than or equal to" the greatest it has seen from that client, and OpenWrt's WireGuard documentation warns that WireGuard "can refuse to pass traffic if the peer's clock is out of sync" and recommends relying on NTP. Asuswrt-Merlin's wiki notes the same dependency for encrypted DNS: it "won't use encryption until after your router's clock has been properly set through NTP".

Practical rule:If the tunnel fails only after a reboot or power cut, check the router's clock and its NTP setting before you touch the VPN profile. A new config file can't fix a wrong date.

Choosing which devices skip the tunnel is a router setting, not an app setting

The router-level version of split tunneling is per device rather than per app, and every firmware with it hides it somewhere different. It's how you send the TV through the VPN while the work laptop, the banking app or a lag-sensitive console uses the normal line.

• ASUS VPN Fusion: turn off Apply to all devices in the profile, then Edit Device and select the devices that should use it. ASUS also lets you run several VPN connections at once and assign different devices to different tunnels.
• Asuswrt-Merlin: VPN Director rules match a local IP and send it to a client or to WAN to bypass every tunnel; WAN rules take priority, and the limit is 199 rules.
• GL.iNet: the VPN Dashboard routes All Clients or Specified Devices, by connection type (LAN, guest network) and by destination, including an excluded domain or IP list.
• TP-Link: add devices under Device List; anything not selected keeps using the regular connection.
• Routers running ExpressVPN: up to five device groups, each with its own VPN location, no VPN or no internet, all on the same protocol.

This solves the two biggest router-VPN complaints at once: services that block VPN addresses get a clean route on one device, while everything else stays protected.

Smart TVs and consoles gain the most, but streaming services still detect VPNs

The whole point of a router VPN is reaching the gadgets an app can't. That's where it earns its keep: the living-room hardware you'd otherwise have no way to protect or relocate. But the same blanket coverage that makes it powerful also changes how streaming behaves, so it's worth setting expectations.

• Smart TVs and streaming sticks — few run a proper VPN app, so the router is often the only practical way to route them through a tunnel. See our smart TV setup guide for the alternatives.
• Game consoles — no native VPN support at all; a router lets them appear in another region for lobbies or content. Our PS5 and Xbox guide covers the console side.
• IoT and smart-home gear — covered automatically, with nothing to install.
• Phones and laptops — still work, though on these the standalone app is usually faster and lets you toggle location per device, and it keeps protecting them once they leave the house.

On streaming, be realistic: services actively detect and block VPN traffic, and they're good at it. A router VPN doesn't magically defeat that — you'll still need a provider with servers that work with your chosen platform. If watching from another region is your main goal, our guides for Netflix and BBC iPlayer cover which services hold up, and the Android TV guide is useful if your TV can actually run an app. Big live events are the classic use case — see our sports streaming hub for how a whole-home setup helps there.

Changing country on a router means switching profiles, not tapping a map

A router config file normally holds one server, so a new location means a new file or a second profile. Proton VPN says so directly: to change your VPN location "you need to update your router configuration", and "you can't switch servers instantly". Surfshark's router guide has you download one file per location for the same reason. The practical workaround is to load several profiles in advance and switch between them:

• TP-Link: up to six profiles in the Server List, with one active at a time.
• Asuswrt-Merlin: up to five OpenVPN and five WireGuard clients, each pointed at a different location and chosen per device in VPN Director.
• ASUS VPN Fusion: several simultaneous tunnels, with devices assigned to each.
• GL.iNet: built-in providers list their servers in the profile, so picking a new one is a menu choice rather than a new upload.
• Routers running ExpressVPN: each of the up to five device groups can sit in a different country.

A free router VPN exists, and it counts as one connection

Among the nine providers we track, Proton VPN is the one whose free plan explicitly covers routers. Its router page says "Router connections are available on all Proton VPN plans, including Proton Free", and that the router "only counts as one connection on a Free plan, no matter how many devices you connect to it". The WireGuard file comes from the same Downloads › WireGuard configuration page, though on the Free plan "the only VPN option available to you is VPN Accelerator". Expect the router's processor, not the plan, to set your speed. Our Proton VPN review and free VPN guide cover the free plan's other limits.

Check the tunnel from a device that has no VPN app of its own

The router's status page tells you the tunnel is up; it doesn't tell you every device is using it. ASUS shows Connected on the profile, GL.iNet a green dot and the connected server in its VPN Dashboard, and DD-WRT Client: CONNECTED SUCCESS under Status › OpenVPN. Then test from the devices themselves, with their own VPN apps switched off so the result reflects the router:

1. 1Open our VPN check or what is my IP on a phone joined to the router's Wi-Fi. It should show the VPN server's location, not yours.
2. 2Run a DNS leak test. Any server belonging to your ISP means the DNS settings above need another look.
3. 3Run the WebRTC leak test in a browser.
4. 4Disable the VPN profile on the router for a moment and watch what happens. With a kill switch on, devices should lose internet rather than fall back to your real address; our kill switch test walks through it.
5. 5Run a speed test through the tunnel and compare it with your baseline from the speed test page.

Our full testing guide explains what each result means.

A router VPN is the most complete home setup, and the most involved one

A router VPN is the most complete way to cover a household, but it's also the most involved to set up and the most likely to cost you some speed. Match the path to your patience: use the client already in your firmware if you have one, buy a provider-built router if you want it done in minutes, flash DD-WRT or FreshTomato if you want maximum control and don't mind the risk, and always test for leaks once it's live.

If you're still deciding between doing this at the router or just running an app on the devices you care about, weigh it against your actual habits. For hands-off, whole-home coverage the router wins; for a single TV or laptop and occasional use, the app is simpler and faster. When you're ready to pick hardware and a provider, start with our router VPN guide and cross-check pricing on the VPN price index.

Every source behind this guide was re-read in October 2026

• ASUS — How to set up an OpenVPN client in VPN Fusion, WireGuard client in VPN Fusion, VPN Fusion as the default connection and VPN Client on older firmware
• ASUS — NordVPN in VPN Fusion and Surfshark in VPN Fusion
• ASUS — WAN connection types and multi-layer NAT, double NAT and Access Point mode
• Asuswrt-Merlin — changelog, VPN Director, DNS Director and DNS Privacy
• GL.iNet — VPN Client Profile, WireGuard Client, VPN Dashboard, DNS and subnet conflict
• GL.iNet product pages: Flint 2, Flint 3, Slate AX, Slate 7, Beryl 7, Beryl AX, Brume 2, Opal, Mango
• TP-Link — Set up a VPN client on your TP-Link router
• NETGEAR — How do I use VPN on my NETGEAR router with my iOS device?
• OpenWrt — WireGuard client, OpenVPN client, WireGuard basics and 8/64 warning
• FreshTomato and its hardware compatibility list
• RFC 2516 — PPPoE (MTU 1492) and RFC 5280 — certificate validity
• WireGuard — protocol and wg-quick MTU logic
• ExpressVPN — router FAQ, Aircove FAQ, future router updates, Fortify announcement, device groups, connecting behind a modem and manual OpenVPN on Asus
• NordVPN — setting up a router, Asus, AsusWRT-Merlin, which router to use and router login token
• Surfshark — manual WireGuard on a router and WireGuard on DD-WRT
• Proton VPN — install Proton VPN on your router, WireGuard configurations, AsusWRT WireGuard, AsusWRT-Merlin OpenVPN, OpenWrt WireGuard and DD-WRT OpenVPN
• Private Internet Access — VPN router
• CyberGhost — VPN router
• IPVanish — VPN routers
• PureVPN — supported routers and protocols and GL.iNet setup
• TotalVPN — help centre