VPN on Your Router: The Pros, the Cons and Your Options

Most people install a VPN app on each phone and laptop and stop there. The other way to do it is to put the VPN on your router, so the tunnel covers everything that connects to your home network in one go. It is a genuinely different trade-off, not just a different installation method: you gain whole-home coverage and lose per-device flexibility. This guide goes through how it works, the real advantages, the disadvantages people usually discover afterwards, and every product route available to you, from a setting already sitting in your current router to routers sold pre-configured. When you have decided, our step-by-step router setup guide walks through the installation itself.

How a router VPN works

Instead of each device running its own VPN app, the router establishes one encrypted tunnel to the VPN provider’s server and passes all household traffic through it. Every device on the network, phones, laptops, TVs, consoles, a doorbell camera, uses that single tunnel and appears online with the VPN server’s location. The devices themselves need no software and no configuration; as far as they are concerned, it is an ordinary Wi-Fi network. That one decision, VPN at the router instead of on the device, drives everything in the two lists below.

The advantages

Every device is covered, including the ones that cannot run apps

Smart TVs, game consoles, streaming sticks, e-readers and most smart-home gadgets have no VPN app, or a limited one. On a router VPN they are covered anyway, because the tunnel sits between them and the internet. This is the single biggest reason people choose the router route: it is the only straightforward way to put the whole household behind a VPN.

It is always on, and there is nothing to remember

Per-device apps only protect you when someone remembers to start them. A router VPN is on whenever the network is on. Nobody in the household can forget, a guest’s phone is covered while it is on your Wi-Fi, and devices that wake up at night to sync are covered too.

It uses one connection slot

Providers that limit simultaneous connections count a router as a single one. NordVPN states it directly: “The router uses only one device slot, but the VPN will protect all the devices connected to the network.” ExpressVPN says the same: “A Wi-Fi router with VPN enabled counts as one connection only, even if it is providing VPN to numerous devices.” Proton VPN confirms a router counts as one connection, and its router setup works on all plans, including the free one. Surfshark sidesteps the question entirely by allowing unlimited simultaneous connections. Either way, a household of fifteen devices does not need fifteen slots.

One setup instead of fifteen installations

You configure one device once, rather than installing and signing in on every phone, tablet and laptop in the house, and new devices are covered the moment they join the network.

The disadvantages

Your router’s processor sets the speed ceiling

Encryption is work, and on a router it is done by a small processor that was not built for it. Proton VPN’s own router guide warns that speeds depend on the router’s processor and that weaker hardware means a slower connection. Every VPN adds a step between you and the internet in any case; on an underpowered router, that step gets noticeably longer. A modern router with hardware encryption support handles this far better than a budget box or an old ISP unit. We have not measured specific routers, so treat any exact speed figure you see elsewhere with caution.

Everything goes through the VPN, including things that should not

The flip side of whole-home coverage is that there is no per-device judgement. Your work laptop’s connection to a local office service, your bank, the printer on your own network, all of it interacts with a tunnel that routes traffic via another location. Devices can behave oddly: local services may treat you as a foreign visitor, and some websites challenge VPN traffic with extra verification. On an app you would simply disconnect for a minute; on a router, changing anything affects the whole household.

Changing location means reconfiguring the router

With an app, switching country takes two taps. With a router VPN, Proton’s guide puts it plainly: changing location requires updating the router configuration. Some routers let you save several profiles and swap between them, but it is never as quick as an app, and everyone else in the house changes country with you.

Some app features do not carry over

Features that live in the provider’s app may not exist when you connect through a router. Proton notes that features such as its NetShield blocker and split tunneling may not be available through a router connection. The same pattern holds generally: the router tunnel is a simpler, more basic connection than the app.

The last stretch is not encrypted by the VPN

A router VPN encrypts traffic from the router onwards. Between your device and the router, traffic uses your ordinary Wi-Fi security, not the VPN tunnel. On your own password-protected home network that is normally acceptable, but it is worth knowing the tunnel starts at the router, not at your screen.

Compatibility is the biggest hurdle

None of this works unless your router can act as a VPN client, and many cannot. NordVPN’s support hub says it plainly: if your router was issued by your ISP, it probably does not support VPN configurations. Proton says the same about ISP routers. Surfshark publishes an unsupported list covering stock firmware from Arris, Belkin, Cisco, most Linksys models, TRENDnet, Google WiFi and most ISP routers, because they lack OpenVPN or WireGuard client support by default. Routers that only offer VPN passthrough or a VPN server mode do not qualify either; hide.me states that explicitly. The first step is always to check whether your specific model has a VPN client, not a VPN server.

Your product options

Option 1: Your current router may already do it

Before buying anything, check what you own. Many ASUS routers include a built-in VPN client called VPN Fusion in their Asuswrt firmware, which can connect to several VPN servers and even assign different devices to different tunnels, so the TV can sit in one country while a laptop sits in another. Older ASUS models expose the same function as “VPN Client”. GL.iNet routers ship with OpenVPN and WireGuard clients pre-installed and advertise support for more than 30 VPN services, with built-in logins for several providers. Many TP-Link routers have a VPN Client feature (under Advanced, then VPN Client), supporting OpenVPN and WireGuard among other protocols, though the exact protocols vary by model and some TP-Link units are server-only. The check takes a minute: open your router’s settings and look for a VPN client, or find your model on the manufacturer’s site.

Option 2: Choose a provider that actually supports routers

Most major providers support routers, but the level of support differs a lot, and a few do not support routers at all.

ExpressVPN goes furthest: it offers its own app for selected ASUS, Linksys and Netgear routers, which brings an app-like interface to the router, plus manual OpenVPN setup for other models. Read the caveat on ExpressVPN’s own pages before counting on the app, though: security updates for that router firmware have ended for the supported models, and ExpressVPN itself notes that manual configurations do not offer the same benefits as its app. Its router counts as one connection against plan limits of 10 to 14 devices depending on tier. Our ExpressVPN review

NordVPN is manual setup only, and self-configured routers use OpenVPN; its faster NordLynx protocol is not available on a router you configure yourself (it appears only on a pre-configured partner router). NordVPN publishes tutorials for a long list of firmware, including AsusWRT, DD-WRT, OpenWrt, pfSense and TP-Link, and the router uses one of your 10 simultaneous connections. Our NordVPN review

Surfshark is also manual setup, with guides covering OpenVPN and WireGuard on AsusWRT (including VPN Fusion), DD-WRT and OpenWrt. Because Surfshark allows unlimited simultaneous connections, the router does not eat into any allowance. Our Surfshark review

Proton VPN supports manual OpenVPN and WireGuard setup on routers across all plans, including Proton Free, and the router counts as a single connection. Its own guide is unusually candid about the downsides listed above. Our Proton VPN review

CyberGhost supports routers through manual setup: you generate a configuration in your account and install it on the router. Manual router setups use OpenVPN only; CyberGhost states that manual WireGuard configuration is not supported, as WireGuard works only in its apps. Our CyberGhost review

IPVanish offers manual OpenVPN setup and pre-configured routers through a partner. Its support is described by IPVanish itself as best-effort, covering high-end ASUS routers and DD-WRT, and it will help with configuration but not with flashing a router. Our IPVanish review PureVPN publishes manual router guides and a dedicated applet for DD-WRT routers. PrivadoVPN supports manual OpenVPN and WireGuard on routers, but its configuration generators are for Premium accounts. hide.me publishes manual guides and its own WireGuard package for OpenWrt routers, with router OpenVPN reserved for Premium subscribers.

And the ones that cannot: Bitdefender VPN states in its official FAQ that it does not support installation on routers and provides no configuration files at all. Norton VPN’s official platform list covers Windows, Mac, iOS and Android apps only, with no router setup offered. Total VPN publishes no router setup documentation on its own pages. If a router VPN is your plan, those three are off the table based on their own published information.

Option 3: Buy a router that arrives pre-configured

If the setup itself is the obstacle, retailers such as FlashRouters sell routers already flashed or configured with VPN support, including a free pre-configuration service where they set up your chosen provider before shipping; the VPN subscription itself is not included. One product that used to headline this category is gone: ExpressVPN’s own Aircove router, a Wi-Fi 6 router with ExpressVPN built in, is listed as sold out in ExpressVPN’s store, and its support page states that Aircove routers are no longer available for purchase. Existing units still work, but do not plan a purchase around one.

Option 4: Flash your own router with open firmware

The enthusiast route is replacing your router’s firmware with DD-WRT, OpenWrt or Tomato, which add VPN client support to many models. Providers publish guides for exactly this, and hide.me even maintains its own OpenWrt package. Go in with your eyes open: providers warn that incorrect flashing can permanently damage the router, Surfshark disclaims responsibility for flashing damage and warranty loss, and IPVanish will not assist with the flashing step itself. This route is for people comfortable recovering a device that fails to boot.

Alternatives if a router VPN is not right for you

The router is not the only way to cover awkward devices. Installing the provider’s app on each main device stays the most flexible option: every device gets its own location, its own features and its own on/off switch, at the cost of covering only devices with apps. A middle path for a single awkward device, such as a TV in one room, is sharing a computer’s VPN connection: connect the computer to the VPN, then share that connection onward (Windows offers this through its mobile hotspot feature). It covers one extra device without touching the router, but only while the computer is on and nearby. And if your router supports per-device tunnels, as ASUS VPN Fusion does, you can run a hybrid: most of the household on apps, and only the devices that cannot run apps assigned to the router’s tunnel.

So which route should you take?

Choose the router route if your main problem is coverage: many devices, several without apps, and a household that will not manage individual connections. Check your current router for a VPN client first; if it has one, the whole project costs you nothing but an hour and any mainstream provider above will work, with Proton the only one that also works free. Choose a pre-configured router if you want the coverage without the configuration. Stay with per-device apps if you switch countries often, use app features like split tunneling, or share the network with people who need different settings. Whatever you choose, the weak point to respect is the router’s processor: it, more than the provider, decides how the setup feels day to day.

Ready to install? Follow the step-by-step router setup guide. Comparing the two providers with the clearest router policies: NordVPN’s current price · Proton VPN’s current price

Frequently asked questions

Does a VPN on my router count as one connection?

With the providers that limit connections, yes. NordVPN says a router uses only one device slot while protecting every device on the network, ExpressVPN says a router with VPN enabled counts as one connection only, and Proton VPN counts a router as one connection too. Surfshark allows unlimited simultaneous connections, so the question does not arise there.

Will a router VPN slow down my internet?

It can. The router’s processor does the encryption work, and providers such as Proton warn that weaker router hardware means slower speeds. A modern router handles it far better than an old or ISP-supplied unit. We have not measured specific routers, so be wary of exact speed claims.

Can I put a VPN on the router my ISP gave me?

Usually not. NordVPN and Proton both note that ISP-issued routers typically do not support VPN client configurations. What you need is a router with a built-in VPN client, such as many ASUS models with VPN Fusion, GL.iNet routers, or TP-Link models with their VPN Client feature.

Which VPN providers do not work on routers?

Based on their own published information: Bitdefender VPN states it does not support routers and provides no configuration files; Norton VPN offers apps for Windows, Mac, iOS and Android only; and Total VPN publishes no router setup documentation. Most other major providers, including ExpressVPN, NordVPN, Surfshark and Proton VPN, publish router setup guides.

Can some devices bypass the router VPN?

It depends on the router. Most router setups send everything through the tunnel. Some, like ASUS routers with VPN Fusion, can assign specific devices to specific tunnels or leave devices outside. Providers also note that app features such as split tunneling may not be available when you connect through a router.