How to Set Up a VPN on a Router (and Which Routers Work)

To set up a VPN on a router, you need a router whose firmware has a built-in OpenVPN or WireGuard client. You download a configuration file (or a key) for one server from your VPN account, import it in the router’s admin page, switch the connection on, and then check your IP address from any device at home. ASUS, GL.iNet, OpenWrt and DD-WRT routers all support this, and most routers handed out by internet providers don’t. The payoff is that every device on your Wi-Fi is covered; the cost is speed, because the router’s small processor does all the encryption.

Last updated 31 October 2026.

Why put a VPN on a router at all

A VPN app protects one device. A VPN on the router protects the whole network behind it, because every phone, laptop and gadget sends its traffic through the router anyway.

NordVPN’s VPN router page puts the counting plainly: one account secures “up to 10 devices at the same time,” but “installing a VPN on your router will cover as many devices as your router normally would.” Proton VPN’s router guide says the same thing from the other side: on its Free plan, the router counts as one connection, however many devices sit behind it.

The second reason is devices that can’t run an app at all. A smart thermostat, a pet camera, a printer, an e-reader, a smart TV: none of them will install a VPN client. ExpressVPN’s router explainer lists exactly this benefit, protection for “devices that don’t support VPN apps.”

The third reason is that it’s always on. NordVPN’s page notes that with a router VPN “you never risk accidentally connecting to the internet without the protection.” In practice, that’s the argument that wins over most families. Nobody has to remember to tap a button.

If you’ve only ever used a VPN on a laptop in a café, a router setup is a different tool for a different job. It protects your home connection from your internet provider’s view. It doesn’t follow you to the airport. For a reminder of what a VPN does and doesn’t hide in the first place, see our guide to what a VPN can and can’t hide.

Which routers support a VPN client

The router needs firmware with a VPN client built in, not just a “VPN server” feature for dialling into your home. Proton’s guide states the rule: “your router must support OpenVPN or WireGuard as a client.” Surfshark’s router help article says you need “firmware with a pre-installed OpenVPN or WireGuard client.” NordVPN’s router page gives a shorter test: “If it supports OpenVPN or WireGuard, it’s likely to work with NordVPN.”

Here’s what the providers’ own setup pages list:

Most people miss the line about internet-provider routers. NordVPN’s router help page says that if your router was issued by your ISP, “it probably does not support VPN configurations.” Proton says the same: most ISP routers “do not support VPN configurations.” If the box on your shelf came free with your broadband, check before you plan anything. Don’t trust the sticker on the box; look in the admin page.

You have three routes when your router can’t do it. ExpressVPN’s explainer lays them out: buy a router with VPN support built into its firmware, install open-source firmware like DD-WRT or OpenWrt on a compatible router, or add a second device (a small travel router, for example) between your modem and your main router. Honestly, the third route is the least risky for most homes, because you don’t touch the router your internet provider supports.

How to set up a VPN on a router: the general steps

Every brand’s menus differ, but the shape of the job is the same everywhere.

1. Check the firmware. Log in to the router’s admin page (usually its IP address, typed into a browser) and look for a VPN client section. On ASUS it’s under VPN, then VPN Fusion. On GL.iNet’s current firmware it’s VPN, then WireGuard Client or OpenVPN Client.
2. Get the configuration from your VPN account. Each provider has a manual-setup or router section in its web account. For WireGuard you usually generate a key pair or a ready-made .conf file for one server. For OpenVPN you download an .ovpn file for one server, plus a separate service username and password (not your normal login).
3. Import it into the router. Upload the file or paste the key, give the connection a name, and save.
4. Switch it on and apply. Some firmware lets you choose which devices use the VPN; others send everything through it.
5. Check it worked. From a phone on your Wi-Fi, open any “what is my IP” page. You should see the VPN server’s location, not your own.

Don’t forget step 5. It turns out a router can look connected in its menu while traffic still goes out the normal way, especially after a reboot or a firmware update.

What it looks like on three common setups

ASUS with VPN Fusion. ASUS’s own Surfshark setup FAQ shows the pattern. In Surfshark’s account, you click Router, then WireGuard, to generate a key. In the ASUS router app, you go to Settings, then VPN, then VPN Fusion, and add a profile: a connection name, the VPN type, a country, and the private key you copied. Then you bind the devices you want and click Apply and Enable. ASUS warns that the key “only shows once,” so paste it somewhere safe first. That FAQ also lists minimum firmware versions, so update the router before you start.

GL.iNet. GL.iNet’s WireGuard client guide covers firmware 4.7 and later. You go to VPN, then WireGuard Client. Some providers are built in, so you enter your account details and the router generates a configuration for each server. For anyone else, you click Add Manually, name the group, and upload the file (zip, tar, gz, conf or txt formats). NordVPN uses an access token here rather than your password, and GL.iNet notes the token is shown only once.

OpenWrt. This is the hands-on route. NordVPN’s OpenWrt guide says the OpenVPN package isn’t in the firmware image by default, so you install it first under System, then Software, and then manage it under VPN, then OpenVPN. After that you add an interface, a firewall zone and DNS servers under the Network menu. NordVPN also says plainly that its staff “have not tested” that configuration and that customers shared it. Skip the OpenWrt route unless you’re comfortable with firewall zones.

A worked example: a family of four on home broadband

Picture a household with two adults and two teenagers. Between them they own four phones, three laptops, two tablets, a smart TV, a printer, a thermostat and a doorbell camera. That’s 14 devices.

With app-only protection on NordVPN’s plan of 10 devices at a time, they’d have to choose which four go without. The thermostat, the printer, the doorbell and the TV can’t run the app anyway. So in practice they’d protect 10 of the 10 app-capable devices and leave the other four unprotected.

Put the VPN on the router instead, and the count changes. The router uses one of the 10 slots. All 14 devices behind it ride through the tunnel. The adults can still install the app on their phones for when they’re out, because that leaves 9 slots spare.

Now the trade-off. Every one of those 14 devices shares one server location. If one adult needs a home-country bank site to see a local address and a teenager’s school portal objects to VPN addresses, the router can’t treat them differently unless its firmware supports per-device rules. ASUS’s VPN Fusion does, with its exception list. Plenty of firmware doesn’t.

The downsides nobody puts on the box

Speed is capped by the router’s processor. This is the big one. ExpressVPN’s explainer says “most VPN-enabled routers use relatively weak CPUs,” and “that single processor handles encryption for every device on your network.” Proton says “internet speeds depend on your router’s processing power.” On a phone, the VPN uses the phone’s chip; on a router, one small chip encrypts for the whole house. Surfshark’s help article says simply that “connection speed might decrease.” We haven’t measured any routers ourselves, so we won’t quote figures, but every provider’s own page warns about it. For more on why VPNs slow connections, see does a VPN slow down internet.

You may lose the fast protocol. WireGuard-based protocols are usually quicker than OpenVPN. GL.iNet’s guide says WireGuard “intends to be considerably more performant than OpenVPN.” But several firmware guides, including DD-WRT and Tomato, only cover OpenVPN. NordVPN’s help page singles out one partner router for its “exclusive integration for NordLynx,” which tells you how uncommon that is.

One location for the whole house. Changing country means editing the router settings, not tapping a flag in an app. Proton notes that switching servers “requires editing the router configuration,” and that its settings apply to every device on the router.

App features don’t come along. Proton says some app features, such as NetShield and split tunneling, may not work through the router. The same applies broadly: ad blocking, kill switch toggles and per-app rules live in the app, not in a config file.

Flashing firmware can go wrong. NordVPN’s router page warns that “using custom firmware can void your router’s warranty.” Surfshark says a botched firmware install “might permanently damage your router.” Proton calls flashing “difficult” and says a mistake can leave the router unusable. Don’t flash a router you can’t afford to replace. Skip the risk when you can buy a cheap second router instead.

Common mistakes

Using your normal account password in the router. Many people forget this one. Most providers give you separate service credentials or a key for manual setups. Your website login won’t work in an OpenVPN file.

Forgetting DNS. If the router keeps your internet provider’s DNS servers, lookups can leak outside the tunnel. NordVPN’s OpenWrt guide adds its own DNS servers for exactly this reason. Use the DNS servers your provider’s guide names.

Double VPN by accident. When you run the app on a laptop that’s also behind the VPN router, your traffic goes through two tunnels. That’s slower, and rarely what you meant. Turn off one or the other. Honestly, when you’re at home, the router alone is enough.

Skipping the IP check after updates. Router firmware updates can reset VPN settings. Check your IP after every update, not just on setup day.

Which provider is easiest on a router

If choosing a provider is the question, the documentation matters more than the logo. NordVPN, Proton VPN and Surfshark all publish router guides for ASUS, OpenWrt and DD-WRT, and GL.iNet builds several providers into its own menus. Our NordVPN review and Proton VPN review cover their device limits and audit records, and the VPN section compares all five we cover.

FAQ: VPN router questions

Can any router run a VPN?

No. The router’s firmware needs an OpenVPN or WireGuard client. Many ASUS, GL.iNet and OpenWrt-capable routers have one; most routers supplied by internet providers don’t, according to both NordVPN and Proton.

Does a VPN router count as one device?

For the provider, yes. The router makes one connection, and every device behind it shares it. NordVPN says a router setup covers “as many devices as your router normally would,” and Proton says its Free plan counts the router as one connection.

Will a VPN on my router slow my internet?

Probably, yes. The router’s processor encrypts traffic for every device at once, and ExpressVPN, Proton and Surfshark all warn that speed depends on the router. When you’re choosing hardware, a newer router with WireGuard support usually copes better than an older one stuck on OpenVPN.

Should I flash DD-WRT or OpenWrt onto my router?

Only if you’re comfortable recovering a router that stops working. NordVPN warns custom firmware can void the warranty, and Surfshark warns a bad install can permanently damage it. A router with VPN support built in, or a small second router, is the safer route.

The short version

• A router VPN covers every device at home, including ones that can’t run a VPN app, and uses one connection on your account.
• You need firmware with an OpenVPN or WireGuard client: ASUS, GL.iNet, OpenWrt, DD-WRT and Tomato are the common ones. ISP routers usually can’t.
• The steps are the same everywhere: get a config or key from your provider, import it, switch it on, then check your IP.
• Expect slower speeds, one location for the whole house, and fewer features than the app.
• Don’t flash firmware on a router you can’t afford to lose.

More from the VPN & Privacy section