VPN router setup
Updated 21 September 2026 · How we research
A router-level VPN covers every device on your network, including the ones that cannot run a client at all: TVs, consoles, smart speakers and printers. It also has real drawbacks that vendors rarely mention.
The trade-offs
Best used alongside device clients rather than instead of them.
| Advantage | Cost |
|---|---|
| Covers devices with no VPN app | Router CPUs are slow; encryption often caps throughput well below your line speed |
| One connection covers the whole household | Switching server or country means reconfiguring the router |
| Always on, with nothing to forget | A router VPN rarely has a real kill switch |
| May count as a single device against your limit | Troubleshooting is harder when everything is behind one tunnel |
Firmware options
- Stock firmware: some consumer routers include an OpenVPN or WireGuard client. Check before assuming.
- OpenWrt: the most flexible option, with good WireGuard support and full firewall control.
- DD-WRT / Tomato: long-standing OpenVPN support on a wide range of hardware.
- Vendor-specific firmware such as AsusWRT, which often includes an OpenVPN client.
WireGuard is the right choice if your firmware supports it
Router hardware is usually the bottleneck, and WireGuard's lower per-packet cost makes a substantial difference on modest CPUs. If only OpenVPN is available, expect throughput well below your broadband speed.
Setting it up
- Confirm your provider publishes configuration files or router instructions. Windscribe offers manual config generation; Astrill lists router support for StealthVPN and OpenVPN; ZoogVPN lists router support for WireGuard and both OpenVPN transports.
- Back up your current router configuration before changing anything.
- Install the configuration and connect to a nearby server first, to establish a working baseline.
- Measure throughput from a wired device and compare it with your speed without the VPN. If the router is the bottleneck, you will see it immediately.
- Verify DNS is going through the tunnel — see DNS leak protection.
- Consider excluding devices that do not need the tunnel, if your firmware supports policy-based routing.
Providers compared
Commercial terms as published on VPN Sherlock.
| # | VPN | Best for | Key features | Protocols | Devices | Price | Learn more |
|---|---|---|---|---|---|---|---|
| 1 |  | Best overall | Six published protocols — the widest range among the five compared here | 6 (incl. Shadow, ZoogTLS) | Unlimited | $2.49/month | Get dealRead review |
| 2 |  Proton VPN | Clearest obfuscation | The only provider here that publishes how its obfuscation protocol is built | 3 (incl. Stealth) | 10 | $4.99/month | Get dealRead review |
| 3 |  PureVPN | Most devices covered | Native Apple TV and Fire Stick apps, which removes the usual reason to configure a router | 3 (WireGuard, OpenVPN, IKEv2) | 10 | $3.24/month | Get dealRead review |
| 4 |  | Most obfuscation options | Two proprietary transports, one of them available at router level. No IKEv2 | 4 (incl. OpenWeb, StealthVPN) | 5 | $5.00/month | Get dealRead review |
| 5 |  Windscribe | Most flexible | Manual config generation for all three protocols, plus a free tier you can evaluate first | 3 (OpenVPN, IKEv2, WireGuard) | Unlimited | $3.00/month | Get dealRead review |
Save 82%ZoogVPN lists router support for WireGuard, OpenVPN UDP and OpenVPN TCP.
$2.49/month+ 3 months free
2-year plans
Unlimited devices30-day guarantee
Affiliate link — we may earn a commission at no extra cost to you. See our affiliate disclosure. Pricing shown as published on VPN Sherlock; confirm current terms at checkout.
Frequently asked questions
Does a router VPN slow down my internet?
Usually yes. Router processors are much slower than phone or laptop CPUs, and encryption is CPU-bound, so throughput is often capped well below your line speed. WireGuard reduces this considerably.
Can I still use a VPN app on my laptop if my router has one?
Yes, but you would be tunnelling inside a tunnel, which costs speed. Most people exclude the device from the router VPN or accept the overhead.