How to Set Up a VPN on Your Router — 2026 Guide
A VPN on your router protects every device connected to your home network — including smart TVs, game consoles, and IoT devices that can't run VPN apps. The setup is more complex than a regular app, but once configured, it runs automatically in the background.
Do you need a VPN on your router?
A router VPN makes sense if you want to protect devices that can't run VPN software — smart TVs, PlayStation/Xbox, Chromecast, Ring doorbells, smart speakers. It also covers every device automatically without managing multiple app subscriptions. The downside: speed is limited by your router's CPU, and you can't switch servers per-device without extra configuration.
Most home routers can't run VPN software. You need a router with custom firmware (DD-WRT, Tomato, Asus Merlin, OpenWRT) or a router that ships with VPN support built in.
Compatible routers and firmware
Check compatibility before purchasing:
- DD-WRT: Supports 200+ router models. Download from dd-wrt.com — check your router model first.
- Asus Merlin: Enhanced firmware for Asus routers with built-in OpenVPN and WireGuard UI.
- Tomato: Broadcom-based routers. Older but simpler interface.
- OpenWRT: Most flexible. Supports almost all modern routers with OpenVPN + WireGuard packages.
- Pre-flashed VPN routers: Vilfo, Aircove (ExpressVPN), InvizBox 2 — ready to go out of the box.
Method 1: Asus router with Merlin firmware (easiest)
Asus routers with Merlin firmware have a built-in VPN client UI.
- 1. Flash Asus Merlin: Download from asuswrt-merlin.net → upload via router admin → Firmware Upgrade
- 2. Open router admin → VPN → VPN Client → Add Profile
- 3. Choose protocol (WireGuard or OpenVPN)
- 4. Import your .conf or .ovpn file from your VPN provider
- 5. Set 'WAN access' to route all traffic through VPN → Activate
Method 2: DD-WRT with OpenVPN
- 1. Verify your router supports DD-WRT at dd-wrt.com/wiki
- 2. Download and install the correct DD-WRT build for your router
- 3. In the DD-WRT admin: Services → VPN → OpenVPN Client → Enable
- 4. Enter your VPN server IP, port, and paste the certificate and key from your .ovpn file
- 5. Set 'NAT' to Enabled → Apply Settings → Reboot
Method 3: Buy a pre-configured VPN router
If you don't want to configure firmware yourself:
- ExpressVPN Aircove: Wi-Fi 6, native ExpressVPN integration, manages device groups
- Vilfo: Open-source router with WireGuard and OpenVPN, designed for VPN use
- InvizBox 2: Dedicated VPN router with automatic server failover
- Flash Routers: Buy pre-flashed DD-WRT or Tomato routers from flashrouters.com
Important limitations to know
- Speed: Your router's CPU limits VPN throughput. Budget routers max out at 20–50Mbps with encryption. Mid-range ($100+) routers can do 100–300Mbps.
- No per-device server selection: All devices use the same VPN server. Workaround: set up multiple VPN clients and assign devices via static IP routing.
- Double encryption: If you run a VPN app on a device connected to a VPN router, you'll have double encryption — slower but more private.
Frequently asked questions
Which VPN works best on routers?
NordVPN, ExpressVPN, and Surfshark all provide detailed router setup guides and .ovpn/.conf files. ExpressVPN's Aircove router has native integration. Mullvad's WireGuard config works excellently on OpenWRT.
Does a VPN router slow down internet?
Yes — the router's CPU handles encryption, which limits throughput. A budget router might max at 30Mbps with VPN on. An Asus RT-AX88U or similar mid-range router with hardware AES can do 200–400Mbps. WireGuard is much faster than OpenVPN on routers.
Can I run a VPN on my regular ISP router?
Most ISP-provided routers (from Comcast, AT&T, etc.) don't support third-party VPN clients. You'd need to either replace it with a compatible router or use a VPN app on each device individually.