How to Set Up a VPN on Your Router
Installing a VPN on your router encrypts all internet traffic from every device on your network without needing to install the VPN app on each individual device.
Why Use a VPN on Your Router?
A device-level VPN app protects only that one device. A router-level VPN protects every device that connects to your home network simultaneously - smart TVs, gaming consoles, IoT devices, and any device that cannot run a VPN app on its own. It is particularly useful for devices like Apple TV or Roku that do not support VPN apps natively.
The trade-off is that router VPN setup is more complex, some routers do not support it, and VPN speed is limited by the router CPU rather than your internet connection. Older routers can become a bottleneck for high-speed connections.
Requirements
- A router that supports VPN client mode (Asus, Netgear Nighthawk, newer TP-Link)
- A VPN subscription with OpenVPN or WireGuard config file support
- The VPN provider's config files (.ovpn or .conf)
- A router with a reasonably powerful CPU for good throughput
Asus routers with ASUSWRT have one of the easiest built-in VPN client implementations. Netgear Nighthawk and TP-Link Archer also support OpenVPN. Budget routers often lack VPN client capability entirely.
Setup on Asus Router (ASUSWRT)
Go to http://192.168.1.1 or router.asus.com. Enter admin credentials.
Click the VPN menu item in the left sidebar, then select VPN Client.
Select the protocol your VPN provider supports. Click Add Profile, then import the .ovpn or .conf file from your VPN provider's dashboard.
Enter your VPN username and password if required. Click Activate to start the VPN connection. All devices on your network now route through the VPN.
The Speed Reality Nobody Advertises
Here's the number that surprises people: a mid-range router that moves 500+ Mbps of ordinary traffic might manage 50-150 Mbps through OpenVPN, because encryption runs on the router's little CPU and OpenVPN is single-threaded to boot. WireGuard changes the math substantially, it's lighter and faster on the same hardware, often two to four times quicker than OpenVPN on router-class chips, which is why it's worth preferring wherever your provider and firmware both support it. Even so, if you pay for gigabit and expect gigabit through a whole-router VPN, only high-end hardware (or an x86 box running the router software) gets close.
The practical pattern that serves most homes best is split tunneling: route only the devices that need the VPN through it, the streaming box, maybe a desktop, and let everything else use the normal connection at full speed. ASUSWRT calls this VPN Fusion or Director depending on version; OpenWrt and FreshTomato do it with policy routing. It also sidesteps the classic day-two complaint, "my VPN router broke my banking app", because your phone can stay off the tunnel entirely.
Three Pitfalls Before You Commit
Streaming services fight VPNs. Netflix and friends block known VPN endpoints, and when your whole network rides the tunnel, the blocked screen appears on every TV in the house at once. Split tunneling (above) is the sane insurance.
Your ISP-supplied gateway probably can't do this. VPN client mode is a retail-router feature: Asus is best-in-class, plus OpenWrt, FreshTomato, GL.iNet, some TP-Link and Netgear models. ISP boxes almost never offer it; the usual arrangement is your own VPN-capable router behind the ISP unit in bridge mode.
Know your kill-switch behaviour. Decide what should happen when the VPN drops: fail open (traffic continues unprotected) or fail closed (internet stops until the tunnel returns). Routers differ in their default, and discovering it by accident, either as a privacy leak or as a mystery outage while you're away, is the bad way to find out. Test it once on purpose: activate the tunnel, then break it (disable the profile) and watch what happens.