# How to configure a VPN on a router so every device is covered URL: https://webvpn.org/vpn/vpn-on-router/ Updated: 2026-09-06 How to configure a VPN on a router step by step: which routers support it, where the settings live, WireGuard and OpenVPN client setup, speed limits, and free VPN limits. To configure a VPN on a router you need a router whose firmware includes a VPN client, a configuration file or key set from your VPN provider or your own server, and about fifteen minutes to paste the settings in and test them. Once it is running, every device connected to that router goes through the tunnel automatically. That last sentence is why people do this. Phones and laptops can run a VPN app, but a smart TV, a games console, a set-top box or a thermostat cannot. Putting the client on the router covers them all, avoids per-device connection limits, and removes the chance that someone in the household forgets to switch the app on. The costs are speed, because a router's processor is far weaker than a laptop's, and some complexity when you want one device to bypass the tunnel. This guide covers both the setup and the trade-offs. ## Check whether your router can run a VPN client There are three kinds of routers for this purpose. - Routers with a built-in VPN client. Several consumer brands ship firmware with an OpenVPN client, and newer models add WireGuard. Look in the admin interface for a section named VPN, VPN Client or similar. If it only offers a VPN server, that lets you connect into your home from outside, which is a different feature. - Routers that can run open firmware. OpenWrt, DD-WRT and similar projects support WireGuard and OpenVPN on a long list of hardware. Flashing firmware is a one-time task with a real risk of bricking the device if you pick the wrong image, so read the project's page for your exact model. - Routers that cannot do either. Most ISP-supplied boxes fall here. The usual answer is to leave the ISP router in place, plug a second VPN-capable router into it, and connect your devices to the second router. Also check the processor. Router product pages rarely list VPN throughput, but community forums for each firmware usually do. A router that struggles with OpenVPN often does much better with WireGuard, because WireGuard's cipher is designed for hardware without AES acceleration. ## Get the configuration from your provider or server A router VPN client needs the same information as an app, but in file form rather than through a login. For OpenVPN, your provider's website usually offers .ovpn files per server location, plus a username and password specific to manual connections. Download one file for the location you want. For WireGuard, providers that support it generate a configuration containing your private key, the server public key, the endpoint and the allowed IP ranges; some let you download it, others show a QR code you can decode. If you run your own server, generate a peer on it for the router exactly as you would for a laptop. The WireGuard setup guide on this site walks through the server side. A router is just another peer with its own key pair and its own tunnel address. Keep the file somewhere safe and never share it. A WireGuard config contains your private key; an OpenVPN file with embedded credentials can be used by anyone who has it. ## How to set up the VPN on the router, step by step The exact screens differ by brand, but the sequence is the same everywhere. - Log in to the router admin page, usually at the gateway address shown in your device's network settings. - Find the VPN Client section. On stock firmware it is often under Advanced or Network. On OpenWrt install the wireguard-tools and luci-proto-wireguard packages first, or the openvpn-openssl and luci-app-openvpn packages. - Create a new client profile and choose the protocol. Upload the .ovpn file, or paste the WireGuard keys, endpoint and addresses into the matching fields. - Enter the manual-connection username and password if OpenVPN requires them. - Set the DNS servers the router should use while connected, ideally the provider's own resolvers or an encrypted public resolver, so lookups do not leak to your ISP. - Enable the profile and watch the status. WireGuard shows a recent handshake; OpenVPN shows Connected and a log. - From a device on the network, check your public IP address on any lookup page, then run a DNS leak test. Both should show the VPN's location. - Enable a kill switch or "block traffic if VPN drops" option if the firmware offers one, so a tunnel failure does not silently expose every device. If the tunnel connects but devices have no internet, the usual culprits are DNS settings pointing at an unreachable resolver, or a firewall zone on OpenWrt that has not been told to forward LAN traffic into the VPN interface. ## Routing some devices around the tunnel Whole-home VPN has one common annoyance: services that dislike VPN addresses, such as some banking sites and video platforms, and devices such as printers or game consoles that want the fastest possible path. Two approaches handle this. Policy-based routing lets you list devices by IP or MAC address and decide per device whether it goes through the VPN or directly to the ISP. Several stock firmwares call this VPN Fusion or Exclusive DNS and Routing; OpenWrt does it through package rules. The alternative is the two-router layout: everything on the VPN router is tunnelled, everything on the ISP router is not, and you move a device between Wi-Fi networks to change its behaviour. The second approach is cruder but nearly impossible to misconfigure. ## What a free VPN on a router can and cannot do Searches for a free router VPN usually mean one of three things, and only two of them work well. Running your own server on a machine you already pay for is effectively free and gives you full control. It hides your traffic from the home ISP and from public Wi-Fi if you point a travel router at it, but it does not make you anonymous, because the server's address is yours. Free tiers of reputable providers sometimes publish configuration files for manual setup, which a router can use. Expect a limited choice of locations and lower speeds, and read the provider's policy on manual connections before relying on it. Free VPN services that only exist as an app, with no configuration files, cannot be put on a router at all. Beyond the practical problem, the safety guide on this site explains why an ad-supported VPN is a poor fit for something you want running unattended on your network gateway. ## Speed: what to expect and how to improve it A router's CPU encrypts every packet, so throughput is limited by the processor rather than by your connection. Reports from firmware communities consistently show the same pattern: single-core routers from a few years ago manage a small fraction of a fast line through OpenVPN, while recent multi-core models using WireGuard come close to saturating a typical home connection. To improve speed, switch from OpenVPN to WireGuard if both are available, choose a VPN server geographically close to you, and connect fixed devices by cable so the router is not also spending effort on Wi-Fi. If a device needs full line speed for large downloads, route it around the tunnel with the policy rules above rather than slowing the whole house. ## Notes from people who run this at home Home-networking communities have accumulated consistent advice about router VPNs that is worth reading before you commit. Firmware maintainers repeatedly stress that the VPN client on a router protects devices only while they are on that network. Phones and laptops that leave the house are unprotected unless they run their own app, so the router setup complements the app rather than replacing it. People who have run whole-home tunnels for years note that the biggest source of frustration is not speed but services that block VPN addresses, which is why almost all of them end up with a policy-routing rule or a second network for a few specific devices. Privacy-focused reviewers add a point that is easy to miss: the router's DNS settings are the leak most people forget. A perfectly configured tunnel with DNS still pointing at the ISP's resolver tells the ISP every domain the household visits. Setting encrypted or provider DNS on the router and then testing it is not optional. ## Do this next Log in to your router now and look for a VPN Client section. If it is there, download one configuration file from your provider or generate a router peer on your own server, follow the eight steps above, and verify with an IP check and a DNS leak test. If it is not there, decide between open firmware for your current router and a second router built for the job before buying anything. ## FAQ Q: Can I put a VPN on any router? A: No. The router must run firmware with a VPN client, either from the manufacturer or an open firmware such as OpenWrt or DD-WRT. Most ISP-supplied routers do not have one. Check the admin page for a VPN client section before buying anything. Q: Will a VPN on my router slow down my internet? A: Yes, and the router's processor is the bottleneck. A cheap router may manage a fraction of your line speed through OpenVPN, while a mid-range router using WireGuard can often handle a typical home connection. Wired and Wi-Fi speeds without the VPN are unaffected if you use a split setup. Q: Is there a free VPN for a router? A: You can run your own WireGuard server on a machine you control and point the router at it for the cost of hosting, or use the free tier of a provider that publishes WireGuard or OpenVPN configuration files. Free consumer tiers rarely include router configs, so check before assuming. Q: What are the VPN settings on a router called? A: Names vary by brand: VPN Client, VPN Fusion, VPN Server and Client, or simply VPN under Advanced settings. On OpenWrt and DD-WRT you install a WireGuard or OpenVPN package and configure it as a network interface. Q: Should I run the VPN on the router or on each device? A: Run it on the router for devices that cannot run a VPN app, such as TVs and consoles, and for convenience. Keep the app on phones and laptops too, because the router tunnel stops protecting them the moment they leave the house.