We would like to count page views and clicks with Google Analytics, which sets cookies in your
browser. It is how we learn which pages are worth writing. Nothing loads until you choose, and
declining costs you nothing on this site. What we collect.
A VPN on the router puts every device in the house behind the tunnel — consoles, smart TVs, the printer, guests' phones — and counts as one connection against the device limit. The catch is that the router's CPU does the encryption, so a cheap router will throttle a fast line. This page ranks providers on router support: their own firmware or app, WireGuard configs for third-party routers, per-device policy routing, and whether a pre-configured router is sold.
ExpressVPN72 The only major provider that sells its own router — Aircove, with Wi-Fi 6, per-device location groups, and the VPN pre-installed — plus firmware for a range of ASUS, Netgear and Linksys models.
NordVPN76 WireGuard (NordLynx) configs are not available for routers, but NordVPN partners with FlashRouters and supports OpenVPN on ASUS, GL.iNet, DD-WRT and pfSense with detailed guides, and its large network keeps streaming working through the router.
Surfshark76 WireGuard configs for routers, official support on ASUS and GL.iNet, and unlimited devices means the router does not even need to count.
Polished apps and reliable unblocking; owned by Kape, which also owns three review sites.
72
Owner
Kape Technologiesalso owns review sites
Jurisdiction
British Virgin Islands · Outside the alliances
No-logs audit
KPMG, 2023 (report not public)
Price
from $4.99/mo · ~$7.08/mo over 3 yrs after renewal
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
The only major provider that sells its own router — Aircove, with Wi-Fi 6, per-device location groups, and the VPN pre-installed — plus firmware for a range of ASUS, Netgear and Linksys models. Lightway on the router is fast and reconnects cleanly. Router setup that a non-technical household can do.
Most expensive provider; Kape-owned; Aircove is a separate purchase.
The biggest network and the most features; renews at nearly triple the intro price.
76
Owner
Nord Security
Jurisdiction
Panama · Outside the alliances
No-logs audit
Deloitte, 2024 (report not public)
Price
from $3.39/mo · ~$7.53/mo over 3 yrs after renewal
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
WireGuard (NordLynx) configs are not available for routers, but NordVPN partners with FlashRouters and supports OpenVPN on ASUS, GL.iNet, DD-WRT and pfSense with detailed guides, and its large network keeps streaming working through the router. Meshnet is an alternative for linking devices without a VPN router at all.
OpenVPN only on most routers, which caps speed; no first-party firmware.
Privacy & trust
65
Features
91
Price & renewal
62
Streaming
90
Largest server network in the market
NordLynx (WireGuard) is consistently fast
Four Deloitte no-logs audits since 2018
Two-year plan renews at roughly 3× the intro price
Sibling brand Surfshark is presented as a competitor
No port forwarding
Lab test pending — scored on public dataiOS app score 58/100 from 699,424 ratingsFull reviewVisit NordVPN
Unlimited devices at the lowest headline price of the big three; same owner as NordVPN.
76
Owner
Nord Security
Jurisdiction
Netherlands · Nine Eyes
No-logs audit
Deloitte, 2025 (report not public)
Price
from $2.19/mo · ~$4.41/mo over 3 yrs after renewal
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
WireGuard configs for routers, official support on ASUS and GL.iNet, and unlimited devices means the router does not even need to count. The value pick for a household that wants every screen covered.
No first-party firmware; renewal triples.
Privacy & trust
58
Features
89
Price & renewal
77
Streaming
84
Unlimited simultaneous connections
Cheapest two-year intro among the major brands
Deloitte no-logs audit (2023) and Cure53 app audits
Renewal is about three times the intro price
Owned by Nord Security, which also owns NordVPN
Netherlands base sits inside the Nine Eyes
Lab test pending — scored on public dataiOS app score 66/100 from 128,114 ratingsFull reviewVisit Surfshark
Flat €5 a month, no email required, accepts cash; the privacy benchmark.
66
Owner
Amagicom AB
Jurisdiction
Sweden · Fourteen Eyes
No-logs audit
None — apps audited by Cure53, 2024
Price
from $5.40/mo
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
Clean WireGuard configs generated in the account page, excellent OpenWrt and GL.iNet documentation, and a flat price that makes a permanent router install cheap. The privacy pick for a whole-home tunnel.
Streaming through the router is unreliable; not the pick for a TV.
Privacy & trust
65
Features
76
Price & renewal
83
Streaming
42
Account is a random number, no email or name
Same price forever, no intro-vs-renewal games
Accepts cash by post and Monero
Streaming unblocking is unreliable by design
Port forwarding removed in 2023
Smaller server network
Lab test pending — scored on public dataiOS app score 63/100 from 1,441 ratingsFull reviewVisit Mullvad
Open-source apps, court-proven no-logs, unlimited devices; US-based and Kape-owned.
68
Owner
Kape Technologiesalso owns review sites
Jurisdiction
United States · Five Eyes
No-logs audit
Deloitte, 2022 (report not public)
Price
from $2.03/mo · renewal price unconfirmed
Runs oniOSAndroidMacWindowsLinuxRouterBrowserTV
WireGuard and OpenVPN configs, port forwarding that works on a router for anyone who seeds, unlimited devices, and a guide set covering ASUS, pfSense, OPNsense and OpenWrt. Court-tested no-logs.
US jurisdiction and Kape ownership; port forwarding not on US servers.
No router support, no configs, P2P blocked. Not a whole-home VPN.
What we weighed for routers, and the exact weights
Router firmware or app
Providers with their own router software (ExpressVPN, and Surfshark and NordVPN via partner firmware) make setup a form, not a project.
WireGuard configs
WireGuard is several times faster than OpenVPN on a router's CPU. Providers that supply WireGuard configs for ASUS, GL.iNet and OpenWrt keep speed usable.
Per-device routing
The TV through the VPN, the work laptop direct. Good router firmware allows it per device; some providers' apps do too.
Streaming and trust
A router VPN is mostly for TVs and consoles, so unblocking matters, and the provider sees the whole household's traffic.
Weights on this page: Privacy & trust 22% · Features 22% · Price & renewal 15% · Streaming 15% · Speed (our tests) 10% · App quality 8% · Censorship bypass 4% · Support & refunds 4%. Formula.
What a router VPN is for
A VPN app protects one device. A VPN on the router protects the network: everything behind it, including devices that cannot run an app at all. Consoles, smart TVs, streaming sticks, a NAS, a printer, the guest network. It also counts as one device against the provider’s limit, which is why unlimited-device providers matter less here and per-device routing matters more.
The cost is speed, and it is decided by two things: the router’s processor and the protocol. Encryption happens on the router, and most consumer routers have modest CPUs. WireGuard runs several times faster than OpenVPN on the same hardware; on a GL.iNet Flint or a mid-range ASUS it delivers hundreds of megabits, while OpenVPN on the same box delivers tens. This is the reason the ranking above rewards WireGuard configs so heavily and why NordVPN, with OpenVPN-only router support, sits second despite its network.
Three ways to do it
A provider’s own router. ExpressVPN’s Aircove: Wi-Fi 6, the VPN pre-installed, device groups that route different devices to different countries from a phone app. The simplest route and the only ready-made one.
A router that supports VPN clients natively. ASUS stock firmware, GL.iNet’s whole range (designed for this, with a plain interface and WireGuard), and Synology’s routers. You paste the provider’s WireGuard or OpenVPN config into the router’s VPN client page.
Open firmware. OpenWrt, DD-WRT, FreshTomato on compatible hardware, or pfSense and OPNsense on a small PC. Most flexible, most work. Mullvad’s and PIA’s documentation for these is the best on the site.
Per-device routing
The reason a whole-home VPN is workable rather than annoying. The TV and the consoles go through the tunnel to the country whose library you want; the work laptop and the banking phone go direct so nothing refuses a foreign IP. ASUS’s VPN Director, GL.iNet’s per-device rules, OpenWrt’s policy-based-routing package and Aircove’s device groups all do this. Without it, every device shares one exit and one set of blocks.
Streaming through a router
The main use, and it works with the providers whose networks stay ahead of streaming blocks — NordVPN, ExpressVPN, Surfshark. The awkwardness is that changing server means logging into the router, so the practice is to pick one server for the TV’s group and leave it. For streaming alone with no privacy motive, the provider’s Smart DNS on the TV is simpler and loses no speed.
What we have not tested
Router throughput figures are from published tests on specific hardware and vary widely by model. Our own tests — a fixed GL.iNet and ASUS router, each provider’s WireGuard and OpenVPN configs — are on the roadmap, and will replace the ranges above with numbers.
iPhone app rating is far below every established provider in this catalogue
Frequently asked questions
Why put a VPN on the router?
Every device on the network is covered, including ones that cannot run a VPN app — consoles, smart TVs, streaming sticks, printers, guests' phones — and the whole house counts as one device against the provider's limit. The trade-offs are speed (the router's CPU does the encryption) and flexibility (per-device routing needs decent firmware).
Which routers can run a VPN?
ASUS routers with stock firmware (most models), GL.iNet travel and home routers (built for it), anything running OpenWrt, DD-WRT or FreshTomato, and pfSense or OPNsense boxes. ISP-supplied routers almost never can; put a VPN router behind them. ExpressVPN's Aircove is sold ready-made.
How much speed does a router VPN lose?
Depends entirely on the router's CPU and the protocol. A GL.iNet or ASUS router on WireGuard manages 150–500 Mbps; the same router on OpenVPN manages 30–80 Mbps. A budget router on OpenVPN can drop a gigabit line to 20 Mbps. WireGuard is the difference between usable and not.
Can some devices go through the VPN and others not?
Yes, with policy routing: ASUS's VPN Director, GL.iNet's per-device rules, OpenWrt's PBR package, and ExpressVPN Aircove's device groups all allow it. Typical setup: the TV and consoles through the VPN, work laptops and banking devices direct.
Does a router VPN work for streaming?
Yes, and it is the main reason people do it — a TV or console cannot run a VPN app. Providers with many servers (NordVPN, ExpressVPN, Surfshark) unblock through the router as they do in the app. Mullvad does not attempt streaming. Changing the server means logging into the router, so pick a server and leave it.
Is a VPN router better than Smart DNS for a TV?
Smart DNS changes the TV's apparent region with no encryption and no speed loss, and is simpler for streaming alone. A router VPN encrypts everything and covers privacy as well as region. For a TV only, Smart DNS; for a household, the router.
