Why bother
A VPN app protects one device. A VPN on the router protects everything behind it: the PlayStation, the smart TV, the streaming stick, the printer, guests’ phones, and anything else that has no VPN app and never will. It also counts as a single connection against your provider’s device limit, which matters if that limit is eight rather than unlimited.
The cost is speed and convenience. The router’s processor does the encryption, and consumer routers have modest processors. Changing server means logging into the router rather than tapping a button.
Check what you have
Most routers supplied by an internet provider cannot do this. If yours cannot, the standard arrangement is to leave it in place and put a second router behind it, running the VPN, with your devices connected to the second one.
Routers that work well:
- GL.iNet — the whole range, built for this, with WireGuard support and an interface that does not require expertise. The travel-sized models are useful in hotels.
- ASUS — most current models support OpenVPN and WireGuard clients in the stock firmware, plus VPN Director for per-device rules.
- OpenWrt, DD-WRT, FreshTomato — flexible, more work, wide hardware support.
- pfSense or OPNsense — a small PC as a router; the most control and the most setup.
- ExpressVPN Aircove — the VPN is already installed; you sign in and choose locations per device group.
Installing it
Get the configuration from your provider. In the account area, look for “manual setup” or “router”. Choose WireGuard if it is offered — the speed difference is large. You will get a config file or a set of values: server address, private key, public key, allowed IPs, DNS.
On GL.iNet: VPN → WireGuard Client → Add a new configuration → upload the file or paste it → connect. Set it to start automatically.
On ASUS: VPN → VPN Client → Add profile → WireGuard tab → import the config → Activate. Then check WAN → Internet Connection to confirm DNS is coming from the VPN.
On OpenWrt: install wireguard-tools and luci-proto-wireguard, add a new interface of type WireGuard, paste the keys and peer details, assign it to the WAN firewall zone with masquerading enabled.
Whatever the router, verify afterwards from a device behind it: open the what is my IP tool and confirm the country matches the server, then run the leak test.
Routing only some devices
Sending everything through one exit gets annoying quickly: banking apps refuse foreign addresses, and some services behave oddly. Policy routing solves it.
ASUS’s VPN Director, GL.iNet’s per-device rules, OpenWrt’s PBR package and Aircove’s device groups all let you assign specific devices to the tunnel and leave the rest on the direct connection. The common arrangement is TVs, consoles and streaming sticks through the VPN in whichever country you want, and work laptops, phones and anything doing banking on the direct route.
The kill switch question
A router VPN can be configured to drop all traffic if the tunnel fails, which is stronger than most app-level kill switches because it is enforced by the router’s firewall rather than by software on the client. On ASUS it is the “Block routed clients if tunnel goes down” option; on OpenWrt it is a firewall rule; GL.iNet exposes it as a toggle. Turn it on, then test it by disconnecting the VPN on the router and confirming that devices behind it lose internet rather than falling back to your real address.
When to use Smart DNS instead
If the only reason for the router VPN is region-changing on a television, the provider’s Smart DNS is simpler and costs no speed at all: it changes what the streaming service thinks your region is, without encrypting anything. ExpressVPN’s MediaStreamer and the equivalents at NordVPN and Surfshark do this. You give up the privacy half of the deal, which for a TV is often the half you did not need.
The router VPN list scores providers on all of this: firmware, config quality, WireGuard availability and per-device routing.