What is a VPN router? Pros, cons and how to set one up

This page has affiliate links. If you buy through them, freeswan.ca earns a commission; your price stays the same and it does not change what we write. How we review.

What a VPN router is

A VPN router is a router that runs a VPN client itself. Instead of installing an app on each phone and laptop, you set up the VPN once on the router. Every device that joins its Wi-Fi or plugs into it sends traffic through the router, and the router sends it through the encrypted tunnel to the VPN server.

ExpressVPN's router page puts the result simply: "every device shares the same VPN location, protocol, and configuration." That includes devices that cannot run a VPN app at all, such as many smart TVs, game consoles and smart-home gadgets.

The idea is the same one the Canadian Centre for Cyber Security calls gateway-to-gateway VPN in business networks, "typically used to connect remote office sites". At home, one end of the tunnel is your router and the other is the provider's server.

Should you put the VPN on your router?

Put it on the router if most of these apply:

• You want devices without VPN apps covered, such as a TV or console.
• Your household has more devices than your plan allows. The router usually counts as one connection.
• You want protection to stay on without anyone remembering to tap Connect.
• You travel with several devices and want one box between them and the hotel network.

Keep the VPN on each device if you change server locations often, want to turn the VPN off for a single app, or rely on app features such as split tunnelling. Many people do both: a router at home and the app on their phone for when they leave.

Pros and cons

Proton VPN's router guide lists the same trade-offs from the provider's side. It warns that flashing a router "can be difficult. If done incorrectly, it may cause your router to stop working", that "Internet speeds depend on your router's processing power", that "To change your VPN location, you need to update your router configuration", and that features such as NetShield or split tunnelling "may not be available when connecting through your router."

One point is easy to miss. Proton states that "A VPN router encrypts traffic between your router and the internet, but it does not encrypt connections between your devices and the router." Your home Wi-Fi still needs a strong password, and you should check that no unknown devices are connected.

Protocols your router must support

A router can only connect to a VPN provider if its firmware includes a client for a protocol that provider uses. Proton puts it directly: "your router must support OpenVPN or WireGuard as a client." Those two are the common ground:

• WireGuard is a newer protocol with a small codebase. Its project describes it as "meant to be easily implemented in very few lines of code, and easily auditable". On a router it is usually the simpler setup. Mullvad, Surfshark, NordVPN (whose NordLynx is based on WireGuard), Windscribe and Private Internet Access all list it, and Proton's router guides cover it.
• OpenVPN is the older of the two, and the one most router guides start with. NordVPN, ExpressVPN, Surfshark, Windscribe, Private Internet Access and IPVanish list it among their protocols.
• IKEv2/IPsec is built into phones and computers. None of the router guides we read from Proton or GL.iNet use it, so do not count on it for a home router.

Our page on WireGuard vs OpenVPN compares the two in detail, and VPN protocols compared covers the rest.

Which router to use

There are three routes, and ExpressVPN's router page lists the same three:

1. A router with a VPN client in its stock firmware. Some models let you add a VPN from the admin page. Proton's guide includes setup instructions for AsusWRT (OpenVPN and WireGuard), GL.iNet, MikroTik, OPNsense, pfSense and Vilfo, among others.
2. Open-source firmware on a compatible router. ExpressVPN's page names "DD-WRT or OpenWrt"; Proton also has guides for AsusWRT-Merlin and FreshTomato. This gives the most control and carries the most risk.
3. A separate gateway or travel router that sits between your main router and your devices, or creates its own Wi-Fi. ExpressVPN's page mentions a travel router as one option.

Your internet provider's router is unlikely to qualify. Proton notes that "Most routers provided by internet service providers (ISPs) do not support VPN configurations." If you rent your modem-router from Rogers, Bell, Telus or another provider, the usual answer is to add a second router behind it.

Travel VPN routers

A travel router is a small router you carry with you. You connect it to the hotel's network, and your phone, laptop and tablet join the router's own Wi-Fi. GL.iNet sells travel routers, and its documentation for firmware v4.7 and later says its routers "offer built-in WireGuard support" for several providers: "If you have an active subscription, simply enter your service credentials on the WireGuard Client page". The list includes Mullvad, NordVPN, Surfshark, Windscribe, Private Internet Access and IPVanish, with a manual option for other providers. Its OpenVPN client page has a NordVPN setup and a manual option.

See GL.iNet routers

For trips abroad, read our VPN for travel guide first, since VPN rules differ by country.

Setup outline

The exact steps depend on the router, but the outline is the same everywhere:

1. Update the router's firmware to the latest version from its maker. Proton warns that outdated firmware can cause connection problems.
2. Get configuration files from your VPN provider. In your account on the provider's website, generate a WireGuard or OpenVPN configuration for the server you want, for example Toronto or Vancouver. Some router firmware, like GL.iNet's, can fetch this for supported providers once you enter your account details.
3. Open the router's admin page and find the VPN client section (often called WireGuard Client or OpenVPN Client).
4. Import the configuration or paste the keys and server address, then save and connect.
5. Check that it works. From a device on the router's network, visit an IP address checker and confirm it shows the VPN server's location.
6. Decide what happens if the tunnel drops. Look in the firmware for an option that blocks internet access while the VPN is down. If there is one, turn it on for the same protection as a kill switch in an app.

Which VPN works on a router

Any provider that gives out WireGuard or OpenVPN configurations can work. Surfshark's download page says "manual setup supported" for routers, and its plans allow unlimited devices anyway. Windscribe's download page links to a "VPN for Routers" page. Proton VPN supports routers on all plans, including the free one, where the router counts as a single connection.

If your plan already allows unlimited devices, the main reason for a router is covering devices that cannot run an app. If your plan caps devices, as Mullvad's 5 and NordVPN's 10 do, a router can stretch that limit across a whole household. Our comparison of the best VPNs for Canada lists devices and protocols for each provider.

Check Surfshark's price

Common questions