How to Set Up a VPN on Your Router
Installing a VPN on your router protects every device on your network - Smart TVs, games consoles, IoT devices, and any device that cannot run a VPN app - Without needing to configure each one individually. The trade-off is increased complexity and some performance overhead on the router's CPU.
Why Use a Router VPN?
| Benefit | Detail |
|---|---|
| Covers all devices | Every device connecting to the router is automatically protected - Smart TVs, consoles, printers, IoT sensors |
| No per-device app needed | Devices that cannot run VPN apps (older Rokus, Apple TV older firmware, smart fridges) are still protected |
| One device slot | Uses only one of your provider's simultaneous device connections, regardless of how many devices are behind the router |
| Always-on protection | Protection is active as long as the router is running - No need to remember to connect |
| Bypasses device-level blocks | Useful in environments where VPN apps are blocked on managed devices |
Compatible Router Firmware
| Firmware | VPN Support | Compatible Hardware | Difficulty |
|---|---|---|---|
| DD-WRT | OpenVPN, WireGuard (newer builds), PPTP | Linksys, Netgear, TP-Link, Asus (many models) | Moderate - Requires flashing |
| Tomato / FreshTomato | OpenVPN, WireGuard | Asus, Linksys, Netgear (fewer models than DD-WRT) | Moderate - Requires flashing |
| Asus Merlin | OpenVPN, WireGuard, IPSec | Asus RT series (native - No flashing to 3rd-party required) | Easy - Built on stock Asus firmware |
| pfSense / OPNsense | OpenVPN, WireGuard, IKEv2 | Dedicated x86 hardware or Netgate appliances | Advanced |
| GL.iNet stock firmware | OpenVPN, WireGuard | GL.iNet travel routers (GL-AXT1800, GL-MT3000) | Very easy - GUI driven |
OpenVPN vs WireGuard on a Router
| Protocol | Router CPU Load | Speed Impact | Setup Complexity | Best For |
|---|---|---|---|---|
| WireGuard | Low (kernel-level on modern firmware) | Minimal (<15% on capable hardware) | Low - Simpler config files | Modern routers with WireGuard kernel support |
| OpenVPN | High (userspace, single-core) | Significant on older/ARM routers (50%+ speed loss possible) | Moderate - .ovpn files + credentials | Maximum compatibility, censorship bypass (TCP 443) |
General Setup Steps (OpenVPN on DD-WRT/Merlin)
- Log in to your router admin panel (usually 192.168.1.1 or 192.168.0.1).
- Navigate to the VPN section (on Merlin: Advanced Settings › VPN › VPN Client).
- Download the OpenVPN .ovpn configuration file from your VPN provider's dashboard.
- Upload the .ovpn file or paste its contents into the router's VPN client fields.
- Enter your VPN account username and password.
- Enable "Redirect Internet traffic" to route all traffic through the VPN.
- Apply settings and reboot the router.
- Verify from any connected device using our VPN Leak Test.