A VPN on your router is the most complete way to protect your home network. Instead of installing a VPN app on each phone, laptop, and tablet separately, every device that connects to your Wi-Fi gets encrypted automatically — including smart TVs, gaming consoles, and IoT devices that cannot run apps at all. In 2026, setting this up is faster than it used to be, especially with WireGuard replacing the older and slower OpenVPN as the default protocol. Here is exactly how to do it.
What changed in 2026
- WireGuard is now supported by all major VPN providers (Mullvad, NordVPN, ExpressVPN, ProtonVPN, etc.) and most consumer router firmware. It is the default choice over OpenVPN.
- GL.iNet routers with built-in VPN client support became more affordable — the GL-MT6000 (Flint 2) supports WiFi 6 and WireGuard hardware acceleration at ~$90–$100.
- Asus routers with Merlin firmware remain the most powerful option for power users who want split tunneling and per-device routing rules.
- ISP-provided routers still block VPN client mode in 2026 — you will need a separate router or use the ISP router in bridge mode.
Router compatibility check
| Router type |
VPN client support |
| ISP-provided modem/router combo |
Usually no — no client mode |
| GL.iNet routers (GL-MT3000, GL-MT6000) |
Yes, built-in WireGuard + OpenVPN UI |
| Asus routers with Merlin firmware |
Yes, full VPN fusion and split tunneling |
| TP-Link Archer / Deco with OpenWRT |
Yes, with OpenWRT flashed |
| Netgear Nighthawk with DD-WRT |
Yes, with DD-WRT flashed |
| Stock Netgear / TP-Link (no custom firmware) |
Usually no |
If your current router is not on a compatible list, the easiest path is a GL.iNet router (~$60–$100) placed behind your ISP router.
Setup method 1: GL.iNet routers (easiest)
GL.iNet routers have a built-in VPN client UI that requires no command line.
- Connect the GL.iNet router to your ISP router (WAN port → LAN port of ISP router).
- Access the admin panel at
192.168.8.1.
- Go to VPN → WireGuard Client.
- Download your WireGuard configuration file from your VPN provider's dashboard (ProtonVPN, Mullvad, NordVPN all provide
.conf files).
- Import the
.conf file → click Connect.
- Under VPN Dashboard, enable "VPN Policy" to apply to all devices or specific ones.
Done — every device on the GL.iNet network now routes through the VPN.
Setup method 2: Asus router with Merlin firmware
- Flash the router with Merlin firmware from asuswrt-merlin.net (compatible models listed there).
- Access admin at
192.168.1.1 → VPN → VPN Client → WireGuard.
- Create a new WireGuard profile, paste in the config from your VPN provider.
- Enable VPN Director to route specific devices through the VPN while others bypass it (split tunneling by device).
Setup method 3: OpenWRT on compatible hardware
- Flash OpenWRT on your router (openwrt.org lists supported hardware).
- Install the WireGuard package:
opkg install wireguard-tools kmod-wireguard luci-proto-wireguard.
- Configure via LuCI (web UI) → Network → Interfaces → Add new WireGuard interface.
- Paste your peer config and set routing rules.
This is the most flexible but most complex option — best for network enthusiasts.
Choosing a VPN provider for router use
| Provider |
WireGuard support |
Router config download |
Notes |
| Mullvad |
Yes |
Yes (.conf files) |
No account needed, privacy-first |
| ProtonVPN |
Yes |
Yes (.conf files) |
Free tier available (limited) |
| NordVPN |
Yes (NordLynx) |
Yes |
Large server network |
| ExpressVPN |
Yes (Lightway) |
Yes |
Premium price ~$8–$13/month |
Download a configuration file from your chosen provider before starting setup. Most dashboards have a dedicated "Router" or "Manual configuration" section.
How to pick your approach
- Want the simplest setup with no firmware flashing? GL.iNet router — plug in, import config, done.
- Want per-device routing (some devices through VPN, some not)? Asus with Merlin firmware and VPN Director.
- Maximum control and open-source everything? OpenWRT.
- Only one or two devices need VPN? Just install the VPN app on those devices — router setup is overkill.
Common mistakes
Using OpenVPN instead of WireGuard on consumer hardware. OpenVPN software crypto on a router CPU is slow — expect 10–30 Mbps throughput. WireGuard with hardware acceleration on GL.iNet or Asus runs 3–10× faster on the same hardware.
Putting your router itself behind double NAT. If the GL.iNet is behind the ISP router and both are doing NAT, some services (gaming, P2P) break. Put the ISP router in bridge/passthrough mode or DMZ the GL.iNet's WAN IP.
Forgetting to check for DNS leaks. Even with VPN active, DNS queries can leak through the ISP's resolver. Test at dnsleaktest.com after setup and configure the VPN provider's DNS server in your router settings.
Choosing a server geographically far away. Every hop adds latency. Use a VPN server close to your physical location unless geo-bypassing is the goal.
No kill switch configured. If the VPN drops, traffic falls back to unencrypted by default. Enable the kill switch option in your router firmware to block internet if the VPN disconnects.
What to skip
- Free VPN services for router-level setup — free VPNs log data, throttle speeds, and most do not provide WireGuard configs for router use.
- PPTP protocol — deprecated, cryptographically broken, not worth using in 2026.
- Configuring the VPN on the ISP router directly without checking it supports client mode — most do not, and attempting it softbricks some models.
FAQ
Will a VPN on my router slow down my internet?
Yes — expect 20–40% throughput reduction on typical consumer routers. Routers with hardware AES or WireGuard acceleration (GL-MT6000, Asus AX88U with Merlin) reduce this to ~5–15%.
Can I stream Netflix through a router VPN?
Netflix actively detects and blocks commercial VPN IP ranges. Router VPN does not change this — you still need a provider with working unblocking and will need to connect to a server the service accepts.
Do I need a subscription for this?
Yes — a reliable VPN service costs ~$3–$13/month depending on the provider. Free tiers from ProtonVPN work but are limited to a few server locations and lower speeds.
Can smart TVs and consoles use a router VPN?
Yes — this is the primary advantage of a router-level VPN. Devices like Apple TV, Roku, PS5, and Xbox that cannot install VPN apps are protected automatically.
Where to go next
See how to secure your router in 2026, how to block ads network-wide in 2026, and how to set up a mesh network in 2026.