Home › How to Set Up a VPN on Your Router

How-to guide · Updated October 2026

How to set up a VPN on your router (2026 guide)

RSBy the RankedTrue test team · router flows verified against provider support pages

Affiliate disclosure: Affiliated, never sponsored. We earn commissions through links on this page, but commissions don't move rankings — picks with no affiliate program are still mentioned where they're the honest choice. See “How we test” for the protocol behind every score.

Lab status: router config-file support (all 5 VPNs) · ASUSWRT + GL.iNet setup flows — in progress: on-router speed measurements.

The short answer

If your router has a built-in VPN client (ASUS with ASUSWRT, or any GL.iNet router), setup is: download a config file from your VPN provider, upload it in the router's admin panel, connect. About 30–60 minutes with the provider's guide open. Don't flash firmware unless you have to — it's the only hard way to do this.

Why bother? (And why people do)

A VPN on the router covers every device on your network at once— and it's the only way to protect devices that can't run VPN apps at all: smart TVs, game consoles, and streaming sticks on locked-down platforms like Amazon's Vega OS (see our Fire TV Vega OS guide). It also counts as a single device on your VPN plan, which sidesteps device limits entirely.

Honest difficulty check

This is the most technical thing we cover on this site. The realistic picture:

Native VPN client — moderate

ASUS (ASUSWRT) or GL.iNet router + provider config file. If you can change your Wi-Fi password, you can do this with a provider guide open. Budget 30–60 minutes.

ExpressVPN's router firmware — easy-ish

ExpressVPN ships its own router firmware/app for select Linksys, ASUS, and Netgear models. Flash it, sign in, pick a location. Still flashing, but with the provider's own installer.

DD-WRT / OpenWrt / Tomato — expert

Full manual configuration after flashing third-party firmware. Wrong build = bricked router, and flashing voids your warranty. NordVPN and ExpressVPN maintain current DD-WRT guides; the other three all document manual OpenVPN configs that work on third-party firmware. Either way, this is tinker-only territory.

Which routers have a built-in VPN client?

You want one of these — no flashing required:

ASUS routers (ASUSWRT, stock or Merlin): the VPN section has an OpenVPN client; newer RT-AXxxx models add WireGuard via the VPN Fusion tab. Merlin (the popular third-party ASUS firmware) keeps the same flow.
GL.iNet routers: built-in OpenVPN and WireGuard clients with one-click profiles for several VPN providers, plus manual config upload for the rest. Admin panel at 192.168.8.1. The friendliest router VPN interface we've seen.
Some TP-Link, Netgear, and Linksys models: check for a "VPN Client" section in the admin panel — it's a yes-or-no question per model.

Shopping for one? Start with our VPN router picks and travel router picks (GL.iNet dominates the travel-router list for a reason).

What you need from your VPN provider

Router setup isn't an app — it's a config file: OpenVPN (.ovpn) or WireGuard (.conf), downloaded from your VPN account and uploaded to the router. Here's what each of our five provides, verified on their support pages (October 2026):

VPN	Router configs	What to know
ExpressVPN	✓ OpenVPN configs + own router firmware	Only one of the five with its own router firmware/app (select Linksys, ASUS, Netgear models) — the easiest path after GL.iNet. Manual OpenVPN configs available for everything else.	Get ExpressVPN — $3.49/mo
Surfshark	✓ OpenVPN + WireGuard configs	Widest manual-setup guides of the five: AsusWRT, ASUS VPN Fusion (has a built-in Surfshark profile in newer firmware), GL.iNet, OpenWrt, DD-WRT.	Get Surfshark — $2.49/mo
Proton VPN	✓ WireGuard + OpenVPN configs	Choose 'Router' as the platform in the config generator. ASUS RT-AXxxx: WireGuard via VPN Fusion; older RT-ACxxx: OpenVPN only.	Get Proton VPN — $2.99/mo
NordVPN	✓ OpenVPN configs only	NordLynx is not offered as downloadable router configs. Workaround: GL.iNet's built-in NordVPN profile handles setup automatically.	Get NordVPN — $3.49/mo
Private Internet Access	✓ OpenVPN configs	Manual .ovpn files from PIA's site; GL.iNet's built-in PIA profile generates server configs from your login automatically.	Get Private Internet Access — $2.03/mo

One protocol caveat: none of the five offers their in-house protocol (Lightway, NordWhisper) as a router config. On routers it's always OpenVPN or WireGuard.

WireGuard vs OpenVPN on a router

Pick based on what your router supports, not ideology:

WireGuard — if your router supports it. Faster on weak router CPUs, simpler configs. ASUS RT-AXxxx (VPN Fusion), GL.iNet, and OpenWrt all do.
OpenVPN — the universal fallback. Works everywhere, including older ASUS RT-ACxxx routers, DD-WRT, and Tomato. Slower on router hardware, but compatibility is the point.

NordVPN is the one provider-specific gotcha: it only offers OpenVPN configs for routers (no downloadable WireGuard), so it's OpenVPN there regardless.

Setup outline: ASUSWRT

Paraphrased from the providers' own support guides — follow your provider's guide for the exact clicks.

Get your config: sign in to your VPN account and download a router config for your server location — OpenVPN .ovpn (Nord Account → "Set up NordVPN manually"; ExpressVPN → "Set Up Other Devices" → Manual Configuration), or WireGuard .conf (Surfshark → VPN → Manual setup; Proton VPN → Downloads → platform "Router").
Open the router admin panel (usually 192.168.1.1 or router.asus.com) and go to VPN → VPN Client (or VPN Fusion on newer firmware).
Add a profile, choose the OpenVPN or WireGuard tab, upload the config file, enter your credentials when asked, and Activate.
Verify: the connection status column should show success — then confirm your IP changed on any connected device.

On newer ASUS firmware (VPN Fusion), you can also bind specific devices to the VPN instead of the whole network — useful if you want your streaming stick on VPN-US but your laptop off it.

Setup outline: GL.iNet

GL.iNet's interface is the simplest of the lot, with built-in provider profiles doing most of the work.

Open the admin panel (192.168.8.1) and go to VPN → WireGuard or OpenVPN Client.
Pick your provider from the built-in list if it's there (PIA, Surfshark, NordVPN and others have one-click profiles — enter your credentials and the router generates server configs for you).
Otherwise upload manually: download the config from your VPN account, add a profile, upload the file, enter credentials, and start the connection.
Verify on the VPN Dashboard, and use the router's VPN policies if you want exceptions per device.

The downsides, honestly

One location for the whole network. Every device gets the same VPN country until you change the profile. Online banking and streaming on other devices will notice. (Per-device rules on ASUS VPN Fusion and GL.iNet soften this.)
Slower than device-level apps. Router CPUs are weak; expect a speed hit versus running the VPN on your phone or PC, and WireGuard will cost you less than OpenVPN.
Switching servers is clunkier. No one-tap server hop — you visit the router admin panel, swap the profile, reconnect. Kill-switch behavior varies by firmware, so check yours.
Troubleshooting is harder. When something breaks, the whole house's internet breaks. Keep the ISP router credentials and a factory reset procedure handy before you start.

Which VPNs make router setup easiest?

Ranked by how painless the router path is: ExpressVPN is the only one with its own router firmware — the closest thing to an app experience on a router. Surfshark has the deepest set of step-by-step router guides and both WireGuard and OpenVPN configs. Proton VPN matches on configs (WireGuard + OpenVPN) with ASUS-specific guides. NordVPN and PIA are OpenVPN-only for manual setup (both get a boost on GL.iNet's built-in profiles). Prices drift with promos — verify at checkout.

Get ExpressVPN Get Surfshark Get Proton VPN

Full reviews: ExpressVPN → · Surfshark → · NordVPN → · Proton VPN → · PIA →

Questions, answered

Will it slow my internet?

Yes, expect some drop. A router's CPU is far weaker than your phone's, and it's encrypting traffic for every device at once. WireGuard usually costs less speed than OpenVPN on the same hardware. ExpressVPN's own guide warns that routers without AES-NI hardware acceleration can see occasional speed issues on OpenVPN manual configs.

Can I still switch countries easily?

Not as easily as with a phone app. The whole network sits on one server location until you change the profile in the router's admin panel. Workarounds exist: GL.iNet and ASUS routers let you pre-load multiple profiles and toggle between them, and ASUS VPN Fusion and GL.iNet policies can route specific devices outside the VPN.

Does it work with my ISP router?

Usually no. The modem/router your ISP gave you almost never has a VPN client section — that's the main reason people buy a separate VPN-capable router. The standard setup: put the ISP box in bridge/modem mode and connect your own router behind it.

Do I have to flash custom firmware?

No — and most people shouldn't. ASUS routers (stock ASUSWRT) and GL.iNet routers have a VPN client built in; you just upload a config file from your VPN provider. Flashing DD-WRT or OpenWrt is only for routers with no VPN client, and it's a brick-risky, warranty-voiding job for confident tinkerers.

Does a router VPN count against my device limit?

No — that's the upside. The router counts as one device on your plan no matter how many devices connect through it. On plans with device limits (like NordVPN's 10), it's the cheapest way to cover everything.

Final verdict

Buy a router with a built-in VPN client (ASUS or GL.iNet — see our VPN router picks →), grab a config file from a provider that actually supports routers, and follow their guide. Skip flashing firmware unless you know exactly why you need to. Best for most people: Surfshark — cheapest plan with both WireGuard and OpenVPN configs, honest renewal, unlimited devices.

Traveling instead of whole-homing? Travel routers with VPN →

Get Surfshark