What is a VPN router?
A VPN router runs the VPN itself, so every device on the network is covered without installing anything on them. It is the only practical way to protect a smart TV, a games console or anything else that will not run a VPN app — and the trade is that it covers everything, whether you wanted it to or not.
Where the tunnel starts
With an app, the tunnel starts on that device and covers that device. With a router, it starts at the router — so everything behind it is inside the tunnel without knowing there is one.
That single difference produces every advantage and every problem.
| App on each device | VPN on the router | |
|---|---|---|
| Covers | Devices that can run the app | Everything on the network |
| Smart TV, console, printer | No | Yes |
| Speed | Your device's CPU — fast | The router's CPU — often the bottleneck |
| Excluding one device | Just close the app | Needs policy routing in the firmware |
| Switching server location | Two taps | Log into the router |
| Devices on mobile data | Still protected | Not covered at all |
The case for it
One genuine, unarguable reason: devices that cannot run a VPN client. A smart TV, a games console, a streaming stick, a network printer. If those need to be inside a tunnel, the router is the only practical way to do it.
Two secondary reasons. It typically consumes one subscription slot for the whole household, which matters if you have more devices than your plan allows. And it protects guests and IoT devices you would never think to configure.
The case against, which is usually stronger
The router is slow. Encryption is CPU work, and router processors are small. A mid-range consumer router might sustain 20–50 Mbps on OpenVPN, and that is the ceiling for your entire household simultaneously. On a fast line the router becomes the bottleneck, and no provider can fix that. WireGuard is far lighter and often the difference between workable and not, so check your firmware supports it specifically.
It is all or nothing. Without policy-based routing — which good firmware has and stock firmware generally does not — you cannot exclude anything. Your banking app starts refusing connections because it sees a datacenter address. Your work laptop cannot reach the corporate VPN through another tunnel. A smart device with hard-coded regional endpoints stops working. Each is individually fixable and collectively wearing.
Changing location becomes a chore. Switching countries means logging into the router rather than tapping a flag, and it changes it for everyone in the house at once.
The arrangement that actually works
Most people who set this up well end up in the same place: both. The router covers the devices that cannot help themselves — TV, console, IoT — and phones and laptops run the app, so they stay protected off the home network and can switch location or disconnect individually.
A common refinement is a second router or a separate wireless network behind the first, with the VPN on only that one. Devices that should be tunnelled join that network; everything else joins the normal one. It gives you the exclusion that stock firmware will not.
Whatever the arrangement, check the firmware has a kill switch before relying on it. Without one, a dropped tunnel silently returns every device in the house to the bare connection, and nobody notices because nothing appears to break.
Adjacent terms
VPN passthrough is a different router setting entirely and is frequently confused with this one — it lets a device behind the router reach an external VPN, and it does not make the router a VPN client. A VPN concentrator is the enterprise equivalent of a router terminating tunnels, at a scale of thousands.
For the practical setup, the step-by-step guide covers it. If you are planning the network itself, the subnet calculator does the addressing.
Related questions
Do I need to buy a special router?
Sometimes. Many consumer routers cannot run a VPN client at all — the provider-supplied box almost certainly cannot. Routers running OpenWrt, AsusWRT-Merlin, pfSense or OPNsense can, and some manufacturers sell models with support built in. Before buying anything, check whether your existing router supports WireGuard specifically, because OpenVPN on weak router hardware is the single most common reason a whole-home VPN turns out to be unusably slow.
Why is my router VPN so much slower than the app on my laptop?
Because encryption is CPU work and router processors are small. A laptop encrypts at hundreds of megabits without noticing; a mid-range router might manage 20 to 50 on OpenVPN, and that ceiling applies to your whole household at once. WireGuard is dramatically lighter and is usually the difference between workable and not. If your connection is fast, expect the router to be the bottleneck rather than the VPN service.
Can I exclude one device from the router VPN?
Only if the firmware supports policy-based routing, which better firmwares do and stock ones generally do not. Without it, a router VPN is all-or-nothing: your banking app that blocks VPN addresses, your work laptop that needs a corporate VPN of its own, and your smart doorbell that stops connecting are all going through it whether that helps or not. This inflexibility is the main argument against the approach, not the speed.
Does a router VPN count as one device on my subscription?
Usually yes, and that is the quiet advantage. One connection covers everything behind the router, so a household with a dozen connected devices uses a single slot. Check the specific provider though — a few count connections rather than installations, and a few disallow router installs entirely.