VPN on Your Router or on Your Devices? The Trade-Off Nobody Explains

What Running It on the Router Actually Changes

A router-level VPN moves the tunnel from each device to the single point where your home network meets the internet. Everything behind it is inside the tunnel automatically, whether or not it knows what a VPN is, and that is the entire case for doing it. Smart televisions, games consoles, streaming sticks, e-readers, smart-home hubs and printers mostly cannot run a VPN app at all — there is no app store, or there is one and the provider does not publish to it. If you want those devices covered, the router is the only place to do it. It also means a new device is covered from the moment it joins the network, with no installation step and nothing to forget, and it means one connection rather than one per device, which matters if your provider limits simultaneous connections. Finally, it is the only arrangement that survives a guest: anyone you give the Wi-Fi password to is inside the tunnel too, for better and for worse.

What It Costs You

Four things, and none of them is obvious from the setup guide. First, speed: a router is a small computer with a modest processor, and encryption is work. A consumer router that happily moves several hundred megabits unencrypted may manage a fraction of that through a VPN tunnel, and it is a hard ceiling that no amount of paying for a faster line will lift. Second, control: with the VPN on the router, every device shares one exit location, so you cannot have the laptop in one country and the television in another without extra configuration. Third, friction: switching servers means logging into the router rather than tapping a button, which in practice means you switch far less often. Fourth, breakage that is hard to attribute — banking apps that dislike a foreign exit, local device discovery that stops working, a smart-home device that cannot reach its cloud service. When the tunnel is on the router, everything in the house inherits the problem at once, and the person who has to debug it is you.

The Speed Question, Honestly

This is where most router-VPN projects disappoint, so it is worth being specific about the cause. The limiting factor is almost never your internet connection and almost always the router's ability to encrypt. Older devices in particular can be an order of magnitude slower through a tunnel than without one. Two things help. The first is the protocol: a modern lightweight protocol is substantially less demanding than the older ones and is worth choosing where the firmware offers it — our VPN protocols explained covers the differences. The second is the hardware: routers sold specifically with VPN throughput in mind, or a small dedicated device sitting between your router and the network, will outperform a general-purpose box by a wide margin. Whatever you install, measure it rather than trusting the marketing figure, and measure it the same way twice — how to evaluate VPN speed explains why a single speed test on a busy evening tells you very little.

The Kill Switch Behaves Differently

On a device, a kill switch is a well-defined thing: if the tunnel drops, the app blocks traffic until it is restored, so nothing leaks in the gap. On a router the equivalent is a firewall rule, and whether it exists at all depends entirely on the firmware you are running. Some router VPN implementations fail closed and cut the network when the tunnel drops. Others fail open and quietly send everything out over the ordinary connection, which is the worst possible outcome because nothing on any device gives you a visible signal that anything changed. This is the single most important thing to test after setting one up, and it is easy to test: stop the tunnel deliberately and see whether traffic still flows. Do not assume the behaviour from the documentation. What a VPN kill switch is and why you need one covers the device-level version, and the router version deserves the same scepticism applied by hand.

The Hybrid Most People Should Run

The arrangement that works best in practice is not a choice between the two but a division of labour. Put the VPN on the router for the devices that cannot run an app — the television, the console, the smart-home equipment — and keep the provider's app on the laptops and phones, excluded from the router tunnel or simply pointed at a different server. The phones then keep their protection when they leave the house, which a router obviously cannot provide, and you keep the ability to switch a single device to a different country without touching anything else. Many routers support policy-based routing, which lets you send some devices through the tunnel and others directly, and that is the cleanest expression of this idea if your firmware offers it. It is more setup than either pure approach, and it is the one that stops you disabling the whole thing in frustration the first time a banking app refuses to open.

Before You Start

Three checks save most of the wasted evenings. Confirm your provider actually supports router installation and publishes configuration for your firmware, because not all do and the ones that do vary in how much help they offer. Confirm your router can run it — stock firmware on an ISP-supplied box frequently cannot, and replacing the firmware is a real project with a real risk of ending up with a device that no longer routes anything. And decide in advance what you will do about the devices that need to be outside the tunnel, because there will be some. If that list is short and the only thing you actually wanted was coverage on your laptop and phone, the honest answer is that the apps are simpler, faster and easier to control, and how to set up a VPN in five minutes is the whole job. Router setup earns its complexity when you have devices that cannot be covered any other way, and not really before then.

Frequently Asked Questions