How to Set Up a VPN on Your Router (Protect Every Device)
Protect Every Device on Your Network With a Router-Level VPN
Installing a VPN on your router protects every device that connects to your network — smart TVs, gaming consoles, streaming sticks, IoT devices, and guest devices — without installing VPN apps on each one. This is the most comprehensive way to secure your household.
Difficulty: Advanced | Estimated time: 45 minutes
Step 1: Check If Your Router Supports VPN
Not all routers can run a VPN client. You need a router that supports OpenVPN client or WireGuard client configuration. Here is how to check:
Routers that support VPN (most common):
- Asus routers with AsusWRT or Merlin firmware — the easiest and most recommended option
- GL.iNet travel routers — plug-and-play VPN routers at the cheap end of the router market, and the best option for beginners
- Routers running DD-WRT firmware — popular open-source firmware with VPN support
- Routers running OpenWRT — advanced open-source firmware with full VPN support
- Netgear Nighthawk routers running DumaOS — NordVPN's own compatibility list names Netgear, and the Nighthawk range specifically, among the routers that do not work with it unless the router is running DumaOS. Check yours before assuming
- ISP-provided routers (the one from your internet company)
- Most basic consumer routers from TP-Link and D-Link at the budget end of the range
- Mesh systems (Google Wifi, Eero) — most do not support VPN client mode
Routers NordVPN itself lists as incompatible with its own service: Arris, Belkin, Cisco, D-Link, Huawei, Linksys (except the WRT32X and WRT32XB AC3200), Nighthawk unless running DumaOS, Netgear, TRENDnet, Tenda, TotoLink, Ubee, Orbi, Spectrum, Xfinity, Eero, Verizon, AT&T, FRITZ!Box, and most routers supplied by an internet provider. That list is about stock firmware {EM} several of those models can be flashed with DD-WRT, Tomato, OpenWRT, Padavan or Merlin and will work afterwards.
If your router does not support VPN: The easiest solution is a small GL.iNet travel router — among the cheapest hardware that will do this job; check a retailer for the current price. Connect it to your existing router via ethernet, configure the VPN on the GL.iNet, and connect devices to the GL.iNet's WiFi for VPN protection.
Step 2: Log In to Your Router Admin Panel
Open a browser and enter your router's admin address:
- Most Asus routers: 192.168.1.1 or router.asus.com
- Most Netgear routers: 192.168.1.1 or routerlogin.net
- Most TP-Link routers: 192.168.0.1 or tplinkwifi.net
- GL.iNet routers: 192.168.8.1
Important: The router admin password is different from your WiFi password. If you cannot access the admin panel, you may need to reset the router to factory defaults — but this erases all settings.
Step 3: Download VPN Router Config Files
You need your VPN provider's OpenVPN configuration files for the server you want to connect to.
For NordVPN: 1. Log into your NordVPN account at nordvpn.com 2. Go to the manual setup page (Settings > Manual Setup) 3. Note your service credentials (different from your login credentials) 4. Go to NordVPN's server recommendation tool 5. Download the OpenVPN UDP configuration file (.ovpn) for your preferred server
For Surfshark: 1. Log into your Surfshark account 2. Go to VPN > Manual Setup > Router 3. Choose OpenVPN credentials 4. Download the .ovpn config file for your preferred server
Which server to choose: Pick a server close to your physical location for the best speeds. If you want to access content from a specific country, choose a server in that country — but be aware this affects all devices on your network.
Get NordVPN — Best Router VPN → Try Surfshark — Unlimited Devices →Step 4: Upload Config and Enter Credentials
The exact steps vary by router. Here are instructions for the most common setups:
Asus Routers (AsusWRT / Merlin Firmware)
1. In the admin panel, go to VPN > VPN Client 2. Click Add profile 3. Select the OpenVPN tab 4. Enter a description (e.g., "NordVPN Netherlands") 5. Enter your VPN service username and password (from Step 3) 6. Click Choose File and upload the .ovpn configuration file 7. Click OK to save 8. Click Activate to connect
The router will connect to the VPN server. A green checkmark or "Connected" status confirms success.
GL.iNet Routers
1. In the admin panel, go to VPN > OpenVPN Client 2. Click Add a New OpenVPN Configuration 3. Upload the .ovpn file 4. Enter your VPN service credentials 5. Click Apply 6. Toggle the VPN connection to On
GL.iNet routers also support WireGuard — if your VPN provides WireGuard configs, use those instead for faster speeds.
DD-WRT Routers
1. Go to Services > VPN 2. Enable OpenVPN Client 3. Enter the server address, port, and encryption settings from the .ovpn file 4. Paste the certificate content into the appropriate fields 5. Enter your VPN credentials 6. Click Save then Apply Settings
DD-WRT requires more manual configuration than Asus or GL.iNet. Refer to your VPN provider's DD-WRT setup guide for model-specific instructions.
Step 5: Test — Verify IP Changed on a Connected Device
After the router connects to the VPN, every device on your network should show the VPN server's IP address.
To verify: 1. Connect a device (phone, laptop) to your router's WiFi 2. Open a browser and go to ipleak.net 3. Check that the IP address shows the VPN server's location, not your real location 4. Check that DNS servers belong to your VPN provider, not your ISP
Test multiple devices: Check at least two different devices — a phone and a computer — to confirm all traffic routes through the VPN.
If the IP still shows your real location:
- Verify the VPN connection is active in the router admin panel
- Reboot the router
- Try a different VPN server config file
- Clear DNS cache on your test device (Windows: ipconfig /flushdns)
Important Considerations
Speed impact: A router-level VPN encrypts all traffic on the router's own processor rather than on each device, and consumer router CPUs are far weaker than a phone or laptop's. On most consumer hardware that is the binding constraint, and the speed loss is noticeably larger than running the same VPN as an app — often enough that a fast fibre line will not reach its full rate through the router. We did not benchmark this for the current edition, so we are not putting a percentage on it: measure your own line before and after using the method in how to evaluate VPN speed. Higher-end routers with faster processors, and WireGuard rather than OpenVPN where the router supports it, both help materially.
It costs one device slot, not one per device: NordVPN's documentation states that a router "uses only one device slot, but the VPN will protect all the devices connected to the network". Against a ten-connection account that is the best value available, and it is the only way to cover hardware that cannot run a client at all. See NordVPN on multiple devices for how the limit is counted.
All-or-nothing: When VPN is on the router, all devices are protected — but all devices also appear to be in the VPN server's country. This can affect banking apps, local services, and smart home devices that rely on your real location.
Split tunneling alternative: Some routers (Asus with Merlin firmware) support policy-based routing — you can configure specific devices to use the VPN while others connect directly. This is the ideal setup.
Updating the server: To change VPN servers, you need to upload a new config file in the router admin panel. It is less convenient than switching servers in an app.
Read our NordVPN review or Surfshark review for more details. Browse the VPN for Business category if you need router VPN for an office setup.
NorwegianSpark Editorial — Written with AI assistance and reviewed by the NorwegianSpark SA editorial team. Tutorials are independently written and regularly updated.
