VPNReactor

How to set up a VPN on a router

To set up a VPN on a router, check that your router has an OpenVPN or WireGuard client, copy the credentials or configuration file from your VPN provider, enter them in the router's VPN client settings and test for leaks. Once it connects, every device on your network is covered, including smart TVs and consoles that cannot run a VPN app.

Brian Choi, Technical WriterLast updated: Fact checked

How to set up a VPN on a router: what to know first

A virtual private network protects all devices connected to your network, including smart TVs, game consoles and other gadgets that cannot run a VPN app. You configure it once, and nobody has to switch it on per device.

There are trade-offs. Surfshark notes that you lose most app features, management is less convenient and speeds may drop. Setup is also harder than installing an app, and a bad flash can damage the hardware. If a device can run the provider’s app, the app is usually the easier choice, and this approach works best as a supplement for everything else.

Check that your router supports a VPN client

A VPN-capable router needs a client for a communication protocol such as OpenVPN or WireGuard. Not all routers support VPN functionality, so confirm it in three ways:

Devices handed out by your internet service provider are usually incompatible because their settings are locked. If yours falls into that group, you have two options:

Surfshark names the Asus RT-AC68U and RT-AC88U, and the GL.iNet GL-AR300M and GL-MT300N-V2 running OpenWrt, as examples that can handle a VPN. Some models on their original software already include a built-in VPN client in the advanced settings of the web interface.

How to set up a VPN on a router step-by-step

The exact screens differ by model, but this step-by-step tutorial follows the same order everywhere.

  1. Update the system software. TP-Link warns that older versions may lack full OpenVPN support, so update before you start.
  2. Subscribe to a VPN service that can support VPN use on routers. The best VPN for this job is one with a guide for your model, and NordVPN, Surfshark and ExpressVPN all publish router setup guides.
  3. Get your credentials and configuration files. With NordVPN, open your Nord Account and choose the manual setup option. The Service credentials tab holds a username and password that are separate from your account login. The configuration files tab offers UDP and TCP downloads. With Surfshark, go to the dashboard, choose VPN, then Manual setup, then Router, and pick between the two encryption protocols, OpenVPN or WireGuard.
  4. Open the admin page. Sign in to the control panel and find the VPN settings.
  5. Enter the details. Either type in the VPN server address, username and password, or upload the .ovpn or .conf file you downloaded. On OpenWrt, you install the OpenVPN packages first, upload the .ovpn file and keep the credentials in a separate auth file.
  6. Save, apply and connect. Switch the client on and wait for the status to read VPN connected.
  7. Verify your VPN. Open a web browser, check your IP address and run a DNS or WebRTC leak test. A leak means traffic is escaping the VPN tunnel, so the setup is probably misconfigured.

For NordVPN, stick with OpenVPN on routers. NordVPN’s own guide for an Asus router also says you can create only one such connection, so pick the VPN server you want to use all the time.

Router VPN installation with ExpressVPN firmware

ExpressVPN takes a different route on some models: it installs its own firmware. ExpressVPN lists the RT-AC68U (up to v3), RT-AC87U, RT-AC56R, RT-AC56S and RT-AC56U. Security updates for ExpressVPN on these models have ended, though the installation still works.

  1. Download the file from the ExpressVPN setup portal.
  2. Sign in at 192.168.1.1.
  3. Go to Administration, then Firmware Upgrade, and upload the .trx file.
  4. Let the device reboot, then join its network.
  5. Open the setup screen (or expressvpnrouter.com) and select Get Started.

The new installation replaces your current settings, including the Wi-Fi name and password, so write those down first. ExpressVPN also lists supported Netgear models (R6300v2, R6400v2, R6700v3, R7000 and R7000P) and Linksys models (EA6200, WRT1200AC and two WRT1900AC revisions) on its own pages. Always rely on the provider’s list for your model.

TP-Link owners should check the manufacturer’s guidance too. TP-Link’s own support page describes a quick setup for NordVPN that needs a token from NordVPN first, while OpenVPN uses the manual setup.

Why a VPN on your router helps

A VPN on your router can encrypt traffic from the whole home network before it leaves for the internet, which helps protect your privacy. That covers devices with no VPN app, and new devices are protected the moment they join your Wi-Fi. It protects multiple devices at once, which suits smart TVs and consoles, and families who do not want to manage VPNs on every phone and laptop.

Memory is a practical limit on flashed devices, so keep your configuration lean. If your router cannot run a VPN at all, install the VPN app on each device instead. Setting a secure DNS is a weaker fallback.

How to set up a VPN on a router FAQs

Can any router work with a VPN?

No, only routers with an OpenVPN or WireGuard client, or ones running compatible software, can host a VPN. Check the manual, your model’s page on the manufacturer’s site or the settings.

Do I need custom software to use a VPN?

Not always. Some models on their original software have a built-in VPN client. Custom builds such as DD-WRT are for devices that lack one.

Can I use the router my internet provider gave me?

Usually not. Provider-issued devices tend to have locked settings that block VPN configuration. You can often connect your own VPN-capable router behind it.

Is flashing DD-WRT or Tomato safe?

It carries risk. Flashing third-party software can void your warranty and can brick the device, so follow the guide for your exact model and keep the original file.

How do I know the router VPN is working?

Check your public IP address and run a DNS or WebRTC leak test from a computer on the network. If the address matches your real location or the test shows leaks, recheck the configuration.

Will a VPN on my router slow my internet?

It may. Surfshark warns that speeds may drop when the VPN runs on a router, since the hardware does the encryption work for all your devices.

What are the service credentials for NordVPN?

They are a username and password for manual setups, found in your Nord Account under the manual setup option. They are separate from your account email and password.

What if my router cannot run a VPN?

Buy a VPN-ready model or install the VPN app on each device. Apps also give you features that router setups usually lose.

CybersecurityWhat are the best Surfshark alternatives?Looking for Surfshark alternatives? Compare NordVPN, ExpressVPN, Proton VPN, CyberGhost and more on price, refunds and features before you switch.CybersecurityHow to change location on iPhoneLearn how to change location on iPhone: use a VPN for your IP address, update your Apple Account region for purchases, and control app access.CybersecurityAvast says my IP Address is Visible and How To Fix ItIf you've seen this message from Avast: Your IP address is visible, then you're not alone and there's a few ways to solve it. We've created a...
Get NordVPN