Guide
How to set up a VPN on a router
When the router is the right place for the tunnel and when it is not, the provider’s configuration file on the firmware’s own VPN client page, DNS for the whole house, and the checks from a device behind it. Written against a router whose firmware has a VPN client page; this guide does not reflash anything.
Before you start
This guide does not pick one for you
Every step below is the same whichever provider you use, which is why none is named here. Choosing is a separate job and it is done on the register, where the choice is made against a published score rather than against a download page.
The configuration files come from the provider’s own account area and from nowhere else. A file from a forum carries somebody else’s key, or somebody else’s server.
A router is the right place for the tunnel when the devices behind it cannot run a client of their own — a television, a console, a smart speaker — or when the point is every device at once with nothing to install. It is the wrong place when the house needs to leave the tunnel sometimes: behind a router, no device can, and every device shares one exit, one country and one processor. That processor is the ceiling on speed, and it sits well below a laptop’s. If one or two devices are the reason, install the client on those instead; the platform pages say which providers support which.
This guide does not reflash a router. Replacing the firmware with one of the common third-party firmwares gives a router a better VPN client than most stock ones, and it is also the one step in any guide on this site that can turn hardware into a brick. If your router’s firmware has a VPN client page, the steps below are enough. If it does not, the decision to reflash is yours and its instructions are the firmware project’s, not ours.
Load the configuration
- Sign in on the provider’s website and open the router or manual-configuration section of the account area. Generate a configuration file for the protocol your firmware supports and the exit you want; one file is one exit. The file contains your key — treat it like a password.
- Open the router’s admin page from a device on the wired or home network, and find the VPN client page. Its name varies — VPN client, VPN Fusion, WAN › VPN — but it is a client page, which connects out, not a server page, which lets you connect in from outside. The two look alike and only one of them is this guide.
- Import the file, or paste its fields where the firmware asks for them one by one. Give the profile the exit’s name so that a second one later is distinguishable.
- Choose which devices go through the tunnel if the page offers it, and take all of them for now; the exception list is a later refinement. Then activate the profile.
- Do not stop here. The DNS and the kill switch are on the same page or the next one, and the default for both is off.
The settings worth checking
Firmware pages differ, the settings do not. Each has an entry in the glossary if the name is unfamiliar.
DNS for the whole house
Every device behind the router asks the router where things are, and the router asks whoever it was told to. If that is the internet provider’s resolver, every lookup in the house leaves outside the tunnel, which tells the internet provider which sites the house visits and hides only what it did there. Set the router’s DNS — on the VPN client page where it has a field, otherwise on the WAN page — to the resolver the provider’s file names, and set the router to hand its own address to devices as their resolver, so that no device is handed the internet provider’s. How a leak happens is on the DNS leaks page.
The kill switch
On a router it is a firewall rule: when the tunnel is down, nothing from the tunnelled devices may leave by the ordinary route. Some firmwares have the switch as a checkbox, some call it block routed clients if tunnel goes down, and some do not have it at all. Where it exists, turn it on; a dropped tunnel then takes the house offline until the reconnection, which is the point of it. Where it does not, know that a dropped tunnel hands every device back to the bare connection without a word. What the switch is for is on its own page.
IPv6
Most router tunnels carry only IPv4. If the internet provider gives the house IPv6 as well, devices will use it for any site that offers it, and that traffic goes around the tunnel. Unless the provider’s file sets up IPv6 inside the tunnel, turn IPv6 off on the WAN side while the tunnel is in use.
The protocol
Take the modern one wherever the firmware offers it — the protocol page lists which are current and which are legacy — both for the reason the register scores it and because on a router’s processor it is several times faster than the older one. An old router that offers only the legacy protocol is a router that will be slow as well as marked.
Confirm it is actually working
Check from a device behind the router, not from the router’s own status page, which only says what the router believes. Three checks, in this order:
- The address changed, on a device with no client of its own. Open any “what is my IP” page on a laptop or phone that is on the router’s Wi-Fi, with mobile data off and no VPN app running. The country should be the exit you chose.
- Lookups are inside the tunnel. Run a DNS leak test from the same device. Anything belonging to your internet provider means the DNS setting above did not take, or a device was handed the wrong resolver.
- The kill switch does what it says. With a download running on that device, disable the VPN profile on the router’s page or unplug the router’s WAN cable for a moment and plug it back in. During the gap the download should stop dead, and when the connection returns it should not resume until the tunnel does. If it carries on, the switch is absent or off.
The longer battery of tests, and what each one can and cannot show, is its own guide.
What those checks prove
+Every device on that network leaves through the exit server, in the country you selected, with nothing installed on it
+The internet provider sees one encrypted connection from the house and no lookups
+A dropped tunnel fails closed for the whole house, where the firmware has the switch
What they do not
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not make anyone anonymous: every account on every device is still signed in, see what a VPN does not protect you from
−A passing test on one device says nothing about a device on another network, or one with its own app
One house, two networks
The complaint about a router tunnel is always the same: something needs to be outside it. The clean answer is two networks rather than one with exceptions. Either a second router behind the first, running the tunnel, with the devices that should be inside it on its Wi-Fi and everything else on the first router’s; or, where the firmware allows a VPN per network, a guest or secondary network that is the tunnelled one. A device then chooses by which network it joins, the television stays inside, the console stays out, and nobody turns the tunnel off for the house.
The second router also answers the speed question: it carries only the devices that need the tunnel, so its processor is a ceiling on them alone.
When it does not work
Everything in the house got slower
The router is now encrypting every byte the house sends, on a processor built to forward packets rather than encrypt them. That ceiling is the router's, not the provider's, and it is reached well below what a laptop manages with the same subscription.
The modern protocol is much lighter than the older one, so use it where the firmware offers it. Beyond that, the fix is a faster router or a tunnel on fewer devices — see the last section.
One device needs to be outside the tunnel
A bank app that refuses a foreign address, a games console, a smart speaker: something always does. Some firmwares let you exclude a device by address, which is split tunnelling at the router. Where the firmware cannot, the answer is the last section: a second network for the tunnel, so the device simply joins the other one.
Do not turn the tunnel off for the whole house to serve one device.
The tunnel drops and nothing reconnects
Most firmwares reconnect on their own; some only when told. Look for a keep-alive, auto-reconnect or watchdog setting on the VPN client page and turn it on. If the firmware has a kill switch and it is on, a dropped tunnel takes the house offline until the reconnection — that is the switch working.
If the tunnel drops at the same time every day, the internet provider is renewing your address and the router is slow to notice. A shorter keep-alive helps.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.