Why Set Up VPN at the Router Level
A router-level VPN protects every device on your home network simultaneously -- phones, smart TVs, IoT devices, gaming consoles, and computers -- without needing to install a VPN app on each device. This is the most comprehensive approach to home network privacy and is especially useful for devices that cannot run VPN apps (smart TVs, Apple TV, gaming consoles, smart speakers).
Which Routers Support VPN Client Mode
Not all routers support running a VPN client. Router models that work: Asus RT-series (RT-AX88U, RT-AX86U, RT-AC86U) -- these have a built-in VPN client in the router admin panel. DD-WRT compatible routers -- open-source firmware that adds VPN client support to many router models. OpenWrt compatible routers. Eero, Google Nest, and many ISP-provided routers do NOT support VPN client mode. Check your router's admin panel under Advanced settings or VPN for this feature. Alternatively, buy a pre-configured VPN router: ExpressVPN sells the Aircove, NordVPN partners with Vilfo.
Setup Steps on Asus Router with WireGuard
WireGuard is the recommended protocol for router VPNs -- it uses much less CPU than OpenVPN and provides better speeds. In Asus router admin panel: go to VPN > VPN Client > add profile > select WireGuard. Download the WireGuard config file from your VPN provider for the server you want to use. Import the config file. Click Activate. All traffic from your router now goes through the VPN tunnel.
Performance Impact
A VPN on a router uses the router's CPU for encryption. Budget routers (under 100 EUR) may reduce your internet speed by 40-70% when running a VPN. Mid-range routers with hardware encryption support (like Asus with WireGuard) reduce speed by 10-20% on gigabit connections. On a 100 Mbps connection, even a modest speed reduction is usually acceptable. Test your connection speed with and without VPN after setup to see the actual impact on your hardware.
Split Tunneling on Routers
Router split tunneling routes some devices through the VPN and others directly to the internet. In Asus: go to VPN > VPN Client > edit your VPN profile > Interface under 'Killswitch' shows device routing options. This is useful for streaming devices where you don't need the VPN (to avoid streaming geo-detection) while still protecting all other devices. Not all routers support device-level split tunneling -- OpenWrt provides the most granular control.