Why Put a VPN on Your Router
Installing a VPN on your router protects every device connected to your home network automatically -- smart TVs, game consoles, tablets, IoT devices, and anything else that can't run a VPN app itself. One connection to the VPN server covers the entire household. Trade-off: all traffic goes through a single VPN server, which means you can't easily split-tunnel per device, and your VPN provider's server capacity becomes a bottleneck for the whole home network.
Compatible Routers
Not every router supports VPN client mode. Look for: Asus routers with AsusWRT-Merlin firmware (RT-AX88U, RT-AX86U, and similar -- these support OpenVPN and WireGuard client natively). GL.iNet routers (designed specifically for VPN use, WireGuard and OpenVPN pre-configured, good for travel too). Routers running DD-WRT or OpenWrt firmware (requires manual installation -- more technical setup). Consumer routers from Netgear, TP-Link, and Linksys generally do NOT support VPN client mode on stock firmware unless specifically marketed as such.
Firmware Options
AsusWRT-Merlin: the easiest option for supported Asus routers. Install Merlin firmware, navigate to VPN Client settings, paste your VPN provider's OpenVPN config file or enter WireGuard credentials. Documentation is extensive and many VPN providers (NordVPN, ExpressVPN, ProtonVPN) have step-by-step guides for Merlin. DD-WRT: open source firmware for a wide range of routers. More complex setup, but supports a large number of hardware. Check DD-WRT's router database before buying hardware. OpenWrt: even more flexible than DD-WRT, but significantly more technical to set up.
VPN Providers That Support Router Installation
ExpressVPN: sells its own pre-configured router (Aircove) and provides router firmware for Asus and Linksys. NordVPN: configuration files available for DD-WRT, AsusWRT-Merlin, and other firmware. ProtonVPN: WireGuard and OpenVPN configuration files available, step-by-step guides for major routers. Mullvad: WireGuard config files for router setup, no account required for config generation.
Trade-Offs to Know
Speed impact: VPN on router CPU is more demanding than VPN on a dedicated device. Routers with weak CPUs will bottleneck throughput significantly. A router with hardware AES acceleration (most modern Asus flagships) handles this much better. Split tunneling: per-device exclusions are harder on router VPN than on VPN apps -- you'd need to set up policy-based routing or VLAN separation. Single point of failure: if the VPN connection drops on the router, all devices lose internet access (unless you set up a kill switch or fallback routing).