Skip to content
PrivacyTechReview
VPN & Privacy

The best VPN for routers in 2026: which VPNs work on your router, and what you give up

A VPN on your router covers every device on your home network, including the ones that can't run a VPN app, such as smart TVs and game consoles. But your router needs a VPN client, usually OpenVPN or WireGuard, and you give up features the apps have. Of the nine VPNs we review, Proton VPN, NordVPN, Surfshark, PureVPN, hide.me and VeePN publish router setups; VirtualShield, Betternet and Hotspot Shield say in their help centers that they don't support routers.

PrivacyTechReview Editorial Team Editor-in-Chief: Kirill Prosandeev Reviewed Nov 1, 2026 10 min read
See the picks What to look for

Ad-supported — we may earn a commission from links on this page, at no cost to you, and it never changes our assessments. How this works.

A black wireless router with four antennas under a glass dome on a dark desk at night, tunnels of light running from it to a laptop, a phone and a TV

We read each vendor's router guides and device-limit pages, and ASUS's and GL.iNet's own documentation, on November 1, 2026. We rank the six by how many router platforms and protocols each supports, how it counts a router against your device limit, and how plainly it explains the trade-offs. We haven't set these up ourselves, and we don't publish prices or speeds. NordVPN, Surfshark, Proton VPN, PureVPN and VeePN are partners: we may earn a commission when you buy through our links, and that doesn't decide the order.

Check your router first: NordVPN says a router issued by your internet provider probably doesn't support VPN configurations, and Proton says most don't.

What a VPN router covers, and what you give up

A VPN router sends the traffic of every connected device through the VPN. The vendors are plain about the trade-offs:

  • Devices without VPN apps. Proton and Surfshark name smart TVs and game consoles, PureVPN gaming consoles, and ASUS set-top boxes, smart TVs and Blu-ray players. NordVPN's guide for Xbox and PlayStation suggests installing NordVPN on your router.
  • One device slot. NordVPN says the router uses one device slot while protecting every device on the network, PureVPN that it uses one of your ten, and hide.me that you can connect as many devices behind a VPN router as you wish. Proton says a router counts as one connection on its free plan. Surfshark has no device limit.
  • Lost app features. Surfshark says you'll lose most of the features in its apps, and that its post-quantum encryption layer isn't supported on manual configurations. Proton says NetShield or split tunneling may not be available, that switching servers means changing the router's settings, and that the settings apply to every connected device.
  • What isn't encrypted. Proton notes that a VPN router encrypts traffic between the router and the internet, not between your devices and the router, and that Bluetooth and other local connections aren't protected.
  • Kill switch. On a router, the kill switch is a firmware setting or firewall script, not an app feature, and some vendors show you how to set one up: NordVPN's DD-WRT, Tomato, AsusWRT-Merlin and OpenWrt guides have optional kill switch steps, as do Proton's FreshTomato and AsusWRT-Merlin guides and hide.me's AsusWRT-Merlin guide. GL.iNet says its firmware 4.8 and later has a kill switch for the global VPN connection and for each tunnel.

How to choose a VPN for your router

  1. 1

    Check your router's VPN client

    It needs a VPN client, usually OpenVPN or WireGuard; routers from internet providers usually don't have one.

  2. 2

    Pick a VPN with a guide for your firmware

    Proton, NordVPN, PureVPN and hide.me publish guides for ASUS, DD-WRT, OpenWrt, Tomato and more; GL.iNet has built-in sign-in for NordVPN, PureVPN, hide.me and Surfshark.

  3. 3

    Decide which devices use it

    ASUS VPN Fusion lets you pick which devices use each VPN profile, or apply it to all devices. Keep the VPN apps on laptops and phones if you want their split tunneling and other app features.

  4. 4

    Check how the router counts

    Most of these VPNs count the router as one device; VeePN's terms say routers serving many devices may be restricted.

The six VPNs that support routers, ranked

6 compared
Editors' choice
1

Proton VPN

Best for clear router guides, even on the free plan

Our take: Proton offers router connections on every plan, including Proton Free, where it says the router counts as one connection however many devices you connect. Its guides cover AsusWRT, AsusWRT-Merlin, DD-WRT, FreshTomato, GL.iNet, MikroTik, OpenWrt, OPNsense, pfSense, Vilfo and Ubiquiti's Dream Machine, over OpenVPN or WireGuard; its Stealth protocol isn't available for routers. Proton's router page is also the most detailed about the limits: what a VPN router doesn't encrypt, that NetShield and split tunneling may not work, and that changing servers means editing the router.

Strengths

  • Router setup on every plan, including Free
  • OpenVPN or WireGuard, with guides for 11 router platforms
  • Explains what a VPN router doesn't cover

Worth knowing

  • No Stealth protocol on routers
  • No built-in sign-in on GL.iNet
  • One-connection rule stated only for the free plan
Platforms: AsusWRTDD-WRTFreshTomatoGL.iNetOpenWrtpfSense

Bottom line: Pick Proton if you want to try a VPN router on its free plan before you pay.

Read full Proton VPN review

Ad

Check Proton VPN price

Opens Proton VPN's official site

2

NordVPN

Best for a long list of router tutorials, on one device slot

Our take: NordVPN lists router tutorials for ASUS (stock and Merlin), DD-WRT, GL.iNet, MikroTik, NetDUMA, OPNsense, OpenWrt, Padavan, pfSense, Sabai, Tomato, TP-Link, DrayTek, EdgeRouter and Starlink, among others, and says the router uses only one device slot while protecting every device on the network. Most of its router guides use OpenVPN, and its DrayTek and MikroTik guides use IKEv2; NordLynx, its WireGuard-based protocol, comes on the Privacy Hero routers that FlashRouters sells preconfigured. GL.iNet's firmware has a built-in NordVPN sign-in for both WireGuard and OpenVPN. NordVPN also lists the brands its setup doesn't support on stock firmware.

Strengths

  • Tutorials for 18 router platforms
  • Router uses one device slot
  • Built-in sign-in on GL.iNet; preconfigured routers

Worth knowing

  • OpenVPN on most routers; NordLynx integration only on Privacy Hero
Platforms: ASUSDD-WRTGL.iNetOpenWrtpfSenseTomato

Bottom line: Pick NordVPN if your router isn't one of the common brands, or you want one preconfigured.

Read full NordVPN review

Ad

Check NordVPN price

Opens NordVPN's official site

3

Surfshark

Best for a household with no device cap

Our take: Surfshark sets no device limit and lists routers among the devices you can use. Its manual setups use OpenVPN or WireGuard, with guides for DD-WRT, AsusWRT, GL.iNet, OpenWrt and others, and GL.iNet's firmware has a built-in Surfshark WireGuard sign-in. Surfshark is frank that a router setup means you'll lose access to most of the features in its apps, and its protocols page says the post-quantum encryption layer isn't supported on manual configurations; it recommends its apps where you can use them.

Strengths

  • No device limit
  • OpenVPN or WireGuard
  • Built-in WireGuard sign-in on GL.iNet

Worth knowing

  • Most app features lost on a router
  • No post-quantum layer on manual setups
Platforms: AsusWRTDD-WRTGL.iNetOpenWrt

Bottom line: Pick Surfshark if the router is for TVs and consoles and everyone else keeps the app.

Read full Surfshark review

Ad

Check Surfshark price

Opens Surfshark's official site

4

PureVPN

Best for a DD-WRT app or a router that arrives set up

Our take: PureVPN supports routers with WireGuard and OpenVPN clients from a long list of brands, among them ASUS, DD-WRT, GL.iNet, Netgear, OpenWrt, pfSense, Tomato and TP-Link, and it has an app for DD-WRT routers. FlashRouters sells routers preconfigured with PureVPN, and GL.iNet's firmware has a built-in PureVPN WireGuard sign-in, though GL.iNet says PureVPN's dedicated IP doesn't work on its routers. PureVPN says a router uses one of your ten devices.

Strengths

  • App for DD-WRT routers
  • WireGuard or OpenVPN; preconfigured routers
  • Router uses one of 10 devices

Worth knowing

  • Dedicated IP doesn't work on GL.iNet routers
Platforms: ASUSDD-WRTGL.iNetNetgearOpenWrtTP-Link

Bottom line: Pick PureVPN if you run DD-WRT or want a preconfigured router.

Read full PureVPN review

Ad

Check PureVPN price

Opens PureVPN's official site

5

hide.me VPN

Best for protocol choice, on Premium

Our take: hide.me supports routers with a VPN client over SSTP, OpenVPN, IKEv2, SoftEther or WireGuard, with guides for AsusWRT (stock and Merlin), DD-WRT, OpenWrt, Tomato and pfSense, and GL.iNet's firmware has a built-in hide.me WireGuard sign-in. A router needs Premium: its WireGuard and third-party OpenVPN setups are for paying users. In hide.me's own example, a router takes one of your ten devices, and you can connect as many devices behind it as you wish.

Strengths

  • Five protocols for routers
  • Built-in WireGuard sign-in on GL.iNet
  • Router counts as one of 10 devices

Worth knowing

  • Router setups need Premium
Platforms: AsusWRTDD-WRTOpenWrtTomatopfSense

Bottom line: Pick hide.me if your router's firmware only speaks one of the less common protocols.

Read full hide.me VPN review

Ad

Check hide.me VPN price

Opens hide.me VPN's official site

6

VeePN

OpenVPN only, on paid plans

Our take: VeePN supports routers through OpenVPN configuration files on paid plans, and names ASUS routers and DD-WRT and Tomato firmware. Its router page promises no restrictions on the number of devices, but its terms say routers that give VPN access to many devices may be restricted at VeePN's discretion and that using one to get around the 10-device limit can lead to action.

Strengths

  • OpenVPN configs for ASUS, DD-WRT and Tomato

Worth knowing

  • OpenVPN only; paid plans only
  • Its terms may restrict routers that serve many devices
Platforms: ASUSDD-WRTTomato

Bottom line: Pick VeePN only if you already use it and your router runs OpenVPN.

Read full VeePN review

Ad

Check VeePN price

Opens VeePN's official site

VPNs on routers at a glance

What each VPN's own router guides and device-limit pages say.

Proton VPN

Router setup
Manual; every plan, including Free
Protocols on a router
OpenVPN, WireGuard
Built-in sign-in on GL.iNet
No (upload configs)
Router against your device limit
One connection (stated for Free)
What you give up, per the vendor
NetShield and split tunneling may not work; reconfigure to switch servers

NordVPN

Router setup
Manual; preconfigured routers from FlashRouters
Protocols on a router
OpenVPN, IKEv2 (DrayTek, MikroTik); NordLynx on Privacy Hero; WireGuard via GL.iNet
Built-in sign-in on GL.iNet
Yes (WireGuard, OpenVPN)
Router against your device limit
One device slot
What you give up, per the vendor
Not stated

Surfshark

Router setup
Manual
Protocols on a router
OpenVPN, WireGuard
Built-in sign-in on GL.iNet
Yes (WireGuard)
Router against your device limit
No device limit
What you give up, per the vendor
Most app features; post-quantum layer

PureVPN

Router setup
Manual; DD-WRT app; preconfigured routers
Protocols on a router
WireGuard, OpenVPN
Built-in sign-in on GL.iNet
Yes (WireGuard)
Router against your device limit
One of 10
What you give up, per the vendor
Dedicated IP on GL.iNet (per GL.iNet)

hide.me VPN

Router setup
Manual; Premium only
Protocols on a router
SSTP, OpenVPN, IKEv2, SoftEther, WireGuard
Built-in sign-in on GL.iNet
Yes (WireGuard)
Router against your device limit
One of 10
What you give up, per the vendor
Not stated

VeePN

Router setup
Manual; paid plans only
Protocols on a router
OpenVPN
Built-in sign-in on GL.iNet
No
Router against your device limit
Terms may restrict routers
What you give up, per the vendor
Not stated

Proton VPN

An audited no-logs VPN with a no-data-cap free plan

Ad

Check Proton VPN price

Opens Proton VPN's official site

NordVPN

Audited VPN with desktop download scanning

Ad

Check NordVPN price

Opens NordVPN's official site

Surfshark

One VPN account for every device in the house

Ad

Check Surfshark price

Opens Surfshark's official site

PureVPN

VPN with port forwarding and dedicated IP add-ons

Ad

Check PureVPN price

Opens PureVPN's official site

hide.me VPN

A no-sign-up free VPN with an audited no-logs policy

Ad

Check hide.me VPN price

Opens hide.me VPN's official site

VeePN

One VPN account for computers, phones, TVs and browsers

Ad

Check VeePN price

Opens VeePN's official site

Does your router support a VPN?

Your router needs a VPN client, not just VPN passthrough: hide.me explains that a passthrough-only router doesn't block VPN traffic but has no VPN client of its own. Here's what the router makers and the vendors say:

  • Routers from your internet provider. NordVPN says one issued by your ISP probably doesn't support VPN configurations, and Proton that most don't.
  • ASUS. Its VPN Fusion feature has OpenVPN and WireGuard clients (WireGuard on firmware later than 3.0.0.4.388.23000) and sends the devices you assign to each profile through the VPN. ASUS says this gives VPN access to devices that can't run VPN software.
  • GL.iNet. Its firmware 4.7 and later has built-in WireGuard sign-in for hide.me, NordVPN, PureVPN and Surfshark, among other providers, and a built-in OpenVPN sign-in for NordVPN; other providers upload configuration files.
  • Brands that don't work out of the box. NordVPN and Surfshark list routers their setups don't support on default firmware, including Arris, Belkin, Cisco, TRENDnet, TotoLink, Ubee and most Linksys models, and say custom firmware such as DD-WRT can make some of them work. Proton warns that flashing firmware, if done incorrectly, may cause your router to stop working.
  • Preconfigured routers. NordVPN and PureVPN point to FlashRouters, which sells routers set up for them.

Before you set up a VPN on your router

  • Your router has a VPN client (usually OpenVPN or WireGuard), not just VPN passthrough.
  • Your VPN publishes a guide for your router's firmware.
  • You know which devices will go through the router, and which keep their own app.
  • You know how the router counts against your device limit.
  • You've set up the router's kill switch if your firmware or your VPN's guide offers one, and you've accepted that app features such as split tunneling may not be available.

Keep reading

Sources · checked Nov 1, 2026

Frequently asked questions

Can I put a VPN on my router?
Yes, if your router's firmware has a VPN client, usually OpenVPN or WireGuard. ASUS's VPN Fusion and GL.iNet's firmware have both, and NordVPN, Proton, Surfshark, PureVPN and hide.me publish setup guides for many other router platforms. NordVPN and Proton say most routers from internet providers don't support VPN configurations.
Does a VPN router count as one device?
Usually. NordVPN says the router uses one device slot, PureVPN and hide.me count it as one of ten, and Proton says it's one connection on its free plan. Surfshark has no device limit. VeePN's terms say routers that serve many devices may be restricted.
Which VPNs don't work on routers?
VirtualShield's help center says it doesn't support installation on routers, though its pricing and VPN pages mention routers. Betternet says it doesn't support configuring routers, and Hotspot Shield's help center lists routers as unsupported.
Does a VPN router have a kill switch?
Only if the router's firmware has one or you add one. NordVPN's DD-WRT, Tomato, AsusWRT-Merlin and OpenWrt guides, Proton's FreshTomato and AsusWRT-Merlin guides and hide.me's AsusWRT-Merlin guide show how to turn one on, and GL.iNet says its firmware 4.8 and later has a kill switch for the global VPN connection and for each tunnel.
Do I still need VPN apps if my router has a VPN?
For phones and laptops, usually yes. Surfshark recommends its apps where you can use them, since a router setup loses most app features, and Proton notes that a VPN router doesn't encrypt traffic between your devices and the router. A router can't protect a device once it leaves your home network.
Can I use a VPN router for my game console or smart TV?
That's the main reason to set one up. Proton, Surfshark, PureVPN and ASUS all name consoles or smart TVs among the devices a router VPN covers, and NordVPN's guide for Xbox and PlayStation suggests installing NordVPN on your router.

Our top pick: Proton VPN

An audited no-logs VPN with a no-data-cap free plan

Ad Check price