A VPN on the router covers everything in the house at once, including devices that cannot run a VPN app, such as a smart TV or a game console. A VPN app on each device is faster, easier to switch, and lets you choose what goes through the tunnel. For most people the right answer is the app on phones and laptops, plus the router for the devices that cannot do it themselves. The details decide which side you land on.

What "VPN on router" actually means

The router connects to the VPN server and every device behind it gets its traffic sent through the tunnel automatically. Devices do not know a VPN exists; they just see a normal Wi-Fi network. Sites and services see the VPN server's address for the whole household.

That requires a router that can run a VPN client. Stock ISP routers usually cannot. Routers running OpenWrt, ASUS routers with Merlin firmware, GL.iNet travel routers, MikroTik, Keenetic and similar devices can, most of them with WireGuard built in.

What the router does better

  • Every device is covered, including TVs, consoles, streaming boxes, printers and smart-home gadgets that have no VPN app.
  • Always on. Nobody forgets to connect. Guests are covered the moment they join the Wi-Fi.
  • One connection instead of ten. If your VPN plan limits simultaneous devices, the router counts as one.
  • No apps to install or update on each device.
  • The tunnel starts before any app does, so there is no window at boot where traffic goes out unprotected.

What the device app does better

  • Speed. Encryption on a router CPU is the most common bottleneck. A mid-range phone will out-encrypt a budget router by a wide margin. Why that matters is covered in does a VPN slow down your internet.
  • Choosing per app. Split tunneling lets you send the browser through the VPN and keep the banking app or a game on the direct connection. On a router it is all or nothing, unless you set up policy routing by hand.
  • Switching servers is one tap. On a router it means logging into the admin page.
  • Protection outside the house. The router does nothing for your phone on mobile data or in a café.
  • Kill switch on the device blocks traffic on that device only, exactly when its tunnel drops. A router kill switch takes the whole house offline.
  • Latency-sensitive tasks like gaming can skip the VPN entirely on one device without affecting others.

Speed: the honest comparison

WireGuard on a modern router with a decent CPU can carry a few hundred megabits, which is enough for most homes. OpenVPN on the same router is several times slower. A five-year-old router doing OpenVPN can drop a gigabit line to a few tens of megabits, and every device shares that. Before committing to a router VPN, check what throughput other people report for your exact model and the protocol you plan to use.

The phone or laptop, by contrast, spends a small fraction of one core on WireGuard or VLESS and rarely becomes the limit.

Setting up both without double tunnels

If the router runs a VPN and you also turn on the app on your laptop, the laptop's traffic goes through two tunnels in a row: the app's, then the router's. That works, but it doubles the overhead and puts you in a country you did not choose. Three clean ways to avoid it:

  1. Router only for dumb devices. Put the VPN on a separate Wi-Fi network or a guest network, connect the TV and console there, and keep phones and laptops on the normal network with their own app.
  2. Policy routing. Advanced firmware lets you say which devices, by IP or MAC, go through the tunnel. Everything else takes the direct route.
  3. App on everything, no router VPN. Simplest if your household has no devices that need covering.

Which one to pick

Choose the router if you mainly want to cover a TV, console or streaming box, you have a router that handles WireGuard well, and you do not need to switch servers often.

Choose the device app if you care about speed, use the VPN outside the house, want split tunneling, or share a network with people who need different settings.

Choose both if you have devices in each category. Router for the ones that cannot run an app, app on the ones that can, and no overlap between them.

Practical notes before you start

  • Pick a server close to home for the router: every device pays the latency, so distance matters more than on a single device. The server list shows latency and load per location.
  • Set the router's DNS to the VPN provider's resolvers, otherwise every device leaks DNS in exactly the same way.
  • Disable IPv6 on the router's WAN side unless the tunnel supports it.
  • Keep a way to reach the router's admin page without the VPN, in case the tunnel fails and you need to fix it.
  • After setup, open What Is My IP from a device behind the router to confirm it shows the VPN server.

404 VPN works both ways: apps for iOS, Android, Windows, macOS, Linux, Android TV and Apple TV, and WireGuard configurations you can load into a router. How the connection is built is described on the how it works page; you can get started with either setup.