Set Up a VPN on Your Router and Control Which Devices Use It

Setting up a VPN on your router encrypts all traffic from every device on your network—laptops, phones, smart TVs, game consoles—without installing software on each one. This guide walks you through flashing or configuring your router to connect to a VPN service, then shows you how to route only specific devices through it. You’ll need a VPN subscription with OpenVPN or WireGuard credentials, a compatible router, and about 30 minutes.

What You’ll Need

• A VPN subscription that provides OpenVPN or WireGuard configuration files (most major providers do)
• A router that supports VPN client mode—either natively (AsusWRT, Synology, some Netgear) or after flashing DD-WRT, OpenWrt, or Tomato firmware
• Your router’s admin login credentials (usually printed on the device or in its manual)
• A computer or phone connected to the router’s network to access the admin panel
• The VPN server address, username, and password from your provider’s setup page

Step-by-Step

1. Check router compatibility. Log into your router’s admin panel (typically at 192.168.1.1 or 192.168.0.1, or via the manufacturer’s app). Look for a VPN Client or VPN section in the settings. If you see it, skip to step 4. If not, you’ll need to flash custom firmware.
2. Flash DD-WRT or OpenWrt (only if needed). Download the correct firmware file for your exact router model from the firmware’s official supported-devices list. Back up your current router settings first (Administration > Backup in most panels). Upload the firmware file via the router’s Firmware Upgrade page and wait 5–10 minutes for it to reboot. Do not power off during this process.
3. Access the new firmware. After flashing, connect to the router via Ethernet (Wi-Fi may be reset). Log in with the default credentials (usually admin/admin or root/admin) and set a new admin password immediately.
4. Get your VPN config files. Log into your VPN provider’s website, find the OpenVPN or WireGuard configuration download section, and download the config file for the server location you want. Also note your username and password (for OpenVPN) or your private key and public key (for WireGuard).
5. Upload the config to the router. In your router’s VPN Client section, choose OpenVPN or WireGuard. For OpenVPN, upload the .ovpn file directly. For WireGuard, you’ll paste in the interface address, private key, and peer public key, plus the server’s endpoint address and port.
6. Enter your credentials. For OpenVPN, enter your VPN username and password. For WireGuard, you generally don’t need a separate username—the keys handle authentication.
7. Enable the VPN and test. Turn on the VPN client, save, and wait 30–60 seconds. Check the status page—it should show a connected state with the server’s IP. Then visit a site like whatismyip.com from a device on your network to confirm your IP has changed.
8. Set up policy-based routing (decide what uses it). In DD-WRT, go to Administration > Commands and paste a script that assigns specific LAN IPs to the VPN tunnel and others to the normal WAN. In OpenWrt, use the Luci web interface: Network > Firewall, then create a new routing rule that matches source IPs and sets the VPN interface as the gateway. In AsusWRT, go to VPN > VPN Client > Policy Routing and choose which devices (by IP or MAC address) use the VPN.
9. Assign static IPs to devices you want to control. In your router’s DHCP settings, reserve IP addresses for the devices you want to route through the VPN. This makes the policy rules predictable.
10. Save and reboot. Apply all changes and reboot the router. After it comes back, verify that the devices you assigned to the VPN show the VPN IP, and the others show your normal IP.

Common Mistakes

• Flashing the wrong firmware. Using firmware meant for a different router model bricks the device. Double-check the exact model and hardware revision.
• Forgetting to change the admin password after flashing. Default credentials are public knowledge; leaving them makes your network trivially hackable.
• Using an old OpenVPN config. Many providers now use OpenVPN 2.4+ features. If the router fails to connect, download a fresh config file and try again.
• Routing everything through the VPN. If your VPN server is in another country, all your traffic takes a detour, slowing everything down. That’s why selective routing matters.
• Not testing after each step. Changing multiple settings at once makes it hard to isolate what broke. Test connectivity after enabling the VPN, then after adding policy rules.

Tips

• Use a local VPN server for speed. Choose a server close to you for daily browsing; use distant servers only for geo-unblocking.
• Keep a fallback connection. Before flashing, note your ISP’s DNS servers and your old settings. If the VPN fails, you can revert quickly.
• Schedule the VPN. Some routers (AsusWRT, OpenWrt) let you set a schedule so the VPN is only active at certain hours—useful for overnight downloads that don’t need it.
• Use MAC addresses for policy rules. IP addresses can change; MAC addresses are permanent. Most policy routing interfaces accept both.
• Update the router firmware regularly. VPN client bugs are often fixed in firmware updates.

Troubleshooting

• VPN shows connected but no internet. This usually means the VPN tunnel is up but DNS isn’t working. Go to the VPN client settings and set DNS to use the VPN provider’s DNS servers explicitly, or try a different DNS like 1.1.1.1.
• Router won’t connect to the VPN at all. Check the system log for error messages. Common causes: wrong username/password, an outdated config file, or the router’s clock being wrong (set it to sync with NTP).
• Speed is terrible. Try a different VPN server, switch from OpenVPN to WireGuard if your router supports it, and check if your router’s CPU is maxed out (DD-WRT shows this in the status page). Some cheap routers simply can’t handle high VPN throughput.
• Policy routing not working. Devices still show the normal IP. Verify that you entered the correct LAN IP range or MAC address, and that the firewall rule is enabled and placed before any default routing rule.
• After flashing, router is bricked (won’t boot). Many routers have a recovery mode: hold the reset button while powering on, then upload the original firmware via a TFTP client or the manufacturer’s recovery tool. Check your router’s manual for the exact procedure.
• VPN drops randomly. Enable the “reconnect on failure” option in the VPN client settings. Also check if your ISP is blocking VPN traffic—try changing the VPN protocol from UDP to TCP, or use port 443.

Frequently Asked Questions

Will a router VPN slow down my internet? Yes, somewhat. The router’s CPU encrypts and decrypts all VPN traffic. A mid-range router might handle 50–100 Mbps over OpenVPN; a high-end one can do 300+ Mbps. WireGuard is faster—often 2–3x OpenVPN on the same hardware.

Can I use a VPN on my router and still access local devices like printers? Yes. Local network traffic (within your LAN) is not routed through the VPN. Only traffic destined for the internet goes through the tunnel.

What’s the difference between VPN client and VPN server on a router? VPN client means your router connects out to a VPN service, encrypting your traffic. VPN server means your router accepts incoming VPN connections from devices outside your network, letting you access your home network remotely.

Does every device on my network have to use the VPN? No. With policy-based routing, you choose which devices (by IP or MAC) go through the VPN and which use your normal internet connection. This is the “decide what uses it” part of the setup.

Is it safe to flash custom firmware on my router? It’s generally safe if you use the correct firmware for your exact model and follow the instructions. The risk is a bricked router if you use wrong firmware or lose power mid-flash. Many routers have a recovery mode to undo a bad flash.

Can I use a free VPN service with my router? Technically yes, but most free VPNs don’t provide OpenVPN or WireGuard config files, and their speed and privacy are poor. Paid VPNs are almost always required for router setup.

Related

• iPhone vs Cell Phone: Key Differences Explained
• Fix the Most Common macOS Catalina Problems
• Windows Spotlight Not Working on Windows 11? Fixes