🛡️
One tunnel, whole home
Every device that joins the network is inside the tunnel automatically — no apps to install, no per-device setup, nothing for guests to configure. Devices that cannot run VPN software at all are covered too.
Guides
Running a VPN on your router
Putting the VPN tunnel on your router protects every device on the network at once — including TVs, consoles, and smart speakers that cannot install apps. The trade-offs are real: throughput is limited by the router's CPU, the whole house exits through one country, and troubleshooting gets harder. This guide explains the setups and how to decide.
🌍
The router's CPU is the ceiling
Encryption runs on the router's processor, and consumer routers have weak ones. A connection that does hundreds of megabits through an app on a laptop can drop to a fraction of that through the same router.
🔑
There is more than one way
A firmware with a built-in VPN client is not the only option. A small computer acting as a gateway, or a second router behind the main one, achieves the same result with different trade-offs — and no flashing.
Why put the tunnel on the router at all
Because some devices simply cannot run a VPN app. Smart TVs, game consoles, streaming boxes, smart speakers, and most IoT gadgets have no way to install client software, so the only path to routing their traffic through a tunnel is doing it upstream — on the router they connect through. Everything behind the router inherits the tunnel without knowing it exists.
There is also a practical bonus for device limits: the network behind a router counts as a single connection to the VPN service. On Aurora, a subscription covers up to 7 devices, and a router occupies one slot no matter how many gadgets sit behind it.
What you pay for it: speed
The tunnel's encryption now runs on the router's processor, and that becomes the bottleneck long before your internet plan does. Consumer routers use small, low-power chips: OpenVPN, heavy and single-threaded, often tops out at a few tens of megabits on such hardware. WireGuard is much lighter and reaches several times more on the same chip, but a cheap router still will not saturate a fast fiber line.
Latency suffers less than bandwidth, so browsing and video calls usually feel fine. The pain shows up in large downloads, cloud backups, and 4K streams — all of them competing for the same small CPU at once. Before committing, check what your router's processor can realistically encrypt, and prefer WireGuard over OpenVPN wherever the choice exists.
What you pay for it: flexibility and debugging
The whole house now exits through one country. A per-device app lets your laptop sit in one location while your TV uses another; with a router tunnel, changing the exit country changes it for everyone at once. Banking sites, delivery apps, and anything sensitive to location will see the same foreign address on every device in the home.
Troubleshooting also gets harder. When a page will not load, the question is no longer just is my internet down — it could be the ISP, the router, the tunnel, or the VPN server, and the symptoms look identical. Keeping a quick way to take the tunnel out of the path, such as a separate untunneled network, turns an evening of guessing into a two-minute check.
Option one: a router whose firmware runs the client
Some routers can run a VPN client natively — either the manufacturer's stock firmware includes one, or the hardware is supported by community firmware that adds WireGuard and OpenVPN clients. You enter the server address and keys in the admin panel, and the router builds the tunnel itself. This is the tidiest setup: one box, no extra hardware.
The catch is compatibility and risk. Not every model supports third-party firmware, flashing can void a warranty or, done carelessly, brick the device, and stock firmwares vary widely in which protocols they accept. Rather than chasing a specific model, check the principle: does this router's firmware, stock or community, support the protocol your VPN uses — ideally WireGuard — and does the CPU have headroom for it.
Option two: a separate machine as the gateway
Instead of making the router encrypt, put a small computer — a mini-PC or a single-board machine — on the network, run the tunnel there, and point devices at it as their gateway. The router keeps doing what it does well, and the tunnel gets a far stronger CPU: even a modest x86 mini-PC encrypts WireGuard at speeds no consumer router approaches.
The cost is one more box to power and maintain, and some networking know-how: the gateway must forward traffic and be set as the default route. In exchange you get easy debugging — remove the gateway from the path and the network reverts to direct — and a full operating system that runs whatever client and rules you want.
Option three: a second router behind the main one
Keep your existing router untouched and connect a second one behind it; the second router runs the tunnel and broadcasts its own Wi-Fi network. Now the home has two networks: join the first and you are direct, join the second and you are inside the tunnel. Moving a device between them is just switching Wi-Fi.
This is the easiest setup to reason about and the safest to experiment with — a mistake on the second router never breaks the household internet. The trade-offs are double NAT, which occasionally confuses game consoles and port-dependent apps, and the same CPU ceiling as option one, since the second router still does the encrypting.
Which devices go through the tunnel: split routing
You rarely want every device tunneled. Policy-based routing lets the router decide per device — usually by its local IP or MAC address — whether traffic enters the tunnel or goes out directly. A typical split sends the TV and a work laptop through the tunnel while latency-sensitive consoles and smart-home hubs stay direct.
Three things make a split reliable:
- Give tunneled devices static local addresses, so a lease change does not silently move a device out of the tunnel
- Decide where DNS goes for each group — a direct device using the tunnel's resolver, or the reverse, produces confusing half-tunneled behavior
- Test each group after setup: check the visible IP address from a tunneled device and from a direct one, not just from the one you configured
Frequent questions
Will a VPN on the router slow down my whole network?
It slows only traffic that goes through the tunnel, and by how much depends on the router's CPU and the protocol. Local traffic between devices is untouched. With WireGuard on a capable router the loss can be modest; with OpenVPN on a cheap one, expect a ceiling of tens of megabits shared by everyone tunneled.
Does a router count as one device on my subscription?
Generally yes — the VPN service sees one connection from the router, regardless of how many devices sit behind it. On Aurora the router takes one of the 7 device slots. The flip side of that single tunnel is that every device behind it shares one exit location.
Can I keep some devices off the tunnel?
Yes, that is policy-based routing: the router sends traffic into the tunnel or directly depending on which device it came from, usually matched by local IP or MAC address. Firmware support varies. The two-router setup achieves the same with zero configuration — devices choose by joining the tunneled or the direct Wi-Fi network.
Is a router VPN better than apps on each device?
They solve different problems. Apps give each device its own exit location, per-device kill switches, and easy toggling — better for laptops and phones. The router covers devices that cannot run apps and gear you want protected permanently. Many homes use both: a router tunnel for fixed devices, apps on portable ones.
What happens to streaming boxes and TVs behind a router VPN?
They work, but streaming services recognize the address ranges of commercial servers and may refuse to play or limit their catalog. No provider can honestly promise otherwise. If a TV misbehaves behind the tunnel, split routing lets you take just that device out while keeping the rest of the network covered.
What should I check before setting any of this up?
Four things: whether your hardware supports the protocol you plan to use, ideally WireGuard; how much throughput its CPU can encrypt; whether you can quickly bypass the tunnel for debugging; and which devices actually need tunneling, so the split is planned rather than improvised.
Keep reading
VPN for travel
On the road, a VPN encrypts your traffic on hotel and airport Wi-Fi, keeps your accounts looking like they connect from a familiar country, and reaches services that behave differently abroad. It is not a cure-all: streaming platforms detect server addresses, and local rules vary by country. The one rule that matters most — set everything up and test it before you leave.
What is a VPN
A VPN (virtual private network) builds an encrypted tunnel between your device and a remote server, and your traffic exits to the internet from that server. Your internet provider stops seeing which sites you visit, and websites see the server's IP address instead of yours. It is a privacy tool, not an invisibility cloak.
Choosing a VPN
Choosing a VPN comes down to a few verifiable facts: what the logging policy actually says, where the company is incorporated, which protocols it runs, whether it owns its servers, and what renewal really costs. Marketing claims like "military-grade encryption" carry no information — every serious VPN uses the same algorithms.