Running a VPN on the router rather than on each device sounds tidy: every device covered, nothing to install, including televisions and consoles that cannot run a VPN app. It also has real costs, and understanding them before setting it up saves an evening of confusion later.
The short answer
A router VPN covers every device on the network, including ones that cannot run an app. The costs are a significant speed reduction, because most home routers lack the processing power to encrypt at full line speed, and that some services block VPN traffic outright. Split tunnelling, where only chosen devices use the VPN, is usually the better arrangement.
What you gain
- Every device covered, including smart televisions, consoles and smart home hardware that cannot run VPN software.
- Nothing to install or maintain on each device.
- Guests covered automatically, without asking them to install anything.
- One subscription connection rather than using up device slots on a plan.
What it costs
- Speed. The main one. Encryption is processor-intensive and most home routers can manage only a fraction of their normal throughput with a VPN running. A 500 Mbps connection can drop below 100.
- Streaming services blocked. Most detect and block VPN traffic, and you will find content unavailable or an error message that does not explain itself.
- Banking and shopping sites flagging the connection as suspicious, sometimes locking accounts temporarily.
- Local discovery breaking. Casting, printing and smart home control often stop working, because they depend on devices seeing each other on the local network.
- Harder troubleshooting. When something does not work, the VPN is now a suspect in every problem.
- A single point of failure. If the VPN connection drops and the router is configured to block traffic when it does, the whole house is offline.
Check your router supports it
Many consumer routers cannot run a VPN client at all. Check the specification for OpenVPN or WireGuard client support, not just pass-through, which is different and only allows a device’s own VPN to work.
Prefer WireGuard if available
It is substantially faster and less processor-intensive than older protocols, which matters enormously on router hardware. If both your router and your provider support it, use it.
Measure your speed before setting it up
On ethernet, directly into the router. You will want this number to compare against, because the drop is usually the thing people are unprepared for.
Get the configuration from your provider
Most publish router setup guides and downloadable configuration files per server location. Use their instructions for your specific router model rather than generic advice.
Set up split tunnelling if your router supports it
This is the arrangement worth having: only chosen devices route through the VPN and everything else connects normally. Streaming devices, smart home hardware and consoles stay off it, which avoids most of the problems above.
Configure the kill switch deliberately
A kill switch blocks traffic if the VPN drops, which is the point of it. Understand that this means the whole house loses internet when the VPN has a problem, and decide whether that is what you want.
Measure your speed again
Compare with the baseline. If the drop is unacceptable, the router is the limit, and the answer is either a more capable router or running the VPN on individual devices instead.
Test everything before relying on it
Streaming apps, casting, printing, smart home control, banking. Find out what breaks while you still remember you changed something.
If a service stops working after setting up a router VPN, the VPN is almost certainly the cause and you may not connect the two events days later. Write down what you changed and when, because a router VPN turns into a suspect in every subsequent network problem and people waste hours before remembering it is there.
The speed problem in detail
Encryption is mathematics and mathematics needs a processor. A phone or a laptop has plenty of capacity and barely notices. A home router has a modest processor designed for routing rather than encrypting, and it becomes the bottleneck immediately.
Typical outcomes: an inexpensive router may manage 20 to 50 Mbps with a VPN running regardless of your line speed. A capable router with hardware acceleration may reach 200 to 400. Almost none will sustain a gigabit connection. Newer protocols help considerably, which is why WireGuard support is worth looking for.
Split tunnelling is the arrangement most people actually want. Route the devices where privacy matters through the VPN, and let televisions, consoles and smart home devices connect normally. You get the benefit where you want it without breaking streaming, casting and local discovery across the whole house.
When a router VPN makes sense
- You want every device covered including ones that cannot run an app.
- Your connection is modest enough that the speed reduction does not matter.
- Your router genuinely supports a modern protocol with reasonable performance.
- You are comfortable troubleshooting the extra layer.
When it does not: a fast connection you want to use fully, heavy streaming, a house full of smart home devices that need local discovery, or a router without proper client support.
Will a router VPN slow my internet?
Substantially, in most cases. Home routers lack the processing power to encrypt at full line speed, and a fast connection can drop to a fraction of its normal throughput.
Why do streaming services stop working?
Most detect and block VPN traffic. The error message rarely explains that, which is why people spend a long time troubleshooting the app instead.
What is split tunnelling?
Routing only chosen devices through the VPN while everything else connects normally. It is usually the better arrangement, because it avoids breaking streaming, casting and local discovery.
Does my router support a VPN?
Check for OpenVPN or WireGuard client support specifically. VPN pass-through is a different and much more limited feature that only allows a device’s own VPN to work.
Will casting and printing still work?
Often not, because they depend on devices discovering each other locally and a VPN interferes with that. Split tunnelling avoids the problem by keeping those devices off the VPN.
The bottom line
Measure your speed before and after, because the drop is the thing most people are unprepared for and it can be severe. Use WireGuard if your router and provider support it, and set up split tunnelling so only the devices that need it are routed through. And write down that you did this, because a router VPN becomes a suspect in every network problem you have afterwards.
