A VPN on Your Router: How to Set It Up and Which Router Fits

In short: you can set the connection up once on the router — and then every device in the house goes through it, including the ones with nowhere to install an app: the TV, the console, the smart speaker. Buying a new router is usually unnecessary — the question is not the price of the device but what its firmware can do. Below: how to tell whether your router will do, what to do if it will not, and where to go next for your brand.

First: two different jobs with the same name

The phrase “set up a VPN on the router” means two opposite things, and half the guides on the internet answer the wrong one. Worth sorting out before you configure anything: mix them up and you lose an evening.

⚠️ The guides on manufacturer sites — TP-Link, ASUS, Keenetic — are mostly about the second job: “how to run a VPN server on your router”. They will not help if you need the first. The tell is simple: if the guide talks about “access to your home network from the internet” and “port forwarding”, it is the wrong one.

⚠️ And separately: the second job almost always needs a public IP, and most home ISPs do not hand one out — instead you get an address shared with many subscribers. That is another reason manufacturer guides do not work for people.

---

The practical steps are below; if you'd rather skip the setup, Tainet connects in a couple of minutes - through the Telegram bot or in your account on this site.

Why set it up on the router

The usual route is an app on every device: on the phone, on the laptop, on the tablet. It works, but it has two inconveniences. First: you have to remember to switch it on every time. Second, and more important: a noticeable share of the hardware in a home cannot run apps at all.

The router closes the question entirely: it sits at the entrance to the house, and everything that joins the home network goes through it. Set it up once and you stop thinking about it.

There is a downside, and here it is honestly: by default all home traffic goes through the tunnel, not just the part you need. Selective routing fixes that — more on it below — but not on every model.

The subscription is the same one either way: the link you paste into the app on your phone fits the router too. If you do not have one yet, you can get it in the Telegram bot or in your account on this site — then follow the guide for your brand.

Which router fits

First, one word without which nothing below makes sense. Firmware is the program inside the router, its own workings: the thing that draws the settings page and decides what the router can and cannot do. The manufacturer puts it there, and it updates separately from everything else.

Now the main point, and it is not what most reviews write: the question is not whether the router supports a secure connection. Almost all of them do, even the inexpensive ones.

The question is whether it takes the settings in full. In the file the service hands you, besides the ordinary lines with the address and the key there are several more — they are what keeps the connection steady. Stock firmware does not understand them: it reads the beginning of the file and silently skips the rest. The router shows no error while doing it: the connection looks created, but it will not work — or it will run for a few minutes and break.

⚠️ You cannot delete those seemingly redundant lines to “make it fit”. Without them what remains is an ordinary connection, and that one does not work — they are the whole point.

Hence the split that makes sense in practice.

Works right away, no firmware change needed

Three brands understand the file in full — all you need is a recent version of their own firmware.

💡 About Keenetic and Netcraze. These are the same routers under two names: since 2025 the hardware for Russia ships under the Netcraze brand, with the same workings inside. If yours is a Netcraze — read “Keenetic” everywhere, it all matches.

The order for them is this:

🔴 This has to be done in a browser on a computer: open 192.168.1.1 and configure it there. The Keenetic mobile app cannot upload a settings file at all — there is no such option in it. From a phone you can too, but the same way, through a browser: join your home Wi-Fi and open the same address.

Step by step — in the Keenetic guide and the MikroTik walkthrough.

Works, but the firmware has to be replaced

The factory program inside the router is replaced with another one, made by the community. After that the router understands everything it needs to.

🔴 What you check is not the model name but its revision. Manufacturers release the same model several times over, changing the workings while the name and the box stay the same.

The telling case is the Xiaomi AX3000T. There is an RD03 revision and an RD03v2 one. You cannot tell them apart from the outside, the processors inside differ, and the second one is not supported. 💡 You can tell right in the shop: on the unsuitable revision the barcode ends in 706330 and the article number is DVB4510CN.

⚠️ Enthusiasts have put together their own firmware build for that revision. It exists, but it is not the same thing as official support: it updates separately and not always.

⚠️ And the thing almost nobody writes about: routers with little built-in memory have no chance at all. If it is 4 megabytes, OpenWrt does not go on such a router, and no ready builds exist for it — whatever a search turns up for such a query is beside the point. Of the common ones, that is how the TP-Link Archer C80 is built, for example.

🔴 A firmware change is irreversible, and a mistake can turn the router into a brick. Before you start:

• find your model and its revision on the official list of supported devices;
• connect the router to the computer with a cable and have a spare internet connection ready — the network goes away during the change;
• expect a warranty repair to be refused afterwards;
• save the settings and read the instructions to the end, not as you go.

⚠️ And plainly: if the router does not come back on after a firmware change, that is not something we can help with. Our support works with the connection, not with hardware repair.

Will not do

⚠️ One honest caveat. The step-by-step assistant in your account walks you through three routes by the hand: Keenetic, ASUS with Merlin and OpenWrt. For GL.iNet and MikroTik the settings come from the same place, but there is no step-by-step assistant for them — you configure those from our article.

💡 A router that does not fit is not a dead end, and you will not have to choose anything. The app on the devices themselves works with the same subscription: phones, computers, TVs and set-top boxes connect without any router at all.

And you do not have to pick the app yourself: name your device in the Telegram bot or in your account on this site — they will tell you what to install, give you the install link and add the subscription with one button. Nothing to copy by hand.

How to check your router in five minutes

Instead of hunting for your model in someone else’s lists, check it directly — faster and more accurate, because lists go stale while your router is right in front of you.

Step 1. Find the exact model name. Turn the router over: the sticker underneath carries the name and, next to it, the revision — a number like v3, v4 or rev. B. 🔴 The revision matters as much as the name: the same model is released several times over with different workings, and only some of those runs may fit.

Step 2. Open the settings. In a browser on a computer joined to the home network, type 192.168.1.1 or 192.168.0.1. The login and password are on the same sticker, if nobody changed them.

Step 3. See what brand your router is. From here everything is decided by the brand and the firmware version, not by the presence of some menu item.

⚠️ If you spotted the word WireGuard in the menu — that still means nothing. Routers that will not take the settings file in full have that item too: the setup runs to the end and there is no connection. Go by the brand and the firmware version, not by a menu item.

⚠️ And if all you found is “VPN server” — that is something else entirely: it lets you into your home from outside, and you need the opposite. The difference is covered at the top of this article.

Step 4. If nothing similar is there — check whether the menu has a firmware update section: support sometimes arrives in a newer version. Updating stock firmware is safe, unlike swapping it for a third-party one.

Step 5. If it is still empty after the update — your router either needs a firmware change or will not do at all. Both cases are covered above.

💡 The check costs nothing and breaks nothing: you only look at the menu without changing anything. Worth doing before any decision about hardware.

The ISP router

This is the most common situation: the router came with the connection, it sits there working, and what you can do with it is unclear.

The first thing to know: “an ISP router” is not a brand. Behind the operator’s logo come devices from different manufacturers — Sagemcom, Huawei, Eltex, ZTE, QTech, Sercomm, D-Link and others; a single large ISP hands out around fifty such models. So there is no general answer to “can it or not”: everything depends on the exact model standing in your flat.

Second: most of those devices run the operator’s firmware, not the manufacturer’s. It is assembled for the provider’s job — deliver internet and television — and it usually has no section for connecting to an outside service. Not because it was forbidden, but because the provider has no use for it.

How to check yours. Exactly like any other router: read off the sticker which model hides behind the operator’s logo, and find that brand in the table above. ⚠️ Looking for the word “WireGuard” in the menu is pointless for the same reason as with any other router: the presence of an item guarantees nothing.

⚠️ What to expect in practice: on some ISP models part of the settings is hidden, and the administrator password differs from the one printed on the sticker. If it will not let you in, or the section you need is missing, fighting the device further makes little sense.

🔴 The working answer is a second router behind the ISP one. The ISP router stays as it is and keeps doing its job; behind it you put any router from the ones that work right away — Keenetic, Netcraze or GL.iNet. Home devices join the second one. The scheme is common, breaks nothing and rolls back at any moment: unplug it and things are as they were.

The only thing to watch: the two routers must not hand out the same home network addresses. If both give out a 192.168.1.x network, devices get confused. It changes by one digit in the second router’s settings — to 192.168.2.x, for example.

If your router does not fit

Besides a second router there are two more routes, and both are cheaper.

An app on your devices. You install it on the phone and the computer, and the question is closed for everything except the TV and the console. Costs zero and takes five minutes: in the bot or in your account you pick your device, they show you the app you need and move the subscription over with one tap.

💡 If you would rather work through the apps yourself and compare them — there is an overview of VPN clients for every platform. But you do not need it just to make things work.

Sharing from a computer. A computer with the connection configured shares a network over Wi-Fi, and the console or the TV joins it. Also free, but it only works while the computer is on.

On 4G routers specifically. If there is no wired internet at home and you have a router with a SIM card, everything above applies the same way: what matters is the firmware, not the SIM. Keenetic and GL.iNet make models in 4G versions too. ⚠️ But remember the traffic allowance on your operator’s plan — the tunnel does not cancel it and consumes it just like ordinary traffic.

---

What this actually costs

Let us lay it out honestly, because reviews usually skip this part.

⚠️ The main mistake in the budget is spending on a router and then finding it does not fit. Wi-Fi speed, the number of antennas and Wi-Fi 7 support have nothing to do with this job. Only one thing matters: whether the firmware understands the settings file in full.

So the right order is: check the router you already have, then set the subscription up on your phone and confirm it works, and only then think about hardware.

⚠️ The models that appear in this article are examples, not buying advice: they show how one and the same brand comes both fitting and not. We deliberately give no full lists — line-ups change several times a year, and any such list goes stale faster than you can finish reading it. What you check is your own model, rather than looking for yourself in someone else’s roll.

What happens to speed and ping

Honestly: there will be a slowdown. By how much depends on three things, and the router is not the biggest of them.

There are several ways to connect, and on a router they differ in difficulty. Briefly, what is worth knowing:

⚠️ Plenty of numbers circulate about the speed of these ways, and we do not repeat them: on a home router the difference is more often decided by the router itself — its workings, not the choice of method. The only way to know is to measure it on your own hardware.

The practical consequence: if the router is many years old and barely handles ordinary Wi-Fi, a tunnel will not make it faster. Testing is cheap — configure it and measure the speed before and after.

If you need both speed and the connection at once, selective routing helps: only the devices or addresses that need it go through the tunnel, everything else goes direct. On Keenetic this is built in; on OpenWrt and MikroTik it is done with routes. Simple models have no such option: there it is all or nothing.

⚠️ A practical note: selective routing is the thing worth choosing a model for. Without it, banking apps and work services ride through the tunnel too, which they do not need and sometimes suffer from.

The order of setup: the same for every brand

The details differ, but the sequence is one:

1. Look up the brand and version of your router. The name and the version are printed on the sticker underneath.
2. Find it in the tables above and work out which case is yours.
3. Get the settings — in the Telegram bot or in your account on this site. ⚠️ A router usually needs not a subscription link, as a phone does, but a separate settings file — and it is specific to each server: you choose a country and download the file for it. The assistant in your account walks you through the steps and gives you what you need. The subscription link comes in handy too, but only on one of the routes — through OpenWrt.
4. Open the router’s settings page — in a browser at 192.168.1.1.
5. Add the connection following the guide for your brand.
6. Check it. On any home device, open a site that shows your address on the network and confirm it changed.
7. Set up exceptions, if you need part of your devices to go direct.

💡 A tip that saves an evening: set the subscription up on your phone first and confirm it works. Then, while configuring the router, you will know the problem is the router and not the subscription. Debugging two unknowns at once is the worst way.

Problems and fixes

Not solving it — write to support, and we will advise on your exact model.

Frequently asked questions

How is setup on the router different from an app on the phone?

The app protects one device and has to be switched on. The router covers everything joined to the home network and works all the time. The subscription needed is the same one.

Do I need a separate router if I already have the ISP one?

Not necessarily, but it is usually simpler: the ISP router stays as it is and yours goes behind it. Nothing breaks and you can put it back any time.

One subscription for the router and the phone — is that allowed?

Yes, the subscription link is one. The router counts as a device just like a phone or a computer.

What should I choose on a router?

On a router the choice is simpler than it seems: you need AmneziaWG. It is the same connection, but assembled to hold up steadily — and its settings are exactly what stock firmware does not understand in full.

Ordinary WireGuard is simpler to configure, but in practice the connection comes out unsteady, so there is little point in it.

VLESS on a router is a separate story: it needs additional add-ons and noticeably more fiddling. People take it on when the first route did not work out for some reason.

💡 On a phone and a computer it is all different: there the app works out what to use by itself, and you choose nothing.

If I set it up on the router, do I still need apps on the phone?

At home, no. But outside the house the phone is not on your home network, so the app still comes in handy. One subscription covers both cases.

Will the router get very hot?

Encryption is computed by the router’s processor, so the load on it goes up. How much depends on the model: on older routers heat and a drop in speed are ordinary, and that is a sign the model cannot keep up. The only way to know is on your own device.

Can I do this if I know nothing about networks?

It depends on the router. If it is a Keenetic, a Netcraze or a GL.iNet — yes: it is all done with a mouse on the settings page, and our guides are written step by step. An evening with a tea break.

If the router needs a firmware change, or it is a MikroTik — honestly: without experience it will be hard. Text commands appear there, and the price of a mistake is higher.

💡 In that case there is an easier route with no risk: put the app on the devices themselves. The phone, the computer, the TV and the set-top box each connect separately, the setup takes five minutes and there is nothing to break. The subscription is the same one.

Is a router with “a VPN already set up” worth buying?

Such offers exist, and in themselves they are fine: you are paying for someone else’s evening of configuration. The only question is what exactly is included in the price. ⚠️ Find out three things in advance: whose subscription is inside and for how long, what happens when it runs out, and whether you can put your own in. If they answer reluctantly, that is your answer.

Will my ISP notice that I set up a connection on the router?

Your ISP sees the volume of traffic and that the connection is encrypted — the same as with an app on the phone. There is no difference between a router and a phone here.

Summary

The router is the most reliable way to connect what cannot run apps: the TV, the console, the speaker. Set up once, it then works by itself and does not depend on whether the computer is on.

The place to start is not a purchase but a check. The order is:

1. Confirm that what you need is a router as a client, not as a server — those are different jobs.
2. Look up the brand of your router and its firmware version, and find it in the tables above.
3. Keenetic, Netcraze, GL.iNet — open the guide and do it, an evening’s work. MikroTik — also possible, but be ready for text commands. ASUS and everything else — read the firmware-change warning first. An ISP router — put a second one behind it.