A VPN on a router covers every screen in your home with one setup, including the smart TV and the game console that can’t run a VPN app. How fast it runs depends on the router’s processor: on GL.iNet’s Beryl router, WireGuard tops out at 91 Mbps and OpenVPN at 21 Mbps in the maker’s local tests. Here’s how to check your router, pick a provider and route only the TV.
Surfshark generates WireGuard configurations for routers right in your account, publishes guides for ASUS and FRITZ!Box, and doesn’t cap the number of devices.
SurfsharkBest value for moneyYes, if you have a TV or console without a VPN app and a router that can run a VPN client. No, if you switch countries often or rely on features from the VPN app.
The main win is coverage. ASUS puts it plainly: devices such as smart TVs, set-top boxes and Blu-ray players don’t support VPN software, and a router VPN reaches them all without installing anything. A router also saves device slots. NordVPN counts it as one of 10 devices, ExpressVPN as one connection, and Proton VPN allows routers even on its Free plan, as one connection however many devices sit behind it.
The trade-offs are practical. Proton notes that the router encrypts traffic between itself and the internet, not between your devices and the router. Changing the VPN location means updating the router configuration, and app features such as split tunneling or NetShield may be missing. Speed depends on the router’s processor.
Don’t confuse this with a VPN server. A VPN server, which the FRITZ!Box and the Freebox can also run, is for remote access: your phone connects back home from outside. Streaming needs a VPN client that connects the router out to the provider’s servers.
Open your router’s admin page or app and run through this list:
Look for a VPN client section with OpenVPN or WireGuard. Proton says a router needs one of the two as a client.
Skip any menu that only sets up a VPN server. That’s remote access, not streaming.
Search your model’s manual or support site for “VPN client.”
Check your provider’s router guides. NordVPN’s list includes ASUS, GL.iNet, MikroTik, OpenWrt, pfSense, TP-Link and DD-WRT, among others.
No VPN client on stock firmware? You could install new firmware (known as flashing), but Proton calls it difficult, so a second router is usually easier. On TP-Link routers, NordVPN has a quick WireGuard setup with a token from your account, and the router uses one of your 10 device slots.
NordVPNLightning-fast streamingMost routers from internet providers don’t support VPN setups, according to NordVPN, Proton and Surfshark. NordVPN names routers that won’t work with its service on native firmware, including Spectrum, Xfinity, Verizon, AT&T, eero, Orbi and Netgear. PIA says mesh systems and modem-router combos are generally not supported, and Surfshark lists Google WiFi.
eero supports VPN passthrough: a VPN app on your laptop works through it, but there’s no network-wide VPN. eero suggests a VPN router between the modem and the eero.
Virgin Media, Sky and BT hubs aren’t on these lists. Check the admin menu for a VPN client; most ISP boxes don’t have one, and a second router behind the box solves it. Surfshark adds that Vodafone and BT often enable content filters by default that can block a VPN: turn off Safe Content, Parental Controls or Secure DNS.
Buying a router for this? For streaming, the last column matters most: can only some devices use the VPN?
Brand | VPN client | Only selected devices |
|---|---|---|
TP-Link | OpenVPN, PPTP, L2TP/IPSec; WireGuard on select models | Yes, Device List |
ASUS (VPN Fusion) | WireGuard on firmware later than 3.0.0.4.388.23000 | Yes, per device |
GL.iNet | OpenVPN, WireGuard | Yes, by MAC address |
Synology SRM | PPTP, L2TP/IPSec, OpenVPN | Not stated |
MikroTik | WireGuard in RouterOS | Not stated |
FRITZ!Box | WireGuard to a VPN provider | Yes, on some models |
Source: manufacturers’ help pages and spec sheets, checked October 19, 2026 | ||
TP-Link stores up to six VPN profiles but runs one at a time. ASUS VPN Fusion connects to several VPN servers at once and lets you assign each device to its own tunnel.
The router’s single processor handles encryption for every device in the house, as ExpressVPN points out. WireGuard is lighter: CyberGhost notes it uses less memory and CPU than some older protocols. GL.iNet publishes top speeds from its own local network tests.
WireGuard top speed by GL.iNet router | Mbps |
|---|---|
Flint 2 | 900 |
Slate AX | 550 |
Slate 7 | 490 |
Beryl AX | 300 |
Slate Plus | 170 |
Beryl | 91 |
Opal | 65 |
Source: GL.iNet, maker’s local network tests, October 19, 2026 | |
OpenVPN maximums from the same tests: Opal 21 Mbps, Slate Plus 28, Beryl 21 and Beryl AX 150. Models with OpenVPN DCO support close the gap: Slate 7 reaches 385 Mbps, Slate AX 560 and Flint 2,880. GL.iNet adds that real-world speeds may differ.
If your router feels slow, PIA suggests a speed test without the VPN first, a closer server and a check of CPU and memory load. With OpenVPN, pick UDP. AES hardware acceleration also helps.
Want hardware built for the job? ExpressVPN’s Fortify, a co-branded GL.iNet Flint 2, reaches up to 900 Mbps on WireGuard and counts as one connection.
ExpressVPNGreat for streamingAll seven work on some routers. The difference is the protocol and how much of the setup is done for you.
VPN | On a router |
|---|---|
NordVPN | OpenVPN; NordLynx on select setups; TP-Link quick setup; router uses 1 of 10 slots |
Surfshark | OpenVPN, WireGuard; built into TP-Link’s Deco app; unlimited devices |
ExpressVPN | WireGuard on Fortify; Fortify router; counts as 1 of 10 to 14 connections |
Proton VPN | OpenVPN, WireGuard; works on the Free plan as 1 connection; 10 devices on Plus |
Private Internet Access | OpenVPN only; guides for DD-WRT, OpenWrt, AsusWRT, pfSense, FreshTomato; unlimited devices |
CyberGhost | OpenVPN only; guides for DD-WRT and FreshTomato; 7 devices |
IPVanish | WireGuard via config generator; unlimited devices |
Source: providers’ official websites and help centers, checked October 19, 2026 | |
NordVPN needs an OpenVPN client on the router and lists the FRITZ!Box as unsupported on native firmware. Its WireGuard-based NordLynx comes via TP-Link’s quick setup and the Privacy Hero 2 router, but not on ASUS models like the RT-AX86U. ExpressVPN’s app for third-party routers no longer receives security updates, and Aircove is being retired in favor of Fortify.
These steps follow the WireGuard route. Menu names differ by brand.
In your VPN account, generate a WireGuard configuration for a router and pick a server in the streaming service’s country.
Download the configuration file.
In the router’s admin page, open the VPN client section and add a WireGuard profile.
Upload the file, or paste the keys if the router asks for them.
Choose which devices use the tunnel: the whole network or only the TV and console.
Connect, then check from a device on the tunnel that your IP address shows the chosen country.
On a FRITZ!Box, you’ll find it under Internet > Permit Access > VPN (WireGuard). FRITZ! notes that only IPv4 traffic goes through the tunnel and the guest network stays outside; Surfshark’s guide lists FRITZ!OS 7.39 or later.
No VPN client on your ISP box? Keep it as the modem and connect a VPN-capable router to it. ExpressVPN describes this gateway, such as a travel router, sitting between the modem and the main router or running its own Wi-Fi. Devices on it use the VPN, the rest connect normally.
IPVanish says router-behind-router works only in certain situations and advises static IPs on both routers, the second router in the first one’s DMZ, a different DHCP range on the second router and QoS off on the first.
Routing by device keeps laptops and video calls on your normal connection while the TV streams from another country:
TP-Link: only devices you add to the Device List use the VPN.
ASUS VPN Fusion: assign each device to a VPN profile.
GL.iNet: rules by MAC address, with a kill switch.
FRITZ!Box: an option for only certain devices, available on some models, per Surfshark.
ExpressVPN routers: every device uses the VPN by default, and Device Groups let some of them bypass it.
Turn on a kill switch where the router offers one. ExpressVPN notes that if a router VPN drops, devices can silently fall back to the regular connection. GL.iNet’s kill switch blocks internet for the chosen devices instead.
Consoles can’t run a VPN app. NordVPN says you can’t download it on PlayStation or Xbox, and CyberGhost confirms consoles don’t support VPN apps. That leaves the router, or a Windows PC that shares its VPN connection as a mobile hotspot.
If you go the router route, Proton VPN is an easy place to start: it works on every plan, including Free, where the router counts as one connection, and Proton has WireGuard guides for AsusWRT, MikroTik and OpenWrt.
ProtonVPNTop-tier securityCheck that the tunnel is up on the router’s VPN status page.
Check that the server is in the service’s country. A new country means a new configuration in the router.
Make sure the TV is on the list of devices routed through the VPN.
Keep the TV’s own region setting on the country you’re actually in. LG says the region should match your location.
On Vodafone or BT, switch off the content filters described above.
Netflix showing a proxy message? Our guide to the Netflix proxy error covers the next steps.
A router makes sense when you own it and it has a VPN client. With an ISP box, or when only one TV needs the VPN, a streaming stick with a VPN app is quicker: Android TV, Fire TV or Apple TV. Our guide to a VPN on a Firestick walks through that route, and the guide to a VPN on a smart TV helps you choose by TV system.
Casting doesn’t carry a phone’s VPN to the TV. With Google Cast, the receiver (a Chromecast or the TV) fetches the stream from the service itself, and the phone only sends commands.
Set the tunnel once on the router and the TV, console and streaming stick all use it. Surfshark is a good match here, with WireGuard keys for the router in your account and no device limit.
The same account also covers your phone and laptop. Surfshark, Private Internet Access and IPVanish don’t limit the number of devices, while NordVPN allows 10, Proton VPN 10 on its Plus plan and CyberGhost 7.
Using a VPN is legal in the EU, and you keep paying for your subscriptions as usual. Before you pick a server country, see which services are available where: our list of streaming platforms covers them, and the guides to US streaming services from anywhere and UK streaming services from anywhere help when you live abroad or travel for a few weeks. The Netflix availability and BBC iPlayer pages go into each service.
Still choosing a provider? Our VPN comparison and the NordVPN vs Surfshark comparison follow our review methodology, and the Surfshark review, NordVPN review, Proton VPN review and Private Internet Access review cover each service in detail. Following your team on the road? Read our guide to using a VPN to watch football abroad. New to this? Our explainer on VPN for streaming covers how it works and what it changes.
Yes, if the router has a VPN client that supports OpenVPN or WireGuard. Many ASUS, TP-Link and GL.iNet routers do, and so do current FRITZ!Box models. Most routers supplied by internet providers don’t, and then a second router or a streaming stick is the way around it.
The router is better for TVs and consoles that can’t run a VPN app, and it saves device slots: NordVPN counts a router as one of 10 devices. An app is better when you switch countries often or want features like split tunneling, which may not be available on a router.
It can, because the router’s processor encrypts traffic for every device. In GL.iNet’s local tests, WireGuard maximums range from 65 Mbps on the Opal to 900 Mbps on the Flint 2. On routers without OpenVPN DCO, WireGuard is the faster choice: the Beryl AX reaches 300 Mbps with WireGuard and 150 Mbps with OpenVPN.
Look in the admin page for a VPN client section with OpenVPN or WireGuard. A menu that only sets up a VPN server is for remote access and won’t route streaming. Your VPN provider’s list of router guides is a quick second check.
NordVPN lists Xfinity routers as unsupported on native firmware. Virgin Media and Sky hubs aren’t covered by provider lists, so check the admin menu for a VPN client; most ISP boxes don’t have one. A VPN router connected behind the hub is the usual way around it.
Passthrough means the router lets VPN traffic from your devices pass through, so a VPN app on a laptop or phone still works. It doesn’t put the whole network on a VPN. eero, for example, supports passthrough but offers no network-wide VPN.
Use VPN Fusion: add a WireGuard client profile, click Upload Config to add the configuration file from your VPN provider, then assign the devices that should use it. ASUS supports WireGuard on firmware later than 3.0.0.4.388.23000, and NordVPN notes that most ASUS routers also have a built-in OpenVPN client.
Not with an app, since Xbox and PlayStation don’t support VPN apps. You can put the VPN on your router and route the console through it, or share a VPN connection from a Windows PC as a mobile hotspot.
The CyberGhost Halloween deal cuts the 2-year plan to €2.19 a month, 82% off, with 2 extra months included. Here are the plan prices, the November 3 deadline, the renewal price and how refunds work.
The cheapest VPN for streaming in 2026 is PIA at $2.03 a month, with IPVanish and CyberGhost close behind. See what each VPN costs per month, up front and after renewal, and which cheap VPN is best for streaming.
NordVPN is the best VPN for Netflix in 2026 with a StreamFix score of 9.6 out of 10, ahead of Surfshark and ExpressVPN. Here is the full ranking of 7 VPNs, how to set one up on your phone or TV, and the Black Friday deals running now.
