Set Up a VPN on Your Router (WireGuard)

Running a VPN on your router protects every device on the network at once: phones, smart TVs, consoles, and the smart-home gadgets that have no VPN app of their own. It is also the cleanest way to reach your home network from anywhere. The two things most guides skip are why WireGuard, not OpenVPN, is the right protocol on home hardware, and the DNS leak that quietly undoes the whole setup.

Key takeaways

• A router VPN covers every connected device, including TVs, consoles, and IoT gadgets with no VPN app.
• WireGuard uses a fraction of OpenVPN's CPU and is dramatically faster on home routers.
• You pick a client (route your traffic out for privacy) or a server (reach home remotely), and some routers do both.
• Set the router's DNS to the VPN's servers or a private resolver, or DNS queries leak to your ISP.
• Your router's CPU is the speed ceiling: a weak processor caps VPN throughput no matter how fast your internet is.

Choose WireGuard over OpenVPN

If your router firmware supports it, pick WireGuard. The difference is not subtle. WireGuard is roughly 4,000 lines of code versus OpenVPN's hundreds of thousands, uses modern fixed cryptography, and runs in the Linux kernel, so it spends far less CPU per packet. On a resource-limited home router that translates directly into higher speeds. Modern firmware on ASUS, TP-Link, OpenWrt, DD-WRT, and AsusWRT-Merlin all support WireGuard. Reserve OpenVPN for the case where your specific provider or router genuinely lacks WireGuard.

Real-world speed difference

The gap shows up most on cheap routers because their CPUs are the bottleneck. Rough, representative throughput on typical consumer hardware:

Router class (example CPU)	OpenVPN throughput	WireGuard throughput
Budget (dual-core ~880 MHz)	30-60 Mbps	150-250 Mbps
Mid-range (quad-core ~1.5 GHz)	80-150 Mbps	300-500 Mbps
High-end / Wi-Fi 6 (quad-core 1.8 GHz+)	150-300 Mbps	600 Mbps to near gigabit

Numbers vary by model and provider, but the pattern holds: WireGuard typically delivers two to four times the speed of OpenVPN on the same router because encryption is what saturates these CPUs.

Option A: Run a VPN server to reach home

This lets you connect back to your home network from a laptop or phone anywhere, as if you were on your home Wi-Fi.

1. Log in to your router admin page (often 192.168.1.1 or the brand's app).
2. Find the VPN Server section and enable WireGuard.
3. Click Add to create a client profile for each device that will connect.
4. Export or scan the generated config / QR code into the WireGuard app on your phone or laptop.
5. Connect from outside your home and confirm you can reach local devices.

Option B: Run a VPN client for privacy

To route all your home traffic through a commercial VPN provider, you configure the router as a VPN client instead. Download the provider's WireGuard config (.conf) or OpenVPN file (.ovpn) from their manual-setup section, then in the router's VPN client settings import that file and connect. Every device behind the router now exits through the VPN.

Server or client: which do you actually want?

People conflate these two, then wonder why the setup does not do what they expected. They solve opposite problems.

You want to...	Set up a...	What it does
Reach your home network, files, or cameras while traveling	VPN server	Your phone or laptop tunnels back into your LAN
Hide your home traffic from your ISP / change your exit IP	VPN client	Every device exits through a commercial provider
Both (on capable routers)	Server and client policies	Inbound access plus outbound privacy, routed separately

If you only want privacy, you do not need a server, and exposing one needlessly just adds an inbound entry point to lock down.

Fix speed and connection problems

If the VPN feels slow, try these in order:

Symptom	Likely cause	Fix
Much slower than your plan	Router CPU maxed by encryption	Switch OpenVPN to WireGuard; if already on WireGuard, the CPU is the ceiling
High latency / lag	Distant exit server	Pick a geographically closer VPN server
Frequent drops on OpenVPN	TCP retransmission overhead	Switch the OpenVPN config from TCP to UDP
Works but sites still see your ISP	DNS leak	Set router DNS to the VPN's servers or 1.1.1.1
Cannot reach home remotely	Server port not forwarded / CGNAT	Forward the WireGuard UDP port; if on CGNAT, the server route will not work

That last row catches a lot of people: many ISPs put home connections behind carrier-grade NAT (CGNAT), which means there is no public address to connect back to, and a VPN server simply will not be reachable from outside.

Before adding a VPN, harden the rest of the device with our secure home router checklist, and if you want filtering for kids on the same router, see setting up parental controls on your router. If your goal is unblocking streaming libraries specifically, our VPN and streaming geo-restrictions explainer covers why a router VPN sometimes gets flagged.

What to do right now

• Check your router's admin page for a VPN section; if it lists WireGuard, you are set.
• Decide server vs client based on the table above before configuring anything.
• For a client, download your provider's WireGuard .conf from their manual-setup page and import it.
• Immediately set the router's DNS to the VPN's resolvers (or 1.1.1.1) to close the leak.
• Run a DNS leak test from a device behind the router and confirm only the VPN's servers appear.
• If reaching home from outside fails, verify you are not behind CGNAT before troubleshooting further.

Frequently asked questions

Should I use WireGuard or OpenVPN?

WireGuard, in almost every case. It is faster and lighter on router CPUs while remaining secure. Reserve OpenVPN for situations where your provider or hardware does not support WireGuard.

What is the difference between a VPN server and client on a router?

A server lets you connect into your home network from outside. A client routes your home's outbound traffic through a commercial VPN for privacy. They solve different problems, and some routers can do both.

Why is my VPN connection so slow on the router?

VPN encryption is CPU-heavy, and many home routers have weak processors. Switch to WireGuard, pick a closer server, and if speeds are still poor, the router's CPU is simply maxed out.

How do I stop DNS leaks?

Point the router's DNS at your VPN provider's DNS servers, or a privacy-respecting resolver. This keeps DNS lookups inside the encrypted tunnel instead of going to your ISP.