What it means to run the router as a VPN
When the router runs the VPN client, every device on its Wi-Fi uses the tunnel without an app of its own. That is the only way to cover a Roku, most smart TVs, game consoles and guests' phones. It also means one place to update and one place to troubleshoot. The catch is that the router has to be able to run a VLESS client at all.
What the router needs
- Firmware that can run third-party software; OpenWrt is the common choice.
- A VLESS-capable client for that firmware; OpenWrt's package list includes both sing-box and xray-core.
- Storage to spare: OpenWrt lists xray-core at about 8 MB installed, more than some small routers have free.
- A processor fast enough to encrypt traffic at your internet speed.
The usual route
- 1
Look up your router model in OpenWrt's table of supported hardware.
- 2
Back up the current settings, then install OpenWrt; this can void the warranty.
- 3
Install the sing-box or xray-core package.
- 4
Configure the client with your key, following the package's documentation.
- 5
Make sure DNS requests also go through the tunnel.
- 6
Test from a TV or a phone on the Wi-Fi with an IP check.
Why the router's built-in VPN is not enough
Many stock routers already have a VPN client in their settings. Those clients usually speak OpenVPN or WireGuard, the protocols most commercial VPNs for routers ship as configuration files. A VLESS key needs a different client, sing-box or Xray, and stock firmware does not include either. That is why the usual route goes through OpenWrt rather than the router's own menu.
If your router cannot run it
Keep the provider's router and add a small OpenWrt router behind it. Plug it into a free port, run the key on it, and connect only the devices that need the tunnel, such as the TV and the console, to its Wi-Fi. Everything else stays on the provider's network. Routers and VPN setups like this are easy to undo: unplug the second router and you are back where you started.
Trade-offs for a whole household
Everything in the house now goes through one tunnel, including the streaming apps that refuse VPN addresses. Plan exceptions from the start: most router clients can send chosen devices or sites around the tunnel. Speed depends on the router's processor, and a cheap router may top out well below a fast home connection. When something breaks, every device in the house notices at once. Set aside an evening for the first setup.
Is the router route for you?
- You have screens that cannot run a client, like a Roku or a smart TV.
- You are comfortable flashing firmware and editing a configuration.
- Your router model is supported by OpenWrt and has storage to spare.
- You can live with one setup affecting the whole house.
Sources
- OpenWrt package: sing-boxchecked 2026-10-03
- OpenWrt package: xray-corechecked 2026-10-03
Questions
Can my provider's router run a VPN?
Usually not. Provider routers rarely accept third-party software.
What are the best routers for a VPN?
Look for OpenWrt support, plenty of storage and memory, and a processor strong enough for your plan's speed.
Do I still need apps on my phones?
Not at home. Phones need their own client once they leave the house.
Can I keep one TV outside the tunnel?
Yes, if the router client supports rules by device, as most do.
Is a travel router an option?
Yes. A small router running OpenWrt can carry the key to a hotel room and cover a TV stick there.
Will a router tunnel slow my internet?
It depends on the router's processor. A fast plan on a cheap router can lose a lot of speed.
Can I undo it?
Yes. Flash the original firmware back, or, with a second router, simply unplug it.