VPN on a router: why you need it, which routers work, and how to set it up

Why put a VPN on a router

The main benefit is setting it up once for everything connected to your home network. You don't have to install apps on every device or remember to turn them on.

• Tizen (Samsung) and webOS (LG) TVs, which don't support VPN clients. We cover other TV options in our article on VPNs for TVs.
• Game consoles: PlayStation, Xbox, and Nintendo Switch don't have VPN apps.
• Smart home devices: cameras, speakers, and sensors that lack network settings entirely.
• A family with a ton of devices: you won't have to configure five phones, two laptops, and a tablet individually.

Inside your home network, a router VPN doesn't protect you from much. If your laptop has a virus, the tunnel won't stop it. It encrypts traffic from your home to the VPN server, so your ISP only sees a connection to that server.

How a router VPN is worse than an app

Everything goes through the VPN, including local services

Banks, Gosuslugi (Russia's public services portal), marketplaces, and streaming services will see a foreign IP address. Some will show the wrong city, others will ask to confirm your login or deny access entirely. We explain why this happens in our article about banks and Gosuslugi with a VPN.

On a phone, you can easily exclude these apps from the tunnel. On a router, you need split tunneling: rules that route local websites and addresses directly, while sending everything else through the VPN. We explain how this works in our split tunneling guide. All third-party solutions mentioned here support these rules, but you'll have to configure them yourself.

Speed depends on the router's processor

The router's processor handles the encryption. Cheap models have weak CPUs, so a 500 Mbps connection might drop significantly through a VPN. Exact numbers depend on the model, protocol, and server, so look for reviews testing VLESS specifically on your model before buying. You also need enough memory: an Xray or sing-box core takes up dozens of megabytes, while cheap routers often have just 16 MB of flash memory. Server location also affects latency: the closer the server, the faster the response, which is why people usually pick the nearest location for home networks.

A configuration error takes down the whole house

If a VPN app breaks on your phone, you just turn it off. If there's an error in your router's configuration, no one has internet until you fix it. Firmware updates can also break the third-party add-ons discussed below.

You don't have to route the entire network

You can avoid some of these downsides by routing only specific devices through the tunnel, like your TV and console. XKeen, Podkop, and Passwall2 let you select devices by their local network address. In Keenetic, built-in connections like WireGuard have access policies in the "Connection Priorities" section, allowing you to assign a specific internet connection to a specific device.

One minor detail: if you have a phone at home with an active VPN app, its traffic will go through two tunnels in a row. It works, but it's slower, so you're better off disabling the app while at home.

Why the standard VPN client won't work for VLESS

Almost every modern router has a "VPN Client" section. The catch is the protocol list: WireGuard, OpenVPN, L2TP, PPTP, and IPsec. You can't paste a VLESS subscription link there; factory firmwares don't support this connection type.

If your VPN service provides a WireGuard or OpenVPN configuration, it's simple: set it up in the router's web interface following the manufacturer's instructions. That won't work with VLESS; you need third-party software. We break down the differences between these protocols and why VLESS is necessary in our VLESS, WireGuard, and OpenVPN comparison.

A quick note on routers from ISPs like Rostelecom or MTS: their firmware usually can't be replaced and doesn't support VLESS. If you need a VPN at the router level, you'll have to buy your own router and connect it to the ISP's router with a cable.

How VLESS actually works on a router

WireGuard or OpenVPN create a standard network interface on the router, which sends traffic to it just like another internet connection. VLESS is different. The router runs the exact same core used in mobile apps (Xray, sing-box, or Mihomo). The router intercepts traffic from selected devices and passes it to the core. The core then checks its rules: send this website to the VPN server, route this one directly.

For domain rules to work, the router must also intercept the devices' DNS queries. That's why almost all VLESS router tutorials start with DNS configuration, and errors often hide there: if a device asks a third-party DNS server for a website's address, the domain rule won't trigger.

Keenetic and Netcraze: VLESS only via third-party XKeen

Since 2025, Keenetic routers are supplied to Russia under the Netcraze brand. The model names and ecosystem remain the same, so everything below applies to both brands.

The factory KeeneticOS supports many VPN protocols, but not VLESS. A recent addition is AmneziaWG, a modified WireGuard that disguises its service packets. Basic support appeared in version 4.2, and full support in 4.3.4. If your service provides WireGuard or AmneziaWG configs, this is the easiest route—everything is done in the web interface.

For VLESS, Keenetic users created XKeen. This utility installs the Xray core (and Mihomo in newer versions) on the router and routes selected devices' traffic through it. The jameszeroX/XKeen fork on GitHub is currently the most actively developed, with discussions happening on the Keenetic forum.

What you'll need:

• a router with a USB port and a flash drive: XKeen's developers only guarantee installation on an external drive; installing to internal memory requires advanced experience;
• the OPKG component in KeeneticOS and the Entware environment to run third-party packages;
• SSH access to the router and basic command-line skills;
• willingness to edit Xray's JSON configuration files.

XKeen's documentation shows how closely it's tied to the firmware version. For example, the authors warn that IPv6 can't be completely disabled in KeeneticOS 5 using built-in tools, so they recommend staying on the long-term support 4.3 branch for some scenarios.

We won't list step-by-step commands here: they change between versions, and following an outdated tutorial is an easy way to brick your router. Look for the current installation steps in the project's README.

MikroTik: VLESS in a container on RouterOS 7

RouterOS 7 has built-in WireGuard, but not VLESS. To run it, users rely on the container package, which runs Docker images on the router. You spin up an Xray or sing-box container, then use routing rules to send the right traffic into it.

Restrictions from MikroTik's documentation:

• containers only run on models with ARM, ARM64, and x86 processors; models with other CPUs lack this feature;
• you can only enable them with physical access to the router: after running the command, you have to press a button on the device (or do a cold reboot for x86);
• MikroTik recommends storing container images and data on an external drive;
• the manufacturer explicitly warns that third-party images carry risks and have no security guarantees.

You can check your processor architecture in WinBox under System → Resources. This method is meant for people who already administer MikroTik hardware and understand routing tables. If you set up your router using video tutorials and are afraid to touch the settings, start with an easier option.

OpenWrt: The most flexible option if your router supports it

OpenWrt is an open-source firmware that replaces your factory software. Once installed, your router becomes a tiny Linux computer with a package manager. There are several web-interface add-ons for VLESS on OpenWrt:

• Podkop — a project by the Russian-speaking community based on sing-box, currently in beta. It routes selected domain and IP lists through the tunnel and sends the rest directly. It accepts VLESS, Shadowsocks, Trojan, and Hysteria2 links. It requires OpenWrt 24.10 or newer and about 20–25 MB of free space, so 16 MB flash memory routers aren't supported.
• Passwall2 — a long-standing Xray and sing-box project that can load subscriptions. It updates frequently, with the latest version released on October 29, 2026.
• HomeProxy — a sing-box interface from ImmortalWrt (an OpenWrt fork), designed for ARM64 and x86-64 routers.

These add-ons are configured in LuCI, OpenWrt's web interface, but are usually installed via SSH using the command line, following the project's documentation.

Note that OpenWrt 25.12 switched package managers (from opkg to apk), so unsigned third-party packages can no longer be installed via the web interface by default. Tutorials written for 24.10 won't work word-for-word on the new version.

Before installing, find your model in the OpenWrt hardware compatibility table. Check both the model and the hardware revision. For instance, the popular Xiaomi AX3000T is supported, but its newer RD03v2 revision lacks official support. Flashing usually voids your warranty, and an error during the process can brick your router.

Some routers come with OpenWrt out of the box. GL.iNet's factory firmware is built on OpenWrt, so you can usually install packages from that ecosystem without flashing. However, models with low memory still won't be able to run Xray or sing-box.

ASUS owners have a similar route: the Asuswrt-Merlin custom firmware and the XRAYUI third-party add-on, which installs Xray with a web interface. The list of tested models is in the project's README on GitHub.

What you can do with your router: A summary table

What to look for when buying a router for VLESS

• OpenWrt support for your exact hardware revision, if you plan to flash it. The revision number is usually on the bottom sticker.
• Flash memory size. According to Podkop's documentation, if sing-box isn't already installed, you need about 40 MB of free space, so it won't install on a 16 MB flash model at all.
• Processor. Generally, a modern multi-core ARM handles VLESS better than an old MIPS chip, but look for user reviews with actual speed tests.
• A USB port, if you have a Keenetic and plan to install XKeen.

Using a second router instead of flashing your main one

If you don't want to risk the main router that runs your entire apartment, you can buy a second one with OpenWrt or GL.iNet factory firmware and connect only your TV and console to it. Your main network will work exactly as before, and your VPN experiments will only affect the second router.

For comparison: setting up an Android TV box for a single TV takes about fifteen minutes and requires zero administration experience. If you only need a VPN for your TV, start there.

Will a subscription link work on a router?

A subscription link is a standard format: the client uses it to retrieve a list of servers and updates it automatically. We explain how it works and how it differs from a standalone vless:// key in our article on VLESS keys and subscriptions.

On a router, you can use a subscription in add-ons that know how to load them, like Passwall2. Podkop doesn't have built-in subscription support yet; its documentation recommends pasting links to individual servers manually. With XKeen and MikroTik containers, you usually write the Xray config yourself using the server's parameters.

Where subscriptions are loaded automatically, new servers will appear on their own. Where links are added manually, you'll have to update them manually when servers change.

The Byte VPN dashboard doesn't have router tutorials, only guides for mobile, desktop, and Android TV apps. You can add a subscription link from the dashboard to a router client that supports VLESS subscriptions, but you'll have to set it up yourself using your chosen project's documentation.

How to check if your router VPN is working

1. Turn off the VPN app on your phone or computer connected to the router.
2. Open an IP-checking website. It should show the country and IP address of the VPN server.
3. Open a couple of local websites, like your bank or Gosuslugi. If split tunneling is configured correctly, they should load as usual.
4. Check the device you set this all up for. Samsung and LG TVs have a built-in browser: open the same IP-checking website there.
5. Test your speed with and without the VPN. If the drop is huge, try a different server or route less traffic through the tunnel: your router's processor might be struggling.

If a specific device, like a smart speaker or camera, stops working after enabling the VPN, exclude it from the tunnel. Many of these devices rely on cloud services that might block foreign connections.

We explain how to verify your DNS queries aren't leaking outside the tunnel in our article on how to test your VPN.