Disclosure: This post contains affiliate links; we may earn a commission at no extra cost to you.
If you want every device on your network protected without installing an app on each one — game consoles, smart TVs, IoT sensors that can’t run VPN software at all — a router-level VPN is the only way to get there. It’s also the most confusing VPN setup to actually pull off, and 2026 just made it more confusing: ExpressVPN spent the first quarter of the year phasing out firmware support for third-party routers, catching a lot of long-time customers off guard. This guide covers what actually works right now, honestly, including where that path has narrowed.
The three real ways to get a VPN on your router
1. Native VPN client built into the router’s firmware. Newer ASUS routers ship with a feature called VPN Fusion that supports both OpenVPN and WireGuard client profiles out of the box — no flashing required. You upload a config file from your VPN provider, assign which devices route through it, and enable the profile. This is the easiest path if you already own a recent ASUS router (WireGuard needs firmware 3.0.0.4.388.20000 or later).
2. Third-party firmware (Asus-Merlin, DD-WRT, Tomato). If your router doesn’t have a native VPN client, flashing it with AsusWRT-Merlin, DD-WRT, or Tomato adds OpenVPN (and on newer builds, WireGuard) client support. NordVPN and Surfshark both publish official step-by-step guides for Merlin specifically, since it’s the most common flash target for this. You still need a config file or credentials from your VPN provider, and flashing carries real risk — a bad flash can brick a router that isn’t on the firmware’s supported list, so check compatibility before you start.
3. A pre-configured VPN router. ExpressVPN sells Aircove, a router with the VPN built into its own OS rather than layered on as a client — you sign in with your ExpressVPN account and it’s live, no config files or firmware flashing at all. It’s the simplest option by a wide margin. The catch, as of mid-2026: both the Aircove AX1800 and Aircove Go were showing “currently unavailable” on Amazon and ExpressVPN’s own store, and the AX1800 model’s firmware support is only guaranteed through the end of 2027. If you’re buying specifically for Aircove, confirm current stock and support-window dates before you commit — this is a fast-moving situation, not a settled one.
What happened with ExpressVPN and third-party routers
Worth explaining because it’s a live cautionary tale for anyone setting up a router VPN this year: ExpressVPN’s own firmware for third-party routers (Linksys WRT3200ACM, WRT1900ACS, WRT32X, several older ASUS RT-AC models, and Netgear’s R-series) reached end-of-life in early-to-mid 2026, with the older wave losing support in January and the rest following in March. Initial reporting suggested ExpressVPN was killing third-party router support entirely and pushing everyone toward the roughly $200 Aircove. ExpressVPN pushed back on that framing — non-Aircove routers can still connect using manual OpenVPN or WireGuard configuration rather than the discontinued router app. Practically, that means if you own one of the affected legacy routers, you’re now doing the same manual config-file setup that NordVPN and Surfshark customers have always done, not the point-and-click app ExpressVPN used to offer. If your router isn’t on the affected list, nothing changes for you yet — but it’s a reminder to check your provider’s current router-support page before buying hardware around it.
Setting it up: the general steps
The specifics vary by router and provider, but the sequence is consistent across NordVPN, Surfshark, and ExpressVPN’s manual config path:
- Confirm your router firmware supports a VPN client. Native ASUS firmware, AsusWRT-Merlin, DD-WRT, and Tomato all handle this well. Stock firmware on most consumer routers (stock Netgear, stock TP-Link) does not — you’d need to flash first.
- Log into your router’s admin panel, typically at 192.168.1.1 in a browser, using the admin credentials (not your Wi-Fi password).
- Get your VPN provider’s config file or server credentials. NordVPN and Surfshark both provide downloadable OpenVPN/WireGuard config files per server location from their account dashboards.
- Upload the config and enter your credentials in the router’s VPN client section (VPN Fusion on ASUS, the VPN tab on Merlin/DD-WRT).
- Assign which devices route through the VPN. You don’t have to tunnel your entire network — VPN Fusion and Merlin both let you route only specific devices, which matters because router hardware isn’t as fast as your VPN’s own apps.
- Test before trusting it. Check your IP address from a device on the VPN’d network to confirm it shows the VPN server’s location, not your real one.
The tradeoff nobody mentions: your router’s CPU
A phone or laptop encrypts VPN traffic with hardware built for it. A roughly $100 consumer router usually doesn’t — the CPU has to encrypt every packet for every connected device in software, and on older or budget routers that can cut your real-world throughput by half or more compared to running the VPN app directly on a device. WireGuard is meaningfully lighter on CPU than OpenVPN and is the better choice if your router/firmware supports it. If you have gigabit internet and a budget router, expect the VPN’d connection to land well below gigabit regardless of which provider you pick — that’s a hardware ceiling, not a VPN quality problem.
Router VPN setup methods compared
| Method | Setup difficulty | Cost | Works on | Best for |
|---|---|---|---|---|
| Native firmware (ASUS VPN Fusion) | Easy | Free (if you own a supported router) | Recent ASUS routers | Owners of newer ASUS hardware |
| Flashed firmware (Merlin/DD-WRT/Tomato) | Moderate–hard | Free (flashing risk only) | Compatible older/mid-range routers | Anyone comfortable flashing firmware |
| Pre-flashed router (FlashRouters etc.) | Easy | roughly $150–$250+ | Ships ready to use | Buyers who want zero DIY risk |
| Dedicated VPN router (ExpressVPN Aircove) | Easiest | ~$189–$200 (stock-dependent) | Aircove hardware only | Buyers who want a single-brand, no-config box |
FAQ
Do I need a router VPN if I already use VPN apps on my phone and laptop?
Only if you want to cover devices that can’t run a VPN app — smart TVs, game consoles, smart-home hubs — or want one setting that protects everything without per-device installs. If your phone and laptop are your only real concern, the regular app is simpler and won’t slow your connection down as much.
Will a router VPN slow down my whole household’s internet?
Some, yes — router CPUs are the bottleneck, not the VPN service. WireGuard minimizes the hit; OpenVPN on an older router can be a much bigger slowdown. Test your actual speed after setup rather than assuming.
Is it safe to flash third-party firmware like DD-WRT or Merlin onto my router?
It’s routine for supported models but genuinely risky for unsupported ones — a failed flash can brick the router. Check your exact model against the firmware’s official compatibility list before starting, and don’t skip that step to save time.
With ExpressVPN’s 2026 router changes, should I still consider them for a router VPN?
If you specifically want Aircove’s plug-and-play simplicity and it’s in stock with an acceptable support window, it’s still the easiest hardware option available. If you own one of the now-unsupported legacy routers, be aware you’re doing manual OpenVPN/WireGuard setup rather than using their old router app — check current router-support pages before assuming which path applies to your hardware.
Editor’s pick: ExpressVPN Aircove — the simplest, no-config path to a router-level VPN if you don’t want to flash firmware or hunt for compatible hardware. (Our ExpressVPN affiliate program for this article is still being set up — check expressvpn.com directly for current Aircove stock and pricing.)