What can you actually do with a VPN on your home router?
Summary
Two opposite things. The router can connect out to a VPN service so every device in the house, including a TV or console that can't run a VPN app, uses the provider's servers. Or the router can be a VPN server that you connect into from outside, so your phone can reach the NAS or printer at home. The second setup only works if your internet provider gives you a public IP address, and when it doesn't, a mesh VPN such as Tailscale can do the job.
Pointing the router outward
Proton VPN describes the first setup plainly: putting its VPN on your router "protects every device connected to your home network." The router has to support OpenVPN or WireGuard as a client, and Proton notes that "most routers provided by internet service providers (ISPs) do not support VPN configurations." Its setup guides cover firmware and devices such as AsusWRT, GL.iNet, OpenWRT and pfSense.
Device limits can work in your favor here. On Proton's free plan, the router "only counts as one connection" however many devices sit behind it. The same page doesn't say how paid plans count a router, so that's a question for whichever service you sign up with.
There are costs too. Proton says speed "depends on your router's processing power," and weaker routers may be slower. Encryption covers the path from the router to the internet but not the hop between your laptop and the router. Some app features, NetShield and split tunneling among them, may not be available through a router connection.
Letting yourself back in from outside
The reverse setup makes the router the thing that waits for connections, so it has to be findable from the internet. ASUS states that to use the VPN server on its routers, "your router needs to have a public IP(WAN IP) from your ISP's internet service." WireGuard server support needs firmware later than 3.0.0.4.388.
GL.iNet spells out the failure case: without a public IP, "your router cannot be set as an OpenVPN Server," and asking your ISP for one "may incur an extra fee." If the GL.iNet router is your main router, no port forwarding is needed. If it sits behind the ISP's router, you have to forward the port on that upstream router, and ASUS adds that you need permission to change its settings. When your home IP changes often, both vendors suggest using a DDNS hostname, a fixed name that follows the changing address, as the server address.
Once connected, turning on remote access to the LAN subnet lets you reach the NAS, printer or camera at home through the tunnel.
No public IP? There's another route
Some providers put many customers behind one shared public address, a setup called CGNAT. A router-based VPN server can't work on that kind of connection, and GL.iNet points CGNAT users to a separate product of its own.
Tailscale gets around this differently. Its devices use NAT traversal to try to build a direct UDP tunnel with each other, and every connection starts out relayed through Tailscale's DERP servers, which any device that can open an HTTPS connection can reach. Relayed connections are slower than direct ones, but nobody has to open a port at home for them to work. Opening UDP port 41641 is optional and only helps get a direct connection.
To reach things that can't run Tailscale, you set one machine at home up as a subnet router. Tailscale's docs give printers and cameras as the examples, and devices behind a subnet router "don't count toward your pricing plan's device limit." The free Personal plan covers up to 6 users with unlimited user devices, and Tailscale says it is "only suitable for non-commercial use." Paid plans are covered in our Tailscale pricing article.
Sources
- https://protonvpn.com/support/installing-protonvpn-on-a-router
- https://www.asus.com/support/faq/1048280/
- https://www.asus.com/support/faq/1033906/
- https://docs.gl-inet.com/router/en/4/interface_guide/openvpn_server/
- https://docs.gl-inet.com/router/en/4/interface_guide/wireguard_server/
- https://tailscale.com/docs/reference/connection-types
- https://tailscale.com/docs/features/subnet-routers
- https://tailscale.com/pricing
Related on this site
- Is a VPN router the same thing as a VPN concentrator or VPN passthrough?
- How much does Tailscale cost for a business?
- What is a VPN tunnel, and does all of your traffic have to go through it?
- What do you actually get from a VPN service, and how is a business VPN different?
Written by Kaz (pen name). Published September 28, 2026. The facts above come from the vendor and standards pages listed under Sources. We have not used these products. Corrections: contact form.