A VPN client in a router is easy to advertise and hard to do fast. The number that matters is throughput through the tunnel, and most hardware hides it.
How this page is funded: some links here are affiliate links, and Mesh & Signal earns a commission if you buy through them. It costs you nothing extra, it never changes which product we rank first, and we do not publish a price we have not verified. Full disclosure.
Running a VPN on the router is the only way to cover devices that cannot run a VPN app — a console, a smart TV, a streaming stick. The catch is throughput, and almost nobody publishes it. Encrypting and decrypting every packet is CPU work, and most consumer routers have a processor that collapses to double-digit megabits under it. Our pick is the GL.iNet Flint 3, which does around 680 Mbps through the tunnel.
Why throughput is the only spec that matters here
A router can advertise "VPN client support" and deliver 30 Mbps. That is technically a VPN and practically unusable on a gigabit connection — you would be throwing away most of what you pay for every month. So when comparing hardware, the question is never whether it supports a VPN; it is how fast it is with the tunnel up.
Factor
Why it matters
Protocol
WireGuard is dramatically lighter than classic OpenVPN. A router that is slow on OpenVPN may be fine on WireGuard
CPU and crypto acceleration
This is the real limit. Hardware-accelerated encryption is the difference between double and triple digits
Whether it routes per-device
Sending only two devices through the tunnel means the throughput ceiling applies to far less traffic
Your VPN provider's own server
Even perfect hardware cannot exceed what the far end gives you
Two things drive tunnel throughput: the processor, and which protocol it uses.
Scroll the table sideways to see every column.
Per-device routing is the feature to want
Most households do not want everything routed through a tunnel. You want the smart TV in another country's streaming library, or one laptop private, while the rest of the house goes direct at full speed — and you definitely do not want your game console adding VPN latency.
ASUS calls this VPN Fusion and it works across its routers and ZenWiFi mesh systems: you assign specific devices to specific tunnels and leave everything else alone. It is the single most practical VPN-on-router feature, and it also sidesteps the throughput problem, since the ceiling then applies only to the devices you routed.
This usually backfires
Do not put a VPN in front of your gaming or calling traffic
A tunnel adds a hop and encryption overhead, which means added latency and more variance in it. That is exactly what games and video calls cannot tolerate. If you run a VPN at the router, exclude the console and the work laptop — which is precisely why per-device routing matters more than raw tunnel speed. Our gaming page explains the latency mechanism.
Two different jobs people call "router VPN"
VPN client — the router connects out to a commercial VPN provider, and devices behind it appear to be elsewhere. This is what most people mean, and it is the one with the throughput problem.
VPN server — the router accepts connections in, so you can reach your home network from elsewhere. Far lighter work, supported on most mid-range routers, and genuinely useful for reaching a home server or camera without exposing it to the internet.
If you only need the second, you probably do not need to buy anything — check your current router first.
What router-level VPN does not do
It does not make you anonymous; it moves your traffic's apparent origin to your provider, who can see it instead of your ISP. It does not protect a device once it leaves your network. And it does not encrypt anything that was not already leaving your house — most web traffic is encrypted in transit regardless. Buy it for the specific jobs above, not as a general security upgrade.
How we picked
We do not run a test lab. Rankings here are built from the manufacturers' published specifications, measurements taken by independent outlets that do have labs, and the structural reasoning on this site about what a given house or job actually needs. Every product was checked as currently sold before it was included. Where a figure appears it is attributed and linked in Sources; where we have no basis for a claim, it is left out. Our methodology sets out exactly what we will and will not assert.
Quick picks
Ranked by our published scoring rubric (vpn throughput, provider support, ease of setup, value). Tap any row to jump to the full write-up, or go straight to the retailer from the right-hand column. How we score.
#
Product
Best for
Score
Price
1
Illustrative
GL.iNet Flint 3 (GL-BE9300)Around 680 Mbps through WireGuard and OpenVPN-DCO, 30-plus providers supported out of the box, and AdGuard Home included.
ASUS ZenWiFi BT10VPN Fusion lets you send specific devices through the tunnel and leave the rest direct, which is the feature most households actually want.
Scroll the table sideways on a narrow screen. Scores are our editorial assessment from published specifications and independent testing by named outlets — not our own lab results. What we do and do not test.
The picks in full
Illustrative
#1 · The VPN router to actually buy
GL.iNet Flint 3 (GL-BE9300)
GL.iNet · Midrange
The VPN router to buy: WireGuard and OpenVPN built in with usable throughput, five 2.5G ports, and support for dozens of VPN providers out of the box.
Key specifications
Standard
Wi-Fi 7, tri-band (includes 6 GHz)
Ports
5x 2.5 Gbps (1 WAN + 4 LAN), 10 Gbps LAN aggregation
VPN
WireGuard, OpenVPN and Tor; 30+ providers supported
VPN throughput
Up to about 680 Mbps on WireGuard and OpenVPN-DCO
Extras
AdGuard Home preinstalled
Score 9.4/10
VPN throughput10.0
Provider support10.0
Ease of setup8.0
Value9.5
What it gets right
+Around 680 Mbps through the tunnel is the number that matters — most routers with a VPN client collapse to double digits and make the feature unusable
+Five 2.5 Gbps ports at this price is unusual, and it means the wired side is not the bottleneck
+AdGuard Home preinstalled handles network-wide ad and tracker blocking without another box
+Supports 30-plus commercial VPN providers rather than requiring manual config files
What to watch for
−A single router, not a mesh system — coverage is a one-box problem here
−The interface assumes more networking vocabulary than eero or Deco
−Wi-Fi performance is good but not the reason to buy it; this is a router bought for its software
#ad We do not publish a price we cannot verify, so the button opens Amazon's own listing. How we are funded.
Common questions
Do mesh Wi-Fi systems support VPN?+−
Some do. ASUS supports VPN Fusion across its routers and ZenWiFi mesh systems, with per-device tunnel assignment. Most consumer mesh brands either omit a VPN client entirely or place it behind a subscription. If a VPN client is a requirement, check for it explicitly rather than assuming.
Why is my router VPN so slow?+−
Because encrypting every packet is CPU work and most consumer routers do not have the processor for it. Two things help: use WireGuard rather than classic OpenVPN, since it is dramatically lighter, and route only the devices that need the tunnel rather than the whole network.
Should I run a VPN on the router or on each device?+−
On the router when you need to cover devices that cannot run a VPN app — consoles, smart TVs, streaming sticks. On the device when you want it to keep working away from home, and when you do not want to spend router CPU on traffic that does not need it. Many households sensibly do both.
Will a VPN hurt my gaming or video calls?+−
Yes. A tunnel adds a hop plus encryption overhead, which means more latency and more variance in it — the two things games and calls tolerate worst. Exclude the console and the work laptop, which is why per-device routing matters more than headline tunnel speed.
Illustrative
