Router VPN Setup: Whole-Home Routing Options Compared

The short answer: a router setup buys you coverage

The problem a router VPN solves is specific: giving every device in the house one shared network exit, including the streaming boxes, game consoles, and smart TVs that can't run a client. It doesn't raise your bandwidth ceiling or change the quality of the routes themselves. Whether whole-home routing can hit full speed depends on the router's CPU and how it forwards traffic, not on the subscription.

One more thing worth clearing up first: a router setup and per-device clients aren't an either/or choice. The usual combination is a router covering the devices that can't run a client, while phones and computers keep using their own clients, both sharing the same subscription. Below, the four approaches are compared across three dimensions: hardware requirements, upkeep, and split-tunneling granularity.

Four ways to hand whole-home traffic to a router

The four approaches differ in three places: hardware requirements, upkeep, and split-tunneling granularity. The table below compares them side by side.

Stock firmware is the least effort: some router brands ship an OpenVPN or WireGuard client built in, and importing a config is all it takes. The limits are just as clear — the vendor decides which protocols you get, split-tunneling options are few, and most models can only route everything through the tunnel.

Flashing OpenWrt-style firmware on the main router is the most flexible option: you can install a proxy core and rule sets, and split traffic by domain, IP, or device. The trade-off is that flashing carries risk, and major firmware upgrades can wipe your configuration.

A bypass router is the middle ground: the main router stays as it is, and only the devices that need international routes have their gateway pointed at the bypass router. If you break the bypass router, the main router is unaffected — but traffic takes one extra hop and you gain another point of failure.

An x86 software router hands the gateway role to a separate small machine. It has the highest performance ceiling and suits gigabit-plus homes with many devices, but it also costs the most, and you have to think about power draw and where to put it.

Hardware requirements: three specs set the ceiling

CPU: it sets proxy throughput

Proxied traffic is processed in user space, and hardware NAT acceleration (flow offload, HWNAT, and the like) doesn't really apply to packets forwarded through a proxy. Real throughput therefore depends more on single-core performance than on the router's advertised wireless speed.

As a rule of thumb: older MIPS-based home routers usually top out at a few tens of Mbps; recent quad-core ARM models can reach several hundred Mbps; and an x86 machine with AES instruction support can saturate gigabit without much trouble. Protocol choice matters too — Shadowsocks and VLESS are relatively lightweight, while Hysteria2 and TUIC run over QUIC and use UDP to resist packet loss, but their encryption and congestion control happen in user space, so they're more CPU-hungry and tend to hit the bottleneck first on a router.

RAM and flash: whether it all fits

The proxy core itself isn't large, but rule sets (GeoSite, GeoIP, and similar databases) keep growing with every subscription update. Older models with little flash often can't hold the full package, leaving you to attach a USB drive or switch to a trimmed-down rule set.

Wireless drivers: whether it's still usable afterwards

Before you start, check how your model is listed in the OpenWrt support table. MediaTek's mt76 drivers are open source and well supported; some Qualcomm and Broadcom models rely on closed-source wireless drivers, so after flashing you'll see reduced wireless performance or even wired-only operation — those models are better used as a bypass router or a purely wired router.

What needs maintenance every month once it's running

The cost of a router setup doesn't stop at checkout. These things keep happening:

• Subscription updates. Servers change, so clients need to pull the subscription regularly. On a router the update cadence is usually slower than on a phone client, and format support is pickier: some only accept a base64 server list, others only a YAML config.
• Rule set updates. Split tunneling depends on domain and IP databases; if they aren't updated, newly registered domains get routed the wrong way.
• Firmware upgrades. Major version upgrades can reset your configuration, so export a backup first.
• Time sync. Protocols like VMess are sensitive to timestamps; if the router's clock hasn't synced after a reboot, the symptom is "the config looks right but nothing connects."
• Blast radius. When the router breaks, the whole household is affected; when a client breaks, only one device is.

Split tunneling and DNS: the two easiest traps in whole-home routing

Split tunneling: global, rule-based, and per-device

Global proxying is the least effort — all traffic goes through international routes — but sites in mainland China take the long way around too, latency rises, and some services will flag the activity. Rule-based splitting decides by domain and IP: traffic to mainland China goes direct, overseas traffic goes through the accelerator, and the finer the rule set, the more memory it uses. Device-level splitting uses MAC or IP to decide which devices are routed, which suits cases like "living-room devices through the tunnel, work laptop direct." Port-based splitting is the coarsest and cheapest option.

DNS leaks: the traffic is routed, the DNS queries aren't

A DNS leak means your traffic is already going through the accelerator, but DNS queries are still being sent to your local ISP's resolvers. The result: your browsing intent is exposed, the answers can be poisoned, and you get symptoms like "it connects but nothing loads" — or domains that should use international routes resolving over a direct connection.

There are two ways to handle this on a router. One is to push DNS queries into the proxy path as well — TUN mode takes over port 53 and carries resolution along with the traffic. The other is DNS-based splitting: domains in mainland China go to a domestic resolver, overseas domains are resolved through the proxy. Both work; the key is not letting queries slip outside the tunnel.

Who it suits and who it doesn't: a checklist

• ✅ You have streaming boxes, game consoles, or smart TVs that can't run a client
• ✅ You have enough devices that configuring and maintaining each one costs more than setting up the router once
• ✅ You need per-device routing — for example, only the living-room devices using international routes
• ✅ You can accept the blast radius of a router failure taking the whole house offline
• ❌ You only have one or two phones and computers — per-device clients are simpler
• ❌ Someone at home relies on the network for meetings or classes and can't afford a whole-house outage
• ❌ Your router model isn't on the supported list and you don't plan to buy new hardware
• ❌ You don't want to touch config files or set aside time for rule updates

The path that leaves the router alone

If you add up the requirements above and decide it isn't worth it, there's an alternative: leave the router alone and install a client on each device. What you get in return is a smaller blast radius and a lower hardware bar — configuration and updates happen on the device itself, and one device having problems doesn't affect the others.

That's the route VPNOh's subscription takes: one subscription with unlimited simultaneous devices — install a client on your phone, computer, and tablet, with no router changes and no paying per device. 100+ countries and 170+ routes, monthly plans from ¥9.9 (60GB included), and data packs that never expire. Getting started doesn't require an email address, and Alipay, WeChat, and USDT are all accepted.

The limits are worth stating too: a client-based setup can't cover smart TVs, game consoles, and other devices that can't run a client. If those devices are a must and your current router can't be flashed, you're left with the router approach on hardware that can handle it — or accepting that those devices stay off the accelerator. Live route status by region is on the routes page.

If you decide to go ahead, roll out in this order

1. Confirm the model: check whether your router is in the OpenWrt support list, or whether the stock firmware includes a VPN client.
2. Pick the gateway form: flash the main router, add a bypass router, or add a separate software router — choose one of the three.
3. Import the subscription link and route just one device first, to verify connectivity and where DNS resolution is coming from.
4. Then add split-tunneling rules: traffic to mainland China goes direct, overseas traffic goes through the accelerator, and assign gateways per device where needed.
5. Before expanding the scope, write down your rollback plan: point the gateway back at the main router, or restore the stock firmware.
6. Schedule subscription and rule set updates as recurring tasks instead of pulling them by hand after something breaks.