A VPN on the router moves the tunnel from individual devices to the point where the internet enters the home: everything behind it is covered — phones, laptops, the TV, streaming boxes and smart-home gear. Here is when that makes sense, which router fits, and how to put a personal VPN on OpenWrt.
This guide is for people who are ready to open the router’s web interface and set everything up once. If you only need a VPN for the TV, there is a simpler path at the end through the Apple TV and Android TV apps.
Why put a VPN on the router
An app on a phone protects one phone. A router with a VPN protects everything connected to the home network, and it does so invisibly to the devices themselves: they see an ordinary Wi-Fi network, while encryption and routing happen on the router.
- The TV, console, media player and smart-home gear that have no VPN client get the same IP as the phone.
- Laptops and phones don’t burn battery and don’t need to track whether the tunnel is on.
- Guests and new devices are protected the moment they join the Wi-Fi.
- Settings live in one place instead of a dozen apps.
There is a cost too: speed is capped by the router’s processor, and any tunnel problem affects the whole house at once. So it is worth choosing the hardware carefully and deciding in advance what should happen if the connection drops.
Which router fits
MeduzaVPN ships a ready-made package for OpenWrt — an open firmware installed on hundreds of router models. The package is built for three platforms we test it on, and static daemon builds are available for the rest.
| Platform | Format | Typical devices | Expected speed |
|---|---|---|---|
| x86/64 | Ready-made package | Mini PCs, virtual machines, industrial routers on Intel/AMD | Hundreds of Mbit/s and up |
| MediaTek Filogic | Ready-made package | Modern Wi-Fi 6 routers on MT7981/MT7986 | Hundreds of Mbit/s |
| MT7621 | Ready-made package | Mass-market routers from 2018–2023 | Tens of Mbit/s |
| arm64, armv7, mips | Static daemon build | Other OpenWrt platforms, manual install | Depends on the processor |
Memory and storage
The key requirement is storage space. The package with its dependencies needs 40–46 MB. A router with 16 MB of flash does not fit: after the firmware itself is installed only a few megabytes remain. Look for models with 128 MB or more, or set up extroot on a USB drive if the router has a port. At least 256 MB of RAM is advisable, otherwise the daemon and the web interface will compete for resources under a heavy connection count.
Before buying, check the OpenWrt hardware table: what matters is not just the CPU and memory, but also whether the model is supported by the current firmware branch. Older branches may lack the required dependencies.
Installing the package on OpenWrt
This assumes OpenWrt is already installed and the router has internet access. Installing the package takes a few minutes.
- Open the VPN for router page and download the package for your platform.
- Make sure at least 50 MB is free: the “System → Software” section in LuCI shows the remaining space.
- Upload the package through that same LuCI section, or over SSH with the opkg install command.
- Wait for the dependencies to install; the daemon creates its own settings on first launch.
- Open the new MeduzaVPN page in the LuCI menu and sign in with the QR code.
- Pick a location and protocol, turn the connection on and check the IP from any device on the network.
Static builds for other platforms
If your router runs on arm64, armv7 or mips, use the static daemon build. It does not depend on firmware libraries and runs as an ordinary service. There is no LuCI page in this case: sign-in and location selection are done with SSH commands, and settings live in a configuration file. This path is for people comfortable working from the console.
Signing in by QR code and the LuCI page
A router has no convenient keyboard, and storing your account password on it is not a good idea. So sign-in works the same way as on a TV: the MeduzaVPN page in LuCI shows a QR code, you scan it with the app on your phone or open the link in a browser and confirm the sign-in, and the router gets its own access key, which you can revoke from your account at any time.
The page itself gives you:
- connection status, the current location and the external IP;
- a choice of 60+ locations and protocol switching — MeduzaVPN ULTRA, WireGuard, VLESS and others;
- a kill switch toggle;
- a choice of which devices or subnets go through the tunnel;
- a log of recent connection events.
The router is just another device on the account. It does not use up a separate subscription or take a “slot” — there is no limit on the number of devices. If you share the VPN with family, see how shared access works.
Kill switch and traffic splitting
Kill switch
If the tunnel drops, the router can either let traffic through directly or block it until the connection is restored. The second option is the kill switch. On a router it applies to everyone, so decide in advance: if you have devices that need uninterrupted internet (security cameras, smart-home gear), it may be better to route them around the tunnel and turn the blocking on only for the rest.
Splitting by device
In OpenWrt, traffic is easy to split by client. A practical setup is two Wi-Fi networks: one goes through the VPN, the other goes direct. Connect the TV and the streaming box to the first one, and work devices with a corporate VPN to the second. It is the same idea as split tunneling in the apps, just with the network as the boundary instead of a list of programs.
DNS
Check that DNS queries go through the tunnel too. If the router keeps asking the ISP’s DNS server, websites will see the VPN’s IP while the ISP sees the list of domains. The MeduzaVPN package routes DNS through the tunnel by default, but if you have made manual changes in dnsmasq it is worth double-checking.
Limitations and what to consider
- Speed. Encryption is done by the router’s processor. On MT7621 the practical ceiling is tens of megabits per second; on Filogic and x86, hundreds. That is enough for 4K video, not for a gigabit line.
- One location for everyone. The router is connected to a single server. If one device needs Amsterdam and another needs Tokyo, you either switch back and forth or leave the app on the device itself.
- Geo-restricted services. Every device gets the IP of the chosen location, and some services will start showing a foreign catalogue, currency and language. Use traffic splitting for those.
- Switching protocol for the network. An ISP may start interfering with one protocol; on a router this is felt immediately across the whole house. Keep the LuCI page handy so you can switch — for example, from WireGuard to MeduzaVPN ULTRA.
- Updates. The package updates through opkg, like the rest of OpenWrt. It is worth checking for new versions every few months.
- Single point of failure. A misconfiguration on the router leaves everyone without internet. Save a backup of the configuration before making changes.
Alternatives to a router
A router is not always needed. If the goal is just the TV or a streaming box, it is simpler to install the app on the device itself.
| Criterion | VPN on the router | Apps on devices |
|---|---|---|
| Coverage | Every device on the network, including ones without a client | iPhone, Android, macOS, Windows, Linux, Apple TV, Android TV, Fire TV |
| Speed | Limited by the router’s processor | Limited by the connection and the server |
| Locations | One for everyone | Its own on each device |
| Setup | Needs OpenWrt and its web interface | Install from the store, sign in by code or account |
| Away from home | Does not apply | Works on any network |
For TVs, MeduzaVPN has apps for Apple TV, Android TV and Fire TV: sign in by code from your phone, pick a location with the remote, the same personal server. Many people combine both approaches: the router for gear without a client, apps for phones and laptops that leave the house.
Conclusion
A VPN on an OpenWrt router is a way to cover the whole house with one connection and protect gear that has no client of its own. The main conditions: 40–46 MB of storage, a supported platform and a clear plan for how the network should behave if the tunnel drops.
MeduzaVPN’s personal VPN on the router uses the same dedicated server with its own IP as the apps, and one account covers every device. Subscriptions come with 7 days free and a 15-day refund. Choose a plan.
FAQ
Why put a VPN on the router if there are apps for every device?
The router covers every device in the home with a single connection, including gear that has no VPN client of its own: TVs without apps, game consoles, smart speakers and guest devices. It also saves the battery on phones and laptops, and you do not have to watch whether the tunnel is up.
Which routers does the MeduzaVPN package for OpenWrt run on?
Ready-made packages are built for OpenWrt on x86/64, MediaTek Filogic and MT7621. For other platforms — arm64, armv7 and mips — there are static daemon builds you install manually. The general requirement is 40–46 MB of free storage and a current OpenWrt firmware branch.
Is a router with 16 MB of flash storage enough?
No. The package and its dependencies need about 40–46 MB of storage, and on devices with 16 MB of flash there are only a few megabytes left once the firmware itself is installed. Such routers are only good for minimal configurations; for a personal VPN, get a model with 128 MB or more, or add a USB drive with extroot.
How do you sign in on a router that has no browser or keyboard?
The LuCI web interface gets a MeduzaVPN page that shows a QR code. Scan it with the app on your phone, or open the link in a browser and confirm the sign-in, and the router gets access to your personal VPN without entering a password on the device itself.
What happens to the home internet if the VPN on the router drops?
That is decided by the kill switch. With the kill switch on, the router blocks traffic outside the tunnel and devices stay offline until the connection is restored. With it off, traffic goes straight through your ISP. The choice depends on what matters more: uninterrupted protection or uninterrupted access.
Will home internet speed drop?
Yes — encryption is done by the router’s processor, which is weaker than a phone’s. On MT7621 the practical ceiling is usually tens of megabits per second; on Filogic and x86, hundreds. That is enough for streaming video, but not for downloading large files over a gigabit line.
Can only the TV go through the VPN instead of every device?
Yes. In OpenWrt you can split traffic by device or subnet: some clients go through the tunnel, others go direct. A simple way is a separate Wi-Fi network or VLAN for the devices that need the VPN — the same idea as split tunneling, just at the level of the whole home network.
Is there an alternative if the router doesn’t fit the bill?
For TVs and streaming boxes there are separate MeduzaVPN apps for Apple TV, Android TV and Fire TV with sign-in by code from your phone. For everything else there are apps for iPhone, Android, macOS, Windows and Linux. One account works on all of them with no limit on the number of devices.