Best VPN for Router in 2026: NordVPN, Surfshark and ExpressVPN Compared

Affiliate disclosure: VPN Vetted may earn a commission if you buy through some links on this page, at no extra cost to you. It doesn’t decide our ranking, and we list each pick’s limitations. Ownership note: NordVPN and Surfshark are part of the same group since a 2022 merger agreement; both say they operate autonomously (Surfshark, NordVPN). ExpressVPN is a separate company.

Comparison table: router apps and firmware support

Last updated October 3, 2026 · Prices checked October 3, 2026 (USD; sales tax or VAT may apply).

How we review

We compared what each provider officially documents for routers, using their support centers, router pages and pricing pages, all checked on October 3, 2026. We looked at which firmware and router brands each one has setup guides for, which protocols work on a router, whether a ready-made router option exists, device limits and pricing transparency. We haven’t flashed or configured these routers ourselves, so this guide doesn’t include speed figures.

Best VPNs for routers

NordVPN: best overall for routers

NordVPN has the longest list of router tutorials of the three: ASUS WRT, Asus Merlin, DD-WRT, Privacy Hero, Roqos, GL.iNet, MikroTik, NetDUMA, OPNsense, OpenWRT, Padavan, Sabai, Tomato, pfSense, DrayTek, EdgeRouter, TP-Link and even Starlink (NordVPN router guide). If you’d rather not configure anything, it points to FlashRouters, which sells routers pre-configured for NordVPN, including the Privacy Hero 2 with NordLynx integration and one year of NordVPN included (which routers). It also shows renewal prices up front: Basic is $94.23 for the first 27 months, then $139.08 a year (pricing).

The limitation: on most routers you’ll be using OpenVPN, not NordLynx. NordVPN says your router must support an OpenVPN client, and that popular Asus models like the RT-AX86U, RT-AX68U and RT-AX88U “will not support NordLynx”. It also warns that routers from internet providers probably don’t support VPNs at all.

NordVPN: See the current deal

Surfshark: best for WireGuard routers and big households

Surfshark works with routers whose firmware has an OpenVPN or WireGuard client (Surfshark router guide). It has WireGuard guides for TP-Link, Deco, GL.iNet and Keenetic plus a manual WireGuard setup, and OpenVPN guides for OpenWRT, OPNsense, TP-Link, Deco and AsusWRT (router guides). It recommends Asus routers and GL.iNet, which ships with OpenWRT preinstalled. Unlimited devices means you can also run the app on phones and laptops that leave the house.

The limitations are spelled out by Surfshark itself: on a router you lose access to most app features and speed might decrease. Its list of unsupported routers (updated February 2, 2026) includes Arris, Belkin, Cisco, Linksys (except Tomato-supported models), TRENDnet, TotoLink, Ubee, Google WiFi and most ISP routers (unsupported routers). The pricing page doesn’t list a renewal price.

Surfshark: See the current deal

ExpressVPN: best ready-made VPN router

ExpressVPN no longer makes its own router hardware or sells its router app; its current home-router offering is Fortify (GL-MT6000), a Wi-Fi 6 router made with GL.iNet that runs GL.iNet’s firmware with ExpressVPN built in (WireGuard at launch). ExpressVPN lists it at $199.99, including 12 months of ExpressVPN Advanced, and it has been sold through GL.iNet’s store since September 16, 2026, with Amazon availability to follow (Fortify, Aircove FAQ). ExpressVPN’s FAQ says the included plan is for new and returning customers, while the product page headline says new users, so check the conditions before you buy. ExpressVPN says Fortify lets you choose which devices use which VPN location, with a per-tunnel kill switch, and that the router counts as one device on your plan. Note that ExpressVPN’s own router page still says it no longer offers router hardware. If you don’t buy Fortify, ExpressVPN subscriptions start at $2.99/mo for Basic ($83.72 for the first 28 months, then $99.95 a year) with 10 devices; Advanced allows 12 (pricing).

The caveats matter here. Its earlier Aircove routers are retired from sale; they get security updates until the end of 2027 (Aircove) and 2028 (Aircove Go). Security updates for the ExpressVPN router app on Asus models have already ended (Asus guide). PPTP and L2TP aren’t supported for manual setups. And ExpressVPN’s own router page says that for most people, apps are the better choice, because router CPUs bottleneck encryption (ExpressVPN).

ExpressVPN: See plans and pricing

Which routers support VPN clients

• Most ISP-supplied routers: usually no. NordVPN and Surfshark both say so.
• Asus: many models have a built-in OpenVPN client. Both NordVPN and Surfshark document Asus setups, but NordLynx won’t run on the Asus models NordVPN lists.
• GL.iNet: ships with OpenWRT preinstalled, per Surfshark. Surfshark has a WireGuard guide for it, NordVPN has a GL.iNet tutorial, and ExpressVPN’s Fortify is built on GL.iNet hardware.
• TP-Link and Deco: Surfshark has guides for both, and NordVPN has TP-Link guides. Support depends on the model.
• DD-WRT, Tomato, OpenWRT, pfSense, OPNsense: custom or open-source firmware with VPN clients. Surfshark warns that flashing firmware incorrectly can permanently damage your router.
• Arris, Belkin, Cisco, Google WiFi, most Linksys: on Surfshark’s unsupported list.

Not sure? Log in to your router’s admin page and look for an “OpenVPN client” or “WireGuard client” menu. If you only see a VPN server option, that’s for reaching your home network from outside, not for routing traffic through a VPN provider.

How to set up a VPN on a router

1. Confirm client support. Check your router’s admin page or manual for an OpenVPN or WireGuard client.
2. Get the configuration from your VPN provider. In your account, download an OpenVPN config file or generate WireGuard keys for a specific server (steps differ by provider; follow its guide for your firmware).
3. Add the profile to the router. Upload the config or paste the WireGuard keys and endpoint, then enter your service credentials if asked.
4. Connect and verify. Activate the profile, then check your public IP from a device on the network.
5. Keep a fallback. Note how to disable the VPN profile in case a smart TV or console misbehaves. On most routers, every device shares one location.

For devices that leave the house, install the app too.

Router VPN or app VPN?

A router VPN covers devices that can’t run VPN apps, such as consoles, smart TVs and smart-home gear. The trade-offs: you lose most app features, one router CPU handles encryption for the whole house, and on a typical setup every device shares one location. ExpressVPN says Fortify lets you choose which devices use which VPN location, with a per-tunnel kill switch. On other routers, you’d switch profiles manually.

FAQ

What’s the best VPN for a router? For most people, NordVPN, because it documents the most router firmware and offers pre-configured partner routers. Surfshark is the better pick if your router supports WireGuard and you have lots of devices.

Can I put a VPN on my ISP router? Usually not. NordVPN and Surfshark both say most ISP routers don’t support VPN clients. A common workaround is to add a VPN-capable router as a secondary router on your network, which is what ExpressVPN recommends in its Asus setup guide.

Does a VPN on a router slow down the internet? It can. Surfshark says speed might decrease, and ExpressVPN says router CPUs are often the bottleneck. We haven’t measured it ourselves yet.

Does a router count as one device? ExpressVPN says Fortify counts as one device on your plan, no matter how many devices connect to it. Check each provider’s terms for other setups.

Is WireGuard or OpenVPN better on a router? It depends on what your router supports. Surfshark documents both; NordVPN’s router setups use OpenVPN except on some partner routers with NordLynx.

Verdict

NordVPN is the best fit for most router setups, with the widest range of documented firmware and pre-configured routers, plus renewal prices shown up front. Expect OpenVPN rather than NordLynx on most routers. Pick Surfshark if your router supports WireGuard or you need unlimited devices. Pick ExpressVPN if you’d rather buy a ready-made VPN router (Fortify, $199.99 with 12 months of Advanced). Avoid its older router firmware, which no longer gets security updates.

NordVPN: Check today’s price

Sources (official pages, checked on October 3, 2026)

These are the official pages cited above. Prices and plans change often, so confirm them on the provider’s site before you buy.

• Surfshark blog: merger with Nord Security: surfshark.com/blog/surfshark-merges-with-nord-security
• NordVPN blog: Nord Security and Surfshark merger agreement: nordvpn.com/blog/nord-security-surfshark-merger-agreement
• NordVPN support: router setup: support.nordvpn.com/hc/en-us/articles/19426084718865
• NordVPN support: routers with NordLynx: support.nordvpn.com/hc/en-us/articles/20195707547025
• NordVPN pricing: nordvpn.com/pricing
• Surfshark support: router setup: support.surfshark.com/hc/en-us/articles/360003103833
• Surfshark support: router guides: support.surfshark.com/hc/en-us/sections/4417059333010
• Surfshark support: unsupported routers: support.surfshark.com/hc/en-us/articles/360010780059
• ExpressVPN Fortify: expressvpn.com/fortify
• ExpressVPN Aircove FAQ: expressvpn.com/support/knowledge-hub/aircove-faq
• ExpressVPN pricing: expressvpn.com/pricing
• ExpressVPN router app setup (ASUS): expressvpn.com/support/vpn-setup/app-for-routers-asus
• ExpressVPN for routers: expressvpn.com/vpn-download/vpn-router