Why a Router VPN Behaves Differently From a VPN App
A VPN app protects one device and knows what that device is doing. A VPN on your router protects everything behind it and knows nothing about individual devices — it sees a stream of traffic arriving from your network and forwards it into the tunnel. The coverage is broader and the control is coarser, and several features people rely on simply do not exist at the router level.
If you are deciding between them, or wondering why a router setup feels less capable, the differences are structural rather than a matter of configuration quality.
What each one sees
An app runs on the device and participates in the operating system’s networking. It can create a virtual adapter, install routes, replace resolver settings, apply rules per application, and watch the tunnel’s state directly. It knows which process generated which connection.
A router sits one hop away and sees packets, not processes. It can route traffic from a given device into the tunnel, and it can usually resolve names on behalf of the network. It cannot know that one particular application on your laptop should stay outside the tunnel, because by the time the packets reach it, that context is gone.
That asymmetry produces every difference that follows.
What the router approach does better
Coverage without configuration, on devices that have no client.
- Smart TVs, consoles, and appliances. Plenty of devices cannot run a VPN client. Behind a router tunnel they are covered anyway, which is often the entire reason people set this up.
- Nothing to remember. Every device is protected from the moment it joins the network. No app to launch, no connection to forget.
- Device limits stop mattering. The provider sees one connection regardless of how many devices are behind it, which changes the arithmetic of how many devices a plan covers.
- No escape paths on the device. Because there is no non-tunnelled route out of your network, mechanisms that bypass a device-level tunnel — including the kind of address discovery covered in WebRTC and local IP addresses — have nowhere to escape to.
- Guests are covered too, without asking them to install anything.
What you give up
Most of the per-device intelligence, and some safety features.
Kill switches largely do not exist. A client kill switch works by blocking the device’s traffic with firewall rules when the tunnel drops. On a router, the equivalent is a firewall policy that drops traffic when the tunnel is down, and firmware support for this is inconsistent. Where it is absent, a dropped tunnel means every device silently falls back to your ordinary connection — the exact failure a kill switch exists to prevent, at the moment you are least likely to notice.
Switching servers is a chore. Changing location in an app is a click. On a router it means reconfiguring the tunnel and often restarting it, disrupting every device. Anyone who changes location frequently will find this tiresome.
Split tunnelling becomes per-device at best. Some firmware lets you exclude specific devices, which is genuinely useful, but you cannot exclude one application on a device — see split tunnelling for what the app-level version offers.
Throughput is limited by the router’s processor. Encryption is computationally demanding, and consumer routers are modest computers. A router tunnel is commonly slower than the same connection tunnelled by a laptop, and the ceiling is the router’s capability rather than your line’s. This is a distinct cause from the ordinary reasons a VPN slows a connection.
Protocol and feature support lags. Firmware often supports fewer protocols and fewer provider features than the official client, and updates arrive more slowly.
Nothing tells you it is working. No status indicator, no notification on drop. You have to check deliberately, which is why testing whether the VPN is working from a device behind the router matters more here than anywhere else.
The traps specific to router setups
Three failures that are easy to create and hard to notice.
IPv6 forwarded around the tunnel. Router firmware frequently tunnels only the older address family while passing IPv6 straight through, so a share of traffic bypasses the VPN entirely. Test from a device behind the router, not from the router’s status page — the failure described in why IPv6 is the leak people forget.
Resolver settings not following the tunnel. If the router keeps advertising your internet provider’s resolvers, every device’s lookups leave outside the tunnel while their traffic goes through it. That is a DNS leak affecting your whole network at once, and it needs fixing on the router’s DHCP settings rather than per device.
Silent reversion after a reboot or firmware update. Tunnel configuration can fail to come back, leaving everything unprotected with no indication. Worth re-testing after any router change.
The common thread is that a router tunnel fails quietly. An app tells you when something is wrong; a router just forwards traffic.
A workable hybrid
Use both, for the things each is good at.
Run the tunnel on the router so appliances and guests are covered by default. Keep the client installed on laptops and phones as well, and use it when you need a specific location, a kill switch, per-application routing, or protection on networks away from home.
Two notes on running both at once. Do not tunnel a device twice — a client on a device behind a router tunnel means double encryption, extra latency, and confusing routing. Where firmware supports excluding devices, exclude the ones running their own client. And when the client is what is protecting you, the router tunnel’s state does not matter, which is a simpler mental model than trying to reason about both.
Choosing
Pick the router if your priority is covering devices that cannot cover themselves, you rarely change location, your line is slow enough that the router’s ceiling does not bind, and you are willing to test the setup periodically.
Pick the app if your priority is control and safety features — kill switch, per-application routing, quick server changes, clear status — and you can install it everywhere that matters.
Pick both if you have the appliances and the discipline, which is the arrangement that actually covers the most ground. The discipline part is the real requirement: a router tunnel you never verify is worse than no tunnel, because it produces confidence without protection.