NETGEAR’s support article for Nighthawk routers describes a feature that lets you use a VPN connection to “access your own Internet service when you’re away from home” (NETGEAR’s Nighthawk VPN article). That is the router acting as the endpoint your phone or laptop dials into. Sending devices at home out through a provider’s server needs the opposite arrangement, a VPN client built into the router, and not every router has one. Even where it does, which devices use the tunnel depends on the router and the mode you pick. Some routers send the whole network through the VPN, while others only route the devices you assign to a profile.

Check whether your router can be a VPN client

Look in the router’s admin pages for a VPN client section, such as ASUS’s VPN Fusion. A client page asks for a provider’s server address, keys or configuration file. A server page generates files for your own devices, and a router with only that kind cannot send traffic through a provider.

Protocol support is the next check. ASUS notes that providers can support protocols such as OpenVPN, IPsec, PPTP and WireGuard, and asks owners to confirm the connection type with the provider first. When choosing a provider, VPN reviews and testing methods compare services on speed, logging policy and cost, while compatibility comes from the router maker’s and provider’s instructions. WireGuard also needs ASUS firmware later than 3.0.0.4.388.23000 and a supported model.

If your plan’s router has no client option, the alternatives are a replacement that has one, or a second router of your own behind it. The catch is double NAT: the new router usually gets a private address from the first one and translates addresses again, which can complicate port forwarding and some game connections. Only devices connected to the second router use its tunnel.

What a router profile looks like on an ASUS model

ASUS offers both. Its VPN Fusion documentation describes an Apply to all devices option that makes a profile the default connection for the whole router, and a mode where you assign devices one by one. The clearest public example of the second is ASUS’s VPN Fusion setup guide for a WireGuard client. The setup runs through these steps:

1. Confirm the VPN connection type with the provider.
2. Sign in to the router’s web interface, go to VPN, find VPN Fusion and click Add profile.
3. Click the Upload Config button and select the configuration file from the provider’s WireGuard server.
4. Click the Device icon and choose the end devices that will use this profile.
5. Enable those devices and click Apply all settings.
6. Click the VPN client profile to enable the VPN connection.

In this per-device mode, the last step is separate: assigned devices do not use the tunnel until the profile itself is switched on.

The guide also says WireGuard can run more than one tunnel at a time alongside the local network, so a console can use a tunnel while a laptop stays on the normal connection.

Check that a device really goes through the tunnel

Start with the public IP address. On an assigned device, note your IPv4 and IPv6 addresses with the profile off, then on. A different address is not enough: it should be the provider’s exit address, which you can compare with what the provider lists for your chosen server. If IPv6 still shows your internet provider while IPv4 has changed, that traffic bypasses the tunnel.

A DNS leak test answers a different question: which resolver answers name lookups. Seeing your internet provider’s resolver is worth fixing in the router’s DNS settings, but on its own it does not prove web traffic skipped the tunnel. The IP check has limits too: it shows the exit address of the connection being tested, not the path of every app or DNS lookup on the device.

Then separate two situations. Disabling the profile is a deliberate disconnect, and the device may simply go out over the normal connection, which says nothing about an unexpected drop. The ASUS WireGuard setup guide linked above does not describe a kill switch, so look for one in your own model’s VPN settings and documentation, and follow its instructions to interrupt the tunnel. A page that still loads proves little. Look up the public address: your internet provider’s public IP means the device fell back to the normal connection, while no result suggests traffic is blocked.

What a router tunnel does to your speed

Assigned devices share the tunnel, and the router does the encryption work. NETGEAR’s remote-access article cautions that a VPN “might be slower than accessing the Internet directly,” and a modest router processor may add to that.

Run a wired speed test with the profile off, then on, using the same test server at the same time of day, a few times. Repeat it on several provider servers and at different hours. The results show the speed you can realistically reach through the tunnel with that provider, not the router’s performance alone, because server load and routing are part of every result. If every server stays far below your plan’s speed, suspect the router and look for the maker’s published VPN throughput for your model.

Devices that cannot run a VPN app

Smart TVs, streaming sticks and game consoles often have nowhere to install a VPN app, so a router profile is one way to cover them. Leave out any device whose service restricts VPN addresses.

CISA’s home Wi-Fi guidance says “routine updates will protect you against known vulnerabilities” and advises putting smart home and other IoT devices on the guest Wi-Fi if internet access is all they need (CISA’s home Wi-Fi guidance). Check whether a profile applies to guest-network devices on your router before relying on it.

When apps on each device are the better fit

A router tunnel exists only while a device is connected to that router. A phone on cellular data or a laptop in a coffee shop needs its own app. The tunnel starts at the router, so the hop between a device and the router is not part of it. Protection there depends on your Wi-Fi settings, such as the security mode and password, and HTTPS or an app’s own encryption protects content on that hop too. The provider’s server can still see where traffic goes and when. Apps also fit when devices need different server locations.

Start small: check the router model against its maker’s list, put one device on the profile, and run the IP, DNS, IPv6 and tunnel-drop checks before the speed test.