Guide to installing Proton VPN on different routers
There are many advantages to configuring your router to run Proton VPN. These include:
- No need to set up a VPN on each device
- Protects devices that don’t support VPNs
- Automatically secures all your Internet traffic
- Protects your entire household with one device
We don’t recommend you attempt to set up a VPN connection yourself unless you are a tech-savvy user. You cannot set up Proton VPN on any router.
You can install Proton VPN on routers that support OpenVPN or WireGuard as a client (instead of as a server).
Note that routers your Internet service provider gives you will generally not support VPN configurations.
This means you must either find a router that has a VPN client package, which can take some research, or you must “flash” (or install DD-WRT software) on your router, which comes with the risk of rendering your router inoperable if you make a mistake.
However, if you are a tech-savvy user, we have created several guides for the routers and firmware that work with Proton VPN:
Proton VPN router guides
We have partnered with InvizBox to create a router specifically for Proton VPN. This router is open source and configured to connect easily to your Proton account.
- AsusWRT using OpenVPN
- AsusWRT using WireGuard
- AsusWRT-Merlin using OpenVPN
- DD-WRT
- FreshTomato
- Gl.iNet Flint using OpenVPN
- MikroTik using WireGuard
- OpenWRT
- pfSense using OpenVPN
- pfSense using WireGuard
- Vilfo router
FAQ: Proton VPN on routers
Q: Will my connection speed slow down if I set up Proton VPN on my router?
A: That depends on the processing power of your router. If your router cannot handle the additional VPN encryption, then yes, you could see slower speeds.
Q: Will having Proton VPN on my router protect all my connections?
A: The VPN on your router will protect the connections of all devices connected to the router, but not necessarily the connection between the device and the router. The VPN encryption takes place on your router, which means it only applies to the traffic between your router and your Internet service provider. As long as your router is password-protected and you do not have any unknown devices connected to your network, this should not be an issue.
Other local network connections, like a Bluetooth connection between your smartphone and speaker, will not be protected.
Q: Once I set up a VPN on my router, do I need to do anything else?
A: A router, like any other device, needs to be updated regularly to receive the latest security improvements. If they are not updated, routers can become incompatible and stop supporting Proton VPN’s service. This can happen if the router is running an outdated version of OpenVPN (e.g., 2.3) or an old version of the SSL/TLS networking stack. (These examples are taken from user issue reports.)
Keeping your router up to date will help it stay compatible with our servers. When you are selecting a router to install Proton VPN on, you should choose one from a brand with a good track record of keeping its firmware up-to-date.
If you have any questions, please contact our Support team.
How to set up Proton VPN on an OpenWrt router using OpenVPN
You can set up Proton VPN on your router, which will protect every device that connects to the internet using that router. In this guide, we take a step-by-step look at how to set up Proton VPN on an OpenWrt router using the OpenVPN VPN protocol.
Please note that we only support OpenWrt 22.03+. If you’re running an older version of OpenWrt, we recommend upgrading to the latest version of the firmware.
- Learn more about why you should set up a VPN on your router.
- Learn more about OpenVPN
We also have guides for setting up Proton VPN on a wide selection of other popular routers.
Before starting, you’ll need the following:
- A computer that’s connected to your LAN network so that you can access your OpenWrt router’s web interface. To do this, enter 192.168.1.1 into your browser’s URL bar.
- Your OpenVPN username and password. These are different from your regular Proton VPN username and password. To find them, sign in to account.protonvpn.com and go to Account → OpenVPN / IKEv2 username.
How to set up Proton VPN on an OpenWrt router
1. Download an OpenVPN configuration file
Sign in to Proton VPN using your Proton Account username and password at account.protonvpn.com, go to Downloads → OpenVPN configuration files, and download an OpenVPN configuration file. Be sure to Select Platform: Router.
2. Install the required packages
Follow these official instructions to install the following packages for OpenWrt: openvpn-openssl and luci-app-openvpn.
Once you’ve done this, turn your router off and then on again. The OpenWrt web interface will now have a new OpenVPN configuration page.
3. Upload and edit your OpenVPN config file
In the OpenWrt web interface, go to VPN → OpenVPN → OpenVPN configuration file upload → Browse… and select the OpenVPN configuration file you downloaded in step 1.
Now go to OpenVPN instances and click Edit next to the OpenVPN configuration file you just uploaded.
Look for the line beginning auth-user-pass and add the full path to the username/password .auth file. You can find this lower down on the page next to the heading Section to add an optional ‘auth-user-pass’ file with your credentials.
In the box under Section to add an optional ‘auth-user-pass’ file with your credentials, enter your OpenVPN username and password. Remember: These are different from your regular Proton VPN username and password.
Note: to use our NetShield DNS filtering feature, append the suffix +f1 to your username to block malware or +f2 to block malware, ads, and trackers (for example, 123456789+f2).
Click Save, then go to VPN → OpenVPN → Save & Apply.
4. Start and enable the OpenVPN client
Go to OpenVPN instances → tick the Enabled checkbox → Start for the VPN interface you just created. The OpenVPN connection can take up to 10 seconds to start (and close).
Click Save & Apply when you’re done.
4. Configure firewall rules
The VPN is now set up, and your router can use it. However, devices that connect to the router won’t be able to access the internet. To fix this, we need to configure some firewall rules. Go to Network → Firewall → Zones → Zones ⇒ Forwardings → wan (red zone) → Edit.
Go to the Advanced Settings tab → Covered devices and select Ethernet Adapter “tun(x)” from the dropdown menu (this will probably be tun0 if you only have a single VPN interface running).
Click Save, then click Save & Apply.
5. Configure DNS settings
Go to Network → Interfaces wan → Edit.
Go to the Advanced Settings tab and configure the following settings:
- Use DNS servers advertised by peers: Unchecked
- Use custom DNS servers: 10.2.0.1
Click on Save, then Save & Apply.
6. Run a test
Establish a VPN connection. To verify the VPN is working, visit ip.me from any device on your network. To ensure there are no DNS leaks, go to dnsleaktest.com.
Secure
your internet
- Strict no logs policy
- All apps are open source and audited
- High-speed connections (up to 10 Gbit)
- Based in Switzerland
- 30-day money-back guarantee
How to setup Proton VPN on MikroTik routers using WireGuard
You can set up Proton VPN on your MikroTik router so that all devices that connect to the internet through it are protected by Proton VPN.
In this guide, we show you how to do this using the WireGuard VPN protocol on MicroTik routers running RouterOS 7. This requires a Proton VPN Account
How to set up Proton VPN WireGuard on MikroTik routers (update)
1. Download a WireGuard configuration file
Open it using any text editor.
Note that you can’t use a saved config file. Proton VPN never stores your private keys, so saved config files don’t have them. You must create and download a new config file.
2. Open the MikroTik configuration panel
To do this, open a command line (using Terminal on Linux and macOS or PowerShell on Windows) and enter:
ssh user@192.168.88.1
3. Create a new WireGuard interface
Using the command line, enter the following text and tap . To find your private key, look for the line starting PrivateKey= in the WireGuard config file you downloaded in step 1.
/interface wireguard add listen-port=13231 mtu=1420 name=wireguard-inet private-key=”your private key”
All following steps will involve you entering commands into the command line.
4. Add an IP address to the interface you just created:
/ip address add address=10.2.0.2/30 interface=wireguard-inet network=10.2.0.0
5. Add a WireGuard server as a peer
Add the endpoint address, endpoint port, and public key from the WireGuard config file. Look for the lines starting PublicKey= and Endpoint=.
For example, if the config says Endpoint=103.107.197.2:51820, enter endpoint-address=103.107.197.2 and endpoint-port=51820
/interface wireguard peers add allowed-address=0.0.0.0/0 endpoint-address=x.x.x.x endpoint-port=xxxxx interface=wireguard-inet persistent-keepalive=25s public-key="your public key"
6. Enable masquerade for that interface
Note: This setup assumes that you are using the default local network address used by MikroTik. If you have changed this, use that address for scr-address= instead.
/ip firewall nat add action=masquerade chain=srcnat out-interface=wireguard-inet src-address=192.168.88.0/24
7. Redirect all internet traffic through WireGuard
/ip route add disabled=no distance=1 dst-address=0.0.0.0/1 gateway=10.2.0.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10 add disabled=no distance=1 dst-address=128.0.0.0/1 gateway=10.2.0.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
8. Configure DNS settings
/ip dns set servers=10.2.0.1 /ip dhcp-client set 0 use-peer-dns=no
9. Redirect the WireGuard IP address through main provider’s gateway
Replace x.x.x.x with the endpoint address from the config file (Endpoint=).
/ip route add disabled=no dst-address=x.x.x.x/32 gateway=[/ip dhcp-client get [find interface=ether1] gateway] routing-table=main suppress-hw-offload=no
10. Restart your router
And you’re done! Your router should now protect all internet connections it provides with Proton VPN.
Why you should set up a VPN on your router (and how to do it)
Posted on February 27th, 2020 by Proton Team in How-to.
A VPN is one of the best ways to protect your online data and prevent your internet service provider from spying on your browsing history. However, a VPN only protects your internet connection on the device it’s installed on — unless you set up the VPN on your router.
By running your VPN, not on your smartphone or laptop, but your router, you are shifting the VPN’s security coverage from a single device to your entire network. All the devices connected to your WiFi network will have their traffic encrypted by the VPN tunnel.
You can set up Proton VPN on your home local network and protect all of your network traffic. There are a few ways to do this:
- You can install Proton VPN on your existing router as long as it features a built-in VPN client.
- You may be able to add VPN support to your router by flashing a new firmware version.
- You can purchase a standard router that is VPN-ready. You can also purchase a specialized VPN router, such as the InvizBox 2, that is already configured for Proton VPN.
Four reasons to set up a VPN on your router
Most people set up and use a VPN on individual devices rather than setting up a VPN on their router for network-level coverage. Although it takes a little more work than simply installing Proton VPN on your devices, there are several good reasons to set up a VPN on your router instead.
1. No need to set up a VPN on each device
Once you set up a VPN on your router, you don’t need to use a VPN app on your other devices while connected to your home network. This saves you from having to download a different VPN app for each device. Instead, as long as you are connected to your home WiFi, your traffic will be protected by the VPN on your router.
However, you should still install a VPN app on your mobile devices, such as your laptop and smartphone, as your data will not be protected by the VPN on your router if you are connected to public WiFi or your mobile network.
2. Protect devices that don’t support VPNs
More and more devices, like smart speakers and smart TVs, are connecting to the internet. Many of these smart devices do not support a VPN app. (How would you even install a VPN on your smart microwave in the first place?) This means that your internet service provider can monitor all the activity of the smart devices in your home — unless you set up a VPN on your router.
If you have installed a VPN on your router, any device that is connected to it will have its traffic encrypted, including smart devices. This adds a much-needed layer of security to the smart devices in your home.
Installing a VPN on your router could also help access blocked content if, for instance, your smart TV comes equipped with a YouTube app. By setting your location to another country, you can access shows and movies that would otherwise be geo-blocked in your location.
3. Securing your data is even easier
While signing into a VPN app is not difficult, it may be beyond the technical abilities of others in your home, especially if you live with children or elderly relatives. By setting up a VPN on your router, you can protect the traffic of everyone in your home at once.
Setting up a VPN on your router also protects your guests without them needing to download Proton VPN onto their device or having to compromise the security of your password by sharing it with them.
By running a VPN on your router, using VPN protection is as easy as just connecting to your WiFi.
4. A router protects your entire household with one device
A router counts as a single device when you are looking at how many connections you can have on your VPN at once. As previously mentioned, your router then provides a VPN-protected connection to everyone who is connected to your router, no matter how many devices you connect to it. Even if your whole family is browsing the internet on their smartphones at the same time, if they are all connected to your VPN-equipped router, then that router is the only device that counts towards your connection limit.
Installing a VPN on different types of routers
Depending on the type of router you have, you can either install a VPN manually or flash the router with third-party firmware. However, both of these methods come with their drawbacks: installing a VPN manually on a router can be complex and time-consuming, and when you flash a router, there’s a small chance you will “brick” it, or render it inoperable.
On a VPN-ready router
You can set up a VPN connection yourself on any router that supports the OpenVPN or IKEv2 protocol. Generally, routers that support the OpenVPN protocol will be advertised as having a “VPN client” package or similar — so look for this language if you are considering buying a new router.
Flashing a router
If you prefer to install Proton VPN on a router you already own that doesn’t have a VPN client package, you can try to “flash” your router by installing third-party firmware such as DD-WRT, Fresh Tomato, or OpenWRT onto it. This firmware replaces the standard firmware of your router so it can connect to a VPN. (Here is a list of all the devices supported by DD-WRT.)
How to install Proton VPN on your router
Setting up a VPN on your router can be a daunting task that could result in bricked hardware, so we only recommend it for tech-savvy users. If you’re feeling brave, then here are our guides on setting up a Proton VPN connection on routers yourself:
- How to set up Proton VPN on Tomato routers
- How to set up Proton VPN on DD-WRT routers
- How to set up Proton VPN on Vilfo routers
- How to set up Proton VPN on AsusWRT routers
Pre-configured routers
If you find the reasons to use a VPN router persuasive but are concerned about trying to set up a VPN for your router yourself, then you can buy one that is pre-configured for VPN connections. This means you will be able to connect to Proton VPN from your router right out of the box without any manual setup.
Proton VPN compatible router from InvizBox
Created by InvizBox specifically for Proton VPN, this open-source router comes pre-configured out-of-the-box for Proton VPN.
Simply plug the InvizBox into your existing router/modem and sign in using your Proton VPN account details. Then you will be able to connect as many devices as you like to it over WiFi. In addition to all the protections that installing a VPN on your router provides, the InvizBox is 100% open source and allows you to configure different VPN profiles (for example, a streaming profile and a local high-speed profile).
The InvizBox also includes ad and malware filtering, lets you set time limits for children’s internet access, and allows age-related website blocking.
Visit the InvizBox website to purchase the Proton VPN compatible router from InvizBox. We also have a detailed guide on how to set up the InvizBox 2 with your Proton VPN account.
Pre-flashed router from Flashrouters
Flashrouters is a company that specializes in flashing routers with DD-WRT firmware, so you do not need to “flash” the router yourself. DD-WRT handles the firmware modifications necessary to run a VPN on a router, and the Flashrouters Privacy App allows you to manage the VPN settings on your router via a simple graphic user interface. As of August 2021, Flashrouters also supports WireGuard.
Flashrouters’ Privacy App also lets you switch which VPN server you are connected to with a single click. If you get a router from FlashRouters, it will also support Proton VPN features like kill switch and auto-connect.
Follow these steps to set up Proton VPN on your router with the FlashRouters Privacy App. You can contact FlashRouters support if you have any questions or issues.
Click here to purchase a VPN router from Flashrouters.
Drawbacks to installing a VPN on your router
Although installing a VPN on your router provides many benefits, there are also some potential drawbacks that you should consider before you decide to set up a VPN on your router.
Difficulties accessing content
Once you have set up a VPN for your router, it’s possible that you will lose access to some local services — especially if you connect to a server outside of your country. You may also lose access to some services that block known VPN IP addresses.
One partial workaround for this is to use a multi-band router and set up a VPN on one band (for example, the 5 GHz band) and not on the other (2.4 GHz band). Then you can just switch between the WiFi networks to use the VPN or not. The same applies if you have a guest network.
Potentially slower connection
Although Proton VPN has extremely fast VPN servers, connecting to any VPN will always affect your connection speed to some degree. Although the speed difference may not even be noticeable, you should consider if this is something everyone who is connected to your home network is comfortable with.
Proton VPN’s VPN Accelerator can increase your VPN speeds by over 400%, thus reducing any VPN lag to a negligible amount..
Not all routers support VPNs
You can’t use a VPN on every router, so before you begin the installation process, it’s important to check that your router is able to support a VPN connection. You may also want to consider purchasing a router that supports the WireGuard, OpenVPN, or IKEv2 protocols, or buy a router that is pre-configured for VPN.
Server flexibility
When connecting to a VPN via your router, you can lose some flexibility. For example, changing VPN servers can become more difficult. If you frequently change the server you are connected to (for example, if you like to access content from around the world), you may not wish to install a VPN on your router.
Trustworthiness
It’s almost impossible to verify that your router (or any hardware you purchase) does not have a back door through which your browsing data can be accessed. If you decide to buy a new router to handle your VPN connection, it’s important that you purchase it from a vendor or brand that you trust.
This is one of the benefits of using open-source VPN firmware such as DD-WRT and OpenWRT, as anyone can review their code to ensure that there are no back doors.
VPN for routers FAQ
Can you install a free VPN on your router?
Yes. You can install Proton VPN on your router with a Proton VPN Free plan. The router only counts as one connection on a Free plan, no matter how many devices you connect to your router. However, if you use a Proton VPN Free plan on your router, you will only be able to connect to our Free plan servers, located in the Netherlands, the US, and Japan, which are typically slower than our Plus servers as they have more load.
With a Proton VPN Plus plan, you can have up to 10 VPN connections, which means you are able to install the Proton VPN app on your mobile devices for full VPN coverage when you are away from your home WiFi. By installing a Proton VPN on your router with a Plus plan, you will gain access to our superfast Plus servers in over 60 countries.
How do you uninstall Proton VPN from a router?
All routers are different, but in most cases you will be able to easily remove your VPN profile in the settings. If necessary, you can also uninstall the VPN from your router by resetting it. If your router comes with a pre-installed VPN, you will be able to remove your VPN profile from the device, or you can flash the router with new firmware. Steps for uninstalling on InvizBox can be found here.
How do I know if my router has VPN?
Routers that are compatible with VPN are usually described as having “VPN client software”. You can find this information in your router’s manual or by searching for the make and model name online. If you use an ISP router (usually the case if you use a combined router and modem device), it’s unlikely it is able to connect to VPN. If this is the case, you will need to purchase an additional VPN-compatible router.
What should I look for in a router for VPN?
If you are trying to choose between VPN-compatible routers, you should prioritize the following features:
- WiFi 6 (IEEE 802.11ax) support (or the latest WiFi standard available)
- Frequencies — ideally a router that supports both 2.4GHz and 5GHz bands
- Multiple ports — a router with multiple ports allows you to make the most of its functionality
- User-friendliness — an easy-to-use interface will make installing a VPN on your router simple
Protect your traffic with Proton VPN
Proton VPN is dedicated to defending everyone’s right to online privacy. By running a VPN on your router, you are bringing Proton VPN protection to your entire home with a single device. You can contact us if you have any more questions about installing a VPN on your router.
Proton Team
Proton was founded by scientists who met at CERN and had the idea that an internet where privacy is the default is essential to preserving freedom. Our team of developers, engineers, and designers from all over the world is working to provide you with secure ways to be in control of your online data.