Routers with a built-in VPN server

Two jobs, often confused

"VPN router" is used for two opposite setups, and a router can be good at one and useless at the other.

Remote access — a VPN server on your router. You connect back to your home network from anywhere: reach a NAS, a home lab, a printer, or a security camera without exposing any of it to the internet. This is what the list above filters on.

Whole-network tunnelling — a VPN client on your router, sending outbound traffic through a commercial VPN provider. Everything behind the router is covered, including devices that can't run VPN apps. That's a different feature flag; filter for it on the catalog page.

WireGuard or OpenVPN

WireGuard is newer, dramatically faster on the same hardware, and simpler to configure — a keypair and an endpoint. It reconnects near-instantly when a phone changes networks. Prefer it where both ends support it; the WireGuard-only list is narrower and better.

OpenVPN is older and slower — expect roughly a third of the WireGuard throughput on identical hardware — but it's supported nearly everywhere and can run over TCP on port 443, which gets through restrictive networks that block WireGuard's UDP outright. Worth having as a fallback.

IPsec/L2TP shows up on some models. Native client support on phones and laptops is its main advantage; performance and configuration are worse than either of the above.

The number nobody prints

VPN throughput is set by the router's CPU, not its Wi-Fi rating, because encryption runs in software on the main processor. A router advertising 5,400 Mbps of wireless may move 80 Mbps through a VPN tunnel. Neither figure is wrong; they measure unrelated things.

Rough current-generation expectations for WireGuard: 50–100 Mbps on entry-level dual-core ARM, 150–400 Mbps on quad-core mid-range and flagship parts. Divide by about three for OpenVPN. Where a manufacturer publishes the processor, it's on the product page under Processor — and it is a better predictor of VPN performance than everything else on that page combined.

Finally: a server needs to be findable. Home connections usually have changing IP addresses, so check for a dynamic DNS client, and check whether your ISP puts you behind CGNAT — if it does, inbound connections won't reach you at all without a relay, whatever the router supports.