Routers with a built-in WireGuard server

Server or client — they are not the same feature

A WireGuard server on your router lets you reach your home network from outside it: your phone on hotel Wi-Fi connects back, and you're on your LAN. A WireGuard client points the other way — the router sends its own traffic out through a VPN provider, covering every device behind it, including the ones that can't run VPN software themselves like a TV or a games console.

Most routers here do both, but not all of them, and manufacturers use "VPN support" for either. WhichRouter tracks the two as separate specs, so the list above is servers only. If you want the wider list, the VPN routers guide includes OpenVPN.

Throughput is a CPU spec, not a Wi-Fi spec

This is the part spec sheets bury. WireGuard encryption runs on the router's main processor, and consumer routers rarely have crypto acceleration for it. So your VPN speed is set by the CPU, and it has nothing to do with the AX5400 or BE9300 number on the box.

The practical range on current consumer hardware is roughly 50–100 Mbps on low-end dual-core ARM parts, 150–400 Mbps on the quad-core chips in mid-range and flagship routers, and higher only on the few models with dedicated crypto engines. A gigabit connection through a router-hosted WireGuard tunnel is not something most of this category can deliver — and OpenVPN on the same hardware is typically a third of the WireGuard figure, which is the main reason to prefer WireGuard where you have the choice.

Where a router publishes its processor, WhichRouter lists it under Processor on the product page. Compare that before you compare radios.

What else to check

• Does the stock firmware expose it? Some routers only get WireGuard through third-party firmware. The OpenWrt guide covers those.
• Key management. Some vendors generate config files and QR codes for you; others hand you a text box and expect you to know what a peer is.
• Dynamic DNS. A server is only reachable if you can find it. Most home connections have a changing IP, so a built-in DDNS client is close to required.