Search for this and you mostly find installation tutorials. But the question people actually ask, judging by what they type, is not how to do it. It is where to put it: on the router, or on each device. Those are two different networks, and the difference is not convenience.
What router-level actually means
Installing the VPN client on the router puts the whole local network behind one tunnel. That is not a figure of speech. OpenWrt's own WireGuard client guide has you assign the VPN interface to the WAN zone and route 0.0.0.0/0 and ::/0 through it, which is every IPv4 and every IPv6 destination. Everything that leaves the house goes through the tunnel, whether it knows about the VPN or not.
That single sentence contains both the appeal and the cost.
What you gain, and it is real
Devices that cannot run a client are covered. A smart TV, a games console, a printer, a thermostat: none of them will ever have a VPN app you trust, and behind a router-level tunnel they do not need one. This is why our guides on Apple TV and consoles treat the router as the clean path rather than a workaround.
Nothing is forgotten. No device left unprotected because someone reinstalled the app and never signed back in. Coverage stops depending on whoever configured each machine.
One licence seat covers the household. A router counts as a single connection with most providers, whatever number of devices sits behind it.
What you give up, and it is rarely said
Everyone shares one exit. The whole house appears from the same country, at the same time. You cannot watch something that requires being in one place while someone else needs to be somewhere else. On a device-by-device setup that is trivial; at router level it is a reconfiguration for everybody.
Turning it off is not local. Some banks and some public services refuse VPN traffic. On a device you toggle the app; on a router you either reconfigure or you exclude that device deliberately, if the firmware lets you.
The encryption moves. Cryptography runs on the router's processor instead of on each device's. That is an architectural consequence, not a benchmark: what it costs you depends entirely on your hardware, and it is worth measuring on yours rather than trusting a number from someone else's.
Firmware decides whether the question even arises. Many stock router firmwares have no VPN client at all. The realistic paths are a router that ships with one, a device flashed to something like OpenWrt, or a second router placed behind the first.
The arrangement most people actually want
Once both columns are on the table, the answer is usually not one or the other. It is a router tunnel for what cannot protect itself, and a client on the laptop and the phone, which follow you outside the house anyway and where you want the switch within reach.
If your reason for wanting router-level was "I want some traffic outside the tunnel", the mechanism you are looking for is split tunnelling, and it exists on the device side too.
The honest summary
Router-level is not the advanced version of device-level. It is a different trade: total coverage in exchange for a single shared exit and a switch that is no longer within arm's reach. Pick it because the devices you care about cannot run a client, not because it sounds more thorough.
Secure your connection with NordVPN
Threat Protection blocks trackers & malware · kill switch · 30-day money-back
