· By IMRAN HOSSAIN
Quick answer: Yes, you can run Mullvad or ProtonVPN on OpenWrt, AsusWRT (Merlin) and many DD-WRT builds; use WireGuard where possible for best speed and simpler configs, import OpenVPN profiles where WireGuard is unavailable, and add DNS and routing rules for leak prevention and split tunneling. For higher-level privacy and a side‑by‑side comparison see Mullvad vs ProtonVPN.
- Key takeaways: WireGuard is faster and simpler; use policy routing for split tunneling; force DNS and disable IPv6 to prevent leaks; a router CPU is the main bottleneck for throughput.
- Key takeaways: Mullvad offers single flat pricing and easy WireGuard keys; ProtonVPN provides flexible client options and additional secure‑core style routing depending on plan.
- Key takeaways: Use OpenWrt for the most control, AsusWRT‑Merlin for easy GUI WireGuard, and DD-WRT if your build includes OpenVPN or WireGuard; follow the checklist before flashing.
Which routers and firmware support WireGuard or OpenVPN?
Most modern custom firmware supports WireGuard and OpenVPN; OpenWrt supports both via packages, AsusWRT‑Merlin includes a WireGuard client GUI, and some DD-WRT builds include OpenVPN and experimental WireGuard. If your router is older, check firmware compatibility and CPU capability before installing a VPN. If you use PureVPN, see our step by step router guide for OpenWrt, AsusWRT, and DD‑WRT: Set up PureVPN on a router (OpenWRT, AsusWRT, DD‑WRT).
OpenWrt uses packages called wireguard and luci-app-wireguard; AsusWRT‑Merlin exposes WireGuard in the GUI under VPN, and DD-WRT offers OpenVPN under Services, VPN, with WireGuard only in later builds or entware setups. For a general router VPN rollout and alternatives see this router VPN guide.
How do I install Mullvad on OpenWrt?
Install Mullvad on OpenWrt by adding WireGuard, creating an interface with Mullvad keys, and then creating policy rules to route clients through the tunnel.
Steps, assuming OpenWrt 21.02 or newer: install packages opkg update; opkg install wireguard luci-app-wireguard iptables-mod-tproxy ip-full. Create a WireGuard interface in /etc/config/network using the private key and Mullvad endpoint IP; add allowed IPs 0.0.0.0/0 and ::/0 for full tunnel. Example interface block you can paste into /etc/config/network:
config interface ‘wg-mullvad’
option proto ‘wireguard’
option private_key ”
list addresses ‘10.66.0.2/24’
option mtu ‘1420’
Add peers in the same file or via luci-app-wireguard with Mullvad’s public key and endpoint. Then add a route and firewall zone that forces LAN traffic through wg-mullvad. For routing examples and split tunneling on OpenWrt see the policy routing packages such as mwan3 and luci-app‑vpn-policy-routing; those details match the router strategies in the ProtonVPN vs Mullvad article.
How do I install ProtonVPN on OpenWrt?
ProtonVPN installs on OpenWrt with WireGuard or OpenVPN depending on the plan and your keys, by importing a provider configuration and adding the route and DNS settings to the tunnel interface.
Get WireGuard config from the ProtonVPN account dashboard or use the provider’s client keys. For OpenVPN, use the .ovpn file and place it under /etc/openvpn; then enable and start the openvpn@client service. Set the tunnel interface DNS to ProtonVPN DNS servers and add firewall rules forcing LAN zone to use the ProtonVPN interface. If you need a guided comparison for performance tuning and troubleshooting, see the article on how to fix VPN speed drops.
How do I install Mullvad or ProtonVPN on AsusWRT or AsusWRT‑Merlin?
Use AsusWRT‑Merlin for the easiest router GUI method: import a WireGuard profile or upload an OpenVPN .ovpn file, then enable policy routing and DNS settings in the GUI.
On AsusWRT‑Merlin go to VPN, select WireGuard Client, click Add profile, paste your private key and peer public key, and add Allowed IPs 0.0.0.0/0. Make sure to enable the route all traffic option if you want a full tunnel. For OpenVPN, go to VPN, OpenVPN Client, paste the .ovpn text, username and password if required, and enable NAT. To do split tunneling on AsusWRT‑Merlin use the Policy Rules section and assign LAN IPs or device hostnames to the VPN or WAN route.
How do I install Mullvad or ProtonVPN on DD‑WRT?
DD‑WRT commonly uses OpenVPN profiles; for WireGuard you need a build that includes it or to run a userland WireGuard instance via entware. The general OpenVPN method works on most stable builds.
In DD‑WRT go to Services, VPN, enable OpenVPN Client, paste the provider .ovpn content or fill server, port, and crypto settings, and add TLS auth, ca, cert and key where required. Set DNS to the VPN provider in Services/DNSMasq and add firewall rules to block DNS to outside servers. Because DD‑WRT builds vary a lot, check whether your device supports WireGuard in your specific build before attempting WireGuard; many users avoid DD‑WRT for heavy WireGuard use unless they are on newer builds.
How do I set up split tunneling on a router?
Split tunneling on a router directs specific devices or services through the VPN while the rest use the regular ISP route; use policy routing packages or the router GUI to create per‑IP or per‑port rules.
On OpenWrt install luci-app-vpn-policy-routing, define policies by source IP or mac address and set the gateway to the VPN interface. On AsusWRT‑Merlin use the Policy Rules GUI and assign devices to the VPN. On DD‑WRT add iptables rules that mark packets by source IP and add a separate routing table that uses the VPN gateway; add rules using ip rule and ip route. Test with an exposed IP check for the devices you routed and verify non‑VPN devices still resolve using your ISP DNS.
How do I prevent DNS leaks and enforce DNS over TLS on a router?
Prevent DNS leaks by forcing DNS through the VPN resolver, disabling IPv6 or routing it through the tunnel, and blocking outgoing DNS to non‑VPN servers with firewall rules.
On OpenWrt set /etc/config/dhcp to use the tunnel interface DNS, or configure dnsmasq to forward to provider resolvers and bind to the VPN interface. Add iptables rules that DROP traffic to UDP/TCP port 53 not originating from the tunnel. For DNS over TLS use stubby or unbound to forward to TLS endpoints, or configure the router to use the provider TLS resolver. Always disable IPv6 or ensure IPv6 address blocks go through the tunnel since IPv6 leaks often bypass IPv4 VPN routes.
What are the performance tradeoffs when routing multiple devices through a VPN?
Routing many devices through a VPN increases CPU and throughput load on the router; WireGuard is more CPU efficient than OpenVPN, and consumer router CPUs usually determine your maximum VPN speed.
If your router lacks AES acceleration or a multi‑core CPU, expect speeds to fall well below your ISP line. Using WireGuard typically reduces CPU overhead; enabling hardware offload or moving the VPN endpoint to a faster router or a dedicated device improves performance. For steps to diagnose speed drops and configuration tweaks see the troubleshooting tips in the fix VPN speed drops guide. If you need a headroom estimate, Mullvad historically charged 5 EUR per month which is often compared when budgeting router upgrades on the Mullvad pricing page.
Which one fits you?
Choose Mullvad if you want a privacy‑first, simple WireGuard workflow; choose ProtonVPN if you want flexible plans and extra routing features; use OpenWrt for full control and AsusWRT‑Merlin for easiest GUI setup.
- Beginner, single‑router home: pick AsusWRT‑Merlin with ProtonVPN or Mullvad WireGuard for GUI simplicity and policy rules. See the Asus and Merlin notes earlier and the router guide for general setup router VPN guide.
- Tight budget or privacy purist: choose Mullvad for flat pricing and anonymous account model; it is a good fit when you prefer simple WireGuard keys. Read more comparison context at Mullvad vs NordVPN.
- Small team or creators needing streaming: choose ProtonVPN if you need a provider with diverse exit servers and streaming support; check the streaming guide to pair server choices with use cases best VPN for streaming.
- Advanced users: prefer OpenWrt for full policy routing, dnsmasq, unbound and iptables control; consider separate VLANs per device and use the VPN with a seedbox article if torrenting.
Who should NOT use a router VPN: people with low‑end single‑core routers who need full gigabit throughput, without intent to upgrade; you will see severe slowdowns and complex troubleshooting.
How to choose between Mullvad and ProtonVPN for router use and what hidden costs matter?
Match your router’s CPU and required features to the VPN protocol, then count the true total cost which includes subscriptions and potential hardware upgrades.
Decision framework: first decide protocol, then check router CPU. WireGuard tends to be 2 to 5 times more CPU efficient than OpenVPN on identical hardware, so prefer providers that support WireGuard if your router is low power. Factor in subscription cost and hardware upgrade cost. For example, if Mullvad costs 5 EUR per month (Mullvad pricing page, 2026) that equals 60 EUR a year; if you must buy a $120 router to reach desired speeds the effective first‑year cost doubles. Use the simple rule: if required router upgrade cost exceeds six months of subscription, upgrade the router; otherwise consider a cloud VPN gateway or split tunneling instead. For related comparisons and alternatives consult the Proton and Mullvad comparison pages and competitor writeups such as ProtonVPN vs Mullvad and ExpressVPN vs Mullvad.
Practical checklist before you begin
Follow this checklist to avoid downtime and leaks when installing a VPN on your router.
- Confirm router model supports chosen firmware and has enough CPU and RAM for VPN throughput.
- Back up current firmware and settings; note default login and WAN fallback procedure.
- Create Mullvad or ProtonVPN account and obtain WireGuard keys or OpenVPN profile from the provider; see the provider support pages for exact steps (links below).
- Disable IPv6 or prepare IPv6 routes for the VPN to avoid leaks.
- Plan split tunneling rules and list device IPs or MACs to include or exclude from the VPN.
- Test connectivity on a single device first, check public IP and DNS leak tests, then expand to the whole LAN.
- Have a recovery plan in case you lose remote access to the router, such as physical access or alternate WAN.
Common mistakes and how to fix them
Common router VPN mistakes include missing DNS overrides, not routing IPv6, and using an underpowered router CPU leading to severe speed drops; fix them by forcing DNS to the VPN, disabling IPv6 or routing it through the tunnel, and using WireGuard or upgrading hardware.
Other errors: pasting wrong keys in WireGuard, forgetting AllowedIPs, and leaving NAT disabled. If you see partial connectivity, check firewall zone forwarding and ensure masquerading is enabled on the VPN zone. For speed troubleshooting and specific fixes when VPNs slow your connection see the troubleshooting guide for optimizing speed fix VPN speed drops.
Configuration snippets you can copy and adapt
Below are minimal templates you can paste, replacing placeholders. The WireGuard examples are simplest and recommended when supported.
OpenWrt WireGuard interface example for /etc/config/network:
config interface ‘wg-mullvad’
option proto ‘wireguard’
option private_key ”
list addresses ‘10.66.0.2/32’
config wireguard_wg-mullvad
option public_key ”
option endpoint_host ‘:51820′
option persistent_keepalive ’25’
list allowed_ips ‘0.0.0.0/0’
list allowed_ips ‘::/0’
DD‑WRT OpenVPN client minimal options (Services, VPN, Additional Config):
client
dev tun
proto udp
remote 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
auth SHA256
verb 3
On AsusWRT‑Merlin use the GUI and paste the provider WireGuard keys into VPN, WireGuard Client and enable route all traffic for a full tunnel.
How to verify the VPN is working and not leaking?
Verify by checking a device routed through the VPN with an IP check, checking DNS resolution, and verifying IPv6 addresses are not leaking; run tests from inside the network after enforcing DNS and firewall rules.
Use a public IP check and DNS leak test, then repeat with a device excluded from the VPN to confirm split tunneling. Check router logs for rejected DNS or firewall NAT entries. If you see the ISP IP on a supposedly VPN‑routed device, recheck policy routing and the default route on the router.
What if I want an easier alternative to running VPN on the router?
If router setup is too complex, use provider applications on each device, a dedicated VPN gateway like a small single‑board computer, or a cloud based gateway that forwards traffic into the VPN; each option reduces router CPU load at the cost of extra devices or subscription fees.
For teams or creators who need reliable high throughput consider running the VPN on a small off‑the‑shelf device with a multi‑core CPU and AES support, or host a private WireGuard endpoint in a cloud VM and route traffic through it to reduce latency to the provider. For a migration where you need stepwise changes consult the TeamViewer and migration guides to avoid downtime TeamViewer setup and Sentry to Datadog.
FAQ
Below are short spoken answers to common voice assistant style questions.
- Can I use Mullvad on an OpenWrt router? Yes. Mullvad provides WireGuard keys and OpenVPN profiles; set up the WireGuard interface, import the Mullvad peer public key, and force DNS through the tunnel to avoid leaks.
- How to install Proton VPN on ASUS router? Use AsusWRT‑Merlin, go to VPN, add a WireGuard client profile or OpenVPN client, import ProtonVPN credentials, and set policy rules for devices that should use the VPN.
- How to install Mullvad VPN on router? Download Mullvad WireGuard keys from your account, paste the private key and Mullvad peer in the router WireGuard client, add allowed IPs 0.0.0.0/0 and set DNS to Mullvad resolvers.
- Is Proton VPN still good in 2026? ProtonVPN remains feature rich and is suitable for users who want provider features such as secure core servers and a free tier; choose it if those features matter more than an anonymous payment model.
- Will routing everything through a VPN slow my network? Yes. Expect some throughput loss; WireGuard is faster than OpenVPN, but CPU and router hardware are the main limits, upgrade hardware if you need near line speed.
- How do I prevent DNS leaks when a router is using a VPN? Force DNS to the VPN provider on the router, disable or route IPv6 through the tunnel, and add firewall rules that drop DNS to outside resolvers.
Summary: Use WireGuard on OpenWrt or AsusWRT‑Merlin when possible for best performance. Import provider WireGuard keys or OpenVPN profiles, force DNS through the tunnel, disable IPv6 or route it through the VPN, and use policy routing for split tunnels. If you need stepwise troubleshooting or other provider comparisons, the site has in‑depth guides such as the Mullvad vs ProtonVPN comparison and performance articles like fix VPN speed drops.
Official configuration resources: consult the Mullvad configuration documentation on the Mullvad configuration page and ProtonVPN support and setup pages on the ProtonVPN support site for the latest provider files and account steps.