Ranked on documented facts, not sponsored placement - every provider page shows the evidence.
Short answer: Nine providers document router support - one tunnel at the edge covers every device, including TVs and consoles that cannot run apps. The costs: router CPU caps throughput, and the router layer has no per-app kill switch.
providers on this page: 14 · independent audit on file: 79% · court-proven no-logs: 2 · open-source apps: 21%
quick picks
The most honest VPN on the internet, and in 2026 still the one this industry is measured against: numbered accounts, cash or Monero accepted, open-source…
The best-evidenced no-logs claim in the business - twice tested in US courts (2016, 2018) and twice found to have nothing - plus the cheapest long-term renewal…
The most honest mainstream deal in 2026: open-source apps, real audits, a genuinely usable free tier with no data cap, and a transparent renewal model - and in…
A rare genuinely usable free plan (no card, P2P allowed on the 10 GB free tier) plus audited no-logs claims twice over - DefenseCode 2015 and Securitum 2024…
A genuinely interesting infrastructure story wrapped in a jurisdiction problem: Golden Frog built one of the few fully self-owned server networks and invented…
The freemium that actually respects you: a 10 GB free tier, transparent $9/$69 pricing with no renewal rug-pull, open-source Linux CLI, and a CEO who publicly…
The oldest brand in this batch (2005) and the most forgotten: now a footnote inside Ziff Davis's VPN portfolio alongside IPVanish - the sibling that was…
Unlimited devices and a genuinely documented 2025 Deloitte ISAE 3000 no-logs audit - the strongest paper trail in the Kape/Nord orbit. But it is half of the…
The most expensive VPN in the room wearing the most auditing laurels: $8.33/mo forever after a $2.99 teaser, owned by Kape Technologies (ex-Crossrider adware…
Cheap ($2.19/mo intro on 26 months, renews at $56.94/yr = ~2.2x), Romanian-based, and one of few Kape brands whose no-logs claim is Deloitte-audited - but the…
A brand in palliative care that still markets like it's 2018: ZenMate's own announcement closed new signups on March 16, 2023, killed its apps on May 1, 2023…
The most polished sales machine with the most compromised track record: a 2017 CDT complaint to the FTC - built on Carnegie Mellon research - documented…
A strong everyday VPN with a huge live-verifiable network (7,287 servers in 150 countries counted in the official API on 2026-10-01) and a genuine audit…
The cautionary tale of the entire industry: the service that literally proved a VPN's 'no logs' can be a lie - real logs to DHS in 2016, then sold three times…
14 providers document router support, and the honest pitch is coverage: the TV, the console and the thermostat never run VPN clients. The honest cost is symmetric - one exit IP for the whole house, router-CPU encryption, and no per-app switch at the layer where the tunnel lives.
Provider router guides assume third-party firmware - OpenWrt, DD-WRT, Tomato, ASUS Merlin - because stock ISP routers rarely allow WireGuard or OpenVPN clients. That makes router support a two-part purchase: a provider that documents configs, and hardware that can run them. ASUS Merlin is the pragmatic entry (stock hardware, extended firmware); OpenWrt is the flexible one; ISP boxes are usually a dead end. Buy the router for the firmware, not for the vendor badge - the same box runs either. WireGuard's in-kernel design is why modern router setups keep most of your line speed[3].
The router covers the devices apps cannot - and drops the per-app kill switch they had. The attacks that matter locally are TunnelCrack-class routing tricks[1] and TunnelVision's DHCP manipulation[2]; a correctly firewall-ed router blocks the classes that hurt client apps, which is why the operators who published reasoned TunnelCrack responses[4] are the ones whose router guidance we rate. What the router cannot do: port-level exposure control per device (see the torrenting hub on port forwarding's decline[5]) and per-app routing.
One provider tunnel on the router for everything that cannot protect itself; per-device apps with real kill switches on the machines that can run them; policy routing if the router supports it, so a work laptop can exit outside the tunnel. Then verify: the leak test from a device behind the router shows whether DNS actually follows the tunnel - the most common router-VPN failure is a device silently using its hardcoded resolver. If you enjoy the administration, the self-host hub is the next step; if you do not, this page's providers ship the configs. Budget one router-class CPU for WireGuard at line speed: an underpowered router throttles every device behind it, which is the failure mode users blame on the VPN.
One tunnel at the network edge covers every device behind it - smart TVs, consoles, IoT gadgets that cannot install VPN apps. 14 providers in our ranking document router support. It also replaces per-device subscriptions: one account, whole household. The trade: the router's CPU encrypts for everyone, and the router layer has no per-app control.
Firmware is the gate. The providers' router guides target OpenWrt, DD-WRT, Tomato and ASUS Merlin - Astrill's documentation names them explicitly. Stock ISP routers usually cannot run a VPN client at all. If your router cannot flash third-party firmware, the honest answer is that "router support" in the provider's marketing does not apply to your hardware.
Whatever your router's CPU can afford. WireGuard helps enormously - it is designed to run in-kernel and is fast on weak CPUs[3]. OpenVPN on a cheap router can halve your line; WireGuard on the same box often costs single digits. Router-class hardware from the last few years with WireGuard typically keeps most of a 500 Mbit line.
A router tunnel protects devices behind it, but there is no per-app kill switch, and a tunnel drop can fail in ways the router forwards anyway. The TunnelCrack research[1] and TunnelVision[2] showed local-network attackers routing traffic around client VPNs - a router tunnel neutralizes some of those classes for all devices at once, which is a genuine advantage, but firewall discipline on the router itself is what enforces it[4].
Sometimes - one exit IP for everything means geolocal services (weather, local search, some streaming) see a datacenter IP for the whole house. Split-tunneling at router level exists (policy routing by device or subnet) but is configuration work, not a checkbox. The pragmatic pattern: router tunnel for TVs/consoles/IoT, per-device apps with kill switches for laptops and phones.
Different product. A self-hosted WireGuard endpoint gives you full control and one static IP that identifies everything you do - the self-host hub covers the trade. Provider-on-router gives you a shared exit IP, streaming-compatible ranges and no server administration. For most households the provider-on-router pattern is the better default.