Set up Veystrix on your router
Covers every device in the house, including the ones that cannot run an app.
Sign in to download your configuration file, or see plans.
A router tunnel covers everything in the house at once, including the things that cannot run VPN software: televisions, consoles, smart speakers, plugs and bulbs.
It is also the fiddliest option on this site, so here is the honest version first.
Should you?
Yes, if: you want your television or console covered, you have more devices than your plan allows individually, or you want it on without thinking about it.
No, if: you only care about your phone and laptop. Apps are easier, and they let you change country per device.
A sensible middle: run it on the router for a guest network containing only your smart devices and the TV, and keep apps on your phone and laptop. Your router's guest network is the right home for those devices anyway — see your home router.
Which routers can do this
Works well:
- GL.iNet travel routers — WireGuard built in, genuinely simple, and the usual recommendation
if you are buying something for this.
- OpenWrt on supported hardware.
- Asus routers running Asuswrt-Merlin firmware.
- Ubiquiti, MikroTik, pfSense and OPNsense for anyone already running them.
Cannot, usually: the router your broadband provider gave you. BT, Sky, Virgin and TalkTalk routers do not support WireGuard and cannot be made to.
If yours is provider-supplied, the practical route is a second router behind it, or a GL.iNet box for the devices you care about.
The general shape
The menus differ by firmware, but every one goes like this:
1. Sign in at your account and download a configuration. 2. Open the router's admin page and find VPN, then WireGuard, then Client — not Server. 3. Import the .conf file, or paste in the fields it asks for: private key, address, DNS, peer public key, endpoint and allowed IPs. They are all in the file, which is plain text you can open in any editor. 4. Enable the tunnel and apply. 5. Set which devices or which network use it, if the firmware supports routing rules. This is how you cover the TV but not the work laptop.
Check it worked
From a device on that network, open veystrix.net/tools/ip. It should report our network.
Check a device you did not expect to be tunnelled as well, so you know the routing rules are doing what you think.
What this does not fix
A router tunnel hides your traffic and your address from your internet provider. It does not stop a smart television recognising what is on screen and reporting it — that happens inside the set before anything touches the network. Turn that off in the TV's own settings; there is more in your television is watching back.
It also does nothing for a router with a default admin password or unpatched firmware. Do those first.
If it does not work
No internet at all after enabling. DNS is the usual cause. Set the router's DNS to the one in your config, or temporarily to 1.1.1.1 to confirm the tunnel itself is up.
Slow for everything. A consumer router's processor is doing the encryption. Older hardware struggles past about 100 Mb. This is the main real cost of the router approach.
Some sites refuse to load. Reduce the MTU in the router's WireGuard settings, typically to 1412 or 1380.