Cheap VPN Router 2026: Selection and Setup

If you are reading this, you have probably already tried to install a VPN application on each device separately — and are tired. Your phone and laptop are manageable, but Smart TV, Apple TV, or PlayStation without a native VPN client become a headache. A cheap VPN router solves this problem once and for all: one tunnel for the entire home network. But another issue arises: not every budget hardware can handle encryption without turning your gigabit internet into 25 Mbps.

This is what this material is about — how to choose a decent cheap VPN router, avoid buying a brick, set up WireGuard, and not lose half your speed.

Why do you need a VPN on a router and who needs it

The honest answer: not everyone. If you have two devices — a phone and a laptop — it's easier to install an application. A VPN router is justified when there are many devices, some of which do not support VPN, and you want to bypass blocks on YouTube, Instagram, Facebook, Twitter/X without hassle on each device.

One VPN for all devices at home at once

A router with VPN is a proxy for the entire network. Once connected, your phone, tablet, laptop, TV, and console are already going through the tunnel. There’s no need to configure each device separately. Guests come over, connect to your Wi-Fi — and they are also automatically under VPN.

When a router is more convenient than an app on your phone

The app on your phone needs to be turned on manually, it sometimes disconnects, and it needs to be updated. A router with a properly configured VPN works continuously from the moment it is turned on. This is especially important for IoT devices: smart bulbs, TVs, consoles — they generally do not support VPN clients.

Smart TV, Apple TV, and consoles without VPN app support

On Android TV, you can still install some client. But Samsung Tizen, LG webOS, Apple TV, PlayStation, Xbox — forget about native VPN. The only way to route their traffic through a tunnel is to do it at the router level. This is where a VPN router is indispensable.

Cons: shared channel, speed is divided among all

And here lies the main problem with budget hardware. All traffic from the entire home network is encrypted by one router processor. If this processor is weak, the speed is divided not only among devices but also cut down by the encryption itself. If you start 4K video on the TV and download something on the laptop — the router may simply not cope.

What does "cheap" mean and where is the boundary of savings

A router for 1500 ₽ and a router for 4000 ₽ are different things. The price in the budget model segment directly correlates with the power of the SoC. This is not marketing, it’s physics: AES256 or ChaCha20 encryption requires CPU cycles, and a weak chip simply cannot keep up.

Budget up to 3000 ₽: what to realistically expect

In this range, you will find routers with MediaTek MT7621, Qualcomm IPQ4018/4019, and similar chips. MT7621, for example, is found in the Xiaomi Mi Router 3G and several TP-Link Archer models. With WireGuard, such hardware gives between 50 to 150 Mbps — depending on the specific chip and firmware. With OpenVPN, you can realistically expect 20–50 Mbps.

Very cheap options up to 2000 ₽ — routers on MT7628 or AR9341 — are honestly bad. They provide 10–30 Mbps on OpenVPN, and you shouldn’t be surprised.

The main parameter — processor and support for hardware encryption

Look at two parameters: CPU frequency (you want at least 800–880 MHz) and the presence of hardware AES acceleration. MT7621 supports hardware AES, but only in factory firmware — in OpenWrt, it is often not utilized. IPQ4019 with a hardware crypto-engine performs better. RAM — at least 128 MB, otherwise OpenWrt simply won’t fit properly.

Why a cheap router cuts WireGuard and OpenVPN speeds

WireGuard uses ChaCha20 — an algorithm optimized for software encryption without special hardware. It performs better than AES on weak CPUs. OpenVPN, on the other hand, adds overhead for TLS handshake, operates in user-space through a tun interface, and puts more load on the processor. The difference can be twofold on the same router.

A used router with support for custom firmware as an option

This is actually a good idea that few people talk about. Keenetic Giga or Ultra from previous generations on Avito cost 1500–2500 ₽ and have a decent processor, support for WireGuard in the native firmware, and a large community. A used Asus RT-AC68U for 2000–3000 ₽ can handle Asus Merlin and OpenVPN at decent speeds. The main thing is to check that the firmware is compatible with the specific revision of the board.

Which protocols a budget router can handle: WireGuard, OpenVPN, IKEv2

Choosing a protocol on a budget router is a compromise between CPU load, compatibility, and resistance to detection by the provider. Roskomnadzor has long used DPI — deep packet inspection systems — and some providers actively throttle VPN traffic.

WireGuard — the lightest for weak hardware

WireGuard has been working in the Linux kernel since version 5.6, uses modern cryptography (ChaCha20, Poly1305, Curve25519), and has a minimalist codebase. On the same MT7621, WireGuard provides about 2–3 times more speed than OpenVPN. If your VPN provider supports WireGuard — go for it.

OpenVPN — the most demanding, cuts speed more than all

OpenVPN operates in user-space, each packet goes through TLS, and the processor gets a serious load. On entry-level routers, this gives 15–40 Mbps instead of the possible 100+. OpenVPN has the best compatibility in the industry — it works everywhere. But for a cheap router, it’s not the first choice.

IKEv2/IPsec — a compromise on load

IKEv2 operates in kernel-space and puts less load on the processor than OpenVPN. On routers with hardware IPsec acceleration (for example, some Keenetic models), it is very fast. The downside: setup is more complicated, and not all providers support IKEv2 for routers.

Shadowsocks, VLESS/XRay, and Amnezia against DPI and throttling

This is where it gets interesting. Standard WireGuard and OpenVPN have recognizable signatures — DPI can see them. If a provider actively throttles VPN traffic, the tunnel may come up, but the speed will be zero. Shadowsocks disguises traffic as random streams, VLESS/XRay mimics HTTPS, Amnezia is a fork of WireGuard with header obfuscation.

But there’s a nuance: these protocols are not always natively supported by cheap routers. On OpenWrt, Shadowsocks is installed via the shadowsocks-libev package, XRay — through a separate build. This works but requires knowledge and time.

Why a regular VPN sometimes doesn’t bypass provider blocks

Providers, under Roskomnadzor's directive, use TSPU (technical means to counter threats) — this is equipment with DPI that can throttle specific types of traffic without breaking the connection. The tunnel exists, packets are flowing, but at a speed of 1–2 Mbps. In this case, only disguising protocols help. Keenetic or OpenWrt with Amnezia WireGuard is a working solution.

Firmware for VPN router: OpenWrt, Keenetic, Padavan, Asus Merlin

Many budget routers from the factory support VPN at the PPTP or L2TP level — these are outdated protocols with minimal security. WireGuard and proper OpenVPN require either the right manufacturer (Keenetic, Asus) or a firmware change.

Factory firmware vs custom firmware

If the router is Keenetic or Asus, the factory firmware is usually sufficient. Xiaomi, TP-Link budget series, Tenda — there, the factory OpenVPN is either absent or so poor that it would be better if it didn't exist. They need OpenWrt or Padavan. Warning: flashing can turn the router into a brick, especially if you take the wrong version for your board revision. Check the compatibility table on wiki.openwrt.org.

OpenWrt — flexibility and WireGuard support

OpenWrt supports WireGuard starting from version 19.07, package kmod-wireguard. There is a web interface LuCI with the plugin luci-app-wireguard. This is a full-fledged Linux, you can install anything: Shadowsocks, XRay, Amnezia. The downside is that the interface is not the friendliest, and for some SoC hardware AES acceleration in OpenWrt does not work, which reduces speed.

Keenetic KeenDNS and built-in VPN client

Keenetic is probably the best option for those who do not want to dig into the console. Models on Mediatek MT7628 (Keenetic Lite) support WireGuard through the OPKG package manager. Older models on IPQ4019 (Keenetic Giga) handle WireGuard at decent speeds. The interface is understandable, and support is normal.

Asus Merlin for Asus routers

Asus Merlin is a custom firmware based on the official Asus, with extended capabilities. It works on RT-AC68U, RT-AC86U, and others. It supports OpenVPN, WireGuard (starting from version 386.x), and scripts for routing configuration. The risk of flashing is minimal — the firmware is close to the official one.

Support for Amnezia and DPI bypass on the router

Amnezia WG on the router is real, but not out of the box. You need an OpenWrt version with amnezia-wg support (the package appeared in 2025), or manual compilation. XRay on the router is installed via the xray-core package in OpenWrt. It works, but be prepared that this is not a "download and forget" — you will need to spend an hour or two.

Step-by-step VPN setup on the router (using WireGuard as an example)

I will show using Keenetic with the WireGuard package installed, but the steps for OpenWrt are similar — only the names of the menu items differ.

Step 1: get the VPN config from the provider

Log into your VPN service's personal account and download the WireGuard config. This is a .conf file with [Interface] and [Peer] sections. It will contain PrivateKey, Address, DNS, and server settings (PublicKey, Endpoint, AllowedIPs). If you use NvoVPN, the config for the router is available in the "My Devices" section — you can also select the desired server there.

Step 2: access the router's admin panel

By default, this is 192.168.1.1 or 192.168.0.1, opened in a browser. On Keenetic — my.keenetic.net. Make sure you are on a wired connection or a reliable Wi-Fi — during the setup process, the internet will temporarily disappear.

Step 3: add WireGuard tunnel and import configuration

In Keenetic: Management → Applications → WireGuard → Add configuration. You can paste the contents of the .conf file entirely. In OpenWrt: Network → Interfaces → Add new interface → Protocol: WireGuard. The fields are filled in manually — Private Key, Listen Port (can be left empty), then you add a peer with Public Key, Endpoint, Allowed IPs.

Step 4: routing — all traffic or selective

AllowedIPs = 0.0.0.0/0 means that all traffic goes through the VPN. This is simpler, but the load on the router is maximum. If you want to route only Smart TV through the VPN, while the laptop connects directly, this is called split-tunneling or policy-based routing.

In OpenWrt, this is done through ip rule and separate routing tables by device IP address. In Keenetic — through the "Routes" section and binding to specific devices on the network. In Asus Merlin — through scripts in /jffs/scripts/. The benefit is real: the TV goes through the VPN, while the laptop gets the full speed of the provider without encryption.

Step 5: check for DNS and IP leaks

After enabling the tunnel, go from any device on the network to ipleak.net or dnsleak.com. You should see the IP of the VPN server, not your real one. DNS servers should also be from the VPN, not from the provider. If you see your provider's addresses in DNS — it's a leak. It can be fixed by adding the VPN DNS servers to the router's interface settings (the DNS field in the [Interface] section of the WireGuard config).

Step 6: speed test before and after

The method is simple: measure the speed on speedtest.net before enabling the VPN, then with the tunnel enabled. Run the test from the laptop via cable to exclude Wi-Fi as a factor. A normal drop on WireGuard and a budget router is 20–40%. If it drops by 70% or more — the problem is either in a weak processor or in the choice of server (take the nearest one geographically).

Bypassing blocks on Smart TV and set-top boxes via the router

This is the main reason why people look towards VPN routers. There is no proper VPN app on Smart TVs, and YouTube is periodically slowed down by providers — making 4K viewing turn into a slideshow.

YouTube and slowdown on the TV

A number of providers in Russia slow down YouTube at the network level through TCP. The TV itself cannot do anything. But if its traffic goes through a VPN router with a working protocol — the slowdown is removed because the provider sees an encrypted tunnel, not YouTube traffic. Important: if DPI starts detecting WireGuard itself, obfuscation is needed.

Instagram, Facebook, Twitter/X on Smart TV and Apple TV

Instagram, Facebook, and Twitter/X are blocked in Russia at the level of Roskomnadzor. There are no VPN apps at all on Apple TV. A router with VPN is the only solution. After connecting Apple TV to your network, the traffic automatically goes through the tunnel, and the browser on Apple TV or apps open blocked resources without additional settings on the device itself.

TikTok and WhatsApp on devices without VPN apps

TikTok in 2026 works in Russia, but with periodic instabilities and slowdowns with some providers. WhatsApp — similarly. If you have a smart TV with a browser or a game console with a browser function, a VPN router solves the problem without any settings on the device itself.

Telegram and bypassing restrictions on set-top boxes

Telegram technically works in Russia, but periodically experiences targeted slowdowns or restrictions. There are no Telegram apps on PlayStation and Xbox, but if the console's browser hits blocks — a router with VPN solves this transparently for the device.

One nuance: Smart TVs sometimes cache geolocation. If the TV determined your region before enabling the VPN router — it may continue to restrict content even after changing the IP. Solution: restart the Smart TV after enabling the VPN tunnel on the router, and in some cases, you need to clear the DNS cache in the TV settings.

Frequent situations that no one warns about

Several real pitfalls encountered when setting up a cheap VPN router.

Gray IP behind NAT at the provider. If the provider gives you an address from the range 10.x.x.x or 100.64.x.x — you are behind double NAT. Some VPN configurations with port forwarding will not work. WireGuard with an external server (client → server) works fine — it does not require incoming connections.

Provider router with locked firmware. Many providers rent out routers with locked firmware change capability and restricted access to advanced settings. The only option is to buy your own router and connect it in DHCP-client mode.

Double NAT. If you connect your router behind the provider's one — you have two networks: 192.168.1.x for the provider and 192.168.0.x for yours. VPN usually works, but speed may drop due to double NAT. Try putting your router in DMZ on the provider's router, or use bridge/transparent mode.

DPI detects WireGuard. The tunnel is up, handshake completed, but ping is not going through or is at a speed of 1 Mbps. This is the DPI cutting traffic by signature. Switch to Amnezia WG or Shadowsocks.

OpenWrt without hardware AES. On some chips, OpenWrt does not use a hardware crypto-engine. For example, on MT7621, hardware AES is available only through a special patch or in the manufacturer's firmware. In standard OpenWrt on the same hardware, the speed of OpenVPN can be 3–4 times lower than in the factory firmware. This is not a bug — it is a feature of the implementation. Solution: WireGuard instead of OpenVPN, or an OpenWrt build with the hwcrypto patch.