The four specs that matter
A VPN on the router encrypts every device's traffic on the router's own CPU. That makes the router's processor, not its Wi-Fi rating, the usual bottleneck. GL.iNet lists router CPU speed first among the reasons VPN speed falls short, and says speeds commonly land at 30 to 50 percent of the advertised maximum. [4] This guide is based on vendor datasheets and documentation checked on 30 October 2026. We have not benchmarked these routers.
Four things decide whether a router can handle a household VPN. The first is the published WireGuard and OpenVPN throughput. The second is the CPU behind those figures. The third is policy routing, so that some devices or destinations can bypass the tunnel. The fourth is provider integration, which decides how easily your VPN service's servers get onto the router.
| Spec | Why it matters | What to look for |
|---|---|---|
| Published VPN throughput | Sets the ceiling for the whole house | At least 2x your line speed, given the 30-50 percent rule [4] |
| CPU | Encryption runs on it [4] | Quad-core for lines of several hundred Mbps |
| Policy routing | Lets TVs or game consoles bypass the tunnel | Per-device and per-domain rules [3] |
| Provider integration | Decides setup effort and protocol choice | Login-based WireGuard, or clean config-file import [5] |
| Kill switch scope | Decides what happens when the tunnel drops | Per-tunnel and global options [3][6] |
Published throughput: Flint 2 against Beryl AX
GL.iNet's Flint 2 datasheet lists a 2.0 GHz quad-core MT7986 CPU and 1 GB RAM. It rates OpenVPN at up to 880 Mbps with DCO support and WireGuard at up to 900 Mbps, with two 2.5G ports and four 1G LAN ports. [1] The Beryl AX datasheet, for comparison, lists a 1.3 GHz dual-core CPU, WireGuard at up to 300 Mbps and OpenVPN at up to 150 Mbps. [2] Beryl AX is a travel router, but many people consider it for a small flat, so it makes a useful lower bound.
Apply GL.iNet's 30 to 50 percent rule to plan with real numbers. [4] Flint 2's 900 Mbps WireGuard figure works out to roughly 270 to 450 Mbps of VPN throughput, and Beryl AX's 300 Mbps to roughly 90 to 150 Mbps. These are planning estimates from the vendor's own guidance, not measurements.
| Line speed | Router that leaves headroom | Planning figure for VPN traffic |
|---|---|---|
| Up to 100 Mbps | Beryl AX or Flint 2 | Beryl AX about 90-150 Mbps [2][4] |
| 100-300 Mbps | Flint 2 | About 270-450 Mbps [1][4] |
| 300-500 Mbps | Flint 2 with non-essential devices excluded | About 270-450 Mbps for tunnelled devices [1][4] |
| Above 500 Mbps | Flint 2 with policy routing; tunnel only what needs it | Full line speed will not pass through the tunnel |
Policy routing on GL.iNet firmware
On GL.iNet firmware v4.9 and later, each VPN tunnel has a client source and a target. The client source can be All Clients, Specified Connection Types (such as the LAN, guest network or Drop-in Gateway), Specified Devices by MAC address, or Exclude Specified Devices. The target can be All Targets, a specified domain or IP list, or an excluded domain or IP list. You can add several tunnels. Traffic is checked against the highest-priority tunnel first, and each group can hold several VPN profiles that fail over within the group. [3]
Traffic that matches no tunnel goes to All Other Traffic. By default this is Allow Non-VPN Traffic, which sends it out over the normal WAN. The alternative, Enhanced Kill Switch, blocks unmatched traffic. Each tunnel also has its own Kill Switch option that decides whether its traffic is blocked, or falls back to All Other Traffic, when the VPN drops. [3] On firmware v4.8 and later, GL.iNet's kill switch FAQ describes the per-tunnel switch as on by default once a tunnel is active. [6]
Worked example: 500 Mbps line, two TVs outside the tunnel
A household has a 500 Mbps connection. It wants every phone and laptop on a VPN, and two smart TVs on the normal connection so local streaming apps see a home-country IP. With Flint 2 as the main router, create one WireGuard tunnel with client source set to Exclude Specified Devices, and add the two TVs' MAC addresses. Leave the target as All Targets. Keep All Other Traffic on Allow Non-VPN Traffic, so the excluded TVs reach the internet directly. [3]
Expected result on vendor figures: the tunnelled devices share about 270 to 450 Mbps, and the TVs use the remaining line capacity directly. [1][4] Two pitfalls. If you switch All Other Traffic to Enhanced Kill Switch, the TVs match no tunnel and lose internet entirely. [3] And if a TV uses a randomised MAC address on Wi-Fi, the exclusion will not match it, so turn off MAC randomisation on the TVs or connect them by Ethernet to one of Flint 2's four LAN ports. [1]
- Record each TV's MAC address from the router's client list before writing the rule.
- Set one tunnel with Exclude Specified Devices, add the TVs, and keep the target as All Targets. [3]
- Leave All Other Traffic on Allow Non-VPN Traffic. [3]
- Test from a phone (should show the VPN IP) and from a TV (should show your ISP IP).
- If total VPN throughput feels low, move the tunnel to a closer server and consider lowering the MTU as GL.iNet suggests. [4]
Provider integration: NordVPN and Proton VPN
GL.iNet's VPN client page lists login-based WireGuard setup for AzireVPN, Hide.me, IPVanish, Mullvad, NordVPN, PIA, PureVPN, Surfshark, Windscribe and X-VPN. NordVPN is the only provider with login-based OpenVPN setup. Every other provider is added manually from a configuration file. [5] NordVPN also offers manual OpenVPN (UDP or TCP) and WireGuard (NordLynx) configuration files in Nord Account, and recommends Verified servers for manual setup. [8] It says its apps use NordLynx by default and that NordLynx is the choice for speed. [10] One account allows 10 simultaneous devices, and a router uses one slot. [7]
Proton VPN is not on GL.iNet's login list, so you download a WireGuard configuration from your Proton account and upload it. Proton says its WireGuard configurations work with WireGuard clients built into routers, and that free-plan users can only choose the VPN Accelerator option when creating one. [11] Proton's router article says a router counts as a single device and that Plus allows up to 10 connections. [12] On 30 October 2026 Proton's pricing page listed VPN Plus at $83.76 for the first 24 months ($3.49 a month), then $83.88 every 12 months, with a 30-day money-back guarantee. [9]
| Service | GL.iNet setup route | Router device count | Notes |
|---|---|---|---|
| NordVPN | Login-based WireGuard or OpenVPN, or manual files [5][8] | 1 of 10 slots [7] | NordLynx is the default and speed choice [10] |
| Proton VPN | Manual WireGuard config upload [5][11] | 1 device; Plus allows 10 [12] | Free plan: only VPN Accelerator option in configs [11] |
| Surfshark and others on the list | Login-based WireGuard [5] | Check provider terms | Not covered in depth here |
Who should not run the VPN on the main router
If your line is faster than about 1 Gbps and everyone wants the VPN, no router in this comparison will pass full speed through the tunnel on its published figures. [1][2] Run VPN apps on the few devices that need them and leave the router unencrypted, or tunnel only specific devices with policy routing. [3] Proton's router article also warns that local services can stop working when the whole network appears to be in another country, and that switching servers gets harder once the VPN lives on the router. [12] If your household changes VPN locations often, per-device apps will be easier to live with.
Questions before you decide
Does a router VPN count against my VPN device limit?
As one device. NordVPN says a router uses one device slot while protecting every device on the network, out of 10 simultaneous connections. Proton VPN says a router counts as a single device, and its Plus plan allows up to 10 connections.
Which VPN services can a GL.iNet router log in to directly?
GL.iNet's VPN client documentation lists login-based WireGuard setup for AzireVPN, Hide.me, IPVanish, Mullvad, NordVPN, PIA, PureVPN, Surfshark, Windscribe and X-VPN, and login-based OpenVPN only for NordVPN. Other services, Proton VPN among them, are added by uploading a configuration file with Add Manually.
Will excluded devices lose internet if I turn on the kill switch?
They can. In GL.iNet's VPN dashboard, traffic that matches no tunnel falls to All Other Traffic, which allows non-VPN traffic by default. If you enable Enhanced Kill Switch, unmatched traffic is blocked, so a TV you excluded from the tunnel would have no internet. Use the per-tunnel kill switch instead if you want excluded devices online.
Is WireGuard or OpenVPN better for a whole-home router VPN?
On GL.iNet's published figures WireGuard is faster on most models. Beryl AX lists 300 Mbps WireGuard against 150 Mbps OpenVPN. Flint 2 is the exception, listing 900 Mbps WireGuard and 880 Mbps OpenVPN with DCO. NordVPN says its apps default to NordLynx, its WireGuard-based protocol, for speed.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- GL.iNet Flint 2 (GL-MT6000) datasheet, version 20251103 Accessed 30 Oct 2026
- GL.iNet Beryl AX (GL-MT3000) datasheet, version 20250320 Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Dashboard (firmware v4.9 and later) Accessed 30 Oct 2026
- GL.iNet Router Docs 4: Why is my VPN speed slower than expected Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Client Profile Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Kill Switch (Block Non-VPN Traffic) Accessed 30 Oct 2026
- NordVPN Support: How many devices can I use with NordVPN? Accessed 30 Oct 2026
- NordVPN Support: How to find various server configuration files for NordVPN Accessed 30 Oct 2026
- Proton VPN pricing (USD) Accessed 30 Oct 2026
- NordVPN Support: Which NordVPN protocol should I choose Accessed 30 Oct 2026
- Proton VPN: How to download WireGuard configuration files Accessed 30 Oct 2026
- Proton VPN blog: How to set up a VPN router Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.