Start with the need: when it makes sense to put acceleration on the router
Putting the subscription on the router really means swapping one client per device for one shared exit for the whole household. The router dials, encrypts and forwards; laptops, tablets, TV boxes and consoles that join the same Wi-Fi automatically take that route, with nothing to install or sign in to per device. The more devices you have, the more this pays off — with only one or two, it's just extra work for yourself.
You can boil the decision down to three questions: how many devices you have and what kinds, whether you switch regions often, and how much setup time you're willing to spend once to save effort later.
| Typical situation | Better fit | Why |
|---|---|---|
| Many devices, including a TV box, console or smart TV | Put it on the router | These devices can't run a client, so they need a gateway-level exit |
| One laptop and one tablet | Install the client on each | Fast to set up, and any problem stays with you |
| Frequent country and region switching | Manual switching in the client | Changing routes on a router means opening the admin panel; in a client it's one tap |
| A rented flat or temporary home where the router isn't yours | Client | Flashing firmware and editing config affects someone else's hardware |
| A shared household where nobody else wants to tinker | Put it on the router | Set it up once; everyone else just joins the Wi-Fi |
One prerequisite that's easy to overlook is device count. VPNYF subscriptions don't cap the number of devices, so putting the subscription on the router costs no more just because the household is large. What actually limits you is whether the router's CPU can handle encrypted forwarding, not the license count.
- ✅ The router can run plugin-capable firmware such as OpenWrt, Merlin or Padavan, or ships with a proxy client built in
- ✅ You have a computer with internet access on hand, so a broken router config can be recovered
- ✅ The main devices at home connect to this router's Wi-Fi, not the signal from the ONT
- ❌ The router is an ISP-supplied ONT combo that can be neither bridged nor flashed
- ❌ You have devices that rely on LAN discovery (screen casting, network printers, a smart-home hub) and you don't plan to set up split routing
- ❌ You only need it occasionally and don't want to maintain firmware and subscription updates
Hardware and firmware prerequisites: three things to confirm first
Stock firmware rarely offers client mode
Most home routers' stock firmware only provides a VPN server — that is, letting you connect back home from outside. On the client side they usually support only legacy protocols such as PPTP, L2TP and OpenVPN, with no native support for common protocols like Shadowsocks, VMess, VLESS, Trojan, Hysteria2 or TUIC. Running those on a router almost always requires firmware that accepts plugins.
Which firmware you can flash
There are three common paths: OpenWrt (the richest plugin ecosystem — OpenClash, ShellClash and PassWall all live here), Merlin and Padavan (Asus and some other models, with plugins installed via entware), or an x86 soft router running OpenWrt outright. Before flashing, check that your model is on the supported list; flashing carries a risk of bricking the device and can affect the warranty. If you'd rather not flash, go through the stock firmware's feature list first and confirm whether it supports the protocols you need.
Performance is the hard limit
Proxy forwarding means encryption and decryption, and all of that lands on the router's CPU. An entry-level model looks fine with one or two devices, but once the whole household is streaming, downloading and on video calls at the same time, CPU usage pins at 100% and everyone stalls together. The test is simple: if the router already struggles during a full-speed download, adding encrypted forwarding will only make it worse. A soft router or a mid-to-high-end model with hardware acceleration is the safer bet.
Setup walkthrough: from subscription link to whole-home coverage
The order below applies to OpenWrt-family plugins. Entry points differ between plugins, but the logic is the same.
- Install the plugin, keep a way back. Check that the plugin version matches your firmware version. Don't rush to enable transparent proxy; keep SSH or the LuCI admin page reachable so you can roll back if something breaks.
- Copy the subscription link. Find the subscription details in the user panel and pick the format your plugin expects: Clash-family plugins take the Clash subscription, V2Ray-family plugins take the generic one. This link carries your account credentials and is equivalent to a password.
- Import and update the subscription. Paste it into the plugin's subscription manager, save, then trigger an update manually and confirm the node list loads. If it doesn't, check the router's DNS and system time first — a large clock skew makes subscription requests fail outright.
- Pin one route manually first. Don't start with automatic switching. Get the link working on a fixed IEPL dedicated or relay route, and only consider policy groups once it's confirmed.
- Enable transparent proxy and choose split mode. Hand both TCP and UDP to the plugin. Start with rule-based split routing (mainland China addresses direct, everything else through the proxy) and keep global mode for temporary debugging.
- Verify the exit. Open the site's IP lookup page on a laptop and on a tablet, and check whether the exit IP and its location now match the route's location. If both device types agree, the gateway layer is working.
- Re-check each device and back up. For TV boxes and consoles with no browser UI, verify through their own apps — whether streaming starts, for example. Once everything passes, export a backup of the configuration.
The subscription link, the panel password and the router admin password are three different things. A leaked subscription link means someone else can use your traffic for free, so don't paste it into public group chats or post screenshots of it; and don't expose the router admin page to the public internet. When you need to change routes, check the route list first, then go back to the admin panel.
Choosing routes: IEPL dedicated lines vs relay vs direct
The difference between the three comes down to one thing: how your data gets from your home network to the overseas server.
- Direct: your local network connects straight to the overseas server. It's the shortest path, but it depends entirely on the quality of your ISP's international capacity, and it fluctuates most at peak hours.
- Relay: you connect to a relay node first, and that node carries the traffic abroad. The leg inside mainland China usually runs on optimised routes and the outbound leg is scheduled by the provider, so it's steadier than a bare direct connection.
- IEPL dedicated: International Ethernet Private Line — a private link between the two ends that doesn't compete with public internet traffic for bandwidth. It costs the most and is the most stable, which suits latency- and jitter-sensitive use.
On a router, the weighting shifts. A shared household means more concurrent connections held for longer, and the odds of streaming and video calls overlapping at peak hours are far higher than for a single user. In that setting, "how fast can it peak" matters less than "is it steady all evening", so favour IEPL dedicated lines and good-quality relays, and keep direct routes as backup.
| Route type | Path | Stability | Suitable for a router? |
|---|---|---|---|
| IEPL dedicated | End-to-end private link | High; little affected by public-network congestion | Yes — good as the household's main route |
| Relay | Enters via a node in mainland China, then exits abroad | Above average; depends on relay quality | Yes — the value option |
| Direct | Local connection straight to the overseas server | Volatile; depends on the ISP's international capacity | Backup only; not recommended as the main route |
VPNYF currently covers 90+ countries and 210+ routes. There's no need to import all of them onto a router: the more routes in the subscription, the slower the plugin starts and switches, and nobody in the family is going to pick between them anyway. Keep just a few — one dedicated line as the main route, one or two relays as backup, one direct route for emergencies — and use the rest in the client when needed.
Split routing and DNS: the two traps after whole-home rollout
Get split routing wrong and the LAN breaks first
In global mode all traffic goes through the proxy, including screen casting, NAS, network printers and smart-home hubs — traffic that should never leave the local network. The usual symptoms: a tablet can't find the TV, the printer goes offline, the robot vacuum drops its connection. The right approach is rule-based split routing, with private ranges (10.x, 192.168.x and the like) and local domain names explicitly set to direct.
DNS leaks make split routing pointless
If the plugin captures traffic but domain resolution still goes through the ISP's DNS, you get a split state — resolution locally, connection abroad. Split decisions are then based on bad data, and some domains resolve to the wrong CDN node, which shows up as slow page loads and images that never appear. The fix is to enable DNS hijacking in the plugin so queries on port 53 go to the plugin's own DNS, and to confirm dnsmasq isn't fighting the plugin for the same port. After the change, verify with a lookup command:
nslookup example.com 192.168.1.1Replace 192.168.1.1 with your router's LAN address and check whether the answer comes from the DNS server configured in the plugin. If it still comes from the ISP's resolver, hijacking isn't in effect.
IPv6 is the third easy-to-miss gap
If your broadband has IPv6 enabled but the plugin only captures IPv4, some traffic slips out around the proxy — which looks like "some sites go through the proxy and some don't". Either capture IPv6 in the plugin as well, or turn off IPv6 announcements on the router for now. Pick one; don't leave it half on.
Back up the configuration before you touch split-routing rules. The worst outcome of a bad rule isn't slowness — it's the whole household going offline, at the exact moment you need the internet to look up how to fix it.
Troubleshooting: the order to handle three kinds of symptoms
Troubleshooting a router setup follows one principle: restore "the internet works" first, then worry about "is it going through the proxy". The cases below cover most of what you'll hit.
| Symptom | Likely cause | Order of checks |
|---|---|---|
| Nothing in the household can get online | Bad rule or DNS configuration, expired subscription | Turn off transparent proxy and confirm plain internet works, then restore rules one at a time |
| Internet works but the exit IP hasn't changed | Transparent proxy isn't capturing traffic, or the device is using another gateway | Confirm the device's gateway points at this router, then check the plugin is running |
| Only some devices are slow | Those devices are on the ONT's Wi-Fi, or the router is already at full load | Use a single Wi-Fi source, then watch router load |
| One particular app won't connect | UDP isn't captured, or the app uses IPv6 and goes around the proxy | Enable UDP forwarding, then review how IPv6 is handled |
| Everything gets slower after a while | Routes in the subscription have failed, or the router is thermally or memory constrained | Update the subscription and retest on another route, then check device temperature |
Change one variable at a time while troubleshooting: swap the route first, then the mode, and only then touch DNS and firewall settings. Change all three at once and you won't know which one fixed it. Once things are stable, write down the route that works so you can switch straight back next time.
Cost and upkeep: is it worth setting up?
The subscription side is straightforward: monthly plans are ¥9.9 for 60GB, ¥18 for 250GB and ¥28 for 500GB, with data resetting each month on the activation date. If the household is heavy on video and downloads, pay-as-you-go data packs that never expire work out cheaper (¥158/300GB, ¥358/1000GB, ¥658/3000GB). Payment accepts Alipay, WeChat and USDT; signing up needs only a username and password, no email address.
The hidden cost is upkeep: firmware upgrades, plugin updates, subscription refreshes and rule tweaks — a few times a year, at least. If that sounds like a burden, this setup isn't for you: it saves day-to-day effort, not the initial learning curve. Before committing, use the 14-day money-back guarantee as a safety net — get the configuration working, try the routes, and then decide whether to keep it long term.
The short version: if you have plenty of devices, a TV box or console that can't run a client, and you're willing to spend an evening getting the configuration working, putting the subscription on the router is the best value option here. With only one or two devices, or if switching regions on the fly matters more, installing the client on each device is less hassle.
A workable rollout order
Here is all of the above as a timeline — follow it and you won't get lost:
- Check whether your model can run OpenWrt or take plugins; if not, stop at the client option.
- Install the plugin, back up the configuration, and confirm you can roll back from the admin panel.
- Import the subscription and pin one IEPL dedicated or relay route manually.
- Enable transparent proxy with rule-based split routing, and set private LAN addresses to direct.
- Deal with DNS and IPv6 so you don't end up capturing only half the traffic.
- Use the IP lookup page to verify the exit is the same on two different device types.
- Only after a few days of stable operation should you look at policy groups and automatic switching.
If you've done step 6 and the results match, the whole-home exit is unified. Everything after that is optimisation, not a requirement — get it working first, then get it good.