Best router for NordVPN: what actually works

Most buying guides answer a different question than the one you’re actually asking. They rank routers by Wi-Fi generation and radio speed, on the theory that a bigger number on the box means faster NordVPN. NordVPN’s own support documentation points elsewhere: NordLynx, the WireGuard-based protocol that gives the app its speed reputation, lives on pre-configured routers, and a standard router you set up yourself “will not support NordLynx.” What the setup tutorials leave you with is OpenVPN. So the real question is which of three routes gets NordVPN onto your network, and what each one costs you. For the wider field beyond one provider, start with our full VPN rankings.

The three routes onto a router, compared

Ways to run NordVPN on a router, per NordVPN's and each router maker's own documentation (24 Jul 2026)

Route	What you actually run	Router cost	The catch
Stock Asus firmware — RT-AX86U, RT-AX68U, RT-AX88U, and the current Pro models	OpenVPN	Not published by NordVPN	The Pro models ship a WireGuard client and VPN Fusion split tunnelling; neither is usable with NordVPN
Custom firmware — GL.iNet (OpenWrt), Merlin, DD-WRT	OpenVPN	$119.99–$209.99 for GL.iNet’s own hardware	Merlin only patches Asus firmware, so it still needs Asus hardware underneath
Pre-configured router (Privacy Hero 2)	NordLynx — NordVPN calls it "exclusive NordLynx integration"	Not listed in NordVPN’s router guidance	The only route to NordLynx; you are buying the setup as much as the hardware

Why the router path is OpenVPN, not NordLynx

NordVPN’s support article is direct about the floor requirement: “It’s important that a router supports VPN configurations to use NordVPN,” and beyond that floor, the vendor’s own words are that “to maximize your NordVPN experience, a router that’s pre-configured for VPN use is key.” That second clause is the part most rankings skip. NordLynx is described as living on pre-configured devices such as the Privacy Hero 2, carrying what NordVPN calls an “exclusive NordLynx integration” — while a standard router you set up yourself, the documentation states plainly, “will not support NordLynx.”

The router’s own hardware doesn’t change that. An Asus RT-AX86U Pro ships with a native WireGuard client, and NordVPN’s router documentation still points it at OpenVPN: the setup tutorials it links are OpenVPN tutorials, and the NordLynx exclusion above applies to configurable routers as a class, not to weak ones. Whatever a router’s spec sheet promises about WireGuard, the documented way to put NordVPN on it is OpenVPN. What that protocol swap costs versus WireGuard is covered in full in WireGuard vs OpenVPN.

Stock Asus firmware: the models NordVPN names

NordVPN’s compatibility guidance states “the most commonly used are Asus routers” and names three: the RT-AX86U, the RT-AX68U, and the RT-AX88U (marketed as AX6000). That’s the extent of what NordVPN publishes about them — model names, not specs or prices.

Asus’s current generation fills that gap. The RT-AX86U Pro runs a 2.0 GHz quad-core CPU with 1 GB of RAM and 256 MB of flash storage, Wi-Fi 6, and five Gigabit Ethernet ports plus one configurable 2.5G/1Gbps port. The RT-AX88U Pro matches the CPU and RAM, and pairs Wi-Fi 6 with a 2.5G WAN port, a 2.5G LAN port, and four Gigabit LAN ports. Both list a VPN client menu covering L2TP, OpenVPN, PPTP, and WireGuard, plus VPN Fusion, Asus’s per-device split-tunneling feature that can route chosen devices through the VPN while the rest stay on the plain connection. Neither model’s spec sheet publishes a VPN throughput figure, so none is claimed here.

The WireGuard client on both routers is real hardware capability — it just has nothing to point at on the NordVPN side, whose router documentation covers OpenVPN and reserves NordLynx for pre-configured hardware. If router-side WireGuard matters more to you than which provider you run, Surfshark’s router options are worth comparing: Surfshark’s own support pages walk through generating a WireGuard key pair and downloading a per-location router config.

Do you need to buy anything at all?

Check what’s already sitting under your desk before buying new hardware. If it’s one of the three models NordVPN names — RT-AX86U, RT-AX68U, or RT-AX88U — you’re done: log into the router’s admin panel, find the VPN client section, and import NordVPN’s OpenVPN configuration file for the server you want. No firmware flashing, no new purchase.

If your router isn’t on that list, check it against the incompatible-brand list further down before spending anything. A router that’s missing from both lists isn’t automatically safe to assume will work — NordVPN confirms only the three Asus models and the custom-firmware paths below; everything else is unverified until you check its own VPN client menu for OpenVPN or WireGuard support yourself. Where the answer is no, the choice is between flashing custom firmware or buying hardware from one of the routes this page covers.

Custom firmware: Merlin, OpenWrt, DD-WRT, and what runs it

NordVPN’s own list of incompatible routers names the workaround in the same breath: DD-WRT, Tomato, OpenWRT, Merlin (Asuswrt-Merlin), and Padavan are the documented custom-firmware route for a router whose stock firmware has no VPN client at all.

Asuswrt-Merlin, a third-party firmware built on top of Asus’s own, added a WireGuard client and server in version 388.1, released 3 December 2022 — the changelog credits it with “WireGuard client and server. The server uses the new 388 VPN server webui.” Support splits across two firmware branches. The 388.x branch covers the RT-AX58U, RT-AX86U, RT-AX88U, GT-AX11000, RT-AX68U, and GT-AXE11000. The newer 3006.x branch adds current hardware: the ZenWiFi Pro XT12, GT-AX6000, GT-AXE16000, GT-AX11000 Pro, RT-AX86U Pro, RT-AX88U Pro, RT-BE96U, GT-BE98 Pro, RT-BE86U, RT-BE88U, RT-BE92U, RT-BE58 Go, and GT-BE19000AI. Stock Asus firmware picked up the same WireGuard client independently, through VPN Fusion, on any firmware build after version 3.0.0.4.388.23000. Either way, a NordVPN setup on that hardware still means an OpenVPN import — Merlin’s WireGuard support doesn’t change what NordVPN issues.

For routers that were never Asus hardware to begin with, OpenWrt is the other named path, and GL.iNet ships it pre-installed on its own boxes. The Flint 2 (GL-MT6000) costs $169.99 at the manufacturer’s own store, runs a MediaTek quad-core CPU at 2.0 GHz with 1 GB of DDR4 RAM, Wi-Fi 6, two 2.5G and four 1G ports, and publishes throughput maxima of 900 Mbps over WireGuard and 880 Mbps over OpenVPN with DCO support — the OpenVPN figure being the one that actually applies to a NordVPN connection. The newer, pricier Flint 3 (GL-BE9300), $209.99, upgrades to Wi-Fi 7 but publishes a lower ceiling on both protocols — “up to 680 Mbps” — despite the radio upgrade. The spec sheets suggest why: the Flint 3 runs a 1.5 GHz Qualcomm quad-core CPU against the Flint 2’s 2.0 GHz MediaTek chip, and VPN encryption is processor work, not radio work, so a Wi-Fi 7 badge doesn’t guarantee a faster tunnel. The compact Slate AX (GL-AXT1800), $119.99, is GL.iNet’s travel-sized option, publishing maxima of 550 Mbps over WireGuard and 560 Mbps over OpenVPN. All three prices and figures are current as of 24 Jul 2026, read from the manufacturer’s own product pages. None of these are speeds anyone measured running NordVPN specifically — for what a VPN connection costs your speed in general, see does a VPN slow down your internet.

Routers that will not run NordVPN

NordVPN’s compatibility page lists these brands as unsupported on their stock, native firmware:

• Arris
• Belkin
• Cisco
• D-Link
• Huawei
• Linksys, except the WRT32X and WRT32XB AC3200
• Netgear, including the Nighthawk range unless it’s running DumaOS
• TRENDnet
• Tenda
• TotoLink
• Ubee
• Orbi
• Spectrum
• Xfinity
• Eero
• Verizon
• AT&T
• FRITZ!Box
• Most other ISP-provided routers

NordVPN’s own explanation sits on the same support page as that list: on 1 December 2018, its servers stopped accepting L2TP/IPsec and PPTP connections. Those are exactly the protocols that a lot of stock router firmware still offers as its only built-in “VPN client” option, if it offers one at all. Without OpenVPN or WireGuard support out of the box, a router on that list has no protocol left that speaks to NordVPN — the custom-firmware route above is the only way around it, and only for hardware capable of running that firmware.

What a router costs against your device count

NordVPN’s device-count documentation states it plainly: “The router uses only one device slot, but the VPN will protect all the devices connected to the network.” Every plan tier — Basic, Complete, and Prime alike — covers ten simultaneous device connections. Put NordVPN on a router and that one slot covers a smart TV, a game console, a guest’s laptop, and anything else on that network, none of which touch the other nine. Those nine stay free for the phones and laptops that leave the house and need the app directly, running NordLynx at full speed.

Run the math on a household with a smart TV, two game consoles, a streaming box, and a desktop that’s hard-wired to the router: that’s five devices behind one router login, none of which support a VPN app on their own, and the router still only spends one of the ten slots getting all of them covered. Compare that to installing the app individually on each device that supports it — impossible here, since none of the four do — and the router stops being a convenience and becomes the only option.

How we picked

Every route on this page traces to a specific field in NordVPN’s or a router maker’s own documentation:

1. Protocol, from NordVPN’s own words. The OpenVPN-versus-NordLynx split comes from NordVPN’s router-requirement and NordLynx guidance, not a third-party listicle’s assumption.
2. Only hardware NordVPN names or documents a route for. The three stock Asus models and the five custom-firmware options are the ones NordVPN’s own support pages actually list.
3. Current-generation specs, from the manufacturer’s own spec sheet. Every CPU, RAM, port, and firmware detail above comes from Asus’s or GL.iNet’s own product pages, never a reseller listing.
4. Throughput attributed, never measured. Every Mbps figure is the manufacturer’s published maximum, labeled as such — this site runs no router benchmarks.
5. Device-slot math checked against NordVPN’s own device-count page, not assumed from the general ten-device limit.

Who should skip a router entirely

Most people don’t need one. Installing NordVPN’s app directly on each device gets you NordLynx — the faster, WireGuard-based protocol — with no firmware to flash and no OpenVPN trade-off, and the ten-device cap on every tier covers a typical household of phones, laptops, and tablets on its own. The full case for and against the service is in our NordVPN review.

A router earns its extra setup mainly for devices that can’t run a VPN app themselves — a smart TV, a game console, a streaming box — or when the goal is one network-wide toggle instead of installing the app on every device separately. If neither applies to you, the app is simpler, faster, and skips the protocol downgrade this page just walked through.

Router and NordVPN questions, answered

Frequently asked questions

Which router should I use with NordVPN?

NordVPN's own guidance names three Asus models — RT-AX86U, RT-AX68U, and RT-AX88U (AX6000) — as “the most commonly used.” Their current Pro-series successors, the RT-AX86U Pro and RT-AX88U Pro, run the same OpenVPN path even though both ship a native WireGuard client, because NordVPN doesn't publish WireGuard configs for routers.

Does NordVPN work on any router?

No. The router has to support VPN client configuration, and NordVPN lists a long set of brands — including Netgear, most Linksys models, Eero, and most ISP-supplied routers — as incompatible on their stock firmware. Custom firmware such as Merlin, OpenWrt, or DD-WRT is the documented workaround for hardware capable of running it.

Do you get NordLynx on a router?

Only on a pre-configured device, which NordVPN describes as having “exclusive NordLynx integration.” Set up NordVPN yourself on a router — stock Asus firmware, Merlin, or OpenWrt alike — and you're running OpenVPN, per NordVPN's own router documentation.

Can I use custom firmware to get NordVPN on an unsupported router?

Sometimes. NordVPN names DD-WRT, Tomato, OpenWRT, Merlin (Asuswrt-Merlin), and Padavan as its documented custom-firmware route for routers whose stock firmware has no VPN client. The router's hardware still has to be capable of running that firmware, which rules out most ISP-issued routers.

Does a router use up one of NordVPN's ten device slots, or more?

One. NordVPN states the router itself counts as a single device slot, and every device connected to that network is covered without touching the other nine — the number every plan tier includes.

Is a VPN router worth it if I can just use the NordVPN app?

For most people, no. The app runs NordLynx directly with no firmware work, and the ten-device cap fits a typical household. A router mainly earns its complexity for devices that can't run a VPN app themselves, like a smart TV or game console.