Best router for Surfshark: pick firmware first

Surfshark is one of the few providers whose router setup doesn’t stop at OpenVPN. This page assumes Surfshark is already the pick — see our full VPN rankings if you’re still comparing providers. Surfshark publishes downloadable WireGuard configuration files for routers, and names three firmwares WireGuard “best works with”: GL.iNet, OpenWrt, and DD-WRT. That makes the buying decision a firmware question first and a hardware question second — a router that can’t run one of those three firmwares still falls back to OpenVPN, no matter how new or expensive it is. The table below ranks the three real routes to a Surfshark-ready router by protocol, published throughput, and price, current as of 24 Jul 2026.

Router routes for Surfshark, by protocol and published throughput (as of 24 Jul 2026)

Route	Protocol	Published throughput	Price	The catch
GL.iNet (OpenWrt pre-installed)	WireGuard and OpenVPN	Up to 900 Mbps WireGuard (Flint 2)	$119.99–$209.99	The newer, pricier model is rated slower
Asus stock firmware (ASUSWRT / VPN Fusion)	WireGuard and OpenVPN, on current firmware	Not published by Asus	Not published	Only specific models get the WireGuard update
DD-WRT (custom firmware)	Named WireGuard firmware; also OpenVPN	Not published	Varies by the hardware you flash it onto	Custom firmware the router's own maker doesn't support

GL.iNet is the only route with a WireGuard number straight from the maker, because GL.iNet ships its routers with OpenWrt already installed — the exact firmware Surfshark names. The Asus route needs a firmware check first: stock ASUSWRT and the third-party Asuswrt-Merlin project both added WireGuard, but only on specific models and specific firmware versions. DD-WRT is the fallback for hardware none of the others cover.

Why does the firmware decide the protocol, not the router?

Surfshark’s baseline compatibility test is broad: “most routers that can run OpenVPN can support a Surfshark connection,” per its own router page. WireGuard is a narrower ask. To use it on a router, you generate a key pair in the Surfshark dashboard, pick a server location, and download a per-location configuration file — and Surfshark’s own guide names GL.iNet, OpenWrt, and DD-WRT as the firmware WireGuard “best works with.” There’s a real trap in that same guide: generate the key pair before you download the config file, or the file comes down without it, and you start over.

WireGuard’s speed and battery case against OpenVPN is covered in our WireGuard vs OpenVPN guide; what matters here is only which router firmware can reach it for Surfshark specifically. That’s a genuine split from our router picks for NordVPN, where the self-configured path runs OpenVPN only — Surfshark is the rarer case where a router owner gets an actual choice of protocol.

How fast is GL.iNet’s WireGuard, model by model?

GL.iNet ships every current router with OpenWrt pre-installed, so the whole lineup already runs the firmware Surfshark names. Three models span travel-sized to desktop, and their own published numbers don’t rank the way the price tags suggest.

GL.iNet router specs, manufacturer's own published maxima (as of 24 Jul 2026)

Model	Price	Wi-Fi	WireGuard throughput	OpenVPN throughput
GL.iNet Flint 2 (GL-MT6000)	$169.99	Wi-Fi 6	Up to 900 Mbps	Up to 880 Mbps (with DCO)
GL.iNet Flint 3 (GL-BE9300)	$209.99	Wi-Fi 7	Up to 680 Mbps	Up to 680 Mbps
GL.iNet Slate AX (GL-AXT1800)	$119.99	Not published (travel-sized)	Up to 550 Mbps	Up to 560 Mbps (with DCO)

On GL.iNet’s own numbers, the $169.99 Flint 2 (2x 2.5G plus 4x 1G ports, 1 GB RAM) is rated up to 900 Mbps over WireGuard. The $209.99 Flint 3 — newer, pricier, and built for Wi-Fi 7 — is rated up to 680 Mbps on both WireGuard and OpenVPN-DCO. Newer and more expensive is slower here, on the manufacturer’s own published maxima. If Surfshark’s WireGuard tunnel is the whole point of buying a router, the Flint 2 is the faster spec for $40 less. The Slate AX trails both at up to 550 Mbps over WireGuard, but at $119.99 it’s built to travel, not to anchor a household network — and its OpenVPN maximum edges just ahead of its own WireGuard number, at up to 560 Mbps.

Can Asus routers run Surfshark over WireGuard?

Yes, on the right firmware. Asus’s own VPN Fusion FAQ puts a floor on it: “WireGuard is only supported on the firmware version later than 3.0.0.4.388.23000.” Support varies by model, and Asus keeps its current list separately. Two current Asus routers document WireGuard client support outright: the RT-AX86U Pro (2.0 GHz quad-core, 1 GB RAM, Wi-Fi 6, five Gigabit ports plus one 2.5G port) and the RT-AX88U Pro (same CPU and RAM, Wi-Fi 6, dual 2.5G ports). Both list VPN Fusion, Asus’s per-device split-tunneling feature, which can route only chosen devices through Surfshark while the rest of the household stays on the plain connection. Neither spec page publishes a VPN throughput figure or a list price, so neither claim appears here.

The alternative is Asuswrt-Merlin, the long-running third-party firmware built on Asus’s own codebase. Its changelog records WireGuard client and server support arriving in version 388.1 on 3 December 2022. The current supported-model list covers the RT-AX58U, RT-AX86U, RT-AX88U, GT-AX11000, RT-AX68U, and GT-AXE11000 on the 388.x branch, and both the RT-AX86U Pro and RT-AX88U Pro on the newer 3006.x branch, alongside several other current models. Merlin replaces the factory firmware entirely — a bigger step than toggling a setting in the stock Asus interface, and one worth taking only on a model the project actually lists.

Is Surfshark’s own router list trustworthy?

Not as a shopping list, because the page disagrees with itself. Surfshark’s router compatibility page names the NetDuma R1 and a set of Asus models — RT-N56U, RT-AC86U, DSL-AC51, RT-AC3200, AC68U, RT-N66U, AC66U, AC52U, RT-AC51U, AX88U, and Rapture GT-AC2900 — as compatible. Further down, the same page recommends five specific routers: the Asus RT-AX88U Pro, Asus AX3000, Asus RT-AX86U, GL.iNet GL-AR300M, and GL.iNet GL-MT300N-V2. Not one of those five appears on the compatibility list above it. Read the list as evidence that a router can work, not as advice on which to buy.

Check this instead: whether the router’s current firmware — stock ASUSWRT, Asuswrt-Merlin, GL.iNet’s OpenWrt, or DD-WRT — lists an active OpenVPN or WireGuard client on the maker’s own current spec or FAQ page, rather than trusting either of Surfshark’s two lists. And if you’re taking the WireGuard route, generate the key pair in the Surfshark dashboard before you download the router’s configuration file — the one documented gotcha in Surfshark’s own guide.

Which routers won’t work at all?

Surfshark’s list of unsupported routers names Arris, Belkin, Cisco, Linksys (except Tomato-supported models), TRENDnet, TotoLink, Ubee, Google WiFi, and most ISP-provided routers. The stated reason is specific: “these routers do not support OpenVPN protocol or the WireGuard protocol by default.” The same page names DD-WRT as the workaround — flash it onto otherwise-unsupported hardware and you gain both protocols, plus a spot on Surfshark’s own list of WireGuard-friendly firmware.

Do you actually need a router for Surfshark?

Maybe not. Surfshark’s paid plans carry unlimited simultaneous device connections, per its pricing page as of 23 Jul 2026 — every phone, laptop, and tablet in a household can run the app directly, at no extra cost and no device slot to manage. That’s the opposite of a capped provider, where a router setup is one way to stretch a limited device count across a whole network. Our Surfshark review covers the plan and its renewal price in full; the same unlimited-device policy is also why Surfshark tops our cheap VPN picks on cost per covered device.

A router earns its place for one reason: hardware that can’t run the Surfshark app at all. Smart TVs, older game consoles, and set-top boxes without a native VPN client only get covered if the network itself is the tunnel. If every device in the house can install an app, the firmware questions above stop mattering.

How we picked

• Documented WireGuard support first. A route only ranks above OpenVPN-only if Surfshark’s own guide names the firmware, or the firmware’s own changelog documents WireGuard client support.
• Manufacturer’s published maxima, not our own numbers. Every throughput figure above is the router maker’s stated ceiling, cited to the model’s own spec page; where a maker doesn’t publish one, that gap is stated rather than filled in.
• Live vendor documentation over listicle claims. Model names, firmware versions, and compatibility come from Surfshark’s, Asus’s, and GL.iNet’s own pages, current as of 24 Jul 2026.
• Price only where it’s published. A router with no stated price or throughput is flagged as such, not estimated.

Surfshark router questions, answered

Frequently asked questions

What routers work with Surfshark?

Most routers that can run OpenVPN can support a Surfshark connection, per Surfshark's own router page. For WireGuard specifically, Surfshark names GL.iNet, OpenWrt, and DD-WRT as the firmware it works best with.

What routers are not supported by Surfshark?

Surfshark's support page lists Arris, Belkin, Cisco, Linksys (except Tomato-supported models), TRENDnet, TotoLink, Ubee, Google WiFi, and most ISP-provided routers as unsupported on their factory firmware, because none of them run OpenVPN or WireGuard by default. DD-WRT is Surfshark's stated workaround.

Does Surfshark work with WireGuard routers?

Yes. Surfshark publishes downloadable, per-location WireGuard configuration files for routers, generated after you create a key pair in the Surfshark dashboard. Generate that key pair before downloading the file — Surfshark's own guide warns that a file downloaded first arrives without it.

How do I know if my router supports Surfshark?

Check the router's current firmware documentation for an active OpenVPN or WireGuard client, on the maker's own current spec or FAQ page. Surfshark's router page carries two lists that don't match — a compatible-model list and a set of five recommendations with no model in common — so treat either as a starting point, not a final answer.

Do I need a VPN router for Surfshark?

No. Surfshark's paid plans allow unlimited simultaneous device connections, so a router isn't needed to cover more devices. It earns its place only for hardware that can't run the Surfshark app itself, like a smart TV or an older game console.

Can I use an ISP router with Surfshark?

Usually not on its stock firmware. Surfshark's support page lists most ISP-provided routers among the unsupported hardware and points to DD-WRT as the workaround for routers whose factory firmware has no VPN client.