How to Set Up a VPN on a Router in Serbia: From Choosing Equipment to Checking for Leaks

Information checked: September 29, 2026. ISP rules, firmware, and prices can change. Product details below apply to the specified hardware revision. If public documentation does not confirm the procedure for your plan, ask technical support before changing your equipment. Prices were checked on the linked pages on September 29, 2026. They are not a guarantee of stock or the final price.

Want a VPN on your TV, console, or entire home network, but those devices do not have a suitable VPN app? The solution is a router that works as a VPN Client. It creates a tunnel to a VPN service, so devices behind it use that connection according to the rules you set. You can first connect this router behind your ISP router. Bridge Mode is not a prerequisite. You do not need a public or static IPv4 address for a regular outbound VPN Client either.

This guide follows the safest order: check what you already have, choose a topology, configure WAN, establish the VPN, decide which devices use it, then measure and check your public IP, DNS, and IPv6. A home VPN Server that you access from outside has different requirements.

Quick answer: do you need an extra router?

If the VPN is only for a laptop or phone, an app on that device is usually simpler. If your ISP router really has a VPN Client for the protocol you want and per-device rules, you may not need another router. Look specifically for the word Client in its interface. VPN Passthrough means a device behind the router is allowed to establish its own VPN. It does not mean that the router itself connects your TV and the rest of your network to a VPN. VPN Server works in the opposite direction: it lets remote devices access your home network.

Before buying, check four items in the specification for the exact hardware revision: WireGuard or OpenVPN Client, VPN client speed if the manufacturer publishes it, per-device rules, and what happens if the tunnel drops. Also check the WAN type required by your ISP, and PPPoE and VLAN support if you plan to use Bridge Mode. AX3000 and BE3600 labels describe the advertised Wi-Fi class, not encryption speed.

Two correct network layouts

Easiest start: without Bridge Mode

Internet
   |
ISP router in Router Mode
   | LAN port
   | Ethernet cable
   | WAN port
Personal router in Router Mode with VPN Client
   | LAN or Wi-Fi
TV, laptop, phone, and other devices

On your personal router, select DHCP / Automatic IP for WAN if the ISP router assigns an address automatically. Its WAN will usually receive an address such as 192.168.1.2. The personal router must use a different LAN range, for example 192.168.50.0/24. Then enable the VPN Client and connect only the devices you want to include to the personal router. You do not need to touch the ISP's ONT or TV receiver.

This creates Double NAT: the ISP router translates addresses once, and the personal router translates them a second time. Outbound WireGuard and OpenVPN clients usually work in this setup, including behind an ISP's CGNAT. Double NAT mainly complicates inbound connections, port forwarding, self-hosting, some games, UPnP, and certain VoIP or P2P scenarios. For web browsing and a standard outbound VPN, it is often perfectly acceptable.

DMZ on the ISP router can forward most inbound traffic to the reserved WAN address of your personal router, for example 192.168.1.2. This is not Bridge Mode, and Double NAT remains. Use DMZ only if you need inbound traffic, and only toward the WAN interface of a router with its firewall enabled. Do not put a computer or NAS directly in the DMZ. If you are behind your ISP's CGNAT, DMZ on your home router will not by itself enable inbound access from the internet.

When the ISP enables Bridge Mode

Internet
   |
ISP ONT or modem in Bridge Mode
   | bridge LAN port
   | Ethernet cable
   | WAN port
Personal router in Router Mode
   | NAT, firewall, DHCP, DNS, Wi-Fi, VPN
Home devices

Bridge Mode effectively hands routing over to your personal router, while the ISP device still terminates the fiber or cable connection, depending on the technology. Your router then manages NAT, the firewall, DHCP, DNS, Wi-Fi, and the VPN. Its WAN does not necessarily receive a public IPv4 address automatically: the ISP may still use CGNAT. The exact bridge port, WAN protocol, and whether TV or phone service continues to work depend on the ISP and equipment.

Do not connect two LAN ports if you want your personal device to act as the main router. In both layouts above, the cable goes from the ISP device's LAN port to the personal router's WAN port. Access Point Mode is for adding Wi-Fi only. In that mode, the device is generally not the gateway, and its VPN Client usually cannot control the entire network. If the ISP cannot enable Bridge Mode, leave it in Router Mode and test the VPN using the simpler layout first.

CGNAT, Double NAT, and a public IP are not the same thing

CGNAT is IPv4 address translation inside the ISP's network: multiple subscribers share a public address. RFC 6598 reserves 100.64.0.0/10 as shared address space.¹ SBB's technical terms describe assigning a public or private dynamic IPv4 address and the limitations on inbound services behind CGNAT.² Home Double NAT occurs when two of your routers route in sequence. You can have both at the same time.

For a rough check, look at the WAN IPv4 address on the first device that receives an address from the ISP and compare it with the address shown by a public IP checker. If the WAN address is in 100.64.0.0/10 and the public IP is different, you are probably behind CGNAT. If the WAN address is 192.168.x.x, first check whether you are looking at a personal router behind the ISP router. A private address on your personal router alone does not prove that the ISP uses CGNAT. DS-Lite and other technologies can make the situation more complex, so ask support to confirm.

A public dynamic IPv4 address can change. A public static IPv4 address remains assigned under the terms of the service. You usually need neither special address to use a VPN Client with a commercial service because the connection is initiated from inside your network. Public reachability matters for a home WireGuard or OpenVPN Server, a directly accessible NAS, cameras, your own server, and port forwarding. A static address makes a service's address stable, but a dynamic public address with DDNS can often work for remote access too.

What ISPs in Serbia have publicly confirmed

This table describes publicly available documents only. It does not guarantee the same configuration at every location. “Personal router” here means connecting an additional device behind the ISP equipment, not an automatic right to replace the ONT. For gaps in the documentation, check with your ISP's technical support.

How to read this information

A1 has published the most specific technical instructions for using your own Layer 3 router on fiber. After you request it, A1 remotely switches its CPE to bridge mode while GPON termination remains on the A1 device. Your personal router must support a PPPoE username and password, VLAN tagging with the ID supplied by A1, MTU 1492, and IPv4. The MTU value applies to the A1 scenario described here. It is not a universal setting for every ISP.⁵

Yettel explicitly directs customers to its online form for Bridge Mode in the current FAQ. The same FAQ lists a private dynamic address for Yettel Net and an extra fee for a public static IP. This does not mean that a static IP is necessary for a VPN Client. Ask support about TV and the exact WAN settings after the change.⁴

mts publicly says that customers can use their own equipment, but its document about PPPoE credentials for residential customers dates from 2018 and describes the scenario at that time. A business FAQ from 2020 describes bridging with personal equipment. Neither source confirms one procedure for every current residential FTTH or VDSL installation.³

SBB technical terms confirm DHCP on cable access, the possibility of a public or private IPv4 address, and the option of a static address as an additional service. A separate wholesale document mentions DOCSIS bridge mode and Ubee and Technicolor CGA2121 models, but it concerns a bitstream service for another operator. We therefore cannot promise that SBB customer support enables bridge mode for residential customers under the same rule. Ask about your modem, plan, and TV service.²

For Supernova and Orion, we could not find a reliable, current public procedure that defines Bridge Mode, PPPoE, VLAN, and CGNAT for all residential customers. Support must confirm the settings for your specific connection. Local fiber providers may use a completely different combination.

A message you can send to your ISP

Hello. I want to connect my own router as the main router. Does my plan and ONT or modem model support Bridge Mode? Which LAN port works as the bridge port? Should I configure WAN with DHCP/IPoE, PPPoE, or static settings? If it is PPPoE, how can I securely obtain the username and password? Is a VLAN ID required, and what is the exact value? What MTU do you recommend? Will IPTV, the TV box, and landline service continue to work, and on which ports? Is my connection behind CGNAT, and is public IPv4 available? Please confirm the settings for my contract and equipment.

For a phone call, it is enough to say: “I need Bridge Mode for my own router. Which WAN type, VLAN, bridge port, and PPPoE credentials apply to my connection, and will TV and phone service continue to work?” Do not ask for someone else's PPPoE credentials or copy a VLAN ID from a forum.

Connecting and configuring WAN step by step

1. Write down the current setup: ISP device model, connection to the TV receiver and landline, LAN range, and access to the admin interface. Make a backup if that option is available.
2. Connect a LAN port on the ISP device to the WAN port on your personal router. If bridge mode is active, use the port specified by the ISP. Run the first test over Ethernet, with a computer connected to a LAN port on your personal router.
3. On your personal router, enable Router Mode, change the administrator password, and set a LAN network that does not overlap with the ISP router's network. For example, ISP 192.168.1.0/24, personal router 192.168.50.0/24.
4. If the ISP router is in regular Router Mode, start with DHCP / Automatic IP. For a true bridge, use the exact settings provided by your ISP: DHCP/IPoE, PPPoE, or, less commonly, a manually configured static WAN IP, subnet mask, gateway, and DNS. A static LAN address for a TV is not the same as a static public WAN address.
5. For PPPoE, enter the exact username and password, and any VLAN and MTU values from your ISP's instructions. Do not guess the VLAN. In the A1 GPON scenario described above, the official document specifies MTU 1492.⁵
6. Before enabling the VPN, confirm that a computer behind your personal router can open multiple websites, DNS works, and TV and phone service still function. Only then add a VPN profile.

If WAN has no address, check the cable, correct port, whether bridge mode is actually active, DHCP/PPPoE selection, and whether the ISP needs to refresh the session. Do not reset an ISP device with a special provider configuration without first agreeing it with support.

IPTV and VoIP are separate services

A TV receiver that gets channels over the network often depends on a separate VLAN, multicast traffic, IGMP Proxy/Snooping features, or a specific LAN port. A landline may use a VoIP profile on the ISP device. Moving these devices behind a VPN router without checking can interrupt service. Before Bridge Mode, ask: “Will TV and landline service continue to work?” If the ISP keeps TV or VoIP on its own port, leave the receiver and phone there until you have a confirmed layout. A VPN for an app on a Smart TV is not the same as the operator's IPTV service for an STB.

WireGuard or OpenVPN?

WireGuard is a good first choice if both the router and VPN service support it. OpenVPN remains useful for existing profiles and environments where TCP is needed. There is no universal guarantee of speed or stability. Compare them on the same router and connection. Official OpenVPN documentation confirms its UDP and TCP modes, while OpenWrt describes a WireGuard client on a router.⁸

General WireGuard setup

1. In your VPN provider account, create a router configuration, preferably for a nearby server. Store it privately. Do not post the PrivateKey in a message or screenshot.
2. On the router, open VPN Client, select WireGuard, and import the configuration file if supported. If not, enter the fields manually.
3. In the [Interface] section, PrivateKey is the local client's secret; Address is the address inside the tunnel; DNS is a resolver suggestion, and whether it is applied depends on the firmware.
4. In the [Peer] section, PublicKey identifies the remote peer; Endpoint is the VPN server's address and port; AllowedIPs determines which networks are routed through the tunnel. 0.0.0.0/0 usually means all IPv4 traffic for clients covered by the router's rule. Enable ::/0 only if the service and router actually tunnel IPv6. Use PersistentKeepalive when needed to maintain a NAT mapping.
5. Save the profile and turn it on. Then check the handshake, whether the transferred byte count is increasing, and the public IP from a device that should use the VPN. A handshake without traffic does not confirm that routing works.

General OpenVPN setup

Download the current .ovpn profile from the service and import it into OpenVPN Client. The firmware may ask for a username and password separately from your website account. The profile may contain or refer to a CA certificate, client certificate, private key, tls-auth, or tls-crypt. Do not skip these items if the profile requires them. Start with a UDP profile, and try TCP if UDP is blocked or the specific network requires it. After importing, check the status, logs, and actual traffic, then check the public IP and DNS. Do not confuse a file for a VPN Server on your home router with a client profile for a commercial service.⁹

Where to find it in the interface

• ASUS with VPN Fusion support: Open VPN Fusion, add a WireGuard or OpenVPN profile, then assign devices to the profile. ASUS also describes multiple simultaneous tunnels, but the specific model must support the feature.¹⁰
• TP-Link with VPN Client support: Open Advanced > VPN Client, add a profile, then assign devices under Device List. TP-Link says only selected devices use the tunnel. WireGuard support depends on the model and revision.¹¹
• Cudy: Open VPN Client and check the protocols listed for your exact hardware revision. Use per-device VPN On/Off if the firmware shows it. WR1500 1.0 lists WireGuard but does not list OpenVPN Client. WR3000 1.0 lists both.¹²
• GL.iNet: In firmware 4.9.x, use VPN Dashboard and VPN Client Profile. You can choose which clients use the tunnel and set a separate Kill Switch for it. Option names differ in older firmware.¹³
• MikroTik: RouterOS supports WireGuard, routing tables, rules, and firewall settings, but there is no simple, universal “import a VPN for the TV” procedure. Beginners are better off following a separate RouterOS guide and building a secure basic network first.¹⁴

Route only the TV through the VPN and keep the rest of the network direct

Full Tunnel sends all traffic from covered devices through the VPN. Split Tunneling or Policy Routing selects devices, destinations, or types of traffic. For most homes, a per-device rule is clearest. Give the TV a stable local IP using a DHCP reservation, then select it in the VPN list. Check on the TV itself, not just on a laptop, that the app uses the expected public IP.

Living room TV -> VPN Germany
Bedroom TV -> VPN United States, only if the router supports a second profile
Laptop -> direct internet
Phone -> direct internet
Console -> direct internet

If you want multiple VPN countries at the same time, look for multiple active tunnels and per-device rules, not just the ability to save multiple profiles. ASUS VPN Fusion and the newer GL.iNet VPN Dashboard have documented mechanisms for this, but the number of tunnels and behavior on failure depend on the model and firmware.¹⁰¹³ If only the TV needs a VPN, it is often better to keep the laptop and phone on a direct connection. A work laptop may have its own mandatory VPN, and adding another tunnel through the home router can complicate access.

Kill Switch, DNS, IPv6, and MTU

A Kill Switch prevents traffic intended for the VPN from automatically switching to the regular WAN if the tunnel drops. A global block can disconnect everyone from the internet; a rule for a tunnel or device affects only selected clients. GL.iNet documents both global and individual options in its newer VPN Dashboard.¹³ For other models, check the behavior instead of relying on the option's name. Do not enter random firewall rules from the internet. To check, open an IP check page on a test device, disconnect the VPN tunnel, and confirm that internet access stops for that device while local access to the router remains available.

A DNS leak occurs when a device uses the VPN for web traffic but sends DNS queries to the ISP or another unexpected resolver. Before and after enabling the VPN, check which resolver the test site detects. Keep in mind that a browser with its own DoH can use a different DNS server from the operating system. VPN DNS, DNS over TLS/HTTPS, Quad9, Cloudflare, NextDNS, and AdGuard DNS represent different choices for trust and filtering. A public DNS service does not by itself guarantee greater privacy. If the router can use DNS obtained through the tunnel for VPN clients, that is usually the simplest place to start.

An IPv6 leak is possible when the VPN routes IPv4 but a device's IPv6 traffic still goes through the ISP. Check whether the provider offers IPv6 through the tunnel, whether the profile contains an IPv6 address and route, and whether the router applies them. If the VPN has no IPv6 support, restrict IPv6 for VPN clients or on the relevant network until you find a supported solution. Do not disable IPv6 throughout your home just because one profile lacks support. Confirm the result with an IPv6 test on the covered device itself.

MTU is the largest packet a connection can carry without fragmentation, while MSS limits the TCP payload in a packet. PPPoE and VPN add headers, so an incorrect MTU can make only some websites work, cause video to stall, or leave a tunnel with a handshake but no useful traffic. First use the value specified by your ISP or manufacturer and automatic MSS adjustment if the firmware offers it. Do not copy arbitrary values. A1 documents 1492 for the PPPoE bridge scenario described above, but that is not a WireGuard MTU recommendation or a setting for another ISP.⁵

What VPN speed can you expect?

Keep Wi-Fi link speed, actual Wi-Fi throughput, ordinary WAN throughput, WireGuard Client, OpenVPN Client, and any IPsec result separate. These are different metrics. CPU, cryptography, firmware, VPN server, distance, congestion, ISP speed, MTU, and the number of connections all affect the result. A router with an AX3000 Wi-Fi rating may be limited to about a hundred megabits in OpenVPN Client mode if that is what its tests show.

Cudy publishes OpenVPN Client upload/download speeds of 90/120 Mbps and WireGuard Client speeds of 224/230 Mbps for WR3000 1.0. These are manufacturer results, not guaranteed home speeds.¹⁵ GL.iNet currently lists up to 900 Mbps for WireGuard Client and up to 880 Mbps for OpenVPN with DCO in a local test for Flint 2. An older 2024 data sheet lists only about 190 Mbps for OpenVPN without that condition. Firmware, DCO, profile, and test method must be specified when comparing the results.¹⁶ We did not find reliable public VPN Client throughput data for the other models in the table.

Test with the same computer, preferably over Ethernet: VPN off, then on, using the same speed test server if possible. Repeat a few times and note download, upload, ping, and jitter. A VPN often increases latency because packets also travel to the VPN server. On 2.4 GHz Wi-Fi, far from the router, or on a congested channel, Wi-Fi may be the bottleneck before the VPN is.

For internet service up to 300 or 500 Mbps, gigabit WAN is enough from the port's perspective. A 1.5 or 2 Gbps connection needs at least 2.5 GbE WAN, and speeds above 1 Gbps on one wired device also require a suitable LAN path. The VPN CPU may limit speed well before the port does. One 2.5 GbE port on a router does not automatically mean 2.5 Gbps for every LAN device.

Which router should you buy: verified models and prices

Prices and availability checked on September 29, 2026. RSD figures come from the linked pages. The “under 50,” “around 100,” and “around 200 EUR” categories are for orientation and do not convert currencies at a changing exchange rate. “No data” means we will not invent VPN throughput or a local price. Be sure to check the exact model, version label on the device, regional firmware, and current stock.

How to interpret the three price tiers

Under approximately 50 EUR: WR1500 is the cheapest WireGuard option and has a 1 GHz CPU, 128 MB RAM, IPv6, and per-device VPN On/Off in the official specifications. OpenVPN Client is not listed in those specifications. WR3000 1.0 is more powerful, with a 1.3 GHz dual-core CPU, 256 MB RAM, and published VPN tests, but the specific low-price listing we checked is currently out of stock. WR1300E 1.0 has older Wi-Fi 5, an 880 MHz dual-core CPU, and 128 MB RAM. Check the firmware and exact hardware revision for all three.¹⁷¹⁵¹⁸

Around 100 EUR: BE220 has WireGuard and OpenVPN Client, EasyMesh, and PPPoE, but only gigabit ports. RT-BE50 adds 2.5 GbE WAN, VPN Fusion, AiMesh, PPPoE, and DNS over TLS. AX55 makes sense only if its price and hardware revision give it an advantage over BE220. TP-Link's AX55 4.0 data sheet confirms both VPN clients, but that claim should not be applied to every older revision.²⁰²²²¹ At the domestic price we checked, ASUS RT-AX53U is not in the under-50-EUR budget and the official comparison lists neither WireGuard Client nor VPN Fusion.¹⁹

Around 200 EUR: TUF BE3600 has 1 GB RAM, USB 3.2, AiMesh, and VPN Fusion. MikroTik hAP ax3 has a 1.8 GHz quad-core CPU, 1 GB RAM, 2.5 GbE, and very flexible RouterOS, but it is not the best first router if you do not want to learn routing and firewall configuration. Flint 2 has a 2 GHz quad-core CPU, 1 GB RAM, 8 GB eMMC, two 2.5 GbE ports, Multi-WAN, AdGuard Home, and GL.iNet firmware based on OpenWrt. At the time of checking, we did not have a reliable price with domestic delivery that would let us place it in the local under-200-EUR tier.²³¹⁴¹⁶

Choose based on what you need

• Lowest cost: WR1500 for WireGuard, keeping in mind that its published specifications do not promise OpenVPN.
• Less configuration: BE220 or RT-BE50, depending on the ports and interface you want. If you need a VPN only on one computer, use an app.
• Smart TV only: Look for a device with a clear client list, such as BE220, RT-BE50, or WR3000.
• Multiple countries and tunnels: Check the exact version of ASUS VPN Fusion or GL.iNet VPN Dashboard.
• Gigabit internet: First look for verified VPN Client speeds. Do not buy based on the Wi-Fi number on the box.
• Over 1 Gbps or 2.5 GbE: RT-BE50, TUF BE3600, and Flint 2 have a suitable WAN port, but check the LAN ports too.
• OpenWrt and advanced rules: Flint 2 is more approachable with its own firmware; standard OpenWrt requires more work.
• MikroTik: Choose hAP ax3 if you want detailed control and are ready to maintain a RouterOS configuration.

OpenWrt, Merlin, and firmware

OpenWrt is separate firmware with packages for WireGuard, firewall, VLAN, SQM, and policy routing. It offers flexibility with added responsibility: the wrong firmware image can disable a device, some Wi-Fi drivers or features can differ from the factory software, and warranty terms depend on the seller. Before installation, check the exact revision in the OpenWrt Table of Hardware. GL.iNet uses firmware based on OpenWrt, which does not automatically mean that every guide for standard OpenWrt applies.²⁴

ASUSWRT-Merlin is a separate project with its own list of supported models. RT-AX53U, RT-BE50, and TUF BE3600 are not on the official Merlin supported-model list at the time of checking. Check the current list before flashing anything, because it can change. The factory firmware may already have all the features you need.

For every manufacturer, check the exact model, V1/V2/V3 or other revision label, region, and firmware date. Before buying a used device on KupujemProdajem, ask whether it is new or has been opened, and check the fiscal receipt and warranty, original power supply, antenna condition, firmware, and link to a previous cloud account. One listing is not a representative market price. After purchase, perform a factory reset, install an update from an official source, and change the admin password.

How to confirm that the VPN really works

1. On a test device behind your personal router, record the public IPv4 address, any IPv6 address, DNS resolvers, and country before enabling the VPN.
2. Enable the profile and check the tunnel status, handshake or OpenVPN log, and actual TX/RX byte counts.
3. Repeat the check on the same device. You should see the VPN exit IP and DNS that match the intended configuration. Check IPv6 too. In the browser, check WebRTC candidate addresses if that exposure matters to you.
4. Repeat the test on the TV or another device assigned by a policy rule. A laptop that is not assigned should keep its direct connection.
5. Intentionally disconnect the VPN tunnel. If a Kill Switch matters to you, the selected device must not silently switch to the ISP WAN.
6. Record the results and only then move the rest of your devices. An IP geolocation database may show the wrong city or country; the public IP and route are more reliable indicators than a single map.

A router VPN protects only traffic that actually passes through that router and the selected tunnel. A phone on mobile data, a device on the ISP router's Wi-Fi, or a TV outside the VPN policy is not covered. A VPN encrypts traffic to the VPN server, but you still need to trust the provider. Check its logging policy, ownership, independent audits, and DNS and IPv6 support. Streaming services may block VPN exits, and there is no guarantee of access to a different catalog. For gaming, a VPN usually increases ping, except in specific cases where the route is poor. For torrents, a VPN changes the IP visible to peers, but configuration, leaks, and copyright rules still apply.

When something does not work

Common mistakes include buying a router with only VPN Passthrough, confusing Client and Server functions, connecting LAN to LAN while using Router Mode, choosing AP Mode instead of routing, using the same LAN range on both routers, entering incorrect PPPoE or VLAN settings, treating a Wi-Fi rating as VPN speed, and assuming a private WAN address is a fault. Other mistakes include an untested Kill Switch, DNS or IPv6 configuration, old firmware, the factory admin password, and resetting an ISP device with special IPTV or VoIP settings.

Safe maintenance

Change the admin password, use WPA2-AES or WPA3 as supported by the device, set a strong Wi-Fi password, and disable WAN administration if you do not need it. Update firmware from the official site for the exact hardware revision, check the checksum if the manufacturer publishes one, save a configuration backup, and separate the IoT network if your router supports it. Do not expose the admin interface to the internet. After updating, repeat the VPN, Kill Switch, DNS, and IPv6 checks.

Frequently asked questions

Is Bridge Mode required for a VPN on a router?

No. Connect the WAN port of your personal router to a LAN port on the ISP router and configure an outbound VPN Client. Bridge is useful when you want your personal router to handle the main routing.

Does a VPN Client work behind CGNAT?

In most cases, yes, because the client starts an outbound connection. CGNAT mainly makes inbound access to a home VPN Server more difficult.

Do I need a public or static IP?

Usually not for a commercial VPN Client. A public address matters for direct inbound access, while a static address makes a server's address easier to keep stable.

Can I use a VPN without an extra router?

Yes, with an app on a device or through an ISP router if it truly supports VPN Client. Passthrough is not a substitute.

Can only my Smart TV use the VPN?

Yes, if you connect it to the VPN router and select only the TV in the rules. A DHCP reservation for that device is recommended.

Can I use two VPN servers at the same time?

Only if the specific router and firmware support multiple active tunnels and per-device rules. Saving multiple profiles alone is not enough.

Will a VPN slow down my internet?

It can. The result depends on the CPU, protocol, server, ISP connection, and local Wi-Fi. Compare wired tests under the same conditions.

Is WireGuard always faster than OpenVPN?

It often is on home routers, but not on every network or configuration. Check the specific model and server.

Can I use a VPN with SBB, mts, Yettel, and A1?

An outbound VPN Client behind an ISP router can generally work with any of them. Bridge mode, WAN settings, TV, and public IP availability vary by plan and equipment.

Can I completely replace my ISP's ONT with my own router?

Do not assume so. The optical termination often has to remain on the ISP equipment, with your personal router connected over Ethernet. A1 explicitly says this for the documented GPON scenario.

Does Bridge Mode turn off the ISP router's Wi-Fi?

That depends on the model and ISP configuration. Ask support what remains active and check after the change.

Will IPTV and landline service work after Bridge Mode?

They may, but they often need specific ports, a VLAN, or a profile on the ISP device. Confirm this before making a change.

What is Double NAT?

Two routers translate addresses in sequence, for example, an ISP router and your personal router in Router Mode. Outbound VPN usually works, but inbound connections are more complicated.

What is CGNAT?

Address translation inside an ISP network that allows customers to share public IPv4 addresses. It is different from Double NAT inside your home.

Does DMZ remove Double NAT?

No. It forwards most inbound traffic from the ISP router to one host while both NAT layers remain.

Which router is the best first choice?

For affordable WireGuard, check the WR1500 or availability of the WR3000. For clear per-device rules and a simple interface, look at the BE220 and RT-BE50. Your budget and required WAN port determine the choice.

Is the MikroTik hAP ax3 good for beginners?

It is excellent for a user who wants to learn RouterOS and maintain routing and firewall rules. Simpler interfaces are available for getting started quickly with a commercial VPN.

Do I need Wi-Fi 7?

Not for the VPN itself. The VPN protocol, CPU, firmware, policy features, and ports matter more.

Do I need 2.5 GbE?

If your WAN is faster than gigabit or you want a faster local wired connection, yes. Check both ends of the link and VPN performance.

Does a router VPN cover every device?

Only devices connected behind it whose traffic matches the VPN rule. Devices on another Wi-Fi network or a mobile connection are not covered.

How do I know that the Kill Switch really works?

Intentionally turn off the tunnel while a test device is using the VPN. That device must not switch to the regular public IP.

Why does a DNS test still show another provider?

The router, operating system, or browser may use different resolvers. Check each layer, especially DoH in the browser.

Does a VPN guarantee access to another country's streaming catalog?

No. The platform may block the VPN exit or determine content availability in another way.

Is 192.168.1.2 on the WAN a sign of a fault?

No, not if your personal router is behind an ISP router that is routing. It is an expected private address in a setup without Bridge Mode.

Practical conclusion

For most people who need a VPN on a TV or a few home devices, the shortest path is: choose a router with a confirmed WireGuard Client, connect the ISP router's LAN to the personal router's WAN, confirm ordinary internet access, enable the VPN only for the devices you want, and test IP, DNS, IPv6, and behavior when the tunnel drops. Ask the ISP for Bridge Mode only if Double NAT causes a specific problem or you want your personal router to be the main gateway. Do not pay for a public or static IPv4 address just for an ordinary outbound VPN Client.

Verified sources