Router VPN or Device VPN: Which One Covers What
A router tunnel covers every device that uses it, and a device app follows you. Coverage, maintenance and failure behaviour decide which one you want.
Putting the tunnel on the router sounds like the tidier choice until a laptop leaves the house. A device app sounds simpler until a television needs coverage and cannot run one. The two arrangements answer different questions. The useful comparison is about where traffic enters the tunnel, not about which one is more secure.
Which Role the Router Is Playing
A router can act as a VPN server for people connecting home, as a client for reaching an outside service, or as both at once. Those are separate features with separate configuration pages, and the server alone sends nothing anywhere. Household browsing only changes exit when a client is configured with a compatible profile. Reading the role before the protocol saves a pointless afternoon.
Feature names do not make protocols interchangeable either. A menu entry labelled VPN tells you nothing about what the other end expects.
Where Traffic Enters the Tunnel
A router applies its policy to traffic crossing the interfaces and rules it owns, so guest Wi-Fi, a second gateway or IPv6 can each behave differently from the main network. Test the devices you intend to cover with a public address check rather than assuming the whole house is included. Traffic also crosses the local network before it reaches the router, so Wi-Fi security and the application's own HTTPS still carry their usual weight. The tunnel begins at the gateway, not at the device.
Outside the house the picture changes completely, because a phone on mobile data is no longer behind that router at all. A laptop on café Wi-Fi needs its own client if the requirement follows the person rather than the building. Nothing the router does travels with the device once it leaves.
This is the split that decides most cases: coverage of fixed devices favours the router, and coverage of a person favours an app. Anything that mixes the two needs both, and both need maintaining.
curl --silent https://api.ipify.org
ip -brief address show
traceroute -n -m 5 203.0.113.25Weigh Maintenance and Identity
A router setup moves secrets, firmware updates and routing policy onto the gateway administrator, and it tends to give every covered device one shared identity. An app gives each device its own sign-in, its own logs and its own profile, at the price of managing more clients. Shared and per-device identity are different propositions when something needs to be revoked.
Processing capacity belongs here too, because a router handling several users can reach its limit well before its Wi-Fi rating suggests. The ordinary throughput number on the box is not a tunnel throughput number.
Decide what should happen when the tunnel fails as well. Stopping traffic and falling back to the ordinary connection are both defensible, and the DNS and firewall configuration has to match whichever you chose.
Plan for the Outage
Keep a secure backup of the gateway configuration and a way to restore administration that does not depend on the tunnel being up. A policy that locks you out of your own router is a harder problem than the leak it was meant to prevent.
Work-managed equipment may still require its own approved client regardless of what the home router does. A home exit cannot provide access to an office network, whatever the routing table says.
Combining both arrangements is possible and sometimes correct, but each additional path is another thing to configure and diagnose. OpenWrt's documentation on VPN server and client roles is a useful reference for keeping the two apart.