VPN for a router: for the devices that cannot run an app

The one good reason to do it

Put the tunnel on the router only if something in the flat cannot run a client: a smart TV with no suitable app, a games console, an older tablet. Phones and laptops are easier with an app each, because the link has no device limit and a router adds nothing to the device count.

A router tunnel is also all-or-nothing by default. Every device behind it goes out through the same European server, the guest's phone and the work laptop included, unless you build exceptions into the router.

What the whole flat gives up and gets

• Every device behind the router uses the tunnel, so an app that asks for extra verification on a connection from abroad may do so on every screen, and none of our five servers is in Turkey.
• The router's processor sets a ceiling, because encrypting for the whole flat falls on a small chip. A modest router can cap the speed below what the line gives, and we publish no speed figures.
• The link sits in the router's settings, so treat the admin page like a password vault and change its default login.
• If the tunnel drops, the devices either lose the internet or fall back to the plain line, depending on how you built it. Decide which you prefer before you rely on it.
• Housemates and guests come with the package, and their traffic takes the same route, so tell them.

The modem your provider put in

The box that Türk Telekom, Superonline or TurkNet gives you is built to run that provider's service. Such modems typically offer Wi-Fi, port settings and parental controls but no place to add a client for a protocol like VLESS, and putting other firmware on a modem that comes with a rented line is rarely possible or sensible. The realistic route is a second router of your own, plugged into the modem, doing the tunnelling for the devices that join it.

That second router sits behind the modem, so two layers of address translation stack up. They are normally fine for browsing and calls and can get in the way of hosting a game or reaching the flat from outside. If that matters to you, ask the provider whether the modem can be switched to bridge mode.

The usual route to VLESS on a router, in order

1. 1

   Look up the router model in the OpenWrt hardware table. If it is not listed as supported, stop there and do not flash anything onto it.

2. 2

   Back up the current settings, install OpenWrt by the instructions on the model's own page, and set a strong admin password.

3. 3

   Install a package that can speak VLESS, for example sing-box, which the OpenWrt package repository carries. Packages differ in how they take the link, and some want it split into its parts, so follow the package's own documentation.

4. 4

   Put in the link you got from the Iskele bot, and keep it out of screenshots, forum posts and any backup you share.

5. 5

   Route one guest network or one device through the tunnel first, and leave the phones and laptops on the plain network until it works.

6. 6

   Keep a plain Wi-Fi network available as a way back, in case the tunnel needs fixing while someone is on a call.

Cheaper ways to deal with one television

If the whole problem is a single TV, the router may be more than you need. A TV or TV box that runs Android TV can take a client directly, and the page on TVs says what to look for. A tunnel on a laptop covers that laptop only, so do not expect it to reach the TV on the same Wi-Fi.

Rented flats, shared lines and who decides

A router that carries everyone's traffic makes you the person who decides what runs through it. In a rented flat, check that the landlord or the building is content with a second router and with changes to the line, and remember that a modem supplied with the line may belong to the provider and have to go back as it came.

The lease and the provider's subscription terms are the documents to read before you build anything: they say what you may attach to the line and what you may change in the flat, and they differ from one flat and one provider to the next. Guests and housemates who join your network use whatever route you built, so the responsibility for it, and for the law where you live, is yours. Does this advice favour the seller? It comes from one, so check: a router adds no device slots and takes effort, which is why the plain reading is that you need one only for screens without an app.

Questions