VPN on the router or in the app?

A router VPN protects what is behind the router, and an app protects the device it is installed on. Each place leaves something out, and which gap hurts depends on what you own.

Router specifics are in OpenWrt and WireGuard and MikroTik vs OpenWrt. For sharing with a household, see sharing a VPN with family.

This post is a coverage map, not a winner's podium. It is read from our own router page, help pages and code on 2026-10-16.

"Router" means the two shipped routes: a RouterOS 7 container on MikroTik, or a package on OpenWrt. "App" means the ForestVPN clients on iPhone, iPad, Mac, Apple TV, Android, Android TV, Windows and Linux.

Which devices belong on the router and which in the app?

Put it on the router for devices that cannot run an app, and in the app for devices that leave home. Smart TVs, consoles and guests' devices often cannot run a VPN app at all, and the whole-home router page names exactly that problem. A phone that goes to work or on a trip is not behind your router when it matters.

The question is rarely "which one". Ask which device sits where. A television that never moves belongs to the router. A laptop that goes to a cafe belongs to the app. A phone is both, depending on the hour.

If you are still choosing between the two router routes, MikroTik against OpenWrt has that comparison, and the OpenWrt WireGuard guide covers the manual alternative. This post stays on the router-versus-app question.

What does a router VPN cover that a VPN app does not?

The router covers devices that cannot run an app, such as a smart TV or a console, from one install; the app covers everything that leaves home. The matrix below has ten rows, one per situation, each read from a named page. The router column describes ForestVPN's router recipes; the app column describes the clients.

The speed row carries no figure on purpose. On a router, the router's CPU is the speed limit. The whole-home router page reports 122 Mbit/s over a gigabit LAN on the two test routers, both MikroTik, measured on 2026-09-01. That is not an OpenWrt result and not a promise for your router. We have no OpenWrt speed figure. The throughput post has the method.

What does a router VPN leave uncovered?

It leaves devices away from home, a default that differs by router, one location for the house, and any choice finer than a device. Four gaps.

Devices that leave home

A phone on mobile data is not behind your router. The router recipe covers a device only while it is on your home network, so a laptop in a hotel or a phone in a cafe needs the app. The whole-home router page says as much in its own FAQ.

There is one way back home. Per the devices page, turn on Use as an exit on a computer that stays home, and a phone away from home can pick it under My exits, the list of your own devices that serve as exits. The exit has to be on, and your home upload speed is the ceiling.

What the router does with its own traffic

The two routes start differently:

• OpenWrt: the router's own traffic never enters the tunnel, and its own name lookups use your normal resolver.
• OpenWrt, Direct: the per-device switch that keeps a device outside the tunnel, for a server you reach from outside or a console that reports a strict NAT type. The kill switch does nothing for those devices.
• MikroTik: the order is reversed. Out of the box the router tunnels its own traffic and nothing else, and the phones and laptops on your network keep using your normal connection until you add rules.

One location for the whole house

Every device behind the router shares one plan and one location. If one person needs an exit in one place and another needs a different one, a single router cannot give both. That is a limit of the design, not a setting you missed.

A choice by app or website

A router never sees which app on a phone sent a packet, so it can only choose by device or by address.

On OpenWrt, in LuCI (OpenWrt's web interface), ForestVPN's device modes let you pick all devices, only chosen devices, or all except some, by hardware address. A phone that rotates its private Wi-Fi address can look like a new device and fall out of the chosen list; the help page names the fix. To choose by site, ForestVPN can step back and let passwall2, podkop or pbr decide.

MikroTik's choice is RouterOS mangle rules (packet-marking rules) that you paste. They select by destination address and port, which is how the calls-and-messengers recipe picks a group of apps. They go on the box that routes your LAN, which may not be the box that runs the container.

What does a VPN app leave uncovered?

It leaves every device you did not install it on, and it asks you to repeat the setup on each one. The smart TV, the console, the printer and a visitor's phone all stay outside until each has its own client, and some of them never can.

An app also brings a few limits of its own. Split tunneling is not the same everywhere: Android picks apps, Windows and Linux pick IP ranges, and iPhone, iPad and Mac have none. On Android TV the TV layout leaves split tunneling out, as the Android TV walkthrough explains.

Seats count too. An account holds up to ten devices, the router uses one, and every phone, laptop and TV with an app uses another. A household that installs an app everywhere may hit the ceiling before it runs out of devices.

Does the kill switch work the same on a router and in an app?

No, and the difference is what it covers.

In an app

The operating system enforces it. See the kill switch page:

• iPhone, iPad, Mac and Apple TV: the app asks the system to send all traffic through the tunnel.
• Android: traffic is blocked the moment the connection drops while ForestVPN is running. Always-on VPN with Block connections without VPN in the system settings covers the gaps when the app is stopped.
• Windows and Linux: local firewall rules.

On a router

It is built from routing and firewall rules for the devices the router protects.

• OpenWrt: two halves that fail independently, a routing half and a firewall half, and neither depends on the ForestVPN program being alive.
• MikroTik: three rules you add: a route health check, a drop route and a firewall rule. They cover the traffic you selected and nothing else, and they are IPv4 only.

Limits of a router kill switch

No kill switch is absolute. On OpenWrt it covers protected devices, not Direct devices or the router's own traffic. On MikroTik it covers only the traffic you selected.

The OpenWrt pages say the full recipe is not yet verified on hardware as a whole. The leak suite passed in a lab on OpenWrt 21.02.7 and 24.10.8, and on 21.02.7 four of its checks are skipped, three of them IPv6 checks. The MikroTik page says its three rules each ran on RouterOS 7.24.1 and that the stop-and-test has not been run on a router. Treat a router kill switch as a safeguard you test yourself, not a guarantee.

IPv6

• OpenWrt with the nftables firewall (fw4): protected devices' IPv6 is carried or refused.
• OpenWrt 21.02 (fw3): the whole LAN's forwarded IPv6 is refused while protection is on.
• MikroTik: the rules are IPv4 only, and selected traffic can still reach its destination over IPv6, around the tunnel.

Can you use both a router VPN and an app?

Yes, and it is often the right setup, but give each device one home for the tunnel. Running the app on a laptop that is also marked as protected on the router sends its traffic through a tunnel inside a tunnel.

A workable split:

• Router: TVs, consoles, speakers and anything with no app.
• App: phones, tablets and laptops that leave the house.
• Travel router: a travel router running OpenWrt is the same router setup in a bag, covering the devices behind it. The first-run help notes that a GL.iNet GL-MT3000 has not yet been tried.
• TV with no app: VPN for smart TV lays out which TVs run an app and which need the router.
• Direct on the router (OpenWrt): a work laptop, or a server you reach from outside, so the router leaves it alone and its own app, if any, does the job.

How do you check a router VPN is working?

On a device, the app reads the tunnel's own counters and names one of eight verdicts, with Working only once data flows both ways. The app's main screen has no Connected state; only the Android Quick Settings tile, widget and device list use the short word Connected. On OpenWrt the status page says Protected, and per the first-run help that appears only after packets are proven to flow both ways, not from a handshake alone. On MikroTik, the container serves a status page where you pick a location.

Check from a protected device by opening a what-is-my-address page: it should show the exit's address, and a device on Direct (OpenWrt) should show your home address. If a protected device has a tunnel and no pages, VPN connected but no internet goes through the causes.

Should you choose a router VPN, a VPN app or both?

Choose the router if most of what you want covered cannot run an app and stays at home. Choose the app if most of what you want covered moves. Choose both if the house has a TV and a phone.

• Choose the router if you have a TV or console without an app, you want one install for the whole house, and you accept one location, a kill switch that covers only what the router protects, and, on MikroTik, some RouterOS rules to paste.
• Choose the app if you travel, want a different location per device, or want to pick apps on Android.
• Choose both if you want the TV covered at home and the phone covered everywhere, and you keep each device in one place only.

A router shares one plan across every device behind it, so check the plan limits before you put a whole home on one.

Ask about this