VPN Router on Raspberry Pi: Step-by-Step Setup 2026

VPN router on Raspberry Pi: complete setup in 2026

A home router with the manufacturer's firmware rarely works properly with VPN at the network level. If you need to protect the traffic of all devices at once — a smart TV, a gaming console, a child's laptop, and a dozen IoT gadgets — you will either have to buy a router that supports custom firmware or build such a device yourself. Raspberry Pi handles this task excellently: a single-board computer costing around 6000–9000 rubles turns into a full-fledged VPN router that encrypts all outgoing traffic and bypasses blocks without installing clients on each device.

Why make a VPN router specifically on Raspberry Pi

There are three scenarios where a separate VPN router solves the problem better than an app on a phone or laptop.

Devices without VPN client support

Smart TVs on their firmware, PlayStation 5 and Xbox Series X gaming consoles, smart speakers, and surveillance cameras physically do not allow the installation of a VPN client. The only way to route their traffic through an encrypted tunnel is to connect them to a network where the VPN is already set up at the router level.

VPN for the whole home

Connect every device at once

1. Download the NvoVPN app
2. Sign in with Google or email
3. Set up your router with our guide

Download for Windows Other devices →

• from $0.06 a day
• card or crypto
• 14 servers online

One configuration point for the entire apartment

Instead of installing and configuring WireGuard or OpenVPN on eight different devices, the configuration is done once on Raspberry Pi. A new device simply connects to the Wi-Fi of this mini-router and automatically gets a secure internet connection.

Routing flexibility

On Raspberry Pi, you can set up split tunneling: some devices or websites go through the VPN, while others go directly. This is convenient if, for example, banking services need to work through a Russian IP, while foreign streaming platforms go through a VPN server in another country.

What is needed for assembly

Equipment

• Raspberry Pi 4 Model B with 2 GB RAM or newer — Raspberry Pi 5 provides a noticeable increase in encryption speed due to the more powerful Broadcom BCM2712 processor;
• microSD card with a capacity of at least 16 GB, speed class A2 (for example, SanDisk Extreme Pro) or, preferably, booting from an SSD USB drive for durability;
• Ethernet-to-USB adapter or a second network interface if cable distribution to multiple devices through a switch is needed;
• 5V/3A power supply with a USB-C connector — insufficient power supply leads to CPU throttling and connection drops;
• Case with passive or active cooling: during constant traffic encryption, the chip heats up more than during regular use of Raspberry Pi.

Software

The optimal choice of operating system is Raspberry Pi OS Lite (64-bit) without a graphical interface: it consumes fewer resources and reduces the load on the CPU, which is already used for encryption. To set up the VPN, one of two protocols will be needed:

• WireGuard — a modern protocol with minimal overhead, speed on Raspberry Pi 4 reaches 250–400 Mbps;
• OpenVPN — an older but flexible protocol, speed on the same hardware rarely exceeds 80–120 Mbps due to higher computational load.

If the VPN service provider you are using supports both protocols, it is almost always worth choosing WireGuard for the router — the difference in speed is noticeable even when watching 4K videos on multiple devices simultaneously.

Preparing Raspberry Pi

Installing the operating system

Download Raspberry Pi Imager from the official Raspberry Pi Foundation website, select the Raspberry Pi OS Lite (64-bit) image, and write it to the memory card or SSD. In the Imager settings (gear icon), enable SSH right away, set a username and password, and configure Wi-Fi settings if you plan to connect wirelessly at the first stage.

First connection and system update

After booting, connect via SSH:

ssh pi@raspberrypi.local

Update the system and reboot the device:

sudo apt update && sudo apt full-upgrade -ysudo reboot

Setting a static IP address

The router needs a predictable address on the local network. Open the dhcpcd configuration file:

sudo nano /etc/dhcpcd.conf

And add to the end:

interface eth0static ip_address=192.168.1.2/24static routers=192.168.1.1static domain_name_servers=1.1.1.1 8.8.8.8

Configuring WireGuard on Raspberry Pi

Installing the package

sudo apt install wireguard wireguard-tools -y

Generating keys

wg genkey | tee privatekey | wg pubkey > publickey

The private key remains on the device, while the public key is sent to the VPN service provider or used when setting up your own server.

Client configuration file

Create a file /etc/wireguard/wg0.conf with the following content, replacing the values with the data obtained from your VPN provider:

[Interface]PrivateKey = ваш_приватный_ключAddress = 10.0.0.2/32DNS = 1.1.1.1[Peer]PublicKey = публичный_ключ_сервераEndpoint = адрес_сервера:51820AllowedIPs = 0.0.0.0/0, ::/0PersistentKeepalive = 25

Startup and autoloading

sudo systemctl enable wg-quick@wg0sudo systemctl start wg-quick@wg0

You can check that the tunnel is up with the command sudo wg show — it will display the connection status, the amount of data transferred, and the time of the last handshake.

Turning Raspberry Pi into an access point

Installing hostapd and dnsmasq

sudo apt install hostapd dnsmasq -ysudo systemctl unmask hostapd

Configuring hostapd

In the file /etc/hostapd/hostapd.conf set the network parameters:

interface=wlan0driver=nl80211ssid=VPN-Home-Routerhw_mode=gchannel=7wmm_enabled=0macaddr_acl=0auth_algs=1ignore_broadcast_ssid=0wpa=2wpa_passphrase=надёжный_пароль_16_символовwpa_key_mgmt=WPA-PSKwpa_pairwise=TKIPrsn_pairwise=CCMP

Configuring dnsmasq for address distribution

In /etc/dnsmasq.conf add:

interface=wlan0dhcp-range=192.168.4.2,192.168.4.100,255.255.255.0,24hdhcp-option=3,192.168.4.1dhcp-option=6,1.1.1.1

Configuring routing through iptables

To ensure all traffic from the wireless network goes through the WireGuard tunnel, enable packet forwarding and set up NAT:

echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.confsudo sysctl -psudo iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADEsudo iptables -A FORWARD -i wlan0 -o wg0 -j ACCEPTsudo iptables -A FORWARD -i wg0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPTsudo netfilter-persistent save

After this, any device connected to the "VPN-Home-Router" network will automatically send all traffic through the encrypted tunnel — without installing client applications.

Bypassing blocks: when one VPN is not enough

In regions with active traffic filtering via DPI (Deep Packet Inspection), the provider may identify and block even WireGuard connections by characteristic packet tags. In such cases, traffic obfuscation helps:

• WireGuard + obfuscation wrapper — for example, the tool wireguard-go with an obfuscation plugin disguises the tunnel as regular HTTPS traffic;
• Shadowsocks in conjunction with VPN — the traffic first goes through a Shadowsocks proxy, which hides the very fact of using the VPN protocol;
• changing the Endpoint port to 443 — sometimes it is enough to move the VPN server from port 51820 to 443 so that the traffic visually does not differ from regular HTTPS.

If the VPN service you are using provides ready-made configurations with obfuscation (often these are separate servers marked "obfuscated" or "stealth" in the location list), it is easier to use them rather than configure the wrapper manually on Raspberry Pi.

Checking operation and diagnostics

Checking for DNS leaks and real IP

After connecting any device to the router's network, open a browser on it and go to an IP address and DNS leak check service. The displayed address should belong to the VPN server, not your internet provider.

Speed measurement

Compare the speed before and after enabling the VPN tunnel using iperf3 within the local network, as well as through a regular speed test in the browser. A drop of 15–30% from the base internet speed is a normal indicator for WireGuard on Raspberry Pi 4; a drop of more than 50% indicates CPU overload or issues on the VPN server side.

Temperature monitoring

vcgencmd measure_temp

Under constant encryption load, the temperature of the Raspberry Pi 4 chip without active cooling may rise above 70°C, leading to throttling. If the readings are consistently above this mark, it is advisable to add a fan to the case.

Autostart and fault tolerance

Connection check script

To ensure the tunnel automatically recovers after a provider failure, add a check in crontab every 5 minutes:

*/5 * * * * ping -c1 10.0.0.1 > /dev/null || systemctl restart wg-quick@wg0

Kill switch in case of VPN disconnection

To prevent devices from "falling out" into the open internet when the tunnel breaks, add a rule that blocks outgoing traffic through the main interface when there is no active WireGuard connection:

sudo iptables -A FORWARD -i wlan0 -o eth0 -j DROP

This rule allows traffic from the wireless network to go only through the wg0 interface, not directly to the internet — if the tunnel drops, devices simply lose connection instead of switching to an unprotected connection.

Typical mistakes when assembling a VPN router

• Weak power supply — saving on an original adapter often leads to unstable operation of the Wi-Fi module, especially during high encryption loads;
• Using a cheap microSD card
• Ignoring MTU
• One Wi-Fi channel for two bands

When Raspberry Pi is not the best option

For apartments with internet speeds above 500 Mbps and a large number of simultaneously operating devices, Raspberry Pi 4 can become a bottleneck: the processor simply cannot keep up with encrypting traffic at such speeds. In this case, it is wiser to consider a router based on an x86 mini-PC or ready-made solutions with hardware acceleration for encryption. However, for a home network with typical speeds of 100–300 Mbps and a dozen connected devices, Raspberry Pi 4 or 5 performs adequately without noticeable limitations and remains one of the most affordable ways to protect all apartment traffic at once, without setting up a VPN on each individual gadget.