Router VPN Guide: Whole-Home International Routing Setup

A router VPN moves the proxy client off every device and onto the router: the router dials out and applies split routing once, and every connected device in the home reaches international sites through the same exit. Whole-home international routing removes the repetitive work of installing clients and switching nodes device by device, and introduces a new problem in exchange: misconfigure the router and the whole household feels it.

This guide works through the approaches, the prerequisites, split routing and DNS, the trade-offs against per-device clients, the setup steps and the households that should skip it, then closes with how to choose a plan.

Three approaches: flashed main router, software router and side router

What runs on the router isn't a single protocol but a proxy core. Cores such as Clash, sing-box and Xray read the node information in a subscription link and then decide, by rule, whether a connection goes out over an international route or connects directly. Shadowsocks, VMess, Trojan, VLESS, Hysteria2 and TUIC are all handled by the core, so there's no need to pick a protocol by hand at home: whatever the subscription provides is what gets used.

There are three ways to deploy it, and the difference comes down to who acts as the gateway:

All three approaches use the same subscription and the same rule set; what differs is hardware and maintenance cost. One thing is worth stating up front: the router only forwards and splits traffic, while line quality comes from the nodes in the subscription. Direct connections reach overseas nodes over the public international exit; relayed connections pass through a relay server in the region before leaving the country, on an optimised path; IEPL dedicated lines run over carrier-grade dedicated channels and don't compete for public exit capacity. Flashing firmware won't turn a relay into a dedicated line, and it won't widen your home broadband either.

Prerequisites: modem, connection method and subscription

The first thing to confirm is who handles the dial-up connection. When the modem does the dialling, the router is just a downstream device; for the main router to take over all household traffic, the modem usually has to be switched to bridge mode and the router has to dial out itself. If touching the modem isn't an option, go with a side router: leave the main router as it is and point the gateway handed out by DHCP at the side router, so only the devices that need international routes pass through it.

The second is hardware. Proxying costs CPU for encryption and decryption and memory for rule sets; the more devices and the faster the broadband, the more headroom matters. Entry-level routers often become the bottleneck once firmware is flashed, and the symptom is pages that load while video stutters, or a household that slows down together. The safer combination splits the two jobs: wired forwarding and proxying on a software router with enough performance, wireless coverage on a separate AP.

The third is the subscription. Sign in, copy the subscription link, import it into the client on the router, and node updates are handled by subscription sync.

Split routing and DNS: where whole-home setups go wrong most often

When a whole-home setup fails, it's usually not the nodes that are down but split routing and DNS that weren't configured properly.

Split routing rules decide what leaves the country

The usual rule set sends domestic domains and IPs direct and everything else over international routes, then subdivides by purpose: one group for streaming, one for AI tools, one for games. Sharing one rule set across the household means there's no "accelerate only this device" option, because whatever one device needs affects everyone. If domestic video, cloud storage or payment sites get pushed onto international routes, the usual symptom is slower loading plus subscription traffic burned for nothing.

DNS leaks turn "connected" into "won't load"

If DNS queries still go to the local ISP while traffic leaves over international routes, the resolved address and the exit region no longer match: a domain resolves to an address reachable domestically, but the connection originates abroad, so pages fail to load or retry over and over. The fix is DNS grouping on the router: domestic domains resolved by a domestic DNS, overseas domains resolved through the proxy. mosdns, AdGuard Home and dnsmasq can all do this, and Clash-family cores can use fake-ip mode to cut resolution latency, but remember to keep a whitelist for LAN and direct-connect devices.

Rule sets need to be updatable. Domains and IP ranges change, and rules left stale in firmware gradually drift, so some sites suddenly go direct or suddenly take a long detour. Choosing a core that supports online rule-set updates is more practical than importing a pile of static rules once.

Trade-offs against per-device clients

The two routes don't replace each other; they suit different situations.

The per-device approach wins on fault isolation and flexibility: one device failing to connect doesn't affect the others, and switching networks or nodes is easier. The router approach wins on coverage and consistency: TV boxes, consoles and smart speakers that can't run a client can only be covered by a router, and the more devices in the home, the more a single configuration pays off.

The facts, side by side:

90+ countries and 160+ routes determine how many exits split routing can choose from; unlimited devices means every device at home can share one subscription without extra accounts; and the 7-day no-questions refund addresses a practical problem, because with a whole-home setup you only find out how stable it is by trying it.

Setup steps: from confirming the dial-up to verifying it works

1. Confirm who dials. Check whether the modem is in router mode or bridge mode and note the broadband account details; if switching to bridge mode isn't practical, go straight to the side-router option.
2. Pick hardware and back up. Before flashing the main router, back up the stock firmware and configuration and confirm the model has usable third-party firmware; with a software router, install the system first and confirm it can dial out and get online normally.
3. Import the subscription. Sign in, copy the subscription link, add it in the proxy client on the router, and wait for the node list to finish updating.
4. Configure split routing and DNS. Domestic domains direct, everything else over international routes, then add streaming and AI tool groups as needed; resolve DNS in domestic and overseas groups.
5. Verify the exit. On one device, check that the exit IP matches the region you selected, then confirm whether DNS is still being resolved by the local ISP; only when both check out is it really working.
6. Handle the exceptions. Add cameras, smart home devices and anything that needs LAN access to the direct list, so one rule doesn't flatten the whole household.
7. Watch it for a week. Try peak evening hours, a weekend and a video call, then decide whether to keep it long term.

Which households should skip the router approach

• ❌ Only one or two devices at home need international sites. Per-device clients are simpler and need no extra hardware.
• ❌ Renting, and can't change the modem or the wiring. Bridge mode isn't an option, and a side router needs an always-on device, so the cost doesn't add up.
• ❌ Older family members or young children at home, and the network has to be zero-maintenance. The router approach is a single point: when it breaks, the whole household goes offline, and troubleshooting is harder than on one device.
• ❌ You're on a carrier-provided all-in-one unit that can't be switched to bridge mode. A side router can work around it, but DHCP and gateways have to be rearranged, and it's easy to misconfigure without networking experience.
• ❌ Nobody wants to troubleshoot when something breaks. A whole-home setup pays off over the long run; without the willingness to maintain it, fault costs eat the benefit.
• ✅ Many devices, including TV boxes and consoles that can't run a client.
• ✅ Willing to spend time on it once, with a rollback plan kept ready.
• ✅ You need one consistent exit for the whole home, for example several devices all reaching services in the same region.

Plans and traffic: which tier fits a whole-home setup

A whole home sharing one subscription burns more traffic than a single device: TV boxes streaming video, console updates, tablets and laptops syncing in the background all come out of the same allowance. There are three monthly tiers: ¥9.9/month for 60GB, ¥18/month for 250GB and ¥28/month for 500GB. Traffic resets monthly on the activation date, and upgrading mid-cycle converts the price difference into the remaining days, which suits households with steady usage who want to control costs month by month.

If usage swings a lot, traffic packs fit better: ¥158/300GB, ¥358/1000GB and ¥658/3000GB, used until they run out and never expiring. Households treating the whole-home setup as long-term infrastructure can run a monthly plan for a while, see what they actually consume, then decide whether to switch to a traffic pack.

Payment is by Alipay, WeChat Pay or USDT; signing up needs only a username and password, no email address; device count is unlimited, so every device at home can share one subscription. The 7-day no-questions refund works as a trial window: set it up as described above, run it for a few days, then decide.

Conclusion: validate on a small scale first, then roll out to the whole home

The rollout order is better reversed: first install the client on one device to confirm the subscription works, then decide whether to move to the router. Whether the subscription itself works, and whether the routes are stable locally, has nothing to do with the router; rule that out first, and the flashing and split routing that follow actually mean something.

Once it's confirmed working, move to the router: many devices, TV boxes and consoles, and someone at home willing to maintain it, and it's worth doing. Otherwise stay with per-device clients and keep maintenance costs at their lowest.