Router VPN vs Per-Device Apps

Count seats, not feelings. An app on a phone is one connected session. An app on a laptop is one. A router that holds a WireGuard or OpenVPN client is one session toward the VPN, then a NAT for the LAN. You did not magically get unlimited Klox devices. You spent one seat on a choke point.

That choke point is the whole point. Five app seats cannot cover thirty IoT addresses. One router seat can, on that LAN, until the CPU cries. Five app seats can cover a phone in an airport. A router seat cannot. If you try to make the router do travel, you will carry a travel router, and that is a third lifestyle I will mention and not romanticize.

Install is still free of the counter. Connect is not. A router that stays up 24/7 occupies the seat 24/7. Apps you disconnect free seats. People forget that and then wonder why the sixth phone errors in a hotel. The router at home is still logged in. Of course it is. You told it to be the house.

Smart TVs, many streaming sticks, game consoles, bulbs, speakers, printers: no Klox app, often no VPN client at all. The honest paths are a router hop, a device that can run an app in front of them, or leaving them on the clear LAN. 'Works on Android' is not a Fire Stick. I will not invent a TV APK to win this paragraph.

If the job is 'nothing on this Wi-Fi talks in the clear to the ISP,' you need the choke point. Apps on two phones will not cover the TV. Features mentions OpenVPN and WireGuard configs on a router for whole-network protection. That is a file you import, not a branded firmware image. The setup-tips article is how. Here: that file spends one seat.

IoT talking to vendor clouds through a VPN can break geo assumptions, vendor APIs, and your own remote access to a camera. Test one gadget. Then the rest. A house that 'just works' on day one and dies on day two is usually a camera or a voice assistant that hated the exit IP. Split later if you must. Do not promise grandma the bulbs and the tunnel on the same evening without a rollback.

The phone is why consumer VPNs exist as apps. Cafe Wi-Fi, hotel splash pages, cellular you may or may not want to wrap. A home router does none of that once you walk past the driveway. If your threat model is 'untrusted Wi-Fi I do not run,' you already lost the router argument for that hour.

Smart Connect, on the apps, is connect automatically on untrusted Wi-Fi. A router has no Smart Connect in the Klox Features sense. It is always the house or it is down. Do not mash those nouns. Auto on a phone is a travel habit. Always-on a gateway is a household policy.

You can run both: router for the LAN, apps off at home so you do not double-encrypt, apps on when you leave. Double-encrypt (phone app plus router VPN) is possible and usually pointless. It burns CPU and confuses kill switches. Pick one path per packet.

Five seats means the traveling phones need vacancies. If the router holds seat one all year, you have four left for humans who walk around. That is often enough. It is not enough if you also insist every laptop stays connected at home through an app while the router already covers them. That is how you invent a cap problem.

On a phone, fail-closed means that phone has no internet until the tunnel returns. Annoying. Recoverable. On a router, fail-closed means the house has no internet: printers, guests, smart locks, the kid's homework, your own admin session to the router if you were sloppy. I have watched people lock themselves out of the only interface that could disable the client. That is not a feature story. That is a Saturday.

Many consumer gateway 'VPN clients' do not even have a real kill switch. They just stop forwarding into the tunnel and leak, or they stall. Do not assume phone-app semantics on a $60 ISP modem. If the firmware does not say what happens on drop, assume leak or stall, then test with a phone while you still have cellular.

I would rather a house leak for ten seconds on a drop than a house that bricks. Phone apps can be stricter. That split is the point of per-device. If you need fail-closed for one laptop, put it on the laptop. Do not punish the thermostat.

Klox app kill switch is a client feature. DNS through the tunnel, IPv6 leak protection, WebRTC leak blocking are also client/Features claims. A stock router may do none of those the way the app does. Importing a config does not magically import the app's leak UI. Test after connect if you care. Do not cite the Features page as if it were LuCI.

Stock firmware may include a VPN client. It may include OpenVPN and not WireGuard. It may include a client that last got a patch in 2019. ISP CPE may hide the client or forbid it. Custom firmware exists because vendors left the client out. Flashing voids warranties and bricks a percentage of attempts. The setup-tips article is where those steps live. Here the decision is: do you want that hobby.

Preconfigured 'VPN routers' from competitor shops are a product: you pay for someone else's flash and their support line. Fine if you like that SKU. It is still one seat toward Klox if you point it at Klox configs, or it is a different vendor's subscription glued to hardware. Read which. Do not assume a Nord-shaped box speaks Klox.

I will not invent throughput for your unnamed chip. Cheap gateways choke on OpenVPN. WireGuard is lighter and still not free. If your WAN is fast and the router is a free ISP brick, the apps on phones will feel better than the whole house sharing a sad CPU. That is a reason to stay per-device even if you liked the IoT story.

Mesh systems are their own pain. The node that holds the VPN client may not be the node you think. Guest SSID may bypass it. Confirm, or do not sell yourself 'the mesh is covered.'

Hotels, cafes, airports: splash pages, rude UDP, SSIDs you do not run. That is app territory. Smart Connect if the row exists. Kill switch you can pause. WireGuard, then OpenVPN. Five seats in a backpack if you overpack. A home router does not come with you unless you packed a travel router, which is a second NAT, a second admin UI, and a TSA conversation I do not need.

Leave the house router up while you travel only if you wanted the house tunneled while empty. That still occupies a seat. Pause it if you need five humans on the road. An empty house does not need a tunnel for the bulbs. An occupied house with a sitter might. Say which.

I travel with phone plus laptop. Two seats. Router at home paused or left as one seat if someone is still there. That is the whole policy. It survives contact with a splash page. A flashed Asus in a suitcase does not.

Seven-day money-back still exists if you bought Klox to try a router weekend and hated the firmware. First purchase only. The window is not a reason to skip reading whether your gateway even has a client.

If the television cannot run a client, the router hop is the honest consumer path. A laptop hotspot is a hack. A streaming stick that can run an app is another path if you actually have that binary. Klox consumer download lists platforms we ship. Confirm the TV row before you promise the living room. I will not invent Netflix catalogs, 4K guarantees, or a Leanback APK in this paragraph.

Router-for-TV means the whole SSID or a carefully split SSID. If you VPN only the TV VLAN, you are already a person who should read setup-tips and still might regret it. If you VPN the whole house to satisfy the TV, you accepted blunt for everyone. Sometimes that is fine. Sometimes the work laptop should not exit from the same IP as the cartoon app.

White-label TV listing problems are a different building. You are a household. You need a hop or a stick. You do not need a Play Console lecture. If a family seating chart is your real issue, five devices is the other post. Here: no app on the TV pushes the needle toward one router seat, not toward a sixth app you cannot install.

The dream is: TV and IoT through the VPN, work laptop clear, guests clear, phones on apps when they leave. The reality is VLANs, two SSIDs, policy routing, and a partner who will reset the gateway. Per-device apps already are split routing: this gadget yes, that gadget no. That is the underrated feature. You do not need nftables to leave the printer alone. You leave the printer without an app.

Router split is powerful and operationally expensive for a small household. Do it if you already enjoy it. Do not do it because a blog made it sound like a toggle. If your firmware has 'VPN for this device' based on MAC, test it twice, then still keep a rollback. MAC lists rot when phones randomize addresses.

Work laptops sometimes forbid a VPN that is not the company's. A house router that forces a consumer tunnel onto that laptop is how you get a fight with IT. Put work on a clear SSID. Put the rest wherever you decided. Apps on personal phones do not capture the work NIC. That is another vote for per-device in mixed houses.

Encryption on a phone is one user's traffic on a chip designed this decade. Encryption on a $40 gateway is everyone's traffic on a chip designed to NAT cheaply. You will notice. Video calls will notice. Large downloads will notice. IoT will not notice because it barely talks. If the humans are the load, apps win on speed. If the load is a TV plus idle gadgets, a decent router might be fine.

Guests inherit whatever you put on that SSID. A router VPN makes your house look like a VPN exit to every visitor. Some guests will not care. Some will fail to reach a bank that hates the exit. Some will blame your Wi-Fi. Have a clear guest SSID if you host humans you are not ready to debug.

I will not quote a percent of line speed. I will not quote a city count as a reason the router is fast. Try your WAN, your box, your protocol. WireGuard first. OpenVPN if you must. If it is sad, you learned something a marketing page would not say.

Battery on phones is an app cost. A router has a wall plug. That is a real point for the gateway if the only goal is 'phones at home should not burn battery on a tunnel.' Then leave apps off at home. You can still turn them on in a cafe. That hybrid is how a lot of sane people actually live.

If two or three humans travel and the house is mostly phones and laptops: apps. Download them. Mark home trusted if you want. Smart Connect for cafes. Router optional forever.

If the living room is a TV with no client and a pile of gadgets you actually want tunneled: one router seat, then apps only when people leave, and pause double-tunnel. Read setup-tips when you are ready to import a file. Do not flash on a work night.

If you want both completeness at home and discipline on the road: router for the LAN, four seats left for travel, apps off on the home SSID. That is the hybrid I would run if I had IoT I cared about. I do not, so I run apps and leave the ISP router stupid. That is also allowed.

Klox remains five simultaneous, WireGuard, OpenVPN, OpenConnect, and Shadowsocks, from $2.83 a month yearly, seven-day first-purchase money-back. A competitor router storefront is a specimen of the category, not a homework assignment. If the firmware fight is the product, you will hate the year. If the cafe habit is the product, you wanted the other post, and the apps.

DNS through the tunnel is an app promise you can leak-test. On a router, you get whatever that client implements. Check. IPv6 on home LAN plus a v4-only gateway client is a leak waiting for a blog comment. WebRTC is a browser problem on a laptop even behind a router. None of that picks the seat. It tells you what to verify after you pick.