Teams considering VPN setup eventually hit the same fork: configure each laptop and phone individually, or handle the connection once at a router or network device that several people share. Neither answer is right by default, and picking one by assumption — usually by buying a router first and asking questions later — is how teams end up with hardware that doesn't fit the actual need.
This is a decision guide, not a setup guide: what each model actually is, when each tends to fit, and the questions that decide it. No commands, no hardware recommendations, and no promise that either model guarantees access, coverage, or safety — because neither does.
The basic difference: device-level vs network-device-level setup
Per-device setup runs a connection on the individual laptop, phone or tablet. Choose the current guide for the actual device: L2TP/IPsec where compatible and appropriate, or an OpenVPN profile with a compatible client where L2TP/IPsec is unavailable or unsuitable. Lisar Connect is also available for Android, iPhone and iPad. Use only that person's authorized active profile and keep its connection values private.
When a compatible router establishes the Lisar tunnel, downstream devices whose traffic is routed through that tunnel do not need a separate Lisar app or VPN client. Check the router model, firmware, VPN client mode and routing rules. Guest networks, excluded devices, split routes or a phone switching to mobile data can follow another path. Website behavior and device policy remain separate from whether traffic uses the tunnel.
When per-device VPN setup is usually simpler
Per-device setup is the usual starting point for good reasons. It's granular — each person's setup is theirs, tied to their own panel profile. It travels — a laptop set up at the office works the same way from home or a hotel, subject to what the network allows. It doesn't depend on shared hardware, so one device's problem stays one device's problem. And it maps onto how distributed teams tend to work: individually, from many places.
Router setup usually solves a shared-infrastructure problem, so distributed teams should first check whether they actually have that problem. For many distributed teams without shared infrastructure, per-device setup is usually the more practical starting point, and fully remote teams often have less reason to plan around router setup unless a specific shared-network scenario exists.
When router or network-device setup may be worth considering
The router model earns consideration when there's genuinely shared infrastructure: a small office where the same people work behind the same network device daily, a shared workspace a team controls, or a travel-team scenario where a network device travels with the group.
Even then, "worth considering" is the right strength of claim. The model has its own compatibility constraints and planning overhead, and business or custom scenarios may involve setup guidance, pricing guidance, custom review, and official support. It's an option to evaluate against real needs, not an upgrade to assume.
Why router compatibility matters
Router setup applies only to compatible routers and network devices — not routers in general, and not whatever hardware an office happens to have. There is no version of this where every router, travel router, or office network is supported, and router-level setup should not be assumed to work on any given device.
The practical rule: compatibility gets checked with Lisar's router setup guidance and official support before it becomes a plan, and definitely before it becomes a purchase.
Why router setup does not mean every device behaves the same way
A compatible router can cover multiple downstream devices with one tunnel when its rules route their traffic through it. That is particularly useful for devices without a suitable local VPN client. The important verification is the route, including guest networks, exclusions and alternate connections.
Router setup centralizes configuration; per-device setup makes each client responsible for its connection. Either can cover the intended traffic when configured correctly. Device policy and a website's own access decisions remain separate checks.
Travel teams and temporary networks
For travel teams, the decision gets one more variable: the surrounding network. Hotel, airport, coworking, and other public or managed networks vary, and none is guaranteed to allow or support every setup — a constraint that hits shared-network-device setups harder, because more depends on one piece of hardware working somewhere unfamiliar.
A travel-team router scenario can still make sense, but it needs the extra care the "Router VPN for Small Offices and Travel Teams" article describes, and it never removes the need for per-device setup on the devices that leave the group.
Company-managed devices still follow policy
Neither model changes device policy. A company-managed laptop behind a VPN-configured router is still a company-managed laptop: its restrictions on apps, profiles, certificates, and network settings still apply, and router setup is not a way around employer IT rules.
For the decision, that means managed devices are a per-device policy question in both models, answered with whoever owns device policy — not something the router choice resolves.
Where the .ovpn profile file download fits
People leave the office, travel and work from home, so decide how those devices connect away from the shared router. Choose the current guide for the actual device: L2TP/IPsec where compatible and appropriate, or an OpenVPN profile with a compatible client where L2TP/IPsec is unavailable or unsuitable. Lisar Connect is also available for Android, iPhone and iPad. Use only that person's authorized active profile and keep its connection values private.
The team habits stay constant across both models: no downloaded .ovpn profile files, credentials, or profile details in shared documents or chat threads. The "VPN Profile File Safety" article covers the details.
Where Custom Exit, GeoDNS, and DNS AdBlock fit
GeoDNS, DNS AdBlock and Custom Exit depend on the selected profile's plan and current configuration. Check availability separately from whether a feature is enabled or an exit is selected. The same plan does not automatically give every profile the same route, and Custom Exit does not by itself promise a dedicated or static IP. Use the current feature guide and panel options; a tailored business arrangement may need review.
All three depend on plan and, in some cases, custom review. Each has its own article and feature page.
Decision checklist: router, device, or mixed setup?
Planning questions, not setup steps:
- Is there genuinely shared infrastructure — an office or workspace where the same people sit behind the same network device regularly? If not, per-device setup is usually the more practical starting point.
- If yes: is the network device actually compatible? Checked with router setup guidance and official support, not assumed?
- Who controls the network the router sits on — the team, a landlord, a coworking operator? Router setup on a network the team doesn't control is a different conversation.
- Which devices leave the shared space — and are those covered per-device regardless?
- Are any devices company- or client-managed, and what do those policies allow in either model?
- Does the scenario touch business or custom territory (shared office rollout, travel-team hardware) where planning, pricing guidance, custom review, or official support applies?
- Who owns support when a device won't connect — in each model?
The checklist often points teams toward per-device setup first, with router setup added only where shared infrastructure is real and the hardware is compatible. For some teams, a mixed model may be the practical answer: per-device as the foundation, router setup where the shared-infrastructure case genuinely exists.
Frequently asked questions
Which is better: VPN on the router or on each device? Neither by default. Per-device setup is usually the more practical starting point, especially for distributed teams; router setup earns consideration where there's genuinely shared infrastructure and a compatible network device.
If we set up the router, are all our devices automatically covered? Devices whose traffic is routed through the active Lisar tunnel use that connection without separate clients. Verify the routing rules, guest networks, exclusions and other connections; merely saving a router profile does not establish that every device is included.
Can we use any router we already have? Not necessarily. Router setup applies only to compatible routers and network devices — compatibility gets checked with Lisar's router setup guidance and official support, not assumed.
We're a fully remote team with no office. Should we still consider router setup? Often there's less reason to, unless a specific shared-network scenario exists. Router setup usually solves a shared-infrastructure problem, so the first check is whether your team actually has one.
Does router setup get around restrictions on our company-managed laptops? No. Device policy applies in both models, and router setup is not a way around employer IT rules.
Can we mix both models? Yes — for some teams a mixed model may be the practical answer: per-device setup as the foundation, with router setup added where a real shared-infrastructure case exists on compatible hardware.
Do Custom Exit, GeoDNS, or DNS AdBlock depend on which model we pick? No. They're plan-dependent features, orthogonal to the setup-model choice, and each depends on plan and, in some cases, custom review.
Related guidance: Router VPN Setup Checklist: Compatibility, Profiles, and Network Limits and Router-Level or Device-Level VPN for a Household or Home Office?.