Teams considering VPN setup eventually hit the same fork: configure each laptop and phone individually, or handle the connection once at a router or network device that several people share. Neither answer is right by default, and picking one by assumption — usually by buying a router first and asking questions later — is how teams end up with hardware that doesn't fit the actual need.
This is a decision guide, not a setup guide: what each model actually is, when each tends to fit, and the questions that decide it. No commands, no hardware recommendations, and no promise that either model guarantees access, coverage, or safety — because neither does.
The basic difference: device-level vs network-device-level setup
Per-device setup means each laptop, phone, or tablet runs its own VPN connection through a supported setup path — with Lisar, a .ovpn profile file downloaded from that person's own Panel profile and imported in OpenVPN Connect using Upload File. The setup travels with the device and is specific to it.
Router or network-device setup handles the VPN connection at a shared network device instead, where a compatible router or network device is in place, relating to the shared network path rather than each device individually. That's the entire conceptual difference; everything else in this decision follows from it.
When per-device VPN setup is usually simpler
Per-device setup is the usual starting point for good reasons. It's granular — each person's setup is theirs, tied to their own panel profile. It travels — a laptop set up at the office works the same way from home or a hotel, subject to what the network allows. It doesn't depend on shared hardware, so one device's problem stays one device's problem. And it maps onto how distributed teams tend to work: individually, from many places.
Router setup usually solves a shared-infrastructure problem, so distributed teams should first check whether they actually have that problem. For many distributed teams without shared infrastructure, per-device setup is usually the more practical starting point, and fully remote teams often have less reason to plan around router setup unless a specific shared-network scenario exists.
When router or network-device setup may be worth considering
The router model earns consideration when there's genuinely shared infrastructure: a small office where the same people work behind the same network device daily, a shared workspace a team controls, or a travel-team scenario where a network device travels with the group.
Even then, "worth considering" is the right strength of claim. The model has its own compatibility constraints and planning overhead, and business or custom scenarios may involve setup guidance, pricing guidance, custom review, and official support. It's an option to evaluate against real needs, not an upgrade to assume.
Why router compatibility matters
Router setup applies only to compatible routers and network devices — not routers in general, and not whatever hardware an office happens to have. There is no version of this where every router, travel router, or office network is supported, and router-level setup should not be assumed to work on any given device.
The practical rule: compatibility gets checked with Lisar's router setup guidance and official support before it becomes a plan, and definitely before it becomes a purchase.
Why router setup does not mean every device behaves the same way
The most common misconception in this decision is that a router setup blankets everything behind it uniformly. It doesn't: devices, apps, and networks behave differently, and router-level setup doesn't guarantee identical coverage for every device behind the router.
That matters for the decision because it removes the false choice. Router setup isn't "cover everything at once" versus per-device's "cover things one at a time" — it's a different placement of the setup, with its own behavior per device, not a universal blanket.
Travel teams and temporary networks
For travel teams, the decision gets one more variable: the surrounding network. Hotel, airport, coworking, and other public or managed networks vary, and none is guaranteed to allow or support every setup — a constraint that hits shared-network-device setups harder, because more depends on one piece of hardware working somewhere unfamiliar.
A travel-team router scenario can still make sense, but it needs the extra care the "Router VPN for Small Offices and Travel Teams" article describes, and it never removes the need for per-device setup on the devices that leave the group.
Company-managed devices still follow policy
Neither model changes device policy. A company-managed laptop behind a VPN-configured router is still a company-managed laptop: its restrictions on apps, profiles, certificates, and network settings still apply, and router setup is not a way around employer IT rules.
For the decision, that means managed devices are a per-device policy question in both models, answered with whoever owns device policy — not something the router choice resolves.
Where the .ovpn profile file download fits
Whichever way the decision goes, individual devices remain part of the picture — people leave the office, travel, and work from home. For those devices, the supported setup path keeps individual setup simple: each person downloads the .ovpn profile file from their own Lisar Panel profile and imports it in OpenVPN Connect using Upload File.
The team habits stay constant across both models: no downloaded .ovpn profile files, credentials, or profile details in shared documents or chat threads. The "VPN Profile File Safety" article covers the details.
Where Custom Exit, GeoDNS, and DNS AdBlock fit
Plan-dependent features sit orthogonal to this decision — they're about what a plan includes, not which setup model carries it. Custom Exit relates to VPN traffic exit behavior where eligible, typically involves custom review, and isn't a universal country switch, arbitrary location choice, content-access guarantee, or self-service location switching. GeoDNS is DNS-related behavior where available, not a guaranteed region switch and not the same thing as Custom Exit. DNS AdBlock may help reduce some unwanted DNS requests where available; it isn't endpoint security, antivirus, malware protection, or browser-level ad blocking.
All three depend on plan and, in some cases, custom review. Each has its own article and feature page.
Decision checklist: router, device, or mixed setup?
Planning questions, not setup steps:
- Is there genuinely shared infrastructure — an office or workspace where the same people sit behind the same network device regularly? If not, per-device setup is usually the more practical starting point.
- If yes: is the network device actually compatible? Checked with router setup guidance and official support, not assumed?
- Who controls the network the router sits on — the team, a landlord, a coworking operator? Router setup on a network the team doesn't control is a different conversation.
- Which devices leave the shared space — and are those covered per-device regardless?
- Are any devices company- or client-managed, and what do those policies allow in either model?
- Does the scenario touch business or custom territory (shared office rollout, travel-team hardware) where planning, pricing guidance, custom review, or official support applies?
- Who owns support when a device won't connect — in each model?
The checklist often points teams toward per-device setup first, with router setup added only where shared infrastructure is real and the hardware is compatible. For some teams, a mixed model may be the practical answer: per-device as the foundation, router setup where the shared-infrastructure case genuinely exists.
Frequently asked questions
Which is better: VPN on the router or on each device? Neither by default. Per-device setup is usually the more practical starting point, especially for distributed teams; router setup earns consideration where there's genuinely shared infrastructure and a compatible network device.
If we set up the router, are all our devices automatically covered? No. Devices, apps, and networks behave differently, and router-level setup doesn't guarantee identical coverage for every device behind it.
Can we use any router we already have? Not necessarily. Router setup applies only to compatible routers and network devices — compatibility gets checked with Lisar's router setup guidance and official support, not assumed.
We're a fully remote team with no office. Should we still consider router setup? Often there's less reason to, unless a specific shared-network scenario exists. Router setup usually solves a shared-infrastructure problem, so the first check is whether your team actually has one.
Does router setup get around restrictions on our company-managed laptops? No. Device policy applies in both models, and router setup is not a way around employer IT rules.
Can we mix both models? Yes — for some teams a mixed model may be the practical answer: per-device setup as the foundation, with router setup added where a real shared-infrastructure case exists on compatible hardware.
Do Custom Exit, GeoDNS, or DNS AdBlock depend on which model we pick? No. They're plan-dependent features, orthogonal to the setup-model choice, and each depends on plan and, in some cases, custom review.