In Iran, can the ordinary router my ISP gave me run a VPN/VLESS?

Mostly no. ISP-supplied routers usually have locked firmware — you can't install third-party components and they can't run a proxy core like xray/sing-box. To do VLESS+Reality on the router you need a model you can flash with OpenWRT or that ships with sing-box support — commonly OpenWRT (install the passwall/sing-box package), GL.iNet (many models, especially travel routers, ship with it built in), or Asus+Merlin. If you're stuck with a locked ISP router, either swap to one of those, or step back and install a client on each device.

In Iran, does a router VPN have to use split-routing?

Strongly recommended — practically required. Iran has a situation Russia doesn't: the national intranet (NIN / شبکه ملی اطلاعات) is usually faster and cheaper, and many plans don't count domestic traffic against the international quota; and many Iranian banks (Shaparak), government and local services flatly reject foreign IPs. If you tunnel everything (including domestic sites and banking), it's slow and wasteful, and you may be unable to log into your own online banking. The correct approach is split-routing rules: Iranian domestic sites, Shaparak banking and government sites go direct, and only blocked/throttled foreign sites go through the tunnel. In Iran that's not an optional tweak — it's the precondition for using local services.

Why is my connection so slow once the VPN is on the router?

Two common causes. One is the CPU bottleneck: encryption/decryption costs compute, and a cheap router's small CPU may only manage tens of Mbps, far below your line — switching to a model with ARM multi-core / hardware AES helps noticeably. The other is no split-routing: tunneling all traffic (including the Iranian domestic intranet, banking, downloads) wastes CPU and takes the long way around, when the domestic intranet is fast going direct. The fix is to route Iranian domestic traffic direct and send only the foreign traffic that needs it through the tunnel. Also, Iran's DPI throttling of foreign encrypted tunnels itself slows things down.

Does using VLESS on the router mean it definitely won't be blocked?

No such guarantee. Iran's blocking is at the protocol layer: DPI probes and throttles/cuts suspicious encrypted traffic. VLESS+Reality survives better because it disguises traffic as ordinary HTTPS to a real major site with almost no unique fingerprint — but the resilience comes from Reality's disguise configuration, not the protocol name; a poorly configured VLESS gets cut too, with no guarantee. And during Iran's characteristic 'national shutdown / domestic-intranet-only' drills, every foreign tunnel in the house goes down together and no router setup can help. A router-level approach changes 'how many devices are covered', not 'the protocol fight'.

Home › Guides › Putting a VPN/VLESS on Your Router in Iran — Whole-Home in One Go (an Honest Explanation): Router-Level = Smart TVs, Consoles and IoT All Go Through the Tunnel With No Per-Device App; but Only a Router That Can Run xray/sing-box Works (OpenWRT+passwall / GL.iNet / Asus Merlin) — a Locked ISP Router Can't; the Iran-Specific Key Point Is Split-Routing: Iranian Domestic Sites (داخلی/NIN), Shaparak Banking and Government Sites Must Go Direct (Domestic Intranet Is Faster/Cheaper/Off the International Quota, and Many Iranian Bank/Gov Sites Reject Foreign IPs); CPU Is the Speed Bottleneck; the Protocol Fight Is Unchanged, and During a National Shutdown Every Foreign Tunnel Goes Down at Once

Putting a VPN/VLESS on Your Router in Iran — Whole-Home in One Go (an Honest Explanation): Router-Level = Smart TVs, Consoles and IoT All Go Through the Tunnel With No Per-Device App; but Only a Router That Can Run xray/sing-box Works (OpenWRT+passwall / GL.iNet / Asus Merlin) — a Locked ISP Router Can't; the Iran-Specific Key Point Is Split-Routing: Iranian Domestic Sites (داخلی/NIN), Shaparak Banking and Government Sites Must Go Direct (Domestic Intranet Is Faster/Cheaper/Off the International Quota, and Many Iranian Bank/Gov Sites Reject Foreign IPs); CPU Is the Speed Bottleneck; the Protocol Fight Is Unchanged, and During a National Shutdown Every Foreign Tunnel Goes Down at Once

Updated 2026-07-05

Diagram: putting a VPN on your router in Iran — the value of a router-level VPN is 'whole-home in one go': smart TVs, PS5/Xbox, set-top boxes, IoT and guest phones, every device on that router automatically uses the encrypted tunnel, with no per-device client (smart TVs/consoles often can't run a VPN app at all). But only a router that can run xray/sing-box works (OpenWRT+passwall, GL.iNet, Asus Merlin); a locked ISP router can't. The Iran-specific key point is split-routing — keep Iranian domestic sites (داخلی/NIN), Shaparak banking and government sites going direct (domestic intranet is faster/cheaper/off the international quota, and many Iranian bank/gov sites reject foreign IPs); the router CPU is the speed bottleneck; the protocol fight is unchanged, and during a national shutdown every foreign tunnel goes down at once.

Bottom line first: a router-level VPN is whole-home in one go, but only a router that can run sing-box/xray works

Putting the VPN on your router has one big advantage: 'whole-home in one go' — every device on that router (smart TV, PS5/Xbox, set-top box, smart speaker, IoT, a guest's phone) automatically uses the same encrypted tunnel and you don't install a client on each device. That matters most for smart TVs and game consoles, which often can't run a VPN app at all — only taking over at the router layer reaches them. But first the cold water: not just any router works — you need one that can run xray-core or sing-box; the locked-firmware router your ISP hands out can't. Below: hardware first, then the Iran-specific split-routing (more critical than in Russia), then steps and honest limits.

Which routers work: OpenWRT+passwall, GL.iNet, Asus Merlin

The ones that can land router-level VLESS in Iran are mainly: (1) OpenWRT — the general-purpose open firmware; install the passwall / sing-box package to run VLESS+Reality, flexible but with a higher configuration bar; (2) GL.iNet — many models (especially travel routers) ship with built-in VLESS/sing-box support, the most out-of-the-box option and common among Iranian users; (3) Asus + Merlin firmware and similar also have community solutions. The shared prerequisite: the router must be able to install third-party components and run a proxy core. If yours is a locked ordinary ISP router, first consider swapping to one of the above, or step back and install a client per device on Windows/your phone.

The Iran-specific, most critical step: split-routing — domestic intranet/banking/government must go direct

This is the biggest difference between an Iranian router setup and a Russian one, and the easiest step to get wrong: be sure to set split-routing so Iranian domestic traffic goes direct and only the foreign traffic that needs it goes through the tunnel. Three reasons: first, Iran's national intranet (NIN / شبکه ملی اطلاعات / داخلی) is usually faster and cheaper, and many plans don't count domestic traffic against the international quota, so tunneling all of it is both slow and wasteful; second, many Iranian banks (Shaparak payment gateway), government sites (gov.ir) and local services flatly reject foreign IPs — from a foreign IP you can't even log into your own online banking; third, it saves the router CPU. So the correct setup is: Iranian domestic sites, Shaparak banking and government sites go direct, and only blocked/throttled foreign sites go through the tunnel. In Iran this isn't an optional optimization — it's the precondition for using online banking and local services at all.

CPU is the bottleneck: a weak router running Reality will throttle speed

Encryption and decryption cost CPU, and a router's CPU is usually weak. On a cheap MIPS small-core router running Reality, measured throughput can be far below your line's ceiling. To hit full speed on a router, pick a stronger ARM multi-core / hardware-AES model; otherwise accept the trade-off of 'whole-home coverage but reduced single-stream speed'. If only a handful of devices (say one TV) need to get out and you want full speed, sometimes a dedicated fast router beside that device, or a client on the device itself, is actually faster.

Configuration steps: import subscription → set Iran split-routing → whole-home takeover → verify

Confirm the router supports it: a model you can flash with OpenWRT or that ships with sing-box (OpenWRT / GL.iNet / Asus Merlin); swap out locked ISP models first.
Install the proxy core: on OpenWRT install the passwall or sing-box package; on GL.iNet it's usually pre-installed — just enable it in the admin panel; on Asus flash Merlin and configure per the community guide.
Import your VLESS+Reality subscription: paste the subscription link or vless:// node into the router's proxy component (the same subscription your phone/PC client uses).
Set the Iran split-routing rules (most critical): route Iranian domestic sites, the NIN national intranet, Shaparak banking and government sites direct, and send only the foreign traffic that needs it through the tunnel — this keeps domestic speed and online-banking access while saving CPU.
Take over the LAN: point the router's default outbound / policy routing at the proxy so whole-home devices go through the tunnel by default (or apply it only to specific devices/segments as needed).
Verify: from a TV/console/phone on that router, open a blocked site to confirm it works; then log into an Iranian domestic bank once to confirm it still goes direct; finally run a speed test to see whether CPU is the bottleneck.

Honest limits and checklist

Only a router that can run xray/sing-box works — a locked ordinary ISP router can't.
Iran split-routing is a precondition: domestic sites / NIN intranet / Shaparak banking / government must go direct, or you'll be locked out of local services and waste international data.
CPU decides speed: a weak model running Reality throttles noticeably; for full speed pick a model with AES/ARM acceleration.
Pick the right protocol: on the router too you must use a well-configured VLESS+Reality — Iran's DPI throttles/cuts suspicious encrypted traffic.
No guarantees: a poorly configured VLESS gets cut too; during Iran's characteristic 'national shutdown / domestic-intranet-only' periods every foreign tunnel in the house goes down together.
Don't flash firmware / install packages from unofficial sources — use official firmware and official component repos to avoid a planted backdoor.

In summary: the value of a router-level VPN in Iran is letting smart TVs, consoles and IoT — the devices that 'can't run an app' — also go through the tunnel, whole-home in one go; the cost is that you need a router that can run xray/sing-box, you have to accept CPU throttling, and you must split the Iranian domestic intranet/banking/government out to go direct. Get those clear and the router-level approach is the widest-coverage option there is; if it's not clear yet, start by installing a client on a single device the way you would on Windows.

FAQ

In Iran, can the ordinary router my ISP gave me run a VPN/VLESS?: Mostly no. ISP-supplied routers usually have locked firmware — you can't install third-party components and they can't run a proxy core like xray/sing-box. To do VLESS+Reality on the router you need a model you can flash with OpenWRT or that ships with sing-box support — commonly OpenWRT (install the passwall/sing-box package), GL.iNet (many models, especially travel routers, ship with it built in), or Asus+Merlin. If you're stuck with a locked ISP router, either swap to one of those, or step back and install a client on each device.
In Iran, does a router VPN have to use split-routing?: Strongly recommended — practically required. Iran has a situation Russia doesn't: the national intranet (NIN / شبکه ملی اطلاعات) is usually faster and cheaper, and many plans don't count domestic traffic against the international quota; and many Iranian banks (Shaparak), government and local services flatly reject foreign IPs. If you tunnel everything (including domestic sites and banking), it's slow and wasteful, and you may be unable to log into your own online banking. The correct approach is split-routing rules: Iranian domestic sites, Shaparak banking and government sites go direct, and only blocked/throttled foreign sites go through the tunnel. In Iran that's not an optional tweak — it's the precondition for using local services.
Why is my connection so slow once the VPN is on the router?: Two common causes. One is the CPU bottleneck: encryption/decryption costs compute, and a cheap router's small CPU may only manage tens of Mbps, far below your line — switching to a model with ARM multi-core / hardware AES helps noticeably. The other is no split-routing: tunneling all traffic (including the Iranian domestic intranet, banking, downloads) wastes CPU and takes the long way around, when the domestic intranet is fast going direct. The fix is to route Iranian domestic traffic direct and send only the foreign traffic that needs it through the tunnel. Also, Iran's DPI throttling of foreign encrypted tunnels itself slows things down.
Does using VLESS on the router mean it definitely won't be blocked?: No such guarantee. Iran's blocking is at the protocol layer: DPI probes and throttles/cuts suspicious encrypted traffic. VLESS+Reality survives better because it disguises traffic as ordinary HTTPS to a real major site with almost no unique fingerprint — but the resilience comes from Reality's disguise configuration, not the protocol name; a poorly configured VLESS gets cut too, with no guarantee. And during Iran's characteristic 'national shutdown / domestic-intranet-only' drills, every foreign tunnel in the house goes down together and no router setup can help. A router-level approach changes 'how many devices are covered', not 'the protocol fight'.

The service you're trying to reach is blocked. Restore access — free.

Back online in about 2 minutes — no credit card. A working VLESS + Reality route on iOS, Android, Windows and macOS.

Free 1 GB/day
·
No credit card
·
VLESS + Reality in 60 seconds

You and your friend each get +30 bonus days plus bonus traffic once they start using Univista.

Restore access — free

Telegram WhatsApp

Already subscribed? Help for import & troubleshooting.

Ready for reliable international access?

View plans

This article is for technical education only. Comply with local laws when using network tools. Univista is not liable for how you use the service.