In Iran, can the ordinary router my ISP gave me run a VPN/VLESS?

Mostly no. ISP-supplied routers usually have locked firmware — you can't install third-party components and they can't run a proxy core like xray/sing-box. To do VLESS+Reality on the router you need a model you can flash with OpenWRT or that ships with sing-box support — commonly OpenWRT (install the passwall/sing-box package), GL.iNet (many models, especially travel routers, ship with it built in), or Asus+Merlin. If you're stuck with a locked ISP router, either swap to one of those, or step back and install a client on each device.

In Iran, does a router VPN have to use split-routing?

Strongly recommended — practically required. Iran has a situation Russia doesn't: the national intranet (NIN / شبکه ملی اطلاعات) is usually faster and cheaper, and many plans don't count domestic traffic against the international quota; and many Iranian banks (Shaparak), government and local services flatly reject foreign IPs. If you tunnel everything (including domestic sites and banking), it's slow and wasteful, and you may be unable to log into your own online banking. The correct approach is split-routing rules: Iranian domestic sites, Shaparak banking and government sites go direct, and only blocked/throttled foreign sites go through the tunnel. In Iran that's not an optional tweak — it's the precondition for using local services.

Why is my connection so slow once the VPN is on the router?

Two common causes. One is the CPU bottleneck: encryption/decryption costs compute, and a cheap router's small CPU may only manage tens of Mbps, far below your line — switching to a model with ARM multi-core / hardware AES helps noticeably. The other is no split-routing: tunneling all traffic (including the Iranian domestic intranet, banking, downloads) wastes CPU and takes the long way around, when the domestic intranet is fast going direct. The fix is to route Iranian domestic traffic direct and send only the foreign traffic that needs it through the tunnel. Also, Iran's DPI throttling of foreign encrypted tunnels itself slows things down.

Does using VLESS on the router mean it definitely won't be blocked?

No such guarantee. Iran's blocking is at the protocol layer: DPI probes and throttles/cuts suspicious encrypted traffic. VLESS+Reality survives better because it disguises traffic as ordinary HTTPS to a real major site with almost no unique fingerprint — but the resilience comes from Reality's disguise configuration, not the protocol name; a poorly configured VLESS gets cut too, with no guarantee. And during Iran's characteristic 'national shutdown / domestic-intranet-only' drills, every foreign tunnel in the house goes down together and no router setup can help. A router-level approach changes 'how many devices are covered', not 'the protocol fight'.

Главная › Руководства › Как в Иране поставить VPN/VLESS на роутер — покрытие всего дома одной настройкой (честное объяснение): уровень роутера означает, что умный телевизор, консоль и IoT все идут через туннель без установки приложения на каждое устройство; но работает только роутер, способный запускать xray/sing-box (OpenWRT+passwall / GL.iNet / Asus с Merlin), заблокированный роутер оператора не может; специфичный для Ирана момент — раздельная маршрутизация: внутренние сайты (داخلی/NIN), банкинг Shaparak и госсайты должны идти напрямую (внутренняя сеть быстрее/дешевле и не расходует международную квоту, а многие иранские банковские/госсайты отклоняют иностранные IP); CPU — узкое место скорости; битва протоколов та же, и при общенациональном отключении все зарубежные туннели падают разом

Как в Иране поставить VPN/VLESS на роутер — покрытие всего дома одной настройкой (честное объяснение): уровень роутера означает, что умный телевизор, консоль и IoT все идут через туннель без установки приложения на каждое устройство; но работает только роутер, способный запускать xray/sing-box (OpenWRT+passwall / GL.iNet / Asus с Merlin), заблокированный роутер оператора не может; специфичный для Ирана момент — раздельная маршрутизация: внутренние сайты (داخلی/NIN), банкинг Shaparak и госсайты должны идти напрямую (внутренняя сеть быстрее/дешевле и не расходует международную квоту, а многие иранские банковские/госсайты отклоняют иностранные IP); CPU — узкое место скорости; битва протоколов та же, и при общенациональном отключении все зарубежные туннели падают разом

Обновлено 2026-07-05

Diagram: putting a VPN on your router in Iran — the value of a router-level VPN is 'whole-home in one go': smart TVs, PS5/Xbox, set-top boxes, IoT and guest phones, every device on that router automatically uses the encrypted tunnel, with no per-device client (smart TVs/consoles often can't run a VPN app at all). But only a router that can run xray/sing-box works (OpenWRT+passwall, GL.iNet, Asus Merlin); a locked ISP router can't. The Iran-specific key point is split-routing — keep Iranian domestic sites (داخلی/NIN), Shaparak banking and government sites going direct (domestic intranet is faster/cheaper/off the international quota, and many Iranian bank/gov sites reject foreign IPs); the router CPU is the speed bottleneck; the protocol fight is unchanged, and during a national shutdown every foreign tunnel goes down at once.

Bottom line first: a router-level VPN is whole-home in one go, but only a router that can run sing-box/xray works

Putting the VPN on your router has one big advantage: 'whole-home in one go' — every device on that router (smart TV, PS5/Xbox, set-top box, smart speaker, IoT, a guest's phone) automatically uses the same encrypted tunnel and you don't install a client on each device. That matters most for smart TVs and game consoles, which often can't run a VPN app at all — only taking over at the router layer reaches them. But first the cold water: not just any router works — you need one that can run xray-core or sing-box; the locked-firmware router your ISP hands out can't. Below: hardware first, then the Iran-specific split-routing (more critical than in Russia), then steps and honest limits.

Which routers work: OpenWRT+passwall, GL.iNet, Asus Merlin

The ones that can land router-level VLESS in Iran are mainly: (1) OpenWRT — the general-purpose open firmware; install the passwall / sing-box package to run VLESS+Reality, flexible but with a higher configuration bar; (2) GL.iNet — many models (especially travel routers) ship with built-in VLESS/sing-box support, the most out-of-the-box option and common among Iranian users; (3) Asus + Merlin firmware and similar also have community solutions. The shared prerequisite: the router must be able to install third-party components and run a proxy core. If yours is a locked ordinary ISP router, first consider swapping to one of the above, or step back and install a client per device on Windows/your phone.

The Iran-specific, most critical step: split-routing — domestic intranet/banking/government must go direct

This is the biggest difference between an Iranian router setup and a Russian one, and the easiest step to get wrong: be sure to set split-routing so Iranian domestic traffic goes direct and only the foreign traffic that needs it goes through the tunnel. Three reasons: first, Iran's national intranet (NIN / شبکه ملی اطلاعات / داخلی) is usually faster and cheaper, and many plans don't count domestic traffic against the international quota, so tunneling all of it is both slow and wasteful; second, many Iranian banks (Shaparak payment gateway), government sites (gov.ir) and local services flatly reject foreign IPs — from a foreign IP you can't even log into your own online banking; third, it saves the router CPU. So the correct setup is: Iranian domestic sites, Shaparak banking and government sites go direct, and only blocked/throttled foreign sites go through the tunnel. In Iran this isn't an optional optimization — it's the precondition for using online banking and local services at all.

CPU is the bottleneck: a weak router running Reality will throttle speed

Encryption and decryption cost CPU, and a router's CPU is usually weak. On a cheap MIPS small-core router running Reality, measured throughput can be far below your line's ceiling. To hit full speed on a router, pick a stronger ARM multi-core / hardware-AES model; otherwise accept the trade-off of 'whole-home coverage but reduced single-stream speed'. If only a handful of devices (say one TV) need to get out and you want full speed, sometimes a dedicated fast router beside that device, or a client on the device itself, is actually faster.

Configuration steps: import subscription → set Iran split-routing → whole-home takeover → verify

Confirm the router supports it: a model you can flash with OpenWRT or that ships with sing-box (OpenWRT / GL.iNet / Asus Merlin); swap out locked ISP models first.
Install the proxy core: on OpenWRT install the passwall or sing-box package; on GL.iNet it's usually pre-installed — just enable it in the admin panel; on Asus flash Merlin and configure per the community guide.
Import your VLESS+Reality subscription: paste the subscription link or vless:// node into the router's proxy component (the same subscription your phone/PC client uses).
Set the Iran split-routing rules (most critical): route Iranian domestic sites, the NIN national intranet, Shaparak banking and government sites direct, and send only the foreign traffic that needs it through the tunnel — this keeps domestic speed and online-banking access while saving CPU.
Take over the LAN: point the router's default outbound / policy routing at the proxy so whole-home devices go through the tunnel by default (or apply it only to specific devices/segments as needed).
Verify: from a TV/console/phone on that router, open a blocked site to confirm it works; then log into an Iranian domestic bank once to confirm it still goes direct; finally run a speed test to see whether CPU is the bottleneck.

Honest limits and checklist

Only a router that can run xray/sing-box works — a locked ordinary ISP router can't.
Iran split-routing is a precondition: domestic sites / NIN intranet / Shaparak banking / government must go direct, or you'll be locked out of local services and waste international data.
CPU decides speed: a weak model running Reality throttles noticeably; for full speed pick a model with AES/ARM acceleration.
Pick the right protocol: on the router too you must use a well-configured VLESS+Reality — Iran's DPI throttles/cuts suspicious encrypted traffic.
No guarantees: a poorly configured VLESS gets cut too; during Iran's characteristic 'national shutdown / domestic-intranet-only' periods every foreign tunnel in the house goes down together.
Don't flash firmware / install packages from unofficial sources — use official firmware and official component repos to avoid a planted backdoor.

In summary: the value of a router-level VPN in Iran is letting smart TVs, consoles and IoT — the devices that 'can't run an app' — also go through the tunnel, whole-home in one go; the cost is that you need a router that can run xray/sing-box, you have to accept CPU throttling, and you must split the Iranian domestic intranet/banking/government out to go direct. Get those clear and the router-level approach is the widest-coverage option there is; if it's not clear yet, start by installing a client on a single device the way you would on Windows.

Частые вопросы

In Iran, can the ordinary router my ISP gave me run a VPN/VLESS?: Mostly no. ISP-supplied routers usually have locked firmware — you can't install third-party components and they can't run a proxy core like xray/sing-box. To do VLESS+Reality on the router you need a model you can flash with OpenWRT or that ships with sing-box support — commonly OpenWRT (install the passwall/sing-box package), GL.iNet (many models, especially travel routers, ship with it built in), or Asus+Merlin. If you're stuck with a locked ISP router, either swap to one of those, or step back and install a client on each device.
In Iran, does a router VPN have to use split-routing?: Strongly recommended — practically required. Iran has a situation Russia doesn't: the national intranet (NIN / شبکه ملی اطلاعات) is usually faster and cheaper, and many plans don't count domestic traffic against the international quota; and many Iranian banks (Shaparak), government and local services flatly reject foreign IPs. If you tunnel everything (including domestic sites and banking), it's slow and wasteful, and you may be unable to log into your own online banking. The correct approach is split-routing rules: Iranian domestic sites, Shaparak banking and government sites go direct, and only blocked/throttled foreign sites go through the tunnel. In Iran that's not an optional tweak — it's the precondition for using local services.
Why is my connection so slow once the VPN is on the router?: Two common causes. One is the CPU bottleneck: encryption/decryption costs compute, and a cheap router's small CPU may only manage tens of Mbps, far below your line — switching to a model with ARM multi-core / hardware AES helps noticeably. The other is no split-routing: tunneling all traffic (including the Iranian domestic intranet, banking, downloads) wastes CPU and takes the long way around, when the domestic intranet is fast going direct. The fix is to route Iranian domestic traffic direct and send only the foreign traffic that needs it through the tunnel. Also, Iran's DPI throttling of foreign encrypted tunnels itself slows things down.
Does using VLESS on the router mean it definitely won't be blocked?: No such guarantee. Iran's blocking is at the protocol layer: DPI probes and throttles/cuts suspicious encrypted traffic. VLESS+Reality survives better because it disguises traffic as ordinary HTTPS to a real major site with almost no unique fingerprint — but the resilience comes from Reality's disguise configuration, not the protocol name; a poorly configured VLESS gets cut too, with no guarantee. And during Iran's characteristic 'national shutdown / domestic-intranet-only' drills, every foreign tunnel in the house goes down together and no router setup can help. A router-level approach changes 'how many devices are covered', not 'the protocol fight'.

Канал Univista в Telegram

В канале — свежие рабочие конфиги, статус узлов и разбор частых проблем.

Перейти в канал

Сервис, который вам нужен, заблокирован? Верните доступ — бесплатно.

Снова онлайн примерно за 2 минуты, без банковской карты. Рабочее подключение по VLESS + Reality на iOS, Android, Windows и macOS.

Бесплатно 1 ГБ в день
·
Банковская карта не нужна
·
VLESS + Reality за 60 секунд

Когда друг начнёт пользоваться сервисом, вы оба получите по +30 бонусных дней и бонусный трафик.

Восстановить доступ — бесплатно

Похожие руководства

Что ещё работает в Иране в 2026: почему DPI ломает обычные VPN и почему важен выбор протокола Что такое VLESS Reality: назначение и отличия от VPN Как в Иране установить и использовать VPN/VLESS-клиент на Windows — честное объяснение (Windows — самая открытая платформа: нет блокировки магазина приложений, любой клиент запускается прямо из .exe с GitHub, а режим TUN охватывает всю машину; но в Иране есть слой, которого нет в России, — санкции США ограничивают доступ иранских IP к GitHub/npm и геоблокируют около 20% топовых доменов для иранских IP, так что даже скачать клиент может оказаться заблокировано, тогда как главное поле боя по-прежнему — выдержит ли ваш протокол иранский DPI) и более надёжный подход (VLESS+Reality) Как в Иране установить и использовать VPN/VLESS-клиент на Linux — честное объяснение (Linux — самая свободная от магазина платформа: нет привязки к App Store, вы берёте бинарник/AppImage/.deb прямо с официального GitHub и запускаете; но главное отличие от Windows/Mac в том, что клиенты под Linux скорее командной строки/ручные — либо правите JSON-конфиг и запускаете sing-box/xray, либо берёте GUI/веб-интерфейс вроде v2rayA/nekoray; TUN на всю машину требует root или CAP_NET_ADMIN, иначе проксируете по приложениям через SOCKS; а ключевой шаг для Ирана — раздельная маршрутизация: местные сайты, банковские шлюзы Shaparak и госсайты должны идти напрямую; настоящее поле боя — выдержит ли ваш протокол иранский DPI) и более надёжный подход (VLESS+Reality со службой systemd) Как в Иране установить и использовать VPN/VLESS-клиент на Mac (macOS) — честное объяснение (как и Windows, Mac — самая открытая платформа: в отличие от iPhone он не заблокирован магазином приложений, любой клиент запускается прямо из официального GitHub и обходит удаление из магазина, а системный режим TUN (utun) охватывает всю машину; но в Иране есть слой, которого нет в России, — санкции США геоблокируют по IP, так что даже скачать клиент может оказаться заблокировано, а macOS добавляет две особенности: предупреждение Gatekeeper о «неустановленном разработчике» и выбор сборки под чип (Apple Silicon/Intel), тогда как главное поле боя по-прежнему — выдержит ли ваш протокол иранский DPI) и более надёжный подход (VLESS+Reality) Как настроить VPN/VLESS на роутере в России — весь дом за один раз (честное объяснение): VPN на роутере значит, что умный телевизор, игровые приставки и IoT идут через туннель без приложения на каждом устройстве; но подходит только роутер, способный запустить xray/sing-box (Keenetic+Entware / OpenWRT+passwall / GL.iNet), — обычный роутер провайдера не годится; процессор роутера — узкое место по скорости; а борьба на уровне протоколов та же — с декабря 2025 RKN блокирует протоколы, так что VLESS+Reality нужен и на роутере

Telegram VK WhatsApp

Уже подписались? Помощь — импорт и устранение неполадок.

Готовы к стабильному доступу в интернет?

Тарифы

Материал носит технический характер. Соблюдайте местные законы при использовании сетевых инструментов. Univista не отвечает за ваш сценарий использования.