Why use a VPN router or dongle to prevent VPN leaks

A VPN hides your real internet address by sending your traffic through another company's server. Most people turn it on in an app on the phone and trust that it works. This guide explains why that trust can fail, and why a small VPN Wi-Fi router (sometimes called a travel router or VPN dongle) is a stronger and simpler choice.

What is a VPN leak?

A leak happens when some of your phone's traffic goes out the normal way instead of through the VPN. Whoever is watching, such as a website, an app maker or the network owner, then sees your real internet address instead of the VPN's. Your VPN app can still say "Connected" while this happens.

A real example: a bug on Android and GrapheneOS

Recently a security researcher reported a bug to the GrapheneOS project (issue number 8617, linked below). In plain words:

• Android has a feature that lets an app ask the phone to send a small "I'm still here" message every few seconds.
• The researcher found that an app could use this feature to send those messages outside the VPN, even when the phone's strongest VPN protection, called Lockdown, was switched on.
• That reveals your real internet address to a server chosen by the app.
• The researcher says it affects most Android 12 and newer phones. The test results were for Pixel phones on Wi-Fi.
• The GrapheneOS team said they know about the issue and plan to fix it, but when this guide was written the issue was still open, with no fix released.

The details are in the public report: GrapheneOS issue 8617. Please open it and check the current status before you rely on this section. It may have been fixed since.

Important: this is what the researcher reported, and it has not been confirmed fixed or disproved by us. It is used here as an example of a wider problem: if your VPN lives on the phone, a bug on the phone can get around it.

Why a VPN router fixes this kind of problem

A VPN router is a small box that makes its own Wi-Fi network. You connect your phone to its Wi-Fi instead of the hotel or cafe Wi-Fi. The box holds the VPN connection, not the phone.

• Everything your phone sends goes to the box first, and the box sends it through the VPN. The phone has no other way out.
• If an app on the phone misbehaves, the "outside the VPN" message still travels through the box, and so it still leaves through the VPN. The outside world sees the VPN's address, not yours.
• If the VPN connection drops, the box can block everything (called a kill switch), so nothing leaks while it reconnects.
• One box protects every device you connect: phone, laptop, tablet.
• You set it up once. After that your phone has nothing to configure.

When a phone VPN is still fine

A VPN app on the phone is still useful because it works on mobile data and any Wi-Fi without carrying extra gear. The router is the extra layer for when you are on Wi-Fi at home, in a hotel or at a cafe. Using both at the same time on the phone can make connections clash, so see the next section.

How to set one up (the simple version)

Any travel router that supports WireGuard or OpenVPN will work. Popular models come from GL.iNet. Your VPN company (for example Mullvad, see our Mullvad voucher) publishes a guide for these boxes.

1. Plug the router in and connect your phone to its Wi-Fi. The first time, use the setup page address printed on the box.
2. Set an admin password that is long and different from your other passwords.
3. Connect the router's internet port or Wi-Fi client to the network you want to use (home, hotel or cafe).
4. In the router's VPN section, add your VPN company's WireGuard details. Your VPN company gives you a file or settings to copy.
5. Turn on the kill switch (sometimes called "block non-VPN traffic").
6. Test it: with the phone on the router's Wi-Fi, open a "what is my IP" website. It should show the VPN company's location, not yours.
7. Turn off the VPN app on the phone while you are using the router's Wi-Fi, so the two do not clash.

Limits to know about

• You must trust the router. It is a small computer. Buy a well-known model, keep its software up to date and never leave the admin password as the default.
• It only protects traffic on its own Wi-Fi. If you switch to mobile data, you are no longer protected by it.
• It cannot hide who you are to the apps you log into. If you sign in to an account, that account still knows it is you.
• It does not replace Tor. See how to use Tor if you need strong anonymity.
• If the router's own VPN fails open, the kill switch must be switched on. Always test it by unplugging the router's internet and checking that nothing loads.

The simple rule

Treat your phone as something that can have bugs, because every phone does. Put the VPN on a separate box, and a bug in the phone cannot expose your address. Keep the phone VPN as the backup for when you are away from the box.

Related reading: how to use a VPN on GrapheneOS.