@bluffwood 

The Archer C4000 does have a VPN server feature so with that setup, you can log into your C4000 remotely, and browse the web as if you were on that router or access your local network resources.

The VPN server feature does not encrypt the traffic from the router to the internet. Only the traffic from your device to the Archer C4000 is encrypted.

Here is a FAQ on how to set that up: https://www.tp-link.com/us/support/faq/1544/

If you are looking to utilize a VPN service so your entire traffic is encrypted from your device to the internet, then you would need to subscribe to a VPN service. The VPN service would have a program/app that you would use with a login. The router is not even involved as it will only pass the VPN traffic.

@bluffwood 

I have an AX50/AX3000. If no encryption from router to client applies (only client to router encryption), is there a reason why?  I would assume that it's a straightforward design to use OpenSSL for both. Is it a router processor bandwidth issue?

@jtsu1 

The original post was talking about setting up a VPN. The router has encryption by default for all wireless clients.

Are you inquiring about the VPN on the AX50?