What Is VPN Passthrough?

When you connect to a VPN, your device sends encrypted packets to a remote VPN server. These packets use specific protocols — IPSec, PPTP, or L2TP — that differ from normal web traffic.

Your home router uses NAT (Network Address Translation) to route traffic between your local devices and the internet. The problem: NAT was designed for standard TCP/UDP traffic. Some VPN protocols — particularly older ones like IPSec and PPTP — use non-standard packet structures that NAT doesn't natively understand.

VPN passthrough solves this by telling your router to recognize and forward VPN protocol packets without modifying them. Without passthrough, the router may drop or corrupt VPN packets, causing connections to fail.

Think of it like a security checkpoint that recognizes VPN traffic as legitimate and lets it through without inspection or modification.

Not all VPN protocols require passthrough. Here's the breakdown:

Protocols that need passthrough:

• IPSec (Internet Protocol Security) — Uses protocol numbers 50 (ESP) and 51 (AH), which aren't standard TCP or UDP. NAT struggles with IPSec unless passthrough is enabled or NAT-T (NAT Traversal) is used
• PPTP (Point-to-Point Tunneling Protocol) — Uses GRE (Generic Routing Encapsulation, protocol 47) alongside TCP port 1723. GRE is not TCP or UDP, so NAT can't handle it without passthrough
• L2TP (Layer 2 Tunneling Protocol) — Often paired with IPSec. L2TP itself uses UDP port 1701, but the IPSec encryption layer requires passthrough

Protocols that do NOT need passthrough:

• WireGuard — Uses standard UDP packets. Works through NAT without any special configuration
• OpenVPN — Uses standard UDP or TCP packets. No passthrough needed
• IKEv2 — Includes built-in NAT-T (NAT Traversal) that handles NAT automatically

Since modern VPNs default to WireGuard or OpenVPN, passthrough is less critical than it was a decade ago. However, corporate VPNs and site-to-site connections often still use IPSec, making passthrough relevant for remote workers.

VPN passthrough is usually enabled by default on modern routers, but here's how to check and enable it on popular brands:

Asus Routers: 1. Log into your router at 192.168.1.1 2. Go to Advanced Settings > VPN 3. Find VPN Passthrough section 4. Enable IPSec, PPTP, and L2TP passthrough as needed 5. Click Apply

TP-Link Routers: 1. Access the router at 192.168.0.1 or tplinkwifi.net 2. Navigate to Advanced > NAT Forwarding > ALG 3. Enable the VPN ALG (Application Layer Gateway) options 4. Save settings

Netgear Routers: 1. Log into routerlogin.net or 192.168.1.1 2. Go to Advanced > Setup > WAN Setup 3. Check the boxes for Enable VPN Passthrough options 4. Apply changes

Linksys Routers: 1. Access 192.168.1.1 2. Go to Security > VPN Passthrough 3. Enable IPSec, PPTP, and L2TP passthrough 4. Save settings

If you don't see passthrough options, your router likely handles it automatically or doesn't support the feature. Try connecting your VPN — if it works, passthrough is already functioning.

These three VPN-related router features serve very different purposes:

VPN Passthrough — Allows devices behind the router to connect to external VPN servers. The router itself doesn't participate in the VPN — it just lets VPN traffic through. This is what you need if you run a VPN app on your laptop or phone.

VPN Client — The router itself connects to a VPN server, encrypting all traffic from every device on your network. This is a more comprehensive setup described in our VPN router guide.

VPN Server — The router acts as a VPN server, allowing you to connect back to your home network from outside. Useful for accessing home files and devices remotely.

Most home users only need passthrough (and it's usually already enabled). If you want to protect all devices without installing VPN apps on each one, look into setting up your router as a VPN client instead.

If your VPN connection isn't working and you suspect a passthrough issue, try these steps:

1. Switch to WireGuard or OpenVPN — These protocols don't need passthrough and work through NAT natively. Most modern VPN apps support them in settings
2. Check your router's passthrough settings — Log into your router admin panel and verify passthrough is enabled for the protocol you're using
3. Update router firmware — Outdated firmware may have bugs in its passthrough implementation. Check your manufacturer's website for updates
4. Disable SPI Firewall temporarily — Some routers' Stateful Packet Inspection firewalls interfere with VPN traffic. If disabling SPI fixes the issue, add a firewall exception for your VPN protocol instead of leaving SPI disabled
5. Try a different port — If using OpenVPN, switch from UDP to TCP port 443. This port is used by HTTPS and is rarely blocked
6. Contact your ISP — Some ISPs block VPN protocols at the network level. A VPN with obfuscation features (NordVPN, ExpressVPN) can help in this case

If none of these work, the issue likely isn't passthrough-related. Check our VPN troubleshooting guide for more solutions.