If you are shopping for a router and see "VPN passthrough" in the spec list, or you just found the toggle in your router settings and have no idea what it does, here is the short version: VPN passthrough lets a VPN connection started on one of your devices travel through the router without the router's firewall getting in the way. It does not turn your router into a VPN. It just steps aside so a VPN app on your laptop, phone, or work computer can connect normally.
Key takeaways
- VPN passthrough is a router setting that allows VPN traffic from your devices to pass through the router's firewall and NAT.
- It is different from a "VPN client" or "VPN server" feature. Passthrough does not encrypt anything itself.
- Most consumer VPN apps (NordVPN, ExpressVPN, Proton, Mullvad and similar) work fine without it because they use modern protocols the router already handles.
- It matters most for older work VPNs that use PPTP, L2TP, or IPsec, and for some setups where your own router sits behind an ISP gateway.
- Nearly every router made in the last decade has it, and it is usually switched on by default.
What VPN passthrough does
Your router does a job called NAT (network address translation). Every device in your home shares one public internet address, and the router keeps track of which device asked for what so replies land in the right place. To do that, the router relies on port numbers stamped on each packet of data.
Some older VPN protocols were designed before home routers were common, and their traffic either has no port numbers for the router to read or gets wrapped in a way the router does not recognize. When that happens, the router cannot figure out where the return traffic belongs and drops it. Your VPN app sits there trying to connect and never finishes.
VPN passthrough is the router recognizing those specific protocols and making an exception for them. On most routers it shows up as three separate switches:
- PPTP passthrough for the oldest protocol, now considered insecure but still used by a few legacy systems.
- L2TP passthrough for L2TP/IPsec, common on older corporate VPNs and some built-in Windows and Mac VPN settings.
- IPsec passthrough for IPsec-based VPNs, including many business firewalls and remote-access clients.
Flip those on and the router lets the matching traffic through. That is the whole feature.
Do you need VPN passthrough?
For most people in 2026, no, and it is probably already on anyway. Here is how to tell which group you fall into.
You do not need to think about it if:
- You use a subscription VPN app for privacy or streaming. These services default to WireGuard or OpenVPN, which travel over regular ports and pass through any router without special handling.
- Your VPN connects fine today. If it works, passthrough is either on or not needed.
It may matter if:
- Your employer's VPN uses L2TP/IPsec or a Cisco IPsec client and you get errors like "connection failed" or the VPN connects for a moment and then drops.
- You added your own router behind an ISP gateway (Xfinity, Spectrum, AT&T, and others) and a VPN that used to work stopped. With two routers in a row, both need to allow the traffic, and the fix is usually putting the ISP gateway in bridge mode so only your router does the NAT work.
- You are running an older VPN setup on a game console or a home server that specifically asks for PPTP or IPsec.
If you are in the second group, look for a router that lists all three passthrough types. Almost every current model from TP-Link, NETGEAR, ASUS, and Linksys does.
Every router in our store supports VPN passthrough. Tested refurbished, 90-day warranty and 30-day returns.
VPN passthrough vs VPN client vs VPN server
These three phrases show up together on router spec sheets and they mean very different things. This is where most of the confusion comes from.
| Feature | What it does | Who it is for |
|---|---|---|
| VPN passthrough | Lets VPN connections from your devices pass through the router. The router does no encryption itself. | Anyone running a VPN app on a laptop, phone, or work computer. Standard on nearly all routers. |
| VPN client | The router itself logs into a VPN service, so every device in the house is protected without installing an app on each one. | People who want smart TVs, consoles, and guests covered. Found on ASUS, some TP-Link, and higher-end NETGEAR models. |
| VPN server | The router hosts its own VPN, so you can connect back to your home network from a coffee shop or hotel. | Remote access to home cameras, files, or a NAS. Common on NETGEAR (OpenVPN) and ASUS (WireGuard, OpenVPN). |
If you want the router to run the VPN for the whole house, you are looking for a VPN client, and that feature is worth confirming before you buy. VPN passthrough alone will not do it.
VPN passthrough is not IP passthrough
One more mix-up worth clearing up. AT&T gateways and a few others have a setting called IP passthrough. That has nothing to do with VPNs. IP passthrough hands the public internet address to your own router so the ISP gateway stops acting as a second router, which is AT&T's version of bridge mode. If you are setting up your own router behind an ISP gateway, IP passthrough or bridge mode is the setting you want, and it will fix most VPN problems on its own by removing the second layer of NAT.
How to check or turn on VPN passthrough
Log into your router's admin page. If you have never done that, our guide on how to log into your router covers every major brand. Once you are in, the setting lives in slightly different places depending on the manufacturer:
- TP-Link: Advanced, then NAT Forwarding or Security, then VPN Passthrough.
- NETGEAR: Advanced, then Setup, then WAN Setup. Passthrough options sit near the bottom of that page. Some newer models under Advanced, then Security.
- ASUS: VPN in the left menu, then the VPN Passthrough or VPN Fusion tab.
- Linksys: Security, then VPN Passthrough.
- ISP gateways (Xfinity, Spectrum, Cox): Usually under Advanced or Firewall. Many ISP gateways leave the toggles hidden and have them on by default.
Turn on all three (PPTP, L2TP, IPsec), save, and reconnect your VPN. Leaving them on has no downside for normal browsing, so there is no reason to switch them off unless a network administrator tells you to.
If your VPN still will not connect
Passthrough is on and the VPN still fails. A few things to try, in order:
- Check for double NAT. If you have your own router plugged into an ISP gateway, put the gateway in bridge mode (or IP passthrough on AT&T) so only one device is routing.
- Switch protocols in the VPN app. If your app offers WireGuard or OpenVPN, pick one of those. They are faster and far less likely to be blocked.
- Reboot the router after changing the setting. Some models do not apply passthrough changes until the next restart.
- Check the router's firewall level. Some routers have a "high" or "maximum" firewall preset that blocks VPN traffic regardless of the passthrough toggles. Set it to medium or typical.
- Update the router firmware. Older firmware on a used router can have passthrough bugs that were fixed later.
Frequently asked questions
Does VPN passthrough slow down my internet?
No. It is a rule that tells the router to let certain traffic through. There is no processing overhead and no speed cost from leaving it enabled.
Is VPN passthrough a security risk?
Not for a home network. It only affects traffic that a device inside your home started. It does not open your router to incoming connections from the internet the way port forwarding does.
Do all routers have VPN passthrough?
Nearly all consumer routers and ISP gateways made in the last ten years support it, and most ship with it on. Very basic ISP-issued gateways sometimes hide the setting, but the feature is still there.
Do I need VPN passthrough for NordVPN or ExpressVPN?
No. Those services use WireGuard-based or OpenVPN protocols by default, which pass through any router without special settings. Passthrough only comes into play if you manually switch the app to L2TP or IPsec.
Will VPN passthrough let me use a VPN on my whole network?
No. That requires a router with a built-in VPN client. Passthrough only allows VPN apps on individual devices to connect.
My work VPN connects on my phone's hotspot but not on my home WiFi. Is that passthrough?
Possibly, especially if the work VPN uses IPsec or L2TP. Turn on all three passthrough toggles, reboot the router, and check for double NAT if you use your own router behind an ISP gateway.
