Modern VPNs that use the WireGuard, OpenVPN, and IKEv2 protocols typically work with all modern routers. However, older VPN protocols like PPTP, L2TP/IPsec, and older pure IPsec implementations may require a feature called VPN passthrough. This feature lets those legacy protocols (except modern IPsec implementations) pass through routers that might otherwise block them. Without it, contemporary NAT (Network Address Translation) routers would drop the connection. Most VPN users don’t need it. If you use any of our 30 tested VPNs, they all support modern protocols and work with almost all routers without issues. But for the rare cases where you do need to configure it, I’ll explain what it does and how to use it.
What Is a VPN Passthrough?
A VPN passthrough is a router feature that allows legacy VPN protocols to pass through the router’s firewall and NAT system. This way, PPTP, L2TP/IPsec, and older IPsec versions can establish a two-way tunnel between your device and the VPN server. Many manufacturers ship routers with VPN passthrough enabled by default, so users don’t have to configure it manually. Most VPNs also don’t require it to function, as they’ve dropped legacy protocol support due to weak encryption. But understanding how it works is useful, since your router most likely has the feature active already.
How Does a VPN Passthrough Work With NAT?
All devices connected to your router share the same public IP address. However, their addresses on your local network are different. So whenever traffic arrives at your router, it has to work out which local device the traffic belongs to and forward it there. That’s where NAT comes in. Whenever you browse on a phone, laptop, or any other device, NAT translates your local IP address into the public IP and attaches a specific port number to track the request. When the response comes back, it uses that port to channel the reply to the correct device. Standard online communication uses the TCP or UDP transport protocols. However, certain legacy VPN protocols don’t have TCP or UDP port numbers, which creates a problem for the NAT system. That’s why VPN passthrough is necessary. Let’s take a closer look. PPTP uses GRE (Generic Routing Encapsulation) on IP protocol 47, and L2TP/IPsec uses ESP (Encapsulated Security Payload) on IP protocol 50. Neither has a TCP or UDP port number. Because of that, a NAT router can’t work out which device to forward incoming traffic to, so it drops the connection. VPN passthrough solves this by using specific identifiers to track each VPN connection. For PPTP, it tracks the Call ID; for L2TP/IPsec, it tracks the Security Parameter Index (SPI). In short, your router uses these values instead of port numbers to correctly identify which local device to send incoming traffic to.
Types of VPN Passthrough: PPTP, L2TP, and IPsec
Firstly, you may have noticed I pair L2TP and IPsec together. That’s because L2TP doesn’t encrypt traffic, it only establishes a tunnel between your device and the VPN server. It’s almost always paired with IPsec to provide the encryption, without which the VPN would be useless. The PPTP protocol uses TCP port 1723 for the control channel, but wraps the data packets using GRE, which has no TCP or UDP port number. In this case, VPN passthrough inspects the unique Call ID for that session and uses it to route the traffic to the correct device. L2TP/IPsec uses UDP port 1701 for tunneling and encrypts traffic using ESP, which also has no TCP or UDP port number. VPN passthrough inspects the IPsec handshake to extract the Security Parameter Index, and, as with the Call ID, uses it to route traffic to the right destination.
How to Enable VPN Passthrough on Your Router
Enabling VPN passthrough is straightforward and more or less the same across routers, though there may be minor differences by model. Follow these steps to reach the VPN passthrough options:
- Find and copy your router’s Default Gateway IP address:
- On Windows: press Start, type
cmd, then in the window typeipconfigand look for the Default Gateway entry under your active network adapter. - On macOS: go to System Settings → Network, choose your active connection (Ethernet or Wi-Fi), and click Details. Select TCP/IP, and the address is next to the Router entry.
- On Windows: press Start, type
- Open your web browser and paste the Default Gateway IP into the address bar.
- Enter your router’s admin username and password, typically found on a sticker on the back or bottom of the router.
- Locate the VPN passthrough section, where you can manage the PPTP, L2TP, and IPsec passthrough options.
VPN Passthrough vs. VPN Router: Security Risks and Modern Alternatives
The security concerns around VPN passthrough stem not from the feature itself, but from the legacy protocols it passes through. The legacy PPTP protocol has well-documented vulnerabilities, so using it is inherently risky. It relies on the outdated MPPE (Microsoft Point-to-Point Encryption), which can be broken with modern hardware, and its MS-CHAPv2 authentication can also be cracked. The L2TP protocol provides no encryption at all. As mentioned, it’s paired with IPsec in most cases, so L2TP/IPsec security essentially depends on the IPsec configuration. Older IPsec deployments may use outdated cryptography and weak authentication, though IPsec also supports secure standards like AES-256. Instead, we recommend using VPNs with modern, secure VPN protocols. Check out our top VPN rankings, as all of them provide features that ensure your online safety and privacy. Another alternative is a VPN router with built-in VPN software: it encrypts every device connected to that router, so you can secure smart TVs, PCs, and anything else you have at home.