KotoVPN

Guide · Updated August 14, 2026

What VPN passthrough is, and why your router probably no longer needs it

What is VPN passthrough?

What is VPN passthrough?

VPN passthrough is a router setting that lets older VPN protocols — PPTP, native IPsec, and L2TP when it is wrapped in IPsec — cross a NAT router that would otherwise break them. It exists because those protocols predate home routers and do not survive address translation unaided. If you use WireGuard or OpenVPN, which almost everyone now does, passthrough is irrelevant and toggling it changes nothing.

The problem it was invented to solve

A home router performs network address translation: many devices behind one public address, with the router rewriting port numbers to keep track of which reply belongs to which device. That works because TCP and UDP carry port numbers the router can rewrite.

PPTP and IPsec do not use ports in the ordinary way. PPTP carries its data inside GRE, protocol 47, which has no port field at all. IPsec in its native mode uses ESP, protocol 50, likewise. A router with nothing to rewrite cannot tell which internal device an inbound packet belongs to, so it drops it, and the tunnel fails to establish or dies seconds later.

VPN passthrough is the router vendor’s workaround: special-case handling that inspects these protocols and tracks sessions by something other than a port number. PPTP passthrough follows the GRE call ID. IPsec passthrough follows the ESP security parameter index. Neither is elegant, and both were bolted on because the alternative was telling customers their VPN did not work.

Why it is almost certainly irrelevant to you

WireGuard runs over plain UDP, usually on port 51820. OpenVPN runs over UDP 1194 or TCP 443. Both are ordinary transport protocols with ordinary port numbers, so NAT handles them the way it handles everything else. There is nothing to pass through.

Every provider we cover ships WireGuard and OpenVPN. None requires PPTP, and PPTP should not be used regardless: its MS-CHAPv2 authentication was broken comprehensively in 2012 and has been unsafe for anything since. If a VPN service still advertises PPTP as a feature, that tells you something about the service.

So the practical answer to "should I enable VPN passthrough" is that it will not hurt and it will not help, unless you are connecting to a corporate IPsec gateway that predates the current decade.

Avoid

  • Enabling passthrough to fix a WireGuard or OpenVPN problem — it addresses neither
  • Using PPTP because passthrough made it connect; connecting is not the same as being secure
  • Assuming a disabled passthrough setting is why a modern VPN app fails to connect

When it genuinely still matters

Corporate remote access is the real remaining case. Plenty of enterprise IPsec gateways still expect native ESP, and a home router with IPsec passthrough disabled will break that connection while leaving everything else working. If your work VPN fails at home but succeeds when tethered to a phone, the router is the first thing to check.

The other case is multiple simultaneous connections to the same gateway. Early passthrough implementations could track exactly one session, so a second device connecting to the same corporate endpoint would knock the first one off. Most modern routers handle several; some budget models still do not, and the symptom is one person in the household dropping whenever another connects.

  • Corporate IPsec gateways that do not support NAT traversal, standardised in RFC 3947 back in 2005
  • Older site-to-site tunnels between office locations
  • Any setup where you cannot change the protocol because you do not control the far end

What to do instead

If you control both ends, use WireGuard. It sidesteps the entire problem, is considerably faster than anything it replaces, and needs no special router handling. Every provider we cover offers it.

If the far end is a corporate gateway you do not control, ask whether it supports NAT traversal — IPsec over UDP 4500, which wraps ESP inside UDP precisely so NAT can handle it. It was standardised in RFC 3947 back in 2005 and works with IKEv1 as well as IKEv2, so gateway age is not the excuse it is often made into.

If neither is available, enable IPsec passthrough and accept that you are relying on vendor-specific special-case code whose quality varies considerably between router models.

Questions

Should VPN passthrough be enabled or disabled?
Enabled is the safe default. It does nothing at all unless you use PPTP, L2TP or native IPsec, and if you do use one of those, disabling it breaks the connection. The security argument for turning it off is weak but not empty: passthrough is implemented as connection-tracking helpers, and router ALGs of that kind have been abused before — NAT Slipstream reached internal hosts from a web page that way. If you use none of those protocols, disabling it is defensible.
Does VPN passthrough affect WireGuard or OpenVPN?
No. Both run over ordinary UDP or TCP with normal port numbers, which NAT already handles. Passthrough only touches GRE and ESP, the protocols used by PPTP and native IPsec. Enabling or disabling it makes no difference to a WireGuard or OpenVPN connection.
Why does my router still have PPTP passthrough if PPTP is insecure?
Backward compatibility. Firmware carries the setting because removing it would break the remaining users connecting to legacy gateways. Its presence is not an endorsement: PPTP’s authentication was broken in 2012 and can be cracked in hours, so it should not be used for anything you care about.
Is VPN passthrough the same as port forwarding?
No, and the two are often confused. Passthrough lets protocols that lack port numbers cross NAT on the way out. Port forwarding directs unsolicited inbound connections on a specific port to a specific internal device. Different mechanisms for different purposes — port forwarding is the one that matters for peer-to-peer transfer.

Terms used here

NAT

Sharing one public address between many devices, which is how commercial VPN servers put hundreds of users behind a single IP.

Port forwarding

Allowing inbound connections to reach your device through the VPN, rather than only outbound connections.

OpenVPN

The long-established open-source VPN protocol, slower than WireGuard but more configurable and more widely supported.

WireGuard

A modern VPN protocol, around 4,000 lines of code, designed to be small enough to audit properly.

VPN protocol

The set of rules governing how the tunnel is established and how data is encrypted inside it.

Related