VPN Passthrough Explained: When Is It Needed?

Somewhere in the settings of many home routers sits a small group of switches labelled PPTP passthrough, L2TP passthrough and IPsec passthrough. They are usually switched on by default, they rarely come with an explanation, and people who are fixing a VPN problem often wonder if flipping them will help. Sometimes it does. Often it does nothing at all.

This article explains what VPN passthrough actually is, why it exists, which situations still need it, which do not, and how to find out whether your router is the reason a VPN will not connect. It deals with a router as a middle-man between your device and a VPN service. If you want a router that runs the VPN itself, VPN router vs VPN app compares the two designs.

What passthrough really means

A home router performs network address translation, usually shortened to NAT. Inside your home, devices have private addresses, such as those defined in RFC 1918. Out on the internet, all of them share the router's single public address. The router keeps a table that remembers which inside device started which conversation, so it can send replies to the right place.

That scheme works easily for ordinary web traffic, which travels over TCP or UDP and has clear port numbers. The router can track the ports. Trouble starts with traffic that does not use ports at all. Some VPN tunnel types are carried by their own protocol numbers rather than by TCP or UDP. Without port numbers, the router has nothing to place in its table, so it may drop the replies or confuse two devices that are both trying to use the same kind of tunnel.

"Passthrough" is the name for router logic that recognises these tunnel types and keeps track of them in another way. When it is on, the router lets such tunnels go out from a device inside, and lets the replies back in. It does not authenticate anything, create a VPN, or encrypt anything. It simply avoids spoiling a VPN that the device and the remote server build between themselves.

The protocols behind the switches

Each switch relates to a family of older tunnel technology.

Switch name	Technology involved	What the router must handle
PPTP passthrough	PPTP, an old tunnel type	A control connection plus a separate packet type called GRE (protocol 47)
L2TP passthrough	L2TP, often combined with IPsec	UDP packets, usually port 1701, often wrapped in IPsec
IPsec passthrough	IPsec tunnels (see RFC 4301)	ESP (protocol 50) and key exchange over UDP, plus NAT traversal on UDP port 4500

Two ideas explain a lot here.

Protocols without ports. GRE and ESP are separate protocol numbers, not TCP or UDP. A router that only tracks ports cannot follow them without special code. That special code is what passthrough switches control.

NAT traversal. Modern IPsec-based tunnels, including those using IKEv2 as described in RFC 7296, solve the problem differently. They detect that a NAT is in the path and wrap the encrypted packets inside UDP, so the router sees ordinary UDP with port numbers. When NAT traversal works, the router needs no special help, and the passthrough switch is unimportant.

The result is that passthrough switches are mostly a legacy of the days when routers could not cope with these tunnels. On a modern router, the switch may be present only for compatibility, and the underlying feature may be always on.

When you actually need to think about it

Passthrough matters in a narrow set of situations.

1. A legacy PPTP connection. Some older office systems still use it. With PPTP, the GRE packets need special handling, and on certain routers PPTP passthrough must be enabled. Note that PPTP is old and widely regarded as weak, so if you control the choice, use a newer tunnel type.
2. Older IPsec or L2TP/IPsec setups, especially with older routers or firmware where NAT traversal is not supported on the remote side.
3. Several devices using the same legacy tunnel type at once. An old router might manage one PPTP session but fail with two, since it cannot tell the GRE replies apart.
4. Unusual or very old router firmware, such as an ISP-supplied box with a stripped-down feature set.
5. A router that has been locked down with firewall rules that block unusual protocol numbers.

For nearly everything else, including the common case of a VPN app on a phone or laptop using ordinary UDP or TCP connections, there is nothing to switch on. Whether your VPN service uses such connections is explained by that service; on the XPASS My Pass page you will find the supported connection methods and setup instructions, and you should follow those rather than guess.

When you can ignore passthrough

Here are the common cases where the switch is irrelevant:

• VPN apps over UDP or TCP. If the app builds its tunnel on a normal port number, the router sees an ordinary connection. See what a VPN protocol is for the idea that different tunnels travel differently.
• A VPN that runs on the router itself. The router is then an endpoint, not a middle-man, and passthrough does not apply to that tunnel.
• A router with no such setting. It probably handles these automatically.
• A mobile hotspot. Mobile networks apply their own rules and have no passthrough switches for you to change.
• A work VPN that already works. If the VPN connects and stays connected, changing router settings only adds risk.

A good rule is to test first and touch settings only if the VPN fails in a pattern that points to the router.

Passthrough, port forwarding and DMZ are different things

These three terms get mixed up constantly.

Feature	Direction	Purpose	Typical need
VPN passthrough	Outgoing, from inside	Lets a device inside build its own VPN	Legacy tunnel types
Port forwarding	Incoming, from outside	Sends a chosen port to a device inside	Hosting a service or a home VPN server
DMZ	Incoming, from outside	Sends all unsolicited traffic to one device	Rarely a good idea

If you want to reach your own devices from outside, you need the server side of the picture, and forwarding concepts are discussed in VPN port forwarding explained. Do not enable a DMZ to fix a VPN client problem; it exposes a device to the internet and almost never solves a client-side connection issue.

Diagnosing whether the router is the problem

If a VPN will not connect, work through this sequence before blaming passthrough.

1. Test on another network. Use a phone hotspot with the same device. If the VPN connects there but not at home, the home router or ISP is a suspect. If it fails everywhere, the issue is credentials, the app or the service.
2. Check the basics. Confirm username and password, system time and app version. The VPN not connecting guide covers these in order.
3. Restart the router. NAT tables sometimes hold stale entries, and a restart clears them.
4. Test one device only. With several devices attempting the same legacy tunnel, a simple router may confuse them. Disconnect the others and retry.
5. Look at the router's passthrough or VPN settings. If the relevant switch is off, switch it on and test again. Change one thing at a time.
6. Update the router firmware. Many NAT handling bugs have been fixed in updates.
7. Check for double NAT. If the router sits behind an ISP box that also translates addresses, the outer box may be what blocks the tunnel. Putting it into bridge mode or asking the ISP for guidance may help.
8. Try a different connection method in the VPN app, if the app offers one. Keep the default unless support advises otherwise.
9. Contact the VPN service's support with the exact message you see. They can tell you which connection method works best on home routers.

This ordering saves time, because the first two steps already separate a router problem from everything else.

Worked examples

A consultant with a client's old VPN. Mei works from home and connects to a client's legacy PPTP gateway. It connects on her phone hotspot but fails at home. The router's PPTP passthrough switch was off. Turning it on fixes it. She also tells the client that PPTP is weak and asks if a newer option exists.

A family where nothing helps. Ben's laptop will not connect to a VPN app at home but works at a cafe. He flips all three passthrough switches without any change. Eventually, he discovers that his ISP box in front of his own router blocks the connection method the app used by default. Switching the app to another connection method from within its own settings, after asking support, solves it. Passthrough was never the issue.

A student in a dormitory. The dorm network is managed and offers no router access. Passthrough settings are not something the student can change, and the VPN does not connect. The helpful step is to ask the network office which outgoing connection types are permitted, and to use a different network for sensitive tasks.

Security notes

Turning on passthrough does not weaken your network in the way that opening ports does. It affects only outgoing tunnels you start yourself. Still, keep a few habits.

• Do not leave router remote administration open to the internet.
• Update the firmware, since NAT and VPN handling code is exactly where bugs appear.
• Prefer modern tunnel types over PPTP whenever you have the choice. The NIST guide on IPsec VPNs is a reliable source on tunnel security.
• Remember that a VPN protects traffic only on the leg between your device and the VPN server; it does not stop phishing or account theft.

You can get the free VPNclient app for iPhone, Android, Windows and macOS from the download page and use the username and password shown on your My Pass page. If it will not connect on your home network but works elsewhere, the sequence above shows where to look.

Summary

VPN passthrough is a router feature that lets a VPN tunnel built by a device inside your network get through address translation. It matters mainly for older tunnel types such as PPTP and some IPsec setups, because those use protocol numbers without ports. Modern tunnels that sit on ordinary UDP or TCP rarely need it. Diagnose with a second network, restart the router, change one setting at a time, update the firmware and check for double NAT, rather than toggling everything at once.

If you would like a simple pass to test on different networks, the pricing page is there when you are ready.