What is VPN passthrough?
VPN passthrough is an old router setting that let PPTP and L2TP/IPsec connections work through NAT. It exists because those protocols predate NAT and break without help. If you are looking at it on a current router, the short answer is that you almost certainly do not need it.
Why it had to exist
Your router does NAT: many devices at home share one public address. It tells connections apart by rewriting port numbers and remembering the mapping, so replies find their way back to the right device.
That works for TCP and UDP, which both have ports. PPTP does not use either — it carries its data in GRE, a protocol with no port numbers at all. With nothing to rewrite, a NAT router has no way of knowing which device a reply belongs to, and the connection simply fails.
PPTP passthrough is special-case code that inspects GRE and tracks the connection by another field instead. IPsec passthrough solves a related problem: IPsec protects packets against modification, and NAT modifies packets, so the two are in direct conflict. Older routers hacked around it; the standard fix, NAT traversal, wraps IPsec in UDP so ordinary NAT works.
Why you can almost certainly ignore it
Both protocols it exists for are obsolete.
PPTP has been practically breakable since 2012 — not as a research finding but as a commercial service — and current Windows, macOS and iOS have removed or disabled it. L2TP/IPsec is not broken but is slow, doubly encapsulated, and blocked on many networks.
Everything current — WireGuard, OpenVPN, IKEv2 — runs over plain UDP or TCP and passes through NAT with no assistance whatsoever. IKEv2 uses NAT traversal by default. There is nothing for passthrough to do.
So: if the setting is already enabled, leave it, because it costs nothing. If you have arrived here looking for a switch to flip to fix a connection problem, this is not it.
What is actually stopping your VPN
The causes worth checking, roughly in order of likelihood:
| Symptom | Likely cause | Try |
|---|---|---|
| WireGuard will not connect at all | The network blocks UDP | Switch to OpenVPN over TCP/443 |
| IKEv2 fails on one network only | UDP 500/4500 filtered | Another protocol |
| Connects, then drops in seconds | Deep-packet inspection recognising it | An obfuscated protocol |
| Connects, but nothing loads | DNS not routed through the tunnel | Test it |
| Small pages fine, large transfers stall | Packet size (MTU) | Lower the client's MTU |
The last two are the ones that look most like a router problem and are not. A tunnel that establishes but carries nothing is nearly always DNS or MTU, and neither is fixed by anything in the router's VPN section.
Not to be confused with
A VPN router runs the VPN client itself, so the tunnel starts at the router and covers everything behind it. Passthrough is the opposite arrangement: the router carries someone else's VPN traffic and is not part of the VPN at all.
If you want the whole house tunnelled, you want a VPN router. If one laptop needs to reach a corporate VPN through your home connection, you want that to just work — and with any protocol from this decade, it will.
Related questions
Should I enable VPN passthrough?
If it is already on, leave it — it costs nothing. If you are turning it on to fix a problem, it will almost certainly not help, because it only affects PPTP and L2TP/IPsec. Every current VPN client uses WireGuard, OpenVPN or IKEv2, none of which need it. The exception is connecting to an older corporate VPN that genuinely still runs one of those protocols.
My VPN will not connect. Is passthrough the problem?
Very unlikely, unless you are using PPTP or L2TP. More common causes are the network blocking UDP, which stops WireGuard outright; a firewall dropping the specific ports IKEv2 needs; or deep-packet inspection recognising and cutting the connection. If your client can switch to OpenVPN over TCP port 443, that is the fastest way to find out which — it looks like ordinary web traffic and crosses most restrictive networks.
Is VPN passthrough the same as a VPN router?
No, and this is the confusion the two names invite. Passthrough means the router lets a device behind it establish a VPN connection to somewhere else — the router carries the traffic and is not part of the VPN. A VPN router runs the VPN client itself, so the tunnel starts at the router and covers the whole network. Passthrough is a compatibility setting; a VPN router is a different architecture.
Why do these old protocols need special treatment at all?
Because they predate NAT. PPTP carries its data in GRE, which is neither TCP nor UDP and therefore has no port numbers — and NAT works by rewriting port numbers to tell connections apart. With nothing to rewrite, a NAT router cannot route replies back to the right device. Passthrough is special-case code that inspects the protocol and tracks connections another way.