Setting Up Home-Based VPN Service

by Dennis Halnon of TAB Computer Systems, cohost of Computer Talk with TAB

OK, So … Why Use a VPN At All?

We’ve recommended using VPN services for security reasons, and in several situations. Perhaps the most important of these is when you’re away from home (possibly traveling) and have connected to public wifi (at a coffee shop, in an airport, a library, etc.). Some of these are not encrypted (that is, they don’t force you to enter a password or key to connect) which means all your device’s Internet traffic is sent “in the clear” and at least theoretically can be picked up by anyone in the area with wifi packet-collecting capability.

Using a VPN encrypts your data inside of this otherwise-unencrypted context, and secures that traffic which would otherwise not be secure at all.

Types of VPN Services

A common way of using a VPN is to use a hosted or “cloud” VPN service such as Proton VPN (which we’ve recommended) as well as others (Nord VPN, Express VPN, etc.). You can certainly go that route if you wish, but there’s a cost to nearly all of those (Proton VPN has a limited free tier of VPN service).

On the other hand, some home routers/firewalls/access-points have a VPN-hosting feature. That’s right, you very well may be able to host your very own VPN service, at no cost to you other than the time it takes to configure and maintain it.

This can be a dicey proposition, for a couple of reasons, which is why we haven’t usually discussed this on the air. But savvy consumers may wish at least to try it and see if it doesn’t meet their needs.

All of the following applies, only if your router offers VPN service. Check its manual or the manufacturer’s Web site to find out if it does or not.

VPN and Router Terminology

Just to clear the air a little and simplify things, here are some terms I use:

Router

These can be referred to as “firewalls,” “access points,” or “gateways,” and sometimes they’re also “modems.” Whatever it is that you have in your home, when I mention your “router” below, I’m referring to the device that distributes Internet connectivity on your network.

VPN server or service

This refers to the device or service that handles incoming VPN connections in your home. Since we’re setting this up on your home router, it’ll be your router which is your VPN server.

VPN client

A VPN client is a device (laptop, smartphone, tablet, etc.) which is outside of your network and connects to its VPN service.

The Key to a Home VPN Service

The most important thing about having a home-based VPN service is the ability to connect to it at any time from anywhere in the world. That requires always knowing your router’s Internet address, but residential service is “dynamic”; that is, Internet addresses change periodically (anywhere from every 24 hours to every 2 weeks).

That means, in addition to setting up the VPN service itself, you’ll also have to set up what’s called “dynamic DNS.” The goal is to set things up so that, at any given time, there’s a hostname (such as mynetwork.someservicename.net) that points to your own router (this hostname is just an example).

Dynamic DNS Services

There are a number of dynamic DNS (DDNS) services available. As noted, some of these can be contacted by the router itself. Others require software to run on a computer. Whether it’s the router that does it, or this software service, your home router’s external hostname (mynetwork.someservicename.net) is periodically refreshed so that it points to your router’s actual Internet address.

The vexing thing about this is that routers which have the DDNS feature don’t work directly with all of the available DDNS services. They’ll work with only 2 or 3 of them, at most.

It’s impossible for me, here, to cross-reference all the DDNS services with all of the router models out there. Later in this document I’ll provide links to AI chat sessions that can help you work with your router and find out what’s available. For now, I will list the best-known and most-widely-supported DDNS services for you to choose from, when the time comes to set it up:

• No-IP (https://www.noip.com/): The current granddaddy of free DDNS services, free level of service requires periodic confirmation. Commonly supported in routers.
• DynU (https://www.dynu.com/): Newer than most, also free. Not often supported in router interfaces.
• DynDNS (https://account.dyn.com/): Formerly the granddaddy of DDNS, no longer has a free tier of service. Most commonly supported in routers. Now owned by Oracle, which may or may not phase out DDNS services at some point.
• Some manufacturers have their own DDNS service. Netgear’s, for example, is explained here: https://kb.netgear.com/23860/How-do-I-set-up-a-NETGEAR-Dynamic-DNS-account-on-my-NETGEAR-router

Establishing the Router’s VPN Service

Having said all of that, here’s the overall framework for setting up home VPN service:

1. Configure a DDNS service
2. Add it to the router’s interface or management app, or set up software on a computer that keeps DDNS updated
3. Configure VPN service in the router’s interface or management app
4. Set up a remote computer (or “VPN client”) to connect to it (may be a laptop or mobile device)
5. Test connectivity and verify the VPN works
6. Ensure DDNS updates on a regular basis, based on the DDNS service being used

Working in Your Router’s Interface or Management App

It’s beyond the scope of this document to explain the exact process of enabling VPN service in your router and collecting the client configuration files or settings required to connect to it from outside your network. There’s far too much variety among all the different manufacturers and models, for me to do that here.

Fortunately, resources are available that can assist you with this:

• OpenAI ChatGPT: https://chatgpt.com/c/6993300f-0e14-832f-bb0b-893011662fc2
• Google Gemini: https://gemini.google.com/share/f6c4713651bf
• Microsoft Copilot: https://www.microsoft365.com/search/?version=19.2602.40291.0&capabilities=interopPromise%2CsuspendOnClose%2CautoStart&client-request-id=85db7229-b0f4-6b42-8f66-86bad92489dd

Note, some of these include instructions on setting up dynamic DNS in addition to the VPN server and client configuration. Go ahead and follow that advice, if you find it useful. Below I will show you how one DDNS service was set up on a Netgear Nighthawk-type router.

Choosing Among VPN Protocols

Depending on your router, you may have a choice of VPN protocols to select from. The most common ones found on consumer routers are OpenVPN and WireGuard. Both of these are free, open-source protocols with client capability available on a wide variety of devices. Pros and cons for each are:

1. WireGuard typically performs better and is a bit faster, but may not work well, or at all, from some remote networks
2. OpenVPN isn’t quite as fast, but you’re more likely to be able to connect to it from remote networks, and once connected, it tends to be more reliable

The differences between them aren’t huge, however. It’s not really worth it to obsess over this choice.

As a rule, you’re going to want to go with Wireguard if possible, but OpenVPN may be what you need.

Note: Some remote networks discourage the use of any VPNs at all. You may find that neither of these protocols works, from some locations. So on occasion, you may find the choice of protocol may not help.

One Example of VPN Configuration and Deployment

Netgear Nighthawk-type routers are among the more common varieties available. I’m using it only as an example here. Your router’s interface might be different (possibly, very different!). But as kind of an exercise, I’m taking you through it to give you an idea of the overall process here.

First, Dynamic DNS Configuration

In the case of Netgear Nighthawk routers (as well as a lot others) the process begins with DDNS configuration. VPN deployment files and/or settings will depend on a dynamic DNS hostname, so that has be set up first.

Here is the DDNS configuration screen in this type of router:

The “Service Provider” picklist has only a small number of options available:

So, while you see the DynDNS service set up in this router, it will also connect with the No-IP service as well as Netgear’s own DDNS service.

Note, this is a relatively simple setup since the router itself connects with the service, with username and password provided, and informs the service what its current Internet address is. The only options entered here are:

• Host Name (it’s under dyndns.org)
• User Name
• Password

Note in this case, there’s no option to set update frequency. Some routers may have a frequency specification; I recommend every 24 hours if that’s one of the options. Anything more frequent than that is typically pointless, since ISPs rarely force IP changes more often than every 24 hours (it’s usually either 1 or 2 weeks).

Second, VPN Service/Client Settings

The following is the Netgear Nighthawk-style VPN settings screen:

The only available protocol here is OpenVPN, so (obviously!) that’s what’s being set up. There are only 2 controls, in this interface, that you’ll want to pay attention to.

One, of course, is “Enable VPN Service.” That needs to be turned on in order for it work (obviously!). Disable this only when you don’t plan to use your router’s VPN service.

The second is the “Clients will use this VPN connection to access” control. Here it’s set to “All sites on the Internet & Home Network.” What this means is that VPN clients (such as my laptop while working from airport wifi) can reach both the Internet generally and my home network. The “Home Network only” option would restrict the client from reaching anything other than my own network’s devices (which is typically not desired).

Note that this option still forces all traffic through your home router and thus keeps it all encrypted. The other option is “Auto” which allows the client to handle traffic on its own. Internet traffic would be sent over local wifi (whatever that may be) and, thus, may not be encrypted if you’re on unsecured wifi).

So the “Auto” option also would not typically be desired.

There is an option here to select custom ports, but changing these numbers is not advisable. The only reason to set a custom port would be if a particular remote network blocks one of these ports (for whatever reason) so that setting a different one allows the VPN to function.

Note that the wording of your router’s interface may differ from this. You may have to navigate its details on your own — but the AI chat agents I provided above should be able to help.

Third, Deploying VPN Client Settings and/or Files

The manner in which your VPN connection is set up, will vary based on the model of router you have. This example requires that a small number of configuration files (which includes cryptographic certificate/key exchange) be deployed to a device then have them imported into an OpenVPN client, to create the connection.

The Nighthawk-style interface provides specific directions for doing that on Windows and Mac OS computers and Apple iOS and Android devices. In this interface, links in the VPN settings screen under “OpenVPN client setup instruction” explain how to do that. Your router will have its own way to provide this procedure.

On Android, the import process may seem to fail in the OpenVPN Connect app, if you select to import only the .OVPN file. You’ll need to select all four of the files in order to create the connection.

Although it may seem arduous to have to deploy specific files (including cryptographic keys) in order to establish a VPN connection, this is more secure, at least theoretically, than an exchange of credentials such as the usual combination of username and password.

Fourth, Ongoing DDNS Maintenance

Once you’ve been able to connect, the final consideration is ensuring DDNS correctly points to your router, at any given time, in the future.

In the case of this example, this is managed entirely by the router itself. The only consideration is to ensure, in this specific case, that the DynDNS account being used remains current and active.

Other DDNS services may require something else entirely. For example, you may have to install an updater-client on a computer on your network, which runs in the background and periodically reports your router’s Internet address.

How this works will depend on which DDNS service you use. Navigating that is also something I can’t cover here for all of the various available services. The AI agent chat sessions I linked to, however, can provide guidance.

Note About VPN Performance

Any VPN service, whether it’s home-based or in the cloud, will cause a degradation in Internet speed. All Internet packets have to be encrypted and unencrypted at each end of the VPN connection. This adds overhead to the connection itself. With modern networking equipment this shouldn’t present a severe impediment, but you may very well notice a difference in performance, simply due to this.

There’s no viable way to remedy it aside from selecting a more efficient protocol, such as WireGuard versus OpenVPN, or purchasing and using newer, faster equipment. It’s the simply the nature of the medium when it comes to VPNs.

Also keep in mind that home router VPN service depends on your home’s Internet connection. There are a number of considerations here, but the main one to keep in mind is the six legs (yes, I said 6!) of the VPN connection, once it’s engaged (each up or down arrow in this diagram is one such leg):

Since all Internet traffic to and from your VPN client is piped through the VPN, all of it will flow only as fast as the slowest of these 6 legs. If you have cable Internet at home, your router’s upload speed will always be much lower than its download speed (typically no more than 20 megabits per second or Mbps, and most commonly 10 Mbps).

Now, local wifi speed may not be much higher than that, since public wifi is shared and connection speeds won’t necessarily be brisk. So you may not really notice much degradation due to this branching effect.

Final Security Considerations

Configuring VPN service on your home router will make it what some in the industry call “Internet-facing.” That is, it establishes a service that’s now available to the world, over the Internet. By definition this can open your router, as well as your overall home network, to potential compromise.

For this reason, if you don’t plan to use your VPN service, you should keep it disabled in your router. If you’ve configured it and have successfully tested it, consider enabling it only when you might want to use it (such as, while traveling) and keep it disabled at all other times.

Also, don’t give out your router’s DDNS hostname freely. Certainly, never enter it anywhere on anything electronic, other than devices that must connect to the service you use, and your own devices that you intend to connect to the VPN.

Back up to the Tech Advice Web Site