You can use the FRITZ!Box's internet connection to establish VPN connections to remote VPN servers (for example the VPN server of your company) as well as VPN connections to a VPN server in your home network (for example the VPN server of a NAS system).

Note:Refer to the manufacturer for information on the necessary settings in the VPN software being used.

Outgoing VPN connections

If you want to establish VPN connections to remote VPN servers, you do not have to configure any settings in the FRITZ!Box. By default, VPN passthrough is enabled for the VPN protocols IPsec and PPTP in the FRITZ!Box; no further settings are necessary.

If the VPN software uses the IPsec protocol without NAT traversal or the PPTP protocol, the following restrictions apply when using it behind a router like the FRITZ!Box:

• It is not possible to establish several VPN connections to the same VPN server at the same time.
• The IPsec operating mode "Authentication Header" (AH) cannot be used.
• Normally VPN software does not receive notification when the internet connection is cleared and it usually cannot automatically renegotiate the VPN connection. It is necessary to renegotiate the VPN connection if the FRITZ!Box receives a new public IP address when the internet connection is re-established.

Incoming VPN connections

If you want to establish VPN connections to a VPN server in your home network, you must share the ports in the FRITZ!Box that are required by the VPN server:

• The FRITZ!Box uses UDP ports 500 (ISAKMP) and 4500 (NAT traversal) for IPSec connections.
• The FRITZ!Box uses a port between 49152 and 65535 for WireGuard connections. The port is randomly selected when setting up the first WireGuard connection and it is displayed under "Diagnostics > Security > FRITZ!Box Services" in the FRITZ!Box user interface.

If the VPN server being used also uses the same ports, either configure the VPN server to use different ports, or disable the corresponding VPN connections in the FRITZ!Box under "Internet > Permit Access > VPN".