# VPN Client

> Have the router itself dial a VPN, so traffic leaves masked rather than raw.

Source: https://joinnasnet.com/en/guides/nasnet-connect/wan/vpn-client/
Last updated: 2026-08-14

---

## Overview

The screen is titled **VPN Client Configuration**, and the app is blunt about why
it exists: *"Your use of Starlink can be traced back to your identity. To enhance
security and privacy, please configure a VPN to conceal your Starlink IP."* The
VPN is dialled by the router, not by each device, so everything placed on the VPN
network goes out through it.

The sub-step starts with an enable toggle. Leave it **Disabled** and the panel
reads *"VPN Client is Disabled — Enable VPN Client above to configure your VPN
connection settings."* and you move on. Turn it **Enabled** and you pick a
protocol and enter its settings.

In **Advanced Mode** you can add several VPN connections and then decide how they
work together on the **Strategy & Priority** sub-step, described as *"Choose how multiple VPN
connections should work together"*.

## Before you start

- Have your provider's configuration file, or its server address and
  credentials. For most protocols the panel offers a **Upload/Paste Config**
  toggle so you can drop in the provider's file rather than retyping fields.
- WireGuard and OpenVPN configs are validated for RouterOS compatibility when
  you paste or upload them.
- OpenVPN certificate-based authentication is not fully automated: the app notes
  that you will need to import your certificates into RouterOS yourself, through
  Files → Certificates in WinBox or the certificate import commands.

## Steps

1. Set the toggle to **Enabled**.
2. Pick the protocol.
3. Either upload or paste the provider's config file, or switch to manual entry
   and fill in the fields. Fields marked `*` are required.
4. In Advanced Mode, add further VPNs and then set the multi-VPN strategy.

## Reference

Client protocols:

| Protocol |
| -------- |
| WireGuard |
| OpenVPN |
| L2TP |
| PPTP |
| SSTP |
| IKEv2 |

Multi-VPN strategies (Advanced Mode):

| Strategy | What it does |
| -------- | ------------ |
| **Failover** | Use one VPN at a time, switch to backup when primary fails. If the primary VPN fails, traffic automatically switches to the next available VPN. |
| **Load Balance** | Distribute traffic across active connections, with adjustable weights per VPN. |
| **Priority** | Order the connections explicitly and prefer the highest-priority one. |
| **Combined** | Combines load balancing with automatic failover, so traffic is distributed across active connections, with backup VPNs ready when primary connections fail. |

Failover validation limits:

| Field | Minimum |
| ----- | ------- |
| Failover check interval | 5 seconds |
| Failover timeout | 10 seconds |

## Troubleshooting

**"Please complete the VPN configuration correctly before proceeding."** One or
more required fields is empty or invalid. The panel lists missing required
fields by name.

**"Multi-VPN strategy is required when using multiple VPN clients."** You added
more than one VPN connection but did not choose how they should work together.
Open **Strategy & Priority** and pick one.

## Related

- [VPN Server](/en/guides/nasnet-connect/lan/vpn-server/)
- [Network Subnets](/en/guides/nasnet-connect/lan/subnets/)