VPN Client
Have the router itself dial a VPN, so traffic leaves masked rather than raw.
Overview
The screen is titled VPN Client Configuration, and the app is blunt about why it exists: “Your use of Starlink can be traced back to your identity. To enhance security and privacy, please configure a VPN to conceal your Starlink IP.” The VPN is dialled by the router, not by each device, so everything placed on the VPN network goes out through it.
The sub-step starts with an enable toggle. Leave it Disabled and the panel reads “VPN Client is Disabled — Enable VPN Client above to configure your VPN connection settings.” and you move on. Turn it Enabled and you pick a protocol and enter its settings.
In Advanced Mode you can add several VPN connections and then decide how they work together on the Strategy & Priority sub-step, described as “Choose how multiple VPN connections should work together”.
Before you start
- Have your provider’s configuration file, or its server address and credentials. For most protocols the panel offers a Upload/Paste Config toggle so you can drop in the provider’s file rather than retyping fields.
- WireGuard and OpenVPN configs are validated for RouterOS compatibility when you paste or upload them.
- OpenVPN certificate-based authentication is not fully automated: the app notes that you will need to import your certificates into RouterOS yourself, through Files → Certificates in WinBox or the certificate import commands.
Steps
- Set the toggle to Enabled.
- Pick the protocol.
- Either upload or paste the provider’s config file, or switch to manual entry
and fill in the fields. Fields marked
*are required. - In Advanced Mode, add further VPNs and then set the multi-VPN strategy.
Reference
Client protocols:
| Protocol |
|---|
| WireGuard |
| OpenVPN |
| L2TP |
| PPTP |
| SSTP |
| IKEv2 |
Multi-VPN strategies (Advanced Mode):
| Strategy | What it does |
|---|---|
| Failover | Use one VPN at a time, switch to backup when primary fails. If the primary VPN fails, traffic automatically switches to the next available VPN. |
| Load Balance | Distribute traffic across active connections, with adjustable weights per VPN. |
| Priority | Order the connections explicitly and prefer the highest-priority one. |
| Combined | Combines load balancing with automatic failover, so traffic is distributed across active connections, with backup VPNs ready when primary connections fail. |
Failover validation limits:
| Field | Minimum |
|---|---|
| Failover check interval | 5 seconds |
| Failover timeout | 10 seconds |
Troubleshooting
“Please complete the VPN configuration correctly before proceeding.” One or more required fields is empty or invalid. The panel lists missing required fields by name.
“Multi-VPN strategy is required when using multiple VPN clients.” You added more than one VPN connection but did not choose how they should work together. Open Strategy & Priority and pick one.