Can a router run a VPN to remotely get home? Even with a home NAS outside, I've managed all three routes

last National Day, when I went back to my hometown, my dad suddenly wanted to rewatch the unfinished wedding video, and all the footage was on our NAS. When you're 300 kilometers away, QuickConnect relays spinning in circles are nerve-wracking (I wrote a dedicated about this issue), and mapping 5000 ports directly to NAS public networks is uneasy—it's like putting Synology's login page on the street. That day, I steeled myself and reassembled the VPN server on my home router. As soon as I connected my phone, the entire home network was right at my fingertips. This article will clearly explain the three ways to remotely return home using a VPN on a router, including which path is stuck on the public IP and which is stuck on the CPU.

to be clear: a VPN home isn't about bypassing the firewall—it's about "moving" you back to your living room

many people immediately think of VPNs as a VPN, thinking about VPNs and having a household router is not the same thing. Its work is simple: you run an encrypted tunnel between your phone and your home router, and your phone gets a home intranet IP through this tunnel, such as 192.168.31.x. Once you get it, you're lying in bed in a hotel, accessing the NAS, turning on the printer, checking the camera, and accessing the router backend—just like sitting in your own living room.

the difference between it and port forwarding is worth mentioning. Port forwarding opens a separate window for each device: one for NAS, one for camera, each window is a target reachable on the public network, and those scanning ports can see clearly (I mentioned this concern my article on port forwarding). A VPN sends you the door key to yourself: the router only exposes one port, and only lets you in when the key matches. Once inside, every device in the room can be touched, and you can't see what's inside the house on the public network. That's also why later I removed all the NAS port mappings, leaving only the VPN port.

premise: first check if your home has a public IP address; if not, just skip the third route

this step is not avoidable. A VPN server is like "someone knocking on your door"—the address must be the only public IP address in the entire network. The method is simple: turn on your phone data (be careful not to connect to your home WiFi), search for "IP" and note the exit address, then log in to the router's backend to check the WAN port IP. If both are identical, it's a public IP; if not, it's a risk. If the WAN port starts with 100.64, that's the carrier's CGNAT dormitory, which doesn't even have its own house number. No matter how well the VPN server is set up, no one will come to knock — I write all the specific judgment and the tactics for asking ISPs for public IPs in my article on optical modems.

my home telecom broadband, I called number 10,000 and reported "There is storage device at home that needs remote access." The next day, I switched back to the public IP without spending any money. If you really can't get it, don't go for it—just look at the third option, Tailscale, which doesn't care about house numbers.

Route 1: Use the ASUS router's built-in VPN server, click a few times on the graphical interface

My dad's device is an ASUS RT-AX86U, and this type of machine comes with a built-in VPN server in its firmware, so you don't need to flash anything. Go to the backend and find the "VPN" main menu under "VPN Server." The newer firmware offers four protocols to choose from: PPTP, OpenVPN, IPSec, and WireGuard.

PPTP skip this section directly. This protocol's encryption was sentenced to death in 2016. Apple removed PPTP support from iOS 10 and Android 13 too—you painstakingly build it and find there are no clients on your phone that connect, all your efforts are for nothing. The rest are just for convenience.

I set up OpenVPN for my parents: check the option to enable and set account and password. The router will automatically generate an oVPN configuration file, download it and send it to your phone, install the OpenVPN Connect app, import this file, enter the password, and it connects. I never touched a single order the whole time, which is the greatest value of this route—the machine for my parents' home, I don't go even half a year, stability is everything. WireGuard also has a graphics switch in newer ASUS firmware, with similar configuration logic. If you can choose one, go for it. See the following summary.

a quick note about the mobile experience: after connecting to a VPN, all phone data automatically loops from home, making local food delivery apps slow by a bit. In OpenVPN Connect, you can check "Only VPN needs to tunnel" (split mode), and WireGuard configuration can only point the 192.168.31.0/24 segment into the tunnel, while the rest of the data goes to the SIM card—home access and daily internet use are not affected. If you mismatch this detail, you might think "connecting to VPN turns your phone into a card," but it's not the VPN's fault. How to choose between the several remote access routes? I have a complete comparison table in the of NAS remote access, and the VPN server is the most commonly used among them.

Route 2: Installing WireGuard on OpenWrt multiplies speed but requires some

my main router is AX3000T OpenWrt (the flashing process written about the entire process, Xiaomi also has a separate on unlocking SSH steps ). Installing WireGuard in OpenWrt is the fewest commands and the biggest benefit: install luci-app-wireguard in the software source to generate a pair of keys, the server monitors a UDP port (I use 51820), and the official WireGuard app on mobile scan a QR code, and the configuration is done.

here, we need to calculate the speed factor clearly, and discuss the two bottlenecks one by one.

The first bottleneck is the router's CPU. Every packet passing through the VPN tunnel must be encrypted and decrypted, and this task is done by the CPU (hardware NAT acceleration can't manage traffic inside the tunnel; I have reviewed this in the CPU article). OpenVPN is an old user-mode protocol with high overhead costs; WireGuard is implemented in kernel mode, with code volume only 1% that of OpenVPN, and the same CPU can be two to five times faster. In my test of running WireGuard on my MT7981 chip's AX3000T, tunnel throughput was 370-80 Mbps; My old AC2100 (MT7621) at home also has only 80 to 90 Mbps of specs. So, to "whether a VPN is slow," first check what chip your device has; don't blame the protocol for older machines.

second bottleneck, many people don't think about: broadband upstream. When you collect NAS files from your home at the hotel, the data is "sent out" from the home and is connected via broadband upward. My home has gigabit downstream and 50 Mbps upstream. No matter if the tunnel itself can run over 300 Mbps or 400 Mbps, the actual bandwidth is 50 Mbps—no matter how fast 5G broadband is, it can't save it. The speed limit for going out is just as far as your exit. After figuring this out, I was relieved of OpenVPN's over 100 Mbps speed. After all, the uplink was only 50 Mbps, enough for watching videos.

security, WireGuard is also clean. The server only listens on that UDP port; before it responds, the port does not return packets, so the scanner cannot detect that the service is running here; The keys come in pairs: the private key on your phone matches the public key on your home router, and there's no account or password for database compounding. I previously wrote about NAS anti-ransomware mentioned my current stance: only WireGuard remains on the public network, while Synology's 5000 and 5001 don't map at all. If you want to touch the NAS, you have to go through the tunnel first. After half a year of use, there have been no unknown login records, which is much more reliable than having a row of ports installed.

Route 3: Tailscale punching holes, a hassle-free solution without a public IP

friends without a public IP can find solutions here. The idea behind remote networking tools like Tailscale is: both your home router and your phone log into the same account, the official coordination server matches both sides by drilling holes to establish a point-to-point connection. Once the hole is successful, the traffic is transmitted directly, but it can be done on any third-party server. It is essentially a WireGuard tunnel, except the "house number" issue is circumvented by the coordination mechanism.

free tier for 100 devices, personal use is basically more than enough. Just log in with a client on your phone, computer, or NAS; The OpenWrt software source also includes tailscale packages, installed on routers, and the whole house automatically joins the group, saving the need to install clients separately on each machine. Two pitfalls to be mentioned in advance: first, you might not find it in the iOS client store, so you have to download it with an overseas Apple ID; Second, drilling a hole doesn't mean a successful return. If both sides are buried deep within the operator's CGNAT, the connection won't work, causing traffic to degrade and relay, causing speed drops sharply. At this point, you still have to go back to the operator to get a public IP.

What can you do after connecting

, and which of the three paths do you choose

tunnel is connected, there are more things you can do than you imagine: SMB directly dragging movies from the NAS (smb://192.168.31.x via the file app on your phone), enabling Synology to send photos in the background, viewing real-time camera footage, connecting Windows remote desktop to home desktop, even restarting the optical modem strip in the router backend fault—dealing with home network issues while away from home, I think this is the most worthwhile scenario. If the internet is off, you don't have to wait for your parents to use their phones to describe the color of the light on the router.

Here's a quick

order: first check the public IP, then check the device brand if you have the address. For native support, open the VPN server in the backend. If you want to tinker, set up WireGuard yourself; if you don't have a number, use Tailscale to punch holes. After setting up, remember to do one thing—remove the port mapping from the NAS and camera one by one, leaving only the VPN port. Safe and convenient, this time you don't have to choose between the two.