# Enable VPN functionality when Route10 is not at the edge, when it's behind a NAT device **URL:** \ **Category:** Feature Requests\ **Tags:** vpn\ **Created:** [March 6, 2026, 5:15am UTC](https://forum.alta.inc/t/enable-vpn-functionality-when-route10-is-not-at-the-edge-when-its-behind-a-nat-device/6529 "2026-03-06T05:15:32Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![phxcomm](https://forum.alta.inc/letter_avatar_proxy/v4/letter/p/2acd7d/32.png) [@phxcomm](https://forum.alta.inc/u/phxcomm)\ **Post date:** [March 6, 2026, 5:15am UTC](https://forum.alta.inc/t/enable-vpn-functionality-when-route10-is-not-at-the-edge-when-its-behind-a-nat-device/6529/1 "2026-03-06T05:15:32Z")
It would be useful if the VPN server could work behind a NAT device. Of course, ideally this would be the edge device, but it’s not always the case. There are multiple use cases. Mine at the moment is that I partially set up just the basics for a site, just enough to get everything online and updated, but I won’t be back onsite for a little while and there are other local devices I need to access to continue getting the entire system setup. I wasn’t going to dare throwing the Comcast modem into bridge mode until I knew everything was functional within the Alta network, which means the Route10 has the private 10.x.x.x WAN IP. I tried to connect via VPN, but as I suspected, the Alta VPN is pretty basic, needs it’s WAN exposed. I know it’s possible to do, some others do it. Another use case could be that only a particular VLAN needs VPN access and there’s a more robust edge device in place. This would allow sticking a Route10 on the applicable VLAN and presto. ---
**Author:** ![Alta-MikeD](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-miked/32/1942_2.png) [@Alta-MikeD](https://forum.alta.inc/u/Alta-MikeD)\ **Post date:** [March 6, 2026, 2:51pm UTC](https://forum.alta.inc/t/enable-vpn-functionality-when-route10-is-not-at-the-edge-when-its-behind-a-nat-device/6529/2 "2026-03-06T14:51:38Z")
We actually do not currently restrict the listen interface for the VPN servers, they work perfectly fine behind double-NAT. However, I think I know where the confusion lies, and this isn’t in our documentation yet (it will be, creating a card for it after this post). The `id.ddns.manage.alta.inc` hostname format will resolve to a physical WAN interface. Do note that this is the literal IP on the interface itself, hence why you’re seeing the rfc1918 address. There are some variations to this hostname that I would like to make you aware of, one of which will help here assuming the upstream gateway is properly configured to forward to the Route10. So main hostname again is: `id.ddns.manage.alta.inc` - To return the `wan` IP (WAN 1): `1.id.ddns.manage.alta.inc` - To return the `wan2` IP (WAN 2): `2.id.ddns.manage.alta.inc` - ^… etc, for WANs following their logical number, not metrics/weighting. - To return the current external IP, not the literal interface IP, you would use: `public.id.ddns.manage.alta.inc` It’s that last one which you want to leverage in your case. Try adding `public.` to the hostname. You could also use the external IP if you knew it. ---
**Author:** ![phxcomm](https://forum.alta.inc/letter_avatar_proxy/v4/letter/p/2acd7d/32.png) [@phxcomm](https://forum.alta.inc/u/phxcomm)\ **Post date:** [March 6, 2026, 3:27pm UTC](https://forum.alta.inc/t/enable-vpn-functionality-when-route10-is-not-at-the-edge-when-its-behind-a-nat-device/6529/3 "2026-03-06T15:27:27Z")
Thanks, that’s helpful and good to know. It’s not exactly what I was shooting for here. I’m talking about the Route10 creating a pathway through the edge device to be reachable from a remote VPN client, that is, without touching the edge device and setting up port forwarding. I know Meraki has this option and I don’t recall if Ubiquiti does. ---
**Author:** ![Alta-MikeD](https://forum.alta.inc/user_avatar/forum.alta.inc/alta-miked/32/1942_2.png) [@Alta-MikeD](https://forum.alta.inc/u/Alta-MikeD)\ **Post date:** [March 6, 2026, 10:57pm UTC](https://forum.alta.inc/t/enable-vpn-functionality-when-route10-is-not-at-the-edge-when-its-behind-a-nat-device/6529/4 "2026-03-06T22:57:04Z")
Ah, well I may have good news. We have plans to add support for Tailscale which is a mesh based WireGuard service where an external relay is used to communicate through. I imagine that would at least achieve a similar end result, if it wasn’t a similar architecture. Unfortunately I have not heard timelines, other than it is planned. Would that better align here?