What each plan lets you put in the config
The options below come from Proton's WireGuard configuration article and pricing page. Proton recommends its own apps where available because they include the kill switch and Smart Protocol, but routers with a built-in WireGuard client can use these files. Server counts and connection limits come from Proton's router guidance and pricing page. [1][5][8]
| Item | Free | VPN Plus |
|---|---|---|
| Generate WireGuard .conf files | Yes | Yes |
| VPN Accelerator option | Yes (the only option on Free) | Yes |
| NetShield ad and tracker filtering | No, upgrade required | Yes, selectable level |
| Moderate NAT and NAT-PMP port forwarding | No, upgrade required | Yes, but not both together |
| Server choice | Free servers in 10 countries | Plus servers in over 140 countries |
| Simultaneous connections | 1 | Up to 10 |
Step 1: generate the WireGuard file at Proton
- Sign in at account.protonvpn.com and open Downloads, then WireGuard configuration. [1]
- Give the config a name. Use the router name and date, for example beryl-ax-2026-10, so you can identify it later.
- Choose a platform, then your VPN options (NetShield, Moderate NAT, VPN Accelerator, and NAT-PMP if you need port forwarding), then a server. You can accept the recommended server, which Proton picks by current server load and your location. [1][4]
- Click Create, wait a few seconds, and download the .conf file. [1]
- Store the file somewhere private, such as a password manager, and delete stray copies from your downloads folder.
Step 2: load it into the GL.iNet router
GL.iNet's WireGuard guide is written for firmware v4.7 and later; on v4.9 and later the OpenVPN Client and WireGuard Client pages are merged into a single VPN Client Profile page, with a protocol switch in the upper-right corner. GL.iNet's own tutorial for Proton simply points you to Proton's guide for the file and then to the manual setup section. [2][3][9]
- Open the router Admin Panel and go to VPN, WireGuard Client (VPN Client Profile on v4.9 and later). [2][9]
- Click Add Manually and give the group a name such as proton. [2]
- Upload the .conf file (zip, tar, gz, conf and txt are accepted), or use Manually Add Configuration to paste the text; Item Mode lets you check each field before you apply. [2]
- Click Apply, then the three-dot icon to connect. A green dot marks the active configuration. [2]
- Open VPN Dashboard and confirm the tunnel Kill Switch setting. GL.iNet says that on firmware v4.8 and later each tunnel has its own kill switch, turned on automatically when the tunnel is activated. [7][10]
Port forwarding and NAT notes
Proton supports port forwarding on paid plans and lists it as supported on routers. To use it with a manual config, enable NAT-PMP (port forwarding) when you generate the file and choose a P2P server, marked with a double-arrow icon. [4][6]
The catch is the lease. Proton says a port mapping lasts 60 seconds, so its instructions use a script that renews it about every 45 seconds. Proton's port forwarding guide has no router-specific setup steps, and the GL.iNet VPN pages cited here do not describe a renewal client for VPN tunnels, so treat router-level port forwarding with Proton as an advanced project, not a checkbox. [4][7]
Two more rules from Proton: port forwarding and moderate (Type 2) NAT cannot be used at the same time, and older WireGuard configs may not support IPv6 by default, in which case you download a new config or add ::/0 to AllowedIPs. [4]
Running more than one config
If your router supports several simultaneous WireGuard tunnels, Proton says each extra tunnel needs its Address and DNS lines edited: increase the second number by one per tunnel, for example 10.3.0.2/32 for the second and 10.4.0.2/32 for the third. Consult the router documentation first. [1]
On firmware v4.9 and later, GL.iNet's VPN Dashboard lets you place several profiles in one tunnel; the tunnel tries them in priority order until one connects. That is a simple way to keep a backup server ready without editing files. [7]
Each active router tunnel is a connection on your Proton account. Proton's blog says a router counts as one device; Free allows one connection and Plus up to 10. [5]
What the router cannot do that the app can
Proton's product lifecycle page lists Stealth as not available for router configurations, and its kill switch is listed only for the desktop and mobile apps. On the router you rely on GL.iNet's own kill switch instead. If a hotel network blocks standard WireGuard, the Proton app with Stealth on a laptop or phone is the documented fallback. [6]
Proton's router blog also flags the general trade-offs: some local services can stop working, changing servers is harder than in an app, and speed can drop. [5]
Checklist before you leave home
Test at home, where you control the network, before you depend on it abroad.
- Firmware is v4.7 or later, and you know whether your menus are the v4.9 layout. [2]
- At least two configs on different servers are loaded, labelled with server and date. [7]
- Kill switch state is what you intend, and you know how to turn the VPN off for a captive portal login. [7]
- If you use port forwarding, the config has NAT-PMP enabled and moderate NAT disabled. [4]
- A backup: the Proton app installed on your laptop in case the network blocks router tunnels. [6]
Questions before you decide
Can I use Proton VPN Free on a GL.iNet router?
Proton says Free users can generate WireGuard configuration files but the only VPN option available to them is VPN Accelerator. Its router blog says a router counts as one connection on Free regardless of how many devices are behind it, and Free uses servers in 10 countries.
Does Proton VPN Stealth work on a router?
No. Proton's product lifecycle page says Stealth is not available for Linux or router configurations. Stealth is available in the Windows, macOS, Android and iOS apps.
How do I get port forwarding with a Proton config on a router?
Proton says to enable NAT-PMP (port forwarding) when generating the WireGuard config and to pick a P2P server. Port mappings last 60 seconds, so they must be renewed by a script, and port forwarding cannot be combined with moderate NAT. It requires a paid plan.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Proton VPN: How to download WireGuard configuration files Accessed 30 Oct 2026
- GL.iNet Router Docs 4: WireGuard Client Accessed 30 Oct 2026
- GL.iNet Router Docs 4: How to get configuration files from WireGuard service providers Accessed 30 Oct 2026
- Proton VPN: Port forwarding manual setup Accessed 30 Oct 2026
- Proton VPN blog: How to set up a VPN router Accessed 30 Oct 2026
- Proton VPN: Product lifecycle stages (feature availability by platform) Accessed 30 Oct 2026
- GL.iNet Router Docs 4: VPN Dashboard Accessed 30 Oct 2026
- Proton VPN pricing (USD) Accessed 30 Oct 2026
- GL.iNet docs: VPN Client Profile (firmware v4.9) Accessed 30 Oct 2026
- GL.iNet docs: Block Non-VPN Traffic and Kill Switch FAQ Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.