Using a VPN on Netgear Orbi

NordVPN is the best VPN for Netgear Orbi for most users, but the reason is different from what the phrase “Orbi VPN” often implies. Orbi’s built-in VPN Service is designed to let a remote device connect back to your home network. It does not turn a standard Orbi router into a commercial VPN client that sends the entire household through NordVPN, Surfshark, ExpressVPN, or another provider. For most Orbi households, the practical choices are therefore to run the VPN apps on individual devices or place a VPN-capable router in front of the Orbi system.

Surfshark is particularly useful when many phones, laptops, TVs, and other supported devices sit behind the Orbi mesh because one subscription supports unlimited simultaneous connections. ExpressVPN becomes more interesting if you are willing to add a separate VPN router and use Orbi primarily for mesh Wi-Fi coverage.

Best VPNs for Netgear Orbi compared

Why Netgear Orbi behaves differently from a normal VPN router

The important distinction is between a VPN server and a VPN client.

Orbi firmware includes a feature called VPN Service on supported models. NETGEAR describes this as a way to connect from the internet back to your home network. The Orbi router acts as the gateway, while your phone or computer runs an OpenVPN client.

That gives an Orbi owner two fundamentally different VPN scenarios:

• Remote access into your Orbi network: Orbi’s built-in VPN Service can handle this on supported models.
• Sending Orbi internet traffic through NordVPN or another commercial VPN: standard Orbi firmware does not provide the commercial OpenVPN-client function required for this topology.

NordVPN explicitly lists Orbi among routers that cannot use NordVPN with their native firmware and notes that standard Netgear firmware cannot act as an OpenVPN client. That is why downloading a NordVPN .ovpn file and looking for somewhere to import it in the Orbi VPN Service page does not work: that page serves the opposite side of the connection.

This distinction should determine which VPN you choose. A provider with excellent router configuration files is of limited value if you expect to import those files directly into Orbi. Device coverage, support for a separate gateway router, and how easily the provider fits a two-router topology are more relevant.

1. NordVPN – best VPN for Netgear Orbi overall

Visit NordVPN

NordVPN takes first place because it gives Orbi owners two clean deployment options without pretending that the VPN can simply be installed on native Orbi firmware.

The simplest arrangement is to leave the Orbi mesh exactly as it is and install NordVPN on each computer, phone, tablet, streaming device, or other supported endpoint that needs a VPN. The Orbi satellites continue forwarding normal LAN traffic, while encryption begins on the individual device before packets ever reach the Orbi router.

This is usually preferable when only selected devices need a different public IP address. A gaming console, smart-home controller, printer, or other local device can remain on the normal Orbi route while a laptop or streaming device uses NordVPN.

The second arrangement is appropriate when the entire Orbi network should follow one VPN tunnel. Instead of trying to configure NordVPN inside Orbi, place a router that supports NordVPN between the internet connection and the Orbi mesh:

modem/ONT → VPN-capable router running NordVPN → Orbi in AP mode → Orbi satellites and clients.

NordVPN supports router platforms including OpenWrt, DD-WRT, pfSense, OPNsense, AsusWRT and several other VPN-capable systems. The upstream router terminates the NordVPN tunnel; Orbi becomes responsible for mesh coverage rather than VPN routing.

There is one important Orbi-specific consequence. NETGEAR disables VPN Service when an Orbi router operates in AP mode. You therefore should not choose this topology if you simultaneously depend on Orbi’s own OpenVPN server for remote access to your home LAN.

Best fit: Orbi owners who want a straightforward VPN on selected devices now, with the option of adding a dedicated VPN gateway later if they decide to tunnel the entire mesh.

2. Surfshark – best for an Orbi network with many devices

Visit Surfshark

Surfshark solves one of the most practical consequences of Orbi lacking a commercial VPN client: you can install the VPN directly on a large number of individual devices instead.

Surfshark currently allows unlimited simultaneous connections after the trial period. In an Orbi household with several phones, computers, tablets, Apple TVs, Android TVs, and other supported devices, that can remove much of the reason for forcing the VPN onto the router in the first place.

For example, consider an Orbi system with:

• two work laptops;
• three phones;
• two tablets;
• an Apple TV;
• an Android TV device;
• several printers, speakers, cameras, and smart-home products.

Rather than placing all of those devices behind one router-level VPN, Surfshark can run only on the endpoints that actually benefit from it. Local-only hardware remains on the ordinary Orbi network.

That can also avoid local-network complications. Some VPN applications have settings controlling LAN visibility or VPN bypass behavior. Those controls are available at the endpoint, whereas pushing the entire Orbi mesh through a single upstream tunnel gives every client essentially the same WAN path unless the gateway router supports policy-based routing.

Surfshark does support router configurations when the router has an OpenVPN or WireGuard client. The relevant point for an Orbi owner is that this client must exist on another compatible router; native Orbi firmware is not the place to import the commercial VPN profile.

Best fit: homes where Orbi connects many VPN-capable devices and installing an individual app is easier than redesigning the network around a second router.

3. ExpressVPN – best if you want a dedicated VPN router in front of Orbi

Visit ExpressVPN

ExpressVPN is the most interesting option when you specifically want the Orbi mesh to sit behind a router designed to run a commercial VPN.

ExpressVPN provides its own router firmware for a defined set of Netgear routers, but Orbi models are not on that compatibility list. Supported Netgear hardware includes models such as the R6300v2, R6400v2, R6700v3, R7000, and R7000P.

That difference matters. “ExpressVPN supports Netgear routers” should not be interpreted as “ExpressVPN firmware can be flashed onto an Orbi.” ExpressVPN publishes an explicit model list, and Orbi is not part of it.

A cleaner Orbi arrangement is therefore:

internet → ExpressVPN-compatible router → Orbi router in AP mode → Orbi satellites.

The first router handles NAT, DHCP, and the ExpressVPN tunnel. The Orbi hardware provides the Wi-Fi mesh. Every device connecting through an Orbi satellite ultimately reaches the internet through the upstream VPN gateway.

This layout is particularly useful for devices that cannot run a VPN application themselves. A television, game console, or other appliance does not need to understand ExpressVPN because the upstream gateway applies the tunnel before traffic reaches the internet.

The tradeoff is again Orbi functionality. Switching the Orbi system into AP mode disables several router functions, including its built-in VPN Service. If your priority is preserving Orbi as the primary router, a separate downstream VPN router for selected devices may be preferable to converting the entire mesh to AP mode.

Best fit: Orbi owners willing to add purpose-built VPN routing hardware while keeping the Orbi system for the job it does best: distributing Wi-Fi throughout the property.

4. ProtonVPN – best for an advanced WireGuard or OpenVPN gateway

Visit ProtonVPN

ProtonVPN makes the most sense for an Orbi owner who is comfortable separating the VPN gateway from the Wi-Fi mesh and wants broad support for router platforms such as OpenWrt, pfSense, OPNsense, MikroTik, or compatible Asus routers.

Proton’s router documentation explicitly requires a router that can operate as an OpenVPN or WireGuard client. That is the exact functionality missing from the standard Orbi commercial-VPN scenario.

A particularly clean installation is to use a small wired router or firewall appliance as the main gateway and convert Orbi to AP mode. An OpenWrt gateway can run Proton VPN using WireGuard while the Orbi router and satellites remain responsible for wireless coverage.

This separation also makes troubleshooting clearer:

• if the Orbi mesh loses a satellite, investigate the Orbi backhaul;
• if local Wi-Fi works but internet traffic fails through the VPN, investigate the Proton gateway;
• if the gateway works when the Proton tunnel is disabled, the fault is isolated to the VPN configuration rather than the Orbi radio network.

Proton VPN also documents WireGuard configurations for OpenWrt and other router platforms. That is preferable to trying to repurpose Orbi’s “VPN Service” menu, which is designed for incoming remote-access connections rather than an outgoing Proton tunnel.

Best fit: technical users building an Orbi network around a separate OpenWrt, pfSense, OPNsense, or similar VPN gateway.

5. Private Internet Access – good when Orbi is only the Wi-Fi layer

Visit Private Internet Access

Private Internet Access is most appropriate when you already intend to use a separate router or firewall as the VPN endpoint and treat Orbi as the wireless access layer.

The important topology is not “PIA installed on Orbi.” It is:

PIA-capable gateway → Ethernet → Orbi AP → satellites → wireless clients.

In this design, the VPN router receives the internet connection, establishes the commercial VPN tunnel, performs routing, and passes LAN traffic to Orbi. The mesh does not need to know whether the upstream WAN connection is ordinary internet access or a VPN tunnel.

This arrangement can also make selective routing possible if your gateway supports it. For example, a work computer could use the normal ISP route while a television follows the PIA tunnel. The policy is configured at the upstream router, not in Orbi.

That distinction becomes important when users search the Orbi interface for an option to upload commercial OpenVPN credentials. Seeing “VPN Service” in the menu makes that assumption understandable, but Orbi is providing an OpenVPN endpoint for remote clients rather than an outbound OpenVPN client for PIA.

Best fit: users who already have, or plan to add, a dedicated VPN-capable router and want Orbi to remain responsible only for mesh Wi-Fi.

6. CyberGhost – useful with a separate DD-WRT VPN router

Visit Cyberghost

CyberGhost is relevant to Orbi primarily when you add another router that supports an OpenVPN client.

CyberGhost publishes a DD-WRT OpenVPN configuration that requires the router to have DD-WRT firmware with OpenVPN client support. It also provides router-oriented configuration files containing the server details, certificates, client keys, and credentials required by that separate VPN router.

This creates two reasonable Orbi layouts.

The first is a whole-network configuration:

modem → CyberGhost DD-WRT router → Orbi in AP mode.

The second keeps Orbi as the main router:

modem → Orbi router → separate CyberGhost router → VPN-only devices.

The second option is useful when only one room or one collection of devices should use CyberGhost. It does create another routed network behind Orbi, which can complicate device discovery and services that expect clients to be on the same subnet. However, it avoids changing the entire Orbi mesh to AP mode.

For example, a streaming device and television could connect to the secondary VPN router while printers, smart speakers, cameras, and normal household devices remain directly on the Orbi LAN.

Best fit: Orbi users who want a distinct VPN-only network and are comfortable adding a DD-WRT or other OpenVPN-capable router.

7. IPVanish – useful when you would rather leave Orbi untouched

Visit IPVanish

IPVanish makes sense when the Orbi network is already stable and you do not want to change router mode, DHCP, NAT, satellite behavior, or the physical topology solely to add a VPN.

In that situation, the least disruptive approach is endpoint VPN software. Orbi continues seeing the device as an ordinary LAN client, while the VPN software on the endpoint creates the encrypted tunnel.

This is especially sensible when the VPN requirement applies to laptops, phones, tablets, and supported streaming hardware rather than every IoT device connected to the Orbi system.

It also preserves Orbi’s router-mode features. You do not need to switch the mesh into AP mode, and the built-in Orbi VPN Service remains available if you use it for remote access back into your home network.

Best fit: established Orbi installations where changing the network topology would create more complexity than simply running the VPN on the devices that need it.

Orbi VPN Service vs a commercial VPN

This is the most important distinction in the entire setup.

NETGEAR’s setup procedure demonstrates the direction clearly. You enable Advanced > Advanced Setup > VPN Service, download configuration files from the Orbi router, and import those files into OpenVPN Connect on the remote phone or computer.

The configuration therefore originates from your Orbi router.

With NordVPN, Proton VPN, CyberGhost, or another commercial service, the direction is reversed. The VPN provider supplies the server configuration, and a compatible router must import that configuration and connect outward to the provider.

Can you install NordVPN directly on Netgear Orbi?

Not on standard Orbi firmware.

NordVPN specifically states that Netgear routers using their native firmware cannot act as OpenVPN clients and lists Orbi among unsupported router families.

This means that this topology does not work:

internet → Orbi running native firmware + imported NordVPN profile.

There is no ordinary NordVPN configuration field in the Orbi admin panel into which you can import the provider’s OpenVPN profile and turn the entire mesh into a NordVPN network.

Instead, use one of these:

• NordVPN apps directly on devices connected to Orbi;
• a VPN-capable router upstream with Orbi in AP mode;
• a separate downstream VPN router for only the devices that need the tunnel.

Trying to solve this by installing unsupported third-party firmware on an Orbi router is a fundamentally different project. Firmware support varies by exact hardware revision, and installing incompatible firmware can render router hardware unusable. It should not be treated as the normal way to add a commercial VPN to an Orbi mesh.

Best network layouts for using a VPN with Orbi

Option 1: VPN apps on individual devices

modem → Orbi router → Orbi satellites → VPN apps on selected clients

This is the least disruptive configuration.

Use it when laptops, phones, tablets, or streaming devices are the main reason you want a VPN. Your Orbi mesh remains in router mode, local networking stays unchanged, and different devices can use different VPN locations.

It is also the most practical reason to choose Surfshark in a large household: unlimited simultaneous connections allow many endpoints to run the VPN independently.

Option 2: VPN router in front of Orbi

modem/ONT → VPN router → Orbi in AP mode → satellites → clients

Use this when every Orbi client should automatically follow the VPN gateway.

The upstream device must support the VPN provider as a client. For example, that could be an OpenWrt, AsusWRT, pfSense, OPNsense, DD-WRT, or purpose-built VPN router depending on the provider.

The advantage is coverage: even devices without VPN applications can use the tunnel.

The disadvantage is that Orbi is no longer the main router. NETGEAR disables VPN Service and several other routing features when Orbi operates as an access point.

Option 3: VPN router behind Orbi

modem → Orbi router → secondary VPN router → VPN-only devices

This is useful when you want two logical groups.

Devices connected directly to Orbi use the normal ISP connection. Devices connected to the secondary router use the commercial VPN.

The tradeoff is double NAT on the secondary router branch. That can matter for gaming, inbound connections, local discovery, port forwarding, and devices that need to communicate across both LANs.

Why Orbi AP mode matters when building a VPN network

Changing Orbi from router mode to AP mode is not merely a Wi-Fi setting.

In router mode, the Orbi router can handle functions such as LAN addressing, WAN configuration, routing, and its native VPN Service.

In AP mode, another router becomes responsible for those functions. NETGEAR specifically lists VPN Service among features disabled when Orbi operates as an access point.

That has an important consequence for an Orbi owner who wants both:

• a commercial VPN protecting outbound internet traffic; and
• Orbi’s native VPN Service for connecting back home while traveling.

Putting a commercial VPN gateway in front and switching Orbi to AP mode solves the first requirement but removes the second.

If remote access back to your home network remains important, consider running the remote-access VPN on the upstream router itself instead. An advanced router or firewall can potentially handle both outbound VPN-client routing and a separate inbound remote-access server, depending on its firmware and configuration.

How to use Orbi’s built-in VPN Service

If your objective is remote access to your home network rather than routing your Orbi devices through a commercial provider, you may not need NordVPN or another paid VPN for this function at all.

On supported Orbi systems, NETGEAR’s process is:

1. Enable Dynamic DNS or use the appropriate WAN addressing arrangement.
2. Open Advanced > Advanced Setup > VPN Service.
3. Enable VPN Service.
4. Download the appropriate OpenVPN configuration package for your device.
5. Install an OpenVPN client on the remote device.
6. Import the Orbi-generated configuration.
7. Connect back to your Orbi network while away from home.

NETGEAR notes that Dynamic DNS is used for the connection because most residential internet connections do not retain the same public WAN address indefinitely.

This function is useful for reaching services on your home LAN. It is not a subscription VPN service and should not be evaluated using the same criteria as NordVPN, Surfshark, or ExpressVPN.

Why a commercial VPN profile cannot simply be imported into Orbi VPN Service

The two OpenVPN configurations perform opposite roles.

When Orbi creates an OpenVPN configuration file, it is telling a remote client how to find and authenticate to your Orbi router.

When NordVPN or CyberGhost generates an OpenVPN configuration file, it is telling a VPN-capable client how to find and authenticate to the provider’s VPN server.

Native Orbi firmware supplies the first function. It does not expose the second as a general-purpose commercial OpenVPN client.

What to do if your VPN works on a laptop but not across the whole Orbi network

If NordVPN, Surfshark, or another provider works when its application is installed on your computer, but your television and other Orbi devices still show your normal ISP IP address, the Orbi mesh is behaving normally.

The tunnel begins on the laptop. Other devices do not automatically inherit another client’s VPN connection simply because they share the same Orbi router or satellite.

To route the whole mesh through the VPN, the tunnel must move to a gateway through which all of those devices pass.

That normally means:

• a VPN-capable router in front of Orbi;
• Orbi operating as an access point;
• the upstream router establishing the commercial VPN connection.

What to do if Orbi VPN Service disappears

First check whether the Orbi router is operating in AP mode.

NETGEAR explicitly disables VPN Service in AP mode. If another router was recently installed and Orbi was converted from router mode to access-point mode, the missing VPN menu is therefore expected rather than a VPN-provider failure.

Switching Orbi back to router mode restores its routing role, but doing so behind another router can create a two-router topology and potentially double NAT. The correct choice depends on whether you need Orbi’s native remote-access VPN or the upstream router’s commercial VPN more.

What to do if the whole Orbi network loses internet after adding a VPN router

Separate the mesh from the gateway while troubleshooting.

First verify that a wired device connected directly to the VPN router can reach the internet. If that fails, the problem is upstream of Orbi.

If the gateway has internet access but devices connected through Orbi do not, check:

• whether Orbi is actually in AP mode;
• whether its WAN/LAN cable connects to the correct upstream port;
• whether the upstream router is supplying DHCP addresses;
• whether the Orbi clients received addresses from the expected subnet;
• whether the VPN gateway is configured to forward traffic when its tunnel disconnects.

Do not begin by changing satellite synchronization settings. The Orbi mesh can have a perfectly healthy wireless backhaul while the upstream VPN gateway is blocking WAN traffic.

What to do if local devices stop seeing each other

This most often becomes relevant when you add a second VPN router behind the Orbi system.

Devices behind the secondary router may sit on a different IP subnet from printers, NAS devices, speakers, or computers connected directly to Orbi. Discovery protocols that depend on local broadcasts do not necessarily cross that router boundary.

For a device that needs frequent LAN access, installing the VPN application directly on the endpoint can be simpler than moving the entire device onto a separate VPN-routed subnet.

Alternatively, a more advanced upstream VPN router can use policy-based routing while keeping the household on one LAN.

Should you put Orbi behind a VPN router or use VPN apps?

For most households, start with VPN applications on individual devices.

A separate gateway is worthwhile when one or more of the following is true:

• devices without VPN applications must use the tunnel;
• you want one VPN location applied automatically to most of the household;
• you do not want users to connect the VPN manually;
• you already run an advanced firewall or router capable of policy-based VPN routing.

Stay with device apps when:

• only a few devices need the VPN;
• different users want different VPN countries;
• you rely on Orbi’s VPN Service;
• you do not want to change Orbi to AP mode;
• local-device discovery is important;
• you want to avoid adding another router.

Which VPN should you choose for Netgear Orbi?

For most Orbi owners, NordVPN is the strongest overall choice because it works well as a device-level VPN behind Orbi and has extensive support for alternative router platforms if you later add a dedicated VPN gateway.

The critical point is that NordVPN should not be purchased under the assumption that its configuration can be imported directly into native Orbi firmware. NordVPN itself lists Orbi as unsupported for that use.

Surfshark is more compelling when your main reason for wanting router-level VPN coverage is simply that you have many devices. Unlimited simultaneous connections allow you to install Surfshark directly on a large number of supported devices without modifying the Orbi topology.

Choose ExpressVPN when you specifically want a dedicated VPN router in front of Orbi, or ProtonVPN when you are building a more advanced OpenWrt, pfSense, OPNsense, or WireGuard-based gateway.

If your actual objective is securely reaching devices on your home network while away, check Orbi’s own VPN Service first. That is the use case NETGEAR built the feature for, and it is different from sending your home internet traffic through a commercial VPN provider.

Frequently asked questions

Can I install NordVPN directly on a Netgear Orbi router?

No, not using standard Orbi firmware. NordVPN states that native Netgear firmware cannot operate as the required OpenVPN client and specifically lists Orbi among unsupported router families. Run NordVPN on individual devices or use another VPN-capable router as the VPN gateway.

Does Netgear Orbi have a built-in VPN?

Supported Orbi models have a VPN Service, but it is primarily an OpenVPN server for remote access back to your home network. It is not the same as a commercial VPN client that routes your Orbi household through NordVPN, Surfshark, or another provider.

Why does Orbi have an OpenVPN option if NordVPN does not work on it?

Because OpenVPN can be used on either side of a VPN connection. Orbi uses OpenVPN to accept remote client connections into your home network. NordVPN requires the router to act as an outbound OpenVPN client connecting to NordVPN’s servers. Native Orbi firmware does not expose that general-purpose commercial VPN-client function.

What is the easiest way to use a VPN with Orbi?

Install the VPN provider’s application on the individual phones, computers, tablets, and streaming devices that need it. This requires no changes to Orbi’s router or satellite configuration.

How do I put my entire Orbi network behind a VPN?

Use a separate router capable of running your VPN provider as a client. Connect the Orbi system behind that router and normally configure Orbi as an access point. The upstream router then handles the VPN tunnel while Orbi distributes the resulting connection over its mesh.

Can I use Orbi in AP mode with a VPN router?

Yes. This is one of the cleanest ways to combine Orbi mesh Wi-Fi with a separate commercial VPN gateway. However, NETGEAR disables Orbi’s own VPN Service in AP mode.

Will Orbi satellites automatically use the VPN?

If the main Orbi system sits behind an upstream VPN gateway, devices using the satellites normally follow the same upstream route as other Orbi clients. The VPN tunnel itself exists on the gateway, not on each satellite.

Can I use Surfshark with Netgear Orbi?

Yes, but the straightforward approach is to install Surfshark on devices connected to the Orbi network. Surfshark supports unlimited simultaneous connections after its trial period, which is useful for large Orbi households. For router-level protection, use a separate router with OpenVPN or WireGuard client support.

Can ExpressVPN firmware be installed on an Orbi router?

ExpressVPN publishes firmware for specific Netgear router models, but its current compatibility list does not include Orbi. Do not assume that firmware intended for another Netgear model is compatible with an Orbi router.

Can Proton VPN run directly on Orbi?

Not through Orbi’s standard commercial-VPN client functionality because native Orbi firmware does not provide the OpenVPN/WireGuard client interface Proton requires. Proton VPN can instead run on a compatible OpenWrt, AsusWRT, pfSense, OPNsense, MikroTik, or other supported gateway placed in front of the Orbi mesh.

Why is Orbi VPN Service unavailable after I installed another router?

If you changed Orbi to AP mode after installing the new router, this is expected. NETGEAR lists VPN Service among the features disabled in AP mode.

Can I keep Orbi in router mode and add a separate VPN router?

Yes. You can connect a secondary VPN router behind Orbi and place only selected devices behind it. This preserves Orbi’s router-mode features but creates an additional routed network and usually double NAT for devices connected through the secondary router.

Do I need a paid VPN just to access my Orbi network remotely?

Not necessarily. If your Orbi model supports NETGEAR’s VPN Service and remote access to your home LAN is your only objective, Orbi can generate an OpenVPN profile that you import into a compatible client on your remote device.