A quick fact: Ubiquiti edgerouter x vpn server is a compact, affordable router that can act as a VPN server with the right configurations. If you’re trying to securely access your home or small office network from anywhere, this guide walks you through turning your EdgeRouter X into a VPN server, plus practical tips and common pitfalls. Below is a practical, step-by-step guide with real-world tips, checklists, and quick-reference data.

What you’ll get in this guide

• A clear, step-by-step plan to enable VPN on EdgeRouter X
• Differences between VPN types you can run IPsec, OpenVPN, and WireGuard-inspired approaches
• Common network planning tips IP addressing, DHCP, firewall rules
• Troubleshooting tips with quick fixes
• Quick reference commands and a simple checklist

Useful resources text only
Apple Website – apple.com, Ubiquiti official – help.ubiquiti.com, OpenVPN community – openvpn.net, Reddit networking guides – reddit.com/r/homenetworking, WireGuard – www.wireguard.com

Why you might want a VPN server on EdgeRouter X

If you frequently work from home, travel with a laptop, or want to access devices on your home network remotely, turning your EdgeRouter X into a VPN server gives you a secure tunnel without relying on third-party services. The EdgeRouter X is small but robust, and with proper configuration, it can handle several concurrent VPN connections at home or in a small office.

VPN options you can run on EdgeRouter X

• OpenVPN-style setup via custom packages or compatible VPN services
• IPsec-based VPNs IKEv2-style configurations commonly used by many clients
• WireGuard-like tunnels through third-party modules or newer firmware approaches

Note: The EdgeRouter X hardware is capable, but some VPN options may require more advanced configuration or alternate firmware methods. Always back up configurations before trying new VPN methods.

Planning your VPN network

Before you configure VPN on the EdgeRouter X, decide:

• How many simultaneous VPN connections you need
• Which VPN protocol your devices support
• Your remote access needs: full network access vs. specific services
• How you’ll manage user credentials and keys

A simple plan is to start with one or two users, test full network access, then scale up.

Basic EdgeRouter X network prerequisites

• A static IP or a reliable DHCP reservation for the EdgeRouter X on your ISP modem
• A clean internal network for example, 192.168.1.0/24
• Admin access to the EdgeRouter X via the web UI or SSH
• A firewall rule plan that restricts VPN traffic to what you need

Step-by-step guide to enabling a VPN on EdgeRouter X general approach

Note: The exact steps can vary by VPN protocol and firmware. Use this as a practical outline and adapt to your preferred method. Thunder vpn safe: a practical guide to Thunder VPN safety, privacy, performance, setup, and choosing the right VPN in 2026

1. Access the EdgeRouter X

• Connect to the router’s management interface https://192.168.1.1 or the IP you’ve set
• Log in with admin credentials

2. Create a VPN network range

• Reserve a private subnet for VPN clients for example, 10.10.10.0/24
• Ensure this range does not collide with your LAN or any existing VPNs

3. Enable the VPN service

• For OpenVPN-style setups: configure server mode, certificate authority, and client profiles
• For IPsec-style setups: set up IKEv2 parameters, preshared keys or certificates, and route settings
• For WireGuard-style setups: declare a private key, peer public keys, and allowed IPs

4. Create user credentials or keys

• Generate usernames and passwords for VPN clients or distribution of keys/ certs
• Ensure strong, unique credentials per user

5. Configure firewall rules

• Allow VPN traffic UDP/TCP as required by your VPN type
• Lock down inbound connections to only VPN ports
• Permit VPN clients to access the local network or specific devices as needed

6. Route and NAT configuration

• Ensure VPN clients can reach the local network
• Decide whether to NAT VPN traffic or route directly to the LAN

7. Test the connection

• From a remote device, attempt to connect using a VPN client
• Verify you can reach internal devices like a file server or printer

8. Monitor and adjust

• Check logs for failed handshakes or dropped packets
• Fine-tune firewall rules if you notice unnecessary exposure or blocked traffic

Practical tips and common configurations

• Use a static public IP or dynamic DNS DDNS to reach your EdgeRouter X reliably.
• Prefer a separate VPN subnet like 10.10.20.0/24 to simplify routing
• Regularly update your EdgeRouter X firmware to get security fixes for VPN features
• Backup your configuration before making major changes
• Document your VPN user credentials and certificate lifetimes

Security best practices

• Always use encryption and strong authentication for VPN users
• Disable unused VPN protocols to reduce attack surface
• Enforce client-level access controls so VPN users cannot access devices they don’t need
• Monitor VPN login attempts and set alerting for unusual activity

Troubleshooting common VPN issues on EdgeRouter X

• VPN client cannot connect: verify credentials, certificates/keys, and server address
• Connection drops during use: check for IP conflicts, unstable internet, and keep-alive settings
• Clients cannot reach internal devices: review routing, NAT, and firewall rules
• Slow VPN performance: review MTU settings, CPU load on the EdgeRouter X, and network congestion
• DNS resolution issues for VPN clients: configure correct DNS or push DNS server settings to clients

Real-world tips from users

• Pick a VPN protocol your devices already support to minimize setup complexity
• Test with a single client first before adding more users
• Use monitoring tools to observe VPN connection stability over time
• Document the exact steps you took so you can redo the setup if needed

Performance considerations

• EdgeRouter X is a compact router, so expect decent performance for home use with a small number of VPN clients
• If you need many simultaneous VPN clients, consider upgrading to a more capable router or distribute VPN load across devices

Optional enhancements

• Set up dynamic DNS so you can connect even if your public IP changes
• Create a dedicated VPN VLAN to isolate VPN traffic from your regular LAN
• Set up split tunneling if you only need access to certain internal resources

Quick reference: sample commands and configuration concepts

• Show current firewall rules: show configuration commands or the GUI equivalent
• Create a VPN subnet: define the VPN network range for clients
• Add iptables-like rules to allow VPN traffic and block unwanted access
• Configure NAT for VPN clients if you want internet access through the VPN

Comparison at a glance

• OpenVPN-style: Flexible with broad client support, good security with certificates, may require more setup time
• IPsec-style IKEv2: Strong standards, solid performance, good for mobile clients, more complex to configure
• WireGuard-inspired: Modern, simple, fast, easy key management, not all EdgeRouter X environments support native WireGuard, may require workarounds

Common maintenance tasks

• Rotate keys and certificates on a regular basis
• Review VPN access lists quarterly to remove inactive users
• Schedule firmware updates and backup configurations

Best practice checklist

• Determine VPN protocol and client support
• Reserve VPN subnet and plan routing
• Configure VPN server with proper authentication
• Set up firewall rules and NAT as needed
• Create user credentials or keys
• Test VPN connectivity from multiple remote networks
• Monitor VPN performance and logs
• Back up configuration after successful setup

FAQ Section

What is the EdgeRouter X’s role in a VPN setup?

The EdgeRouter X acts as the VPN server and gateway, handling VPN handshakes, routing VPN client traffic to your LAN, and applying firewall rules to secure access.

Which VPN protocol is easiest to set up on EdgeRouter X?

OpenVPN-style setups are often easiest for broad client compatibility, but the exact ease depends on your firmware and the tools you choose to use.

Do I need a static IP to use VPN on EdgeRouter X?

Having a static IP simplifies remote access, but dynamic DNS DDNS can also work well if you don’t have a static IP.

Can I have multiple VPN users?

Yes, you can create multiple user credentials or keys and assign different access levels or subnets as needed.

How do I test a VPN connection?

From a remote device, install the appropriate client, connect with the credentials or keys, and try to reach devices on your LAN like a file server or printer. Touch extension vpn: a comprehensive guide to browser VPN extensions for privacy, security, Netflix, and speed in 2026

How can I improve VPN performance?

Keep your firmware up to date, ensure the VPN MTU is optimized for your network, and minimize unnecessary traffic over the VPN by using split tunneling where appropriate.

What if VPN connections drop?

Check for IP conflicts, poor internet reliability, misconfigured routing, or firewall rules blocking VPN traffic.

Can EdgeRouter X support WireGuard?

EdgeRouter X hardware can support WireGuard via community modules or firmware variants, depending on your setup; it may require additional steps.

How do I securely store VPN credentials?

Use a password manager for passwords and store keys/certs in encrypted storage or secure vaults with proper access controls.

Is VPN logging important?

Yes. Enable logging for VPN connections to monitor access patterns and detect suspicious activity, then review logs regularly. Touch vpn encryption is disabled 2026

How do I back up EdgeRouter X VPN configurations?

Use the EdgeRouter X backup feature to export your current configuration, including VPN settings, and store it in a safe location.

Can I use VPN if my ISP blocks certain ports?

Sometimes. If a port is blocked, you may need to switch to a different VPN port or protocol, or use obfuscated/alternate ports where allowed.

How do I update EdgeRouter X firmware safely?

Follow the official upgrade path from the Ubiquiti management interface, back up first, and plan for a brief downtime.

What troubleshooting steps should I take first?

Check physical connections, verify IP addresses, confirm port availability, review firewall rules, and validate client configurations.

Ubiquiti edgerouter x vpn server setup guide: how to configure OpenVPN and IPsec remote access on EdgeRouter X for secure home networks

Ubiquiti edgerouter x vpn server is a capable router that you can configure to run a VPN server using OpenVPN or IPsec for remote access. In this guide, you’ll learn why you’d want a VPN on an EdgeRouter X, which protocols make the most sense, and a practical, step-by-step setup that prioritizes performance, security, and reliability. We’ll cover OpenVPN as the primary remote-access option, explain IPsec as an alternative, discuss potential WireGuard approaches, and share real-world tips to keep things moving smoothly. If you’re in the mood for a VPN deal while you set things up, you can check this NordVPN offer here: . NordVPN deal only serves as a contextual nudge for readers weighing their VPN options. Proxy settings in edge chromium 2026

Useful URLs and Resources un-clickable text
– EdgeRouter X official product page – ubnt.com/products/edgerouter-x
– EdgeOS / EdgeRouter documentation – help.ubnt.com
– OpenVPN project – openvpn.net
– IPsec remote access basics – en.wikipedia.org/wiki/Virtual_private_network
– VPN security best practices – en.wikipedia.org/wiki/Virtual_private_network#Security

Introduction short summary and what you’ll get
– Yes, you can turn an EdgeRouter X into a robust VPN server for remote access. This guide walks you through choosing between OpenVPN and IPsec, a practical OpenVPN server setup on EdgeRouter X, firewall and NAT rules, client configuration, performance expectations, and common troubleshooting steps. You’ll also get real-world tips on security hardening and maintenance so your VPN stays usable and safe on a budget-friendly device. The content is organized into a clear step-by-step section, a protocol comparison, performance benchmarks, and a Frequently Asked Questions section at the end.

Why run a VPN on the Ubiquiti EdgeRouter X

• EdgeRouter X is a compact, affordable router with a capable dual-processor design for small homes or offices. It’s known for solid routing features, a flexible CLI, and robust firewall capabilities, which makes it a good base for a VPN server.
• VPN choices on EdgeRouter X focus on OpenVPN for broad client compatibility and IPsec for strong, widely supported security with native client support on many platforms.
• Real-world performance: VPN throughput on a low-power router depends heavily on the protocol, cipher strength, and client load. Expect OpenVPN to deliver tens of Mbps per connection on ER-X hardware in typical home setups, while IPsec can push higher throughput when configured with modern ciphers and hardware acceleration. If you need sustained gigabit-ish VPN performance, you’ll likely want a more powerful device or offload to a dedicated VPN server or appliance. the ER-X is great for remote access with moderate concurrency and reasonable speeds.
• Security best practices matter: keep firmware up to date, use TLS authentication for OpenVPN, rotate certificates regularly, and separate VPN clients from your LAN with precise firewall rules.
• This setup can be part of a layered home network: keep your primary router in charge of local network management while the EdgeRouter X handles VPN remote access and site-to-site VPN for a small branch.

VPN protocol options on EdgeRouter X: what to pick and why

OpenVPN on EdgeRouter X

• Pros: Broad client support Windows, macOS, Linux, iOS, Android, mature ecosystem, straightforward to audit.
• Cons: Potentially lower throughput than IPsec on the same hardware due to the OpenVPN protocol’s overhead. setup is a bit more involved because you manage certificates and TLS keys.
• Typical performance: tens of Mbps per client in a home setup. multiple clients may share CPU inferences, so plan accordingly.

IPsec remote access on EdgeRouter X

• Pros: High performance on many devices. built-in OS support on Android and iOS. strong, standard-based security with either PSK or certificates.
• Cons: Client configuration can be more complex, especially with certificate-based auth. some clients require manual tweaks for perfect interoperability.
• Typical performance: often higher throughput than OpenVPN on the same device, assuming modern cipher suites and proper MTU settings.

WireGuard on EdgeRouter X

• Pros: Lightweight, high performance, simpler configuration. modern crypto. excellent for future-proofing.
• Cons: Native WireGuard support on EdgeOS has historically lagged behind OS-level support. might require experimental packages or workarounds.
• Realistic stance: WireGuard is worth monitoring. if you’re comfortable with experimental features or upgrading to a platform with native support, it can offer noticeable speedups.

Quick decision guide

• If your priority is easy cross-platform client support and solid security with well-documented setups, start with OpenVPN.
• If you need higher throughput and are comfortable with a bit more manual configuration, IPsec is a strong choice.
• If you’re aiming for the highest possible speeds on a small device and are OK with newer tech, watch for WireGuard support maturity on EdgeRouter OS.

Step-by-step: OpenVPN server on EdgeRouter X remote access

Note: You’ll generate a CA, server certificate, and client certificates on a separate machine recommended, then transfer them to the EdgeRouter. This keeps your private keys safe and gives you a clean separation between your VPN server and client devices.

Prerequisites

• EdgeRouter X with the latest EdgeOS firmware
• SSH or console access to EdgeRouter X
• A computer to act as the Certificate Authority or use a hardware security module
• A reliable DNS name for your router dynamic DNS if you don’t have a static IP
• A backup of your current EdgeRouter configuration

High-level steps

1. Create a Certificate Authority and generate server and client certificates

• On your CA computer: generate a private key and certificate authority. create a server certificate for the EdgeRouter. generate per-client certificates.
• Export the server certificate, server key, CA certificate, and client certificates/keys to a safe location.

2. Transfer certificates to EdgeRouter X

• Copy the CA cert, server cert, server key, and any necessary ta TLS files to the EdgeRouter e.g., via SCP or USB. Keep permissions strict.

3. Enable OpenVPN server on EdgeRouter X

• Enter configuration mode on EdgeRouter:
  • configure
• Create the OpenVPN server, define protocol, port, and VPN network:
  • set vpn openvpn server.0 mode server
  • set vpn openvpn server.0 protocol udp
  • set vpn openvpn server.0 port 1194
  • set vpn openvpn server.0 server network 10.8.0.0/24
  • set vpn openvpn server.0 tls-auth enable
  • set vpn openvpn server.0 ca-cert ‘/config/auth/ca.crt’
  • set vpn openvpn server.0 server-cert ‘/config/auth/server.crt’
  • set vpn openvpn server.0 server-key ‘/config/auth/server.key’
  • set vpn openvpn server.0 tls-auth ‘/config/auth/ta.key’
• Define client configuration and routes:
  • set vpn openvpn client-config-dir ‘/config/openvpn/ccd’
  • set vpn openvpn client-config-dir/CLIENTNAME’ that will be created per client
• Configure the firewall to allow VPN traffic:
  • set firewall name VPN-ALLOWED rule 10 protocol udp
  • set firewall name VPN-ALLOWED rule 10 port 1194
  • set firewall name VPN-ALLOWED rule 10 action accept
  • set interfaces ethernet eth1 firewall in name VPN-ALLOWED
• Apply NAT for VPN clients to reach LAN:
  • set firewall name VPN-NAT-OUT default-action accept
  • set firewall name VPN-NAT-OUT rule 100 outbound-interface eth0
  • set firewall name VPN-NAT-OUT rule 100 translation address masquerade
• Commit and save:
  • commit
  • save
  • exit

4. Create per-client config and export

• In the EdgeRouter, set up a per-client config directory, then generate client-config files on your CA machine and copy them back to the EdgeRouter’s client config directory.
• Example client config inline to be embedded into a .ovpn file on the client:
  • client
  • dev tun
  • proto udp
  • remote your-ddns-name 1194
  • resolv-retry infinite
  • nobind
  • persist-key
  • persist-tun
  • ca ca.crt
  • cert client.crt
  • key client.key
  • tls-auth ta.key 1
  • cipher AES-256-CBC
  • compress lz4-v2
  • verb 3

5. Start the server and test

• Start or restart the OpenVPN server:
• Test with a client OpenVPN app by importing the client config and connecting. Verify IP address, DNS, and routing to confirm the VPN tunnel is active.

Step-by-step: IPsec remote access on EdgeRouter X

1. Prepare certificates or PSK

• Decide whether you’ll use certificate-based authentication or pre-shared keys PSK. For better privacy and scalability, certificate-based authentication is recommended.

2. Configure IKE phase 1 and IPsec phase 2

• In EdgeRouter CLI:
  • set vpn ipsec options automatic-add-dry-run
  • set vpn ipsec site-to-site or remote-access depending on your use case
  • For remote access, set up a user and credentials, enable IKEv2 for modern clients

3. Define the VPN pool and traffic rules

• Define a virtual IP pool for clients, e.g., 10.9.0.0/24
• Set policies for encryption AES-256, integrity SHA-256, and DH group 14 or 19+

4. Firewall and NAT

• Allow UDP 500 and UDP 4500 for NAT traversal if you’re behind NAT
• Add appropriate firewall rules to permit VPN traffic and to push LAN routes to VPN clients
• Ensure NAT translates VPN traffic to your LAN as needed

5. Client configuration and testing

• Export client profiles .mobileconfig for iOS, .pcf for Windows, or native IPsec configuration
• Test connectivity with the chosen client and verify the route to LAN resources

6. Maintain and monitor

• Periodically rotate PSKs or certificates
• Reconcile firewall rules if you add new devices or subnets

Security and performance considerations

• Keep firmware up to date: EdgeRouter X is venerable but still powerful. vendor firmware updates often fix security gaps and improve compatibility with new clients.
• TLS authentication: Use tls-auth or tls-crypt if supported for OpenVPN to mitigate TLS handshake abuse.
• Strong ciphers and modern hashes: AES-256-CBC or AES-256-GCM if available with SHA-256 or better.
• Certificate hygiene: Use a dedicated CA for VPN, keep private keys on restricted storage, and rotate certificates every 1–2 years depending on security policy.
• DNS handling: Push a privacy-respecting DNS e.g., 1.1.1.1 or your own DNS to VPN clients to prevent leaks and improve privacy.
• Split tunneling vs full tunneling: Decide whether VPN traffic should go through the tunnel for all destinations or only to specific networks. full tunneling increases load on the router but improves privacy.
• Logging and privacy: Minimize verbose logging on VPN services to reduce the risk exposure if the device is compromised.

Testing and validating your VPN server

• Verify baseline LAN access: Before enabling VPN, confirm that LAN resources and Internet connectivity work normally on the EdgeRouter X.
• Check VPN connectivity from a client device: Connect a Windows/macOS/Linux client and confirm a VPN-assigned IP, DNS resolution via VPN, and ability to access LAN resources.
• Run speed tests with VPN on and off: Use a simple speed test or iperf3 to compare VPN vs normal traffic. Expect OpenVPN to be slower than IPsec, and WireGuard if available to be the fastest option.
• Test DNS leakage: While connected to VPN, visit a DNS leak test site to ensure DNS queries are resolved by VPN DNS servers rather than your ISP.
• Validate restart and recovery: Reboot the EdgeRouter X and ensure VPN services come back automatically.

Advanced tips for stability and long-term maintenance

• Regular backups: Keep a secure backup of your VPN server keys and EdgeRouter configuration. Consider versioning your config changes so you can roll back easily.
• Dynamic DNS: If your WAN IP is dynamic, configure a Dynamic DNS service to keep remote clients pointing to the right address.
• Client management: Maintain an up-to-date list of authorized clients. revoke access for devices that leave the network.
• Monitoring: Use basic EdgeOS monitoring or external tools to watch VPN-related traffic, CPU load, and memory usage. If you notice VPN performance degradation, look at TLS options, MTU, and re-check firewall rules.
• Redundancy: If remote access reliability is critical, consider a second VPN endpoint another router or a Raspberry Pi running OpenVPN as a failover.

Troubleshooting common issues

• OpenVPN won’t start: Check certificate paths, ensure TLS keys are readable by the EdgeRouter, and confirm that you’ve committed and saved changes.
• VPN client can’t connect: Verify the firewall rules, port forwarding, and correct client config server address, port, CA cert, and client cert/key if used.
• Authentication failures: Confirm user accounts and certificate validity. reissue certificates if needed.
• Slow VPN speeds: Check CPU load, cipher selection, MTU settings, and consider switching to IPsec if supported by your devices. confirm that no other processes are saturating the router’s CPU.
• DNS leaks: Ensure VPN DNS servers are pushed to clients. disable DNS forwarding on the router for VPN clients if necessary.

Performance benchmarks and real-world expectations

• The EdgeRouter X is a compact device with an 880 MHz processor and 256 MB RAM. While it’s excellent for small homes and branch offices, VPN throughput will always be bound by CPU and encryption overhead.
• OpenVPN on ER-X typically delivers tens of Mbps per client under real-world conditions. you’ll see diminishing returns as more clients connect simultaneously or you switch to heavier ciphers.
• IPsec remote access tends to offer higher throughput than OpenVPN when configured with efficient ciphers and sane MTU settings, making it a better option if you’re chasing higher speeds.
• For households with multiple remote workers or gamers, you may want to limit concurrent VPN connections or move to a dedicated VPN appliance if you consistently hit performance ceilings.

FAQ: Frequently Asked Questions

What is the EdgeRouter X’s role in a VPN setup?

The EdgeRouter X serves as the VPN server itself or as a VPN gateway, handling remote access or site-to-site VPN connections and providing secure tunnels into your home or small office network.

Can I run both OpenVPN and IPsec on the same EdgeRouter X?

Yes, you can run multiple VPN services on the same device, but you should plan for resource usage and ensure firewall rules don’t conflict. It’s common to offer either OpenVPN or IPsec for remote access, with one protocol active at a time per remote user.

Is WireGuard supported on EdgeRouter X?

WireGuard support on EdgeRouter X depends on the EdgeOS version and any available packages. As of 2025, it’s worth checking whether WireGuard is available in your firmware and if it’s stable enough for production use. Secure access service edge gartner 2026

How many clients can connect to the EdgeRouter X VPN at once?

This depends on the protocol, encryption, and the router’s current load. In typical home setups, you can expect a handful of parallel connections with OpenVPN. more clients will push the CPU and memory, potentially reducing throughput per user.

Should I use a certificate-based or PSK-based IPsec remote access?

Certificate-based IPsec is generally more scalable and secure, especially when you have multiple clients or rotating devices. PSK is simpler but can be riskier if not managed carefully.

How do I test my VPN after setup?

Connect a client device using the generated client config, verify that you receive a VPN-assigned IP, test DNS resolution, and access to LAN resources. Then run speed tests with VPN on versus off and verify no DNS leaks.

How can I improve VPN security on EdgeRouter X?

Use TLS authentication for OpenVPN, keep firmware up to date, rotate certificates regularly, use strong ciphers, and implement strict firewall rules to isolate VPN traffic from the rest of the network.

Can I run a “split tunneling” VPN on EdgeRouter X?

Yes, you can configure the VPN so that only traffic destined for your LAN goes through the VPN split tunneling, while other traffic goes directly to the Internet. This requires careful routing and firewall rules to ensure proper behavior. Purevpn extension chrome: the ultimate guide to using a Chrome VPN extension for privacy, speed, and streaming 2026

How do I set up dynamic DNS for my EdgeRouter X VPN?

Configure your dynamic DNS service on the EdgeRouter X WAN interface, ensuring the VPN clients resolve the public name to reach the server reliably even if your IP changes.

How do I back up VPN configurations?

Export the relevant EdgeRouter EdgeOS configuration sections especially vpn, firewall, and interface settings along with your certificate and key files, and store them securely off-device.

What are best practices for port forwarding with OpenVPN on EdgeRouter X?

Forward the OpenVPN UDP port commonly 1194 to the EdgeRouter X WAN IP, ensure that the firewall allows inbound VPN traffic, and avoid exposing unnecessary services on the same port.

If you’re looking for a practical, privacy-conscious option for remote access to your home network, the Ubiquiti EdgeRouter X VPN server route is a solid choice. OpenVPN remains the easiest path for broad client compatibility, while IPsec gives you strong performance with standard clients. Keep in mind hardware limits and plan for future needs by considering a backup VPN approach or a more powerful device if your remote access footprint grows. Now that you’ve got a solid setup playbook, you’re ready to dive in and get your own EdgeRouter X VPN server humming.

Vpn便宜购买指南：2025年最具性价比的VPN套餐、价格对比、功能与安全要点全解析 Proton vpn google extension 2026