Vpn for edgerouter: complete guide to configuring a VPN on EdgeRouter with OpenVPN and WireGuard options 2026

Vpn for Edgerouter complete guide to configuring a vpn on edgerouter with openvpn and wireguard options is all about giving you a solid, practical path to securing your network using EdgeRouter devices. This guide packs in real-world steps, clear explanations, and practical tips to help you set up VPNs quickly, whether you’re aiming for OpenVPN, WireGuard, or both. Here’s a quick fact to get you oriented: EdgeRouter devices can run OpenVPN and WireGuard configurations, offering flexible remote access and site-to-site capabilities without needing extra hardware.

• Quick fact: EdgeRouter supports both OpenVPN and WireGuard, giving you two modern VPN options to choose from.
• In this guide, you’ll learn exactly how to configure a VPN on an EdgeRouter, compare OpenVPN vs WireGuard, and troubleshoot common issues.
• What you’ll get:
  • A step-by-step setup for OpenVPN on EdgeRouter
  • A step-by-step setup for WireGuard on EdgeRouter
  • How to run both simultaneously for different remote sites or users
  • Security best practices and performance tips
  • Common gotchas with NAT, firewall rules, and DNS
• Techniques you’ll see:
  • Checklists to verify prerequisites
  • Command-line examples
  • Screenshots-style descriptions since we’re text-based, imagine the CLI prompts
  • Quick-reference tables for port usage and config options
• Useful resources text, not clickable links: EdgeRouter documentation – cisco.com, OpenVPN Community – openvpn.net, WireGuard docs – www.wireguard.com, VPN comparison articles on tech sites, Home networking forums like reddit/r/HomeNetworking

What you’ll need before you start

• EdgeRouter model ER-10X, ER-4, ER-6, ER-12, etc.
• Access to EdgeRouter web UI or SSH console
• A static public IP or dynamic DNS setup for remote access
• A client device laptop, phone, or tablet for testing
• For OpenVPN: a certificate authority CA, server certificate, and client certificates or easy-rsa setup
• For WireGuard: a private/public keypair for the server and each client
• A basic understanding of NAT, firewall rules, and DNS

Section A: OpenVPN on EdgeRouter — Step-by-Step
Overview

• OpenVPN provides broad compatibility and works well across platforms, but it can be heavier on CPU for many concurrent connections.
• Typical use cases: remote employees, dad-and-laptop VPN, or site-to-site when you’re integrating with a partner network.

Prerequisites

• Firmware up to date
• Internet connection with a public IP
• Administrative access to EdgeRouter
• OpenVPN software package is not installed by default; you’ll configure via the CLI

Step 1: Create a CA and server/client certificates

• Use easy-rsa or your preferred CA tool
• Generate server certificate, server key, and a client certificate + key for testing
• Create a TLS-auth key for extra security ta.key

Step 2: Prepare server configuration

• EdgeRouter uses its own syntax for VPN services via the CLI. You’ll define:
  • VPN type: openvpn-server
  • Protocol: UDP for performance
  • Port: typically 1194
  • VPN subnet: e.g., 10.8.0.0/24
  • Push routes for internal subnets you want clients to reach
• Example concepts not exact commands:
  • Enable VPN service
  • Define server subnet and tunnel network
  • Set cryptographic parameters cipher, TLS auth
  • Indicate location of server cert/key and CA

Step 3: Configure client profiles

• Generate .ovpn or separate client certs/keys
• Include the CA cert, client cert, client key, and TLS-auth key in the client profile
• Ensure the client config points to the EdgeRouter public IP and port

Step 4: NAT and firewall rules

• Allow VPN traffic through the WAN interface
• Create a firewall rule that accepts UDP 1194 or your chosen port
• Enable masquerading NAT for VPN subnet so clients can access the internet via the VPN
• Optionally restrict VPN clients to required subnets for security

Step 5: Testing

• Start the OpenVPN server on EdgeRouter
• Import the client profile into an OpenVPN client on a test device
• Verify connectivity to internal resources and public access through VPN
• Check logs for handshake errors, certificate mismatches, or routing issues

Step 6: Security hardening and best practices

• Use TLS-auth ta.key to prevent TLS handshake hijacking
• Use strong ciphers AES-256-CBC or newer and secure TLS versions
• Regularly rotate server and client certificates
• Enable DNS leakage protection if supported by your OpenVPN client
• Monitor VPN usage and limit access with firewall rules based on IPs or subnets

Pros and cons of OpenVPN on EdgeRouter

• Pros: broad client support, mature ecosystem, easy to integrate with existing PKI
• Cons: potentially higher CPU usage on the EdgeRouter for many clients, more complex to configure

Section B: WireGuard on EdgeRouter — Step-by-Step
Overview

• WireGuard is lean, fast, and easier to configure. It’s rapidly gaining popularity for site-to-site and remote access.
• Use cases: fast remote access for employees, connecting multiple sites with minimal overhead.

Prerequisites

• EdgeRouter with WireGuard support firmware that includes WireGuard
• A public IP or dynamic DNS for the server
• Private/public key pairs for server and clients
• Optional: DNS configuration for VPN clients

Step 1: Enable WireGuard on EdgeRouter

• Access the EdgeRouter via SSH or web UI
• Enable the WireGuard feature and create a server
• Define the listening port default 51820/UDP

Step 2: Generate keys and peers

• Generate server private key and public key
• For each client, generate a private key and public key
• Exchange public keys as you add peers

Step 3: Configure the server

• Assign a VPN subnet, e.g., 10.14.0.0/24
• Add a peer client with allowed IPs 10.14.0.2/32 or a range if multiple clients
• Set endpoint to your server’s public IP or DNS and the listening port
• WireGuard requires only simple, explicit routes; no complex NAT in most cases

Step 4: Configure clients

• Create a client configuration with the server’s public key, your private key, and the server endpoint
• Include the allowed IPs that should be routed through the VPN 0.0.0.0/0 for full tunnel or a subset for split tunneling
• Optional: set DNS to a private resolver to avoid leaks

Step 5: NAT and firewall rules

• If routing all traffic through VPN, enable masquerading for the VPN subnet on the WAN/NAT firewall
• Add firewall rules to allow traffic from VPN subnet to LAN and out to the internet as needed
• For site-to-site style, you might configure specific allowed subnets instead of full access

Step 6: Testing

• Bring up the WireGuard interface on a client
• Test reachability to internal devices and to the public internet
• Check efficiency and latency compared to OpenVPN

Security considerations for WireGuard

• Use short-lived keys and rotate them periodically
• Keep the server and clients updated with the latest firmware
• Use strong keys 2048-bit or larger in practice
• Consider combining WireGuard with DNS filtering or firewall policies to reduce risk

Section C: OpenVPN vs WireGuard — Quick Comparison

• Setup time: WireGuard is generally faster to set up; OpenVPN can take longer due to PKI
• Performance: WireGuard usually offers lower CPU usage and higher throughput
• Compatibility: OpenVPN has broader OS/old devices support
• Security model: WireGuard uses simpler, modern cryptography and is easier to audit
• Use-case fit:
  • OpenVPN: best for mixed environments, older clients, or when PKI is already in place
  • WireGuard: best for new deployments, fast remote access, or high-performance needs

Section D: Hybrid Scenarios — Running Both VPNs

• You can run OpenVPN for certain users or devices and WireGuard for others
• Consider separate subnets for each VPN e.g., OpenVPN: 10.8.0.0/24, WireGuard: 10.14.0.0/24
• Maintain clear firewall rules to avoid cross-pollination and potential security gaps
• Document which user/device uses which VPN to simplify troubleshooting

Section E: Troubleshooting Tips

• Common issues:
  • VPN client cannot connect: check certificates OpenVPN or keys WireGuard, verify endpoint DNS, confirm port openness
  • Clients can connect but cannot reach LAN: verify routes, NAT rules, and firewall policies
  • DNS leaks: ensure the VPN client pushes a private DNS server or configure client DNS appropriately
  • Performance problems: monitor CPU load on EdgeRouter, consider splitting traffic, check MTU
• Quick commands you’ll use:
  • Show VPN service status
  • Review logs for OpenVPN or WireGuard
  • Verify NAT and firewall rules
  • Ping internal subnets from VPN client to confirm routing

Section F: Security Best Practices

• Regularly update EdgeRouter firmware
• Use strong, unique credentials and disable unused services
• Rotate VPN certificates and keys periodically
• Enable logging and monitor for unusual activity
• Back up VPN configurations and PKI assets securely

Section G: Performance Tips

• For OpenVPN:
  • Consider UDP instead of TCP for better performance
  • Use a modern cipher AES-256-GCM if available
• For WireGuard:
  • Keep MTU optimization in mind to minimize packet fragmentation
  • Prefer persistent keepalives for stable remote connections behind NAT

Section H: Advanced Topics Optional

• Site-to-site VPN with WireGuard to connect multiple offices
• Splitting traffic with OpenVPN by pushing specific routes
• Using DNS filtering or DNS-over-HTTPS DoH with VPN clients
• Integrating VPN with dynamic DNS for remote access without a static IP

Section I: Backup and Recovery

• Regularly export certificates/keys and store them securely
• Maintain a configuration backup for EdgeRouter
• Have a rollback plan if a VPN update causes issues

Table: Quick Reference — VPN Options on EdgeRouter

• OpenVPN
  • Pros: broad client support, PKI flexibility
  • Cons: more CPU, longer setup
  • Typical port: 1194 UDP
  • Typical subnet: 10.8.0.0/24
• WireGuard
  • Pros: fast, simple, low overhead
  • Cons: newer, less mature for some old devices
  • Typical port: 51820 UDP
  • Typical subnet: 10.14.0.0/24

Bottom line

• EdgeRouter gives you powerful VPN options with OpenVPN and WireGuard.
• OpenVPN is great for compatibility and PKI-driven setups, while WireGuard shines in speed and simplicity.
• A well-planned hybrid setup can cover diverse client needs, security requirements, and performance goals.

Frequently Asked Questions

What is the easiest VPN to set up on EdgeRouter?

WireGuard is typically easier to set up on EdgeRouter due to its simple configuration and key-based authentication.

Can I run OpenVPN and WireGuard at the same time on the same EdgeRouter?

Yes, you can run both, but plan subnets carefully to avoid IP conflicts and keep firewall rules clear.

Do I need a static IP to run a VPN on EdgeRouter?

A static IP simplifies remote access, but you can also use dynamic DNS with a stable hostname.

How do I test VPN connectivity from a remote device?

Install the client app, import the profile, connect, and try to reach an internal resource and a public site to confirm routing.

How can I improve VPN performance on EdgeRouter?

For WireGuard, ensure MTU is optimized and keep firmware updated. For OpenVPN, use UDP and modern ciphers, and limit the number of routes if possible.

What ports do OpenVPN and WireGuard use on EdgeRouter?

OpenVPN commonly uses UDP 1194; WireGuard uses UDP 51820 by default, though you can customize ports.

How do I secure VPN traffic from EdgeRouter to the internet?

Use NAT masquerading for the VPN subnet and enforce firewall rules to control what VPN clients can access.

How often should I rotate VPN certificates and keys?

Every 6 to 12 months is a good practice, but rotate sooner if you suspect a compromise.

Can I use VPNs for site-to-site connections with EdgeRouter?

Absolutely. WireGuard is particularly well-suited for site-to-site links due to its performance and simplicity.

What troubleshooting steps help when VPN clients can’t reach LAN resources?

Check routing tables, firewall rules, NAT settings, and ensure the VPN subnet is correctly advertised to the LAN.

Useful URLs and Resources

• EdgeRouter Documentation – cisco.com
• OpenVPN Community – openvpn.net
• WireGuard – www.wireguard.com
• VPN Comparison Guides – tech sites and networking forums
• Home Networking Reddit Communities – reddit.com/r/HomeNetworking
• Dynamic DNS Services – noip.com, duckdns.org

If you want, I can tailor this guide to your exact EdgeRouter model and firmware version, or walk you through a hands-on setup with your specific network diagram.

Vpn for edgerouter can be a game changer for home labs and small offices, letting you route all devices through a VPN or tailor traffic to ride the VPN while keeping other traffic local. Yes, Vpn for edgerouter lets you route all devices on your network through a VPN by configuring EdgeRouter to connect to a VPN server. In this guide, you’ll get a practical, step-by-step approach to setting up an OpenVPN client on EdgeRouter, an honest look at WireGuard options, plus tips to optimize performance, security, and reliability. We’ll cover setup from GUI and CLI, how to decide between full-tunnel and split-tunnel, troubleshooting, and common gotchas. For a quick start, NordVPN offers ready-to-use OpenVPN configurations that work well with EdgeRouter—check out this deal: . NordVPN OpenVPN configs are a solid starting point if you want a straightforward setup.

Useful resources you might want to save for later text only:

• NordVPN – nordvpn.com
• OpenVPN – openvpn.net
• Ubiquiti EdgeRouter help – help.ubiquiti.com
• WireGuard – www.wireguard.com
• ProtonVPN – protonvpn.com
• EdgeRouter OS documentation – help.ui.com

Introduction: what you’ll learn in this guide

• Understand the benefits and limits of running a VPN on EdgeRouter
• Decide between OpenVPN and WireGuard options for EdgeRouter
• Step-by-step OpenVPN client setup on EdgeRouter GUI and CLI
• How to route all traffic or only specific devices through the VPN full-tunnel vs split-tunnel
• DNS considerations, security best practices, and leak protection
• How to verify the VPN is active and performing as expected
• Troubleshooting common issues and performance tips
• Real-world use cases: privacy, remote work, streaming, and accessing geo-restricted services
• FAQs with practical, right-now answers

What is EdgeRouter, and why VPN there matters

• EdgeRouter devices from Ubiquiti are popular for home labs and small offices because of their configurable firewall rules, NAT, and robust routing capabilities.
• Running a VPN on EdgeRouter centralizes protection and makes every device behind the router benefit from the VPN path.
• The most common path to VPN on EdgeRouter today is via OpenVPN client integration. WireGuard can be trickier due to native support limitations in older EdgeOS versions, but workarounds exist.

Key VPN choices for EdgeRouter

• OpenVPN: The most widely supported option across VPN providers and EdgeRouter OS versions. Generally straightforward to export a .ovpn config and feed it into EdgeRouter.
• WireGuard: Fast and modern, but native EdgeRouter support is less consistent across EdgeRouter OS versions. If you’re determined to use WireGuard, you’ll likely need a secondary device to run WG and route traffic through it, or upgrade to a platform that supports WG more fully.
• Split-tunnel vs full-tunnel: Decide whether you want all traffic to go through the VPN full-tunnel or only certain devices/subnets split-tunnel. EdgeRouter supports flexible routing and firewall rules to implement either approach.

Step-by-step OpenVPN client setup on EdgeRouter GUI method

1. Choose a VPN provider that offers OpenVPN config files ovpn and supports the number of simultaneous connections you need. NordVPN is a good example for straightforward OpenVPN configs.
2. Export or copy the OpenVPN client configuration from your provider. You’ll typically get a .ovpn file along with CA/cert/key material.
3. Access EdgeRouter’s web UI https://.
4. Create VPN client interface:
   • Navigate to VPN > OpenVPN Client
   • Click Add OpenVPN Client
   • Enter the server address, port, and protocol as provided by your VPN for example, VPN server: us-east.vpnprovider.com, port 1194, UDP
   • Paste or import the .ovpn content, including CA certificate, client certificate, and client key as required by the provider
   • Enable the interface and ensure it comes up
5. Route all traffic through VPN full-tunnel or set up policy-based routing for split-tunnel:
   • For full-tunnel: Add a static route for 0.0.0.0/0 via the VPN interface vtun0 or similar
   • For split-tunnel: Create firewall/routing rules to send only selected subnets through the VPN e.g., 192.168.1.0/24 while leaving others on the regular WAN
6. NAT and firewall setup:
   • Ensure NAT is configured so VPN traffic can reach the internet masquerade on the VPN interface
   • Create firewall rules to allow VPN traffic and to protect the LAN e.g., drop non-essential inbound traffic
7. Test and verify:
   • Check the VPN interface status in EdgeRouter
   • Verify your public IP through a site like whatismyip.com while VPN is connected
   • Test DNS resolution to ensure no leaks see DNS considerations below
8. Fine-tuning:
   • If you’re hosting local services, ensure port forwarding or DNS resolvers aren’t conflicting with VPN routing
   • Consider DNS leak protection by using DNS servers provided by the VPN or a trusted resolver inside the tunnel

CLI method alternative for OpenVPN on EdgeRouter

• The CLI pathway is more granular and can be faster for experienced admins. Commands vary by EdgeOS version, so keep a local backup and refer to the exact syntax for your build. A typical flow:
  • Upload the OpenVPN .ovpn file to the router’s /config directory
  • Create an OpenVPN interface, attach the config, and enable it
  • Add a static route for 0.0.0.0/0 via the VPN interface
  • Set NAT: masquerade on the VPN interface
  • Apply firewall rules to allow VPN traffic and protect the LAN
• If you’re new to EdgeOS CLI, start with the GUI method and then migrate to CLI for automation.

How to approach WireGuard on EdgeRouter what to know

• Native support status: EdgeRouter OS has historically leaned on OpenVPN for VPN clients. WireGuard support in EdgeRouter is not as universal as with some consumer routers. While newer EdgeOS versions may include more WG-related capabilities, your best bet for a stable EdgeRouter setup is often OpenVPN.
• Workarounds if you want WG:
  • Run WireGuard on a separate device a lightweight Linux box or Raspberry Pi behind the EdgeRouter and route traffic through that device using static routes or policy-based routing.
  • Use a WG-capable edge device in front of EdgeRouter to terminate the WG tunnel, then pass traffic to EdgeRouter.
  • Use a modern gateway device that supports WireGuard natively if you need end-to-end WG across the network.
• If you’re curious about performance, WireGuard generally offers lower CPU load and faster handshakes than OpenVPN, which is why many users want WG on their edge devices.

DNS considerations and security best practices

• Always use a VPN-provided DNS server inside the tunnel to minimize DNS leaks. If your VPN provider supports DNS over TLS or DNS over HTTPS, enable it.
• Disable IPv6 leakage if your VPN provider doesn’t support IPv6 through the tunnel, or configure firewall rules to block IPv6 traffic when VPN is active.
• Regularly update EdgeRouter OS to keep security fixes current. VPN configurations should be revisited after major firmware updates.
• Use strong authentication for VPN certificate-based, or at least a robust username/password with MFA if your provider supports it.

Performance optimization tips

• Choose a VPN server geographically close to your location to reduce latency.
• If you’re on a slower WAN connection, careful selection of MTU settings can improve performance. start with MTU 1500 and test for packet loss.
• Enable a persistent VPN connection to avoid dropouts. configure retries and timers according to your provider’s guidance.
• Consider hardware capabilities: EdgeRouter models with faster CPUs handle VPN encryption tasks more smoothly. If you’re hitting sustained VPN load, you might benefit from hardware with a stronger CPU or consider a dedicated VPN gateway device.

Security, privacy, and practical use cases

• Privacy: A VPN on EdgeRouter protects traffic from local eavesdropping on your network and can mask your public IP. However, you’re still subject to the VPN provider’s logging policies, so pick a provider you trust.
• Remote work: A VPN on EdgeRouter is great for secure access to your home/office network and for connecting to resources remotely without exposing devices to the open internet.
• Streaming and geo-restrictions: When you route traffic through a VPN, you can appear to be located in the VPN server’s region. Be mindful of streaming service terms and potential provider blocks.
• Gaming and latency-sensitive apps: If you’re gaming, run tests to compare latency with and without the VPN. Some providers offer specialized servers for gaming or streaming that can reduce buffering.

Testing and verification: how to confirm VPN is working

• Check your public IP: Visit a site like whatismyip.com to confirm your IP matches the VPN server location.
• Check DNS: Use a DNS leak test to ensure DNS requests are going through the VPN provider and not leaking to your ISP.
• Ping and traceroute: Run ping and traceroute tests to critical endpoints to ensure the VPN path is being used for the intended traffic.
• Check active routes: In EdgeRouter, inspect routing tables to confirm the 0.0.0.0/0 route is pointing toward the VPN interface when you want full-tunnel.

Real-world setup scenarios

• Scenario A: All traffic goes through VPN full-tunnel
  • Pros: Simplified security, consistent IP masking, easier to manage at the router level.
  • Cons: Potentially higher latency, all services including local network access e.g., local NAS routed through VPN may be slower.
• Scenario B: Only specific devices or subnets go through VPN split-tunnel
  • Pros: Local network access remains fast for devices not using VPN. you can selectively route work laptops or mobile devices.
  • Cons: More complex routing and firewall rules to ensure there are no leaks or misrouted traffic.
• Scenario C: VPN for remote access to the home network
  • Pros: Access your LAN resources securely from anywhere, without exposing your services to the broader internet.
  • Cons: Requires proper port forwarding and credentials in the EdgeRouter firewall configuration.

Monitoring and maintenance

• Regularly check VPN uptime and performance metrics. If you notice high latency, check server load, distance, and possibly switch to a different server.
• Keep VPN credentials and certificates rotated periodically for security.
• Periodically audit firewall rules to ensure no unnecessary open ports or accidental leaks exist when VPN is active.

Frequently Asked Questions

Can EdgeRouter run OpenVPN client natively?

Yes. EdgeRouter OS supports an OpenVPN client that you can configure via the GUI or the CLI, allowing you to route LAN traffic through a VPN server.

Does EdgeRouter support WireGuard out of the box?

As of many EdgeOS versions, native WireGuard support is not guaranteed. OpenVPN remains the most reliable edge VPN option on EdgeRouter. If you need WireGuard, you may need a workaround using a separate WG device behind the EdgeRouter or upgrade to a gateway with WG support.

How do I enable full-tunnel VPN on EdgeRouter?

Create a VPN client interface OpenVPN and add a default route 0.0.0.0/0 via that interface. Then Masquerade/NAT the VPN interface for outbound traffic.

How do I enable split-tunneling with a VPN on EdgeRouter?

Configure policy-based routing or firewall rules to direct only selected subnets or devices through the VPN interface, while leaving others to go through the regular WAN.

What VPN provider works best with EdgeRouter?

Providers that offer straightforward OpenVPN configuration files .ovpn usually work well. NordVPN is a common starting point due to solid OpenVPN support and robust documentation. Choose a provider that offers clear OpenVPN config options and reliable servers. Vpn extension edge free guide to using a browser VPN extension on Edge: setup, safety, and best practices 2026

How can I verify the VPN is actually protecting my traffic?

Test by checking your public IP, performing a DNS leak test, and verifying traffic routing with traceroute or network diagnostic tools. If your IP changes to the VPN server, and DNS queries are resolved by the VPN provider, you’re likely in good shape.

How do I handle DNS leaks on EdgeRouter when VPN is active?

Use the VPN’s DNS servers or enable DNS over TLS/HTTPS if your provider supports it. Disable IPv6 or configure firewall rules to prevent IPv6 leaks if you don’t rely on IPv6 in the VPN tunnel.

Can I run a VPN on EdgeRouter and still access local network devices?

Yes, with careful routing and firewall rules. Full-tunnel will route everything through the VPN, including local devices, which might slow access. Split-tunnel, with proper routing rules, lets local devices talk directly while other traffic goes through the VPN.

How do I troubleshoot if the VPN interface doesn’t come up?

Check the OpenVPN client status in the EdgeRouter UI or CLI, ensure the config-file content is correct, verify CA/certificates are valid, confirm server address/port/protocol, and review firewall rules that might block VPN traffic. Also confirm the VPN provider isn’t blocking your IP.

What are best practices for securing VPN credentials on EdgeRouter?

Store credentials securely, rotate certificates periodically, restrict access to the EdgeRouter management interface, and use strong passwords or certificate-based authentication. Keep a recent backup of the configuration but protect it with encryption and access controls. Vpn edge browser: a comprehensive guide to using a VPN with Edge Browser for private, secure, and fast browsing on Windows 2026

Is it possible to run VPN on EdgeRouter X or EdgeRouter Lite?

Yes, but your experience will vary by model and firmware version. Higher-end EdgeRouter models usually handle VPN encryption tasks more smoothly. older models may experience higher CPU load under VPN load.

Do I need to restart the EdgeRouter after setting up the VPN?

Often you’ll need to save the VPN config and apply changes. Some changes may require a router reboot to ensure the VPN interface initializes correctly.

Can I use a VPN with a guest network on EdgeRouter?

Yes, you can set up a separate VPN client for the main network while keeping guest networks isolated. This helps maintain performance and security without exposing guest devices to your VPN’s traffic policies.

Conclusion
Note: This guide provides a comprehensive, practical approach to running a VPN on EdgeRouter, with OpenVPN as the most reliable path for most setups today. If you’re aiming for maximum speed and you’re comfortable with a more advanced networking arrangement, consider exploring WireGuard workflows on a secondary device or WG-capable gateway alongside EdgeRouter to meet your performance goals.

Vpn for chinese 完整指南：在中国使用 VPN 的方法、速度、隐私与合规 Vpn extension microsoft edge free 2026