Why Choose SSTP for Your VPN?
When configuring a Virtual Private Network (VPN) for remote employees, traditional protocols like PPTP are highly insecure, and L2TP/IPsec is frequently blocked by public Wi-Fi hotspots and strict hotel firewalls. SSTP (Secure Socket Tunneling Protocol) is a Microsoft-developed VPN protocol that encapsulates traffic inside an HTTPS (SSL/TLS) session over TCP port 443. Because it looks exactly like normal secure web traffic, it can effortlessly bypass almost all firewalls and NAT routers.
Step 1: Install the Remote Access Role
Log in to your Windows Server. Open Server Manager, click Add roles and features, and select the Remote Access role. Under Role Services, check the box for DirectAccess and VPN (RAS). Complete the installation wizard.
Step 2: Obtain an SSL Certificate
Because SSTP relies on HTTPS, your VPN server must have an SSL certificate installed. The certificate’s common name (e.g., vpn.yourdomain.com) must match the public DNS name your remote users will type to connect. You can issue this certificate from an internal Enterprise CA, or purchase a public SSL certificate from a trusted provider like DigiCert or Let’s Encrypt. Install the certificate into the server’s Local Computer Personal store.
Step 3: Configure Routing and Remote Access (RRAS)
Open the Routing and Remote Access console from the Server Manager Tools menu. Right-click your server name and select Configure and Enable Routing and Remote Access.
In the wizard, select Custom configuration, and then check VPN access. Finish the wizard and start the service when prompted.
Step 4: Bind the SSL Certificate to SSTP
You must tell RRAS which SSL certificate to use for the SSTP connections. In the RRAS console, right-click your server name and select Properties. Go to the Security tab.
At the bottom, look for the SSL Certificate Binding section. Select the specific certificate you installed in Step 2 from the drop-down menu and click OK. (If you ever renew your certificate, you must update this binding).
Step 5: Allow Dial-in Access for Users
VPN access is granted on a per-user basis via Active Directory. Open Active Directory Users and Computers, right-click a user (or select multiple users), and click Properties. Go to the Dial-in tab and change the Network Access Permission to Allow access.
Ensure that your edge firewall forwards TCP Port 443 to your Windows Server. Remote Windows 10/11 users can now use the built-in Windows VPN client, configure it to use SSTP, and securely connect to the corporate network from anywhere.