How to Use Windows Server Routing and Remote Access (RRAS) for Site-to-Site VPN

If your company opens a new branch office across the country, the employees in that branch need access to the central file servers and Active Directory domain controllers located in the headquarters. Purchasing a dedicated, leased fiber line between the two buildings is incredibly expensive. Instead, you can use the public internet to build a secure, encrypted tunnel connecting the two local networks. While you could buy expensive hardware firewalls (like Cisco or Fortinet) to do this, Microsoft includes a powerful software router directly inside Windows Server called Routing and Remote Access Service (RRAS).

What is a Site-to-Site VPN?

A Site-to-Site VPN connects two entire networks (e.g., 192.168.1.0/24 in New York and 192.168.2.0/24 in Los Angeles). When a computer in New York tries to ping a server in LA, the New York RRAS server intercepts the packet, encrypts it, encapsulates it, and sends it over the public internet to the LA RRAS server, which decrypts it and delivers it locally. The end-users have no idea the internet is involved; to them, it feels like they are on one massive local network.

Step 1: Network Prerequisites

To configure this, both Windows Servers (one in HQ, one in the Branch) must have two Network Interface Cards (NICs):

1. Internal NIC: Connected to the local LAN (e.g., 192.168.1.10).
2. External NIC: Connected directly to the internet with a static Public IP address (or port-forwarded from the edge router).

Step 2: Install the RRAS Role

Perform these steps on both servers.

1. Open Server Manager.
2. Click Add Roles and Features.
3. Select Remote Access.
4. On the Role Services screen, check DirectAccess and VPN (RAS) and Routing.
5. Click Install.

Step 3: Initialize the RRAS Console

1. Open the Routing and Remote Access console from the Tools menu.
2. Right-click your server name (it will have a red down arrow next to it) and select Configure and Enable Routing and Remote Access.
3. In the wizard, select Secure connection between two private networks.
4. The wizard will ask if you want to use Demand-Dial connections. Select Yes. (This tells the server to automatically build the VPN tunnel whenever a packet needs to cross it).
5. Finish the wizard and let the service start.

Step 4: Create the Demand-Dial Interface

Now you must tell the HQ server how to reach the Branch server.

1. In the RRAS console, expand your server, right-click Network Interfaces, and select New Demand-Dial Interface…
2. Name it “VPN-to-Branch”.
3. Connection Type: Select Connect using virtual private networking (VPN).
4. VPN Type: Select IKEv2 (The most modern, secure, and resilient protocol).
5. Destination Address: Enter the Public IP address of the Branch server.
6. Protocols and Security: Select “Route IP packets on this interface”.
7. Static Routes: Click Add, and enter the subnet of the Branch office (e.g., Destination: 192.168.2.0, Subnet mask: 255.255.255.0, Metric: 1). This tells the HQ server, “If you see traffic destined for the 2.x network, shove it through this VPN tunnel.”
8. Credentials: Enter a username and complex password. The Branch server will use these credentials to authenticate to the HQ server.

Step 5: Duplicate and Connect

You must repeat Step 4 exactly on the Branch server, but in reverse.

• Name it “VPN-to-HQ”.
• Enter the Public IP address of the HQ server.
• Set the static route to the HQ subnet (192.168.1.0/24).
• Set the credentials.

Once both interfaces are created, right-click the Demand-Dial Interface on the HQ server and select Connect. The interface status will change from “Disconnected” to “Connected,” and your two physical offices are now securely bridged across the internet, all using native Windows Server roles.