Thomas Maurer

Cloud and Datacenter Blog focusing on Microsoft Azure

Subscribe
, ,

How to Install VPN on Windows Server 2012

Thomas Maurer
Updated
2–3 minutes
55 comments on How to Install VPN on Windows Server 2012

Windows Server 2012 RC Logo

This post should show you how to install a VPN Server on Windows Server 2012. This post covers a VPN server for a small environment or for a hosted server scenario. This post is note made for enterprise deployments. If you want to run a VPN solution in your enterprise you should definitely look at Direct Access which is much easier to deploy in Windows Server 2012 than in Windows Server 2008 R2.

For a VPN server on Windows Server 2008 R2 check this post: How to Install VPN on Windows Server 2008 R2

 

    1. Install the role “Remote Access” via Server Manager or PowerShell

  1. Select the DirectAccess and VPN (RAS) role services
  2. The other selection in the wizard can use the default properties.
  3. After the features are installed you can us the Getting Started Wizard to configure the VPN scenario.

  4. If you don’t deploy DirectAccess choose Deploy VPN only.
  5. This will open the Routing and Remote Access MMC. Right click on your server and choose Configure and Enable Routing and Remote Access.
  6. This launches the Routing and Remote Access Server Setup Wizard
  7. If you have just a single network interface in your server choose Custom configuration
  8. Select VPN access
  9. And click finish and start service
  10. Now open the following ports on your firewall and forward them to your Windows Server
    For PPTP: 1723 TCP and Protocol 47 GRE (also known as PPTP Pass-through
    For L2TP over IPSEC: 1701 TCP and 500 UDP
    For SSTP: 443 TCP
  11. Users have to be enabled for Remote Access. On a standalone server this can be done in the Computer Management MMC, in a domain environment this can be done in the user properties of an Active Directory user.

Optional: If you don’t have a DHCP Server in your local network you have to add a static address pool. This can could be if you use a single server hosted by a hosting provider.

  1. Right click on your Remote Access Server and open properties
  2. Click on the IPv4 tab and select “Static address pool”
  3. Now add a IP address pool for example 192.168.1.100 – 192.168.1.200
  4. Now if this is a standalone server which has only a single Public IP address, add a secondary IP address to the server network interface which is in the same subnet as the IP address pool.

I also have other posts for about installing VPN on Windows Server:

Tags, , , , , , , , , , , ,
Thomas Maurer
Thomas is the EMEA Global Black Belt (GBB) for Sovereign Cloud at Microsoft, helping organizations across the region harness Microsoft’s sovereign, hybrid, multicloud, and edge solutions. He works directly with C-level leaders and technical teams to remove roadblocks, accelerate digital transformation, and shape long-term cloud strategies that meet business and regulatory needs. With over 15 years of experience in cloud and datacenter, including his previous role as Principal Program Manager and Chief Evangelist for Azure Hybrid, he combines deep technical expertise with a passion for customer success. He specializes in creating scalable architectures, solution accelerators, and thought leadership that drive adoption and innovation on Azure. Thomas is a passionate community advocate and frequently speaks at industry events such as Microsoft Ignite and Microsoft TechDays. He shares his expertise through his Cloud and Datacenter Blog at www.thomasmaurer.ch and on LinkedIn and X.com www.twitter.com/thomasmaurer.

Related articles

55 responses

  1. GASTON Avatar
    GASTON

    i appreciate your guide
    i wanted to try the setup but i’m behind a small router from my isp . my question is to configure the client do i need a public ip ?
    i would appreciate to have the client config too

    Reply
  2. Thomas Maurer Avatar
    Thomas Maurer

    You can use a public IP or you can setup a Port-Forwarding via NAT. (see the ports in my post)

    Reply
  3. leps Avatar
    leps

    What are the pre-requisite when installing server 2012?

    Reply
  4. martin Avatar
    martin

    Hi, thanks for this article.
    I have installed VPN by your example, but when the client is connecting to the server it ends with Verifying username and password.. In the server system event log I see: CoId={01181E8F-FC20-4A5B-8E91-17C4DB6E4073}: The user connected to port VPN3-127 has been disconnected because the authentication process did not complete within the required amount of time.

    Do you have any idea what can be wrong?

    thanks.

    Reply
  5. Petr Mazánek Avatar
    Petr Mazánek

    To Martin:

    I had that same problem, so I installed NPS and reconfigure VPN and it works now.

    Reply
  6. Grammy Leung Avatar
    Grammy Leung

    @Thomas, I followed your contents, and failed to connect to the host. my client is win7, must i do some special setting on the client. thank you.

    Reply
  7. Grammy Leung Avatar
    Grammy Leung

    finally, it tells ‘Error 800: The remote connection was not made because the attempted VPN tunnels failed. The VPN server might be unreachable…’

    Reply
  8. Miguel Avatar
    Miguel

    1. Click Start and type in Active Directory users and Computers into the Quick Search then open it.
    2. Navigate down to the account in question and open up its properties.
    3. On the “Dial-in” tab check that under “Remote Access Permissions (Dial-in or VPN)” that “Allow Access” is selected. If it is not then change it and Apply the update.

    On the client VPN connection

    1. Right-click the VPN connection and click Properties.
    2. Select the Security tab.
    3. Under Type of VPN: select Point to Point Tunneling Protocol (PPTP).
    4. Under Data encryption: select Optional encryption (connect even if no encryption).
    5. Make sure Allow these protocols is selected
    6. Check mark Microsoft CHAP Version 2 (MS-CHAP v2).

    Finally retry the VPN Connection.

    Hope it helps Grammy Leung

    Reply
  9. lkp Avatar
    lkp

    Hi All,

    I could install ppptp on win 2012 and I could connect from clients, but I can’t ping tha LAN, neither can’t access the server. I have checked the NAP polices many many times. Do you have any ideas ?

    Thx!

    Reply
  10. stat Avatar
    stat

    LKP, i’m having the same problem…WS2012 following instructions to start the RAS VPN-Only role…

    i can connect to the VPN from a remote location, put i cannot ping or rdp anywhere on the network…

    ports and services are triple checked..i’m hitting my head against the wall..:-(

    Reply
  11. David Fricke Avatar
    David Fricke

    Thank you for this article. I was missing the Network Access Permissions – Allow Access in the User properties.

    My current issue is this. I’m connected to the remote server. However, I cannot map a drive on the server. It’s a 1 server VPN. Anyone have suggestions?

    Reply
  12. Cole Schmidt Avatar
    Cole Schmidt

    Thank you Tom, this helped me out.

    Reply
  13. lili lala Avatar
    lili lala

    this will work in azure ?

    Reply
    1. Thomas Maurer Avatar
      Thomas Maurer

      In Windows Azure you can use a build in Gateway to do VPN with your on premise network

      Reply
  14. LKP Avatar
    LKP

    Hi stat, Have you had solution ? I haven’t find yet :(

    Reply
  15. Isaac Avatar
    Isaac

    Hi
    Just noticed this post is word for word with http://XXXXX
    Clearly yours was posted first. Really sad to see people copy others work.

    Keep up the good work

    Reply
  16. hassan Avatar
    hassan

    In the name of God
    I hope good luck
    I had a question
    How do I setup my domain vpn in Windows Server 2008
    What do settings in Windows 7
    Thanks

    Reply
  17. erik Avatar
    erik

    VPN works as expected but to secure the server I want to change the network profile from public to private but this can’t be done on Windows Server 2012??? Do you have an answer?

    Reply
  18. erik Avatar
    erik

    The answer is: Force the private network profile by setting the local security policy under network lists manager rules for RAS (Dial In) Interface properties -> networkaddress -> location type -> from unconfigured to private

    Reply
  19. van Avatar
    van

    hi thanx for the tut i like your header can i save it

    Reply
  20. Warren Avatar
    Warren

    Is it possible to Manage Hyper-V Free with Windows 2012 Essentials? I know that there is no Hyper-V in Essentials, but can you manage with it? Great website you have here! Have a great week!

    Reply
  21. JEWEL AHMMED Avatar
    JEWEL AHMMED

    I configure VPN successfully, But when I connect with my VPN, I can not browse Internet. What can i do?

    Reply
  22. xenon Avatar
    xenon

    Browse the Internet not works. How I can change it?

    Reply
    1. Thomas Maurer Avatar
      Thomas Maurer

      I think this is a DNS or Routing Problem

      Reply
  23. Adam Avatar
    Adam

    Jewel,

    On the Network you are connecting to, is it part of a domain or workgroup? On the client side computer in the properties you need to make sure you have the correct DNS settings to use. If it is using a DNS server in the domain put the correct DNS server in on the client computer vpn connection.

    Under Advanced in the TCP/IP v4 settings you can uncheck the box to use the remote gateway. This will allow you to use the gateway of the local network you are on for the internet.

    Reply
  24. Chen Avatar
    Chen

    Now if this is a standalone server which has only a single Public IP address, add a secondary IP address to the server network interface which is in the same subnet as the IP address pool.
    ——————————————–
    Hello , my server is a standalone and single public ip address,
    How can I add a secondary IP address to the server network interface ?
    Would you please help ,thank you

    Reply
    1. Thomas Maurer Avatar
      Thomas Maurer

      Well on the NIC configuration in the advanced configuration you can add other IP addresses

      Reply
  25. Rene Avatar
    Rene

    Any ideas on how to do a site to site VPN?

    Reply
  26. Nick Gaulin Avatar
    Nick Gaulin

    UDP 1701, not TCP bro…

    Reply
  27. John Avatar
    John

    Did you really try did? PPTP doesn’t work on Azure no matter how you configure. GRE 47 isn’t available. Users can’t modify that option, I guess.

    Reply
    1. Thomas Maurer Avatar
      Thomas Maurer

      This was not a VM running in Windows Azure, the VM was running on another hoster. I don’t think this will work in Windows Azure

      Reply
  28. Fahad Avatar
    Fahad

    I have configured the VPN server on WIN2012 as per the above guide . . but when we dial it from client machine following error generates. . Error806: the connection between your computer and VPN server couldn’t completed because VPN server is not configured to allowe GRE packet. Please help

    Reply
  29. Dan Avatar
    Dan

    wOot! I’ve been working on this on and off for a few weeks, probably have close to 5 hours of troubleshooting how to get my clients to connect to server shares over a vpn client. I had missed the last step; adding the IP address to the server’s single NIC to match the subnet IP from my static IP pool! Thanks so much for this information.

    Reply
  30. David Avatar
    David

    Okay. I followed this guide and I can connect to the server, but not all the time. I can connect over my Verizon phone (HTC Windows Phone 8) using the “Internet sharing” without any issues – which I could not do with when using the Cisco VPN Client. I was able to connect using a WiFi connection at an office about 45 miles from the server location – not that the distance matters much, but just for reference. I am not sure how to determine why sometimes I can connect, but other times I cannot. I am a software developer by trade, but this is my first stab at setting up my own server – which mostly hosts VMs for different development environments. The server has multiple NICs – one is outward facing with a WAN static IP address and the other is inward facing with a LAN static IP address. The server is a monster resource wise (Dual 8-core Intel Xeon Processors, 128 GB of memory, and a 500 GB SSD), so that should not be an issue. Anything you can recommend to assist me with debugging would be extremely helpful. I thought that once I got a successful connection, I should be able to connect from then on, but from one location, I keep getting a 789 error and I cannot seem top locate any issues on the server.

    Reply
  31. David Avatar
    David

    I forgot to include this. I have configured both a PPTP connection and a L2TP connection – both of which have been previously successful. I used the PPTP connection earlier today over my Verizon Wireless MiFi, but I cannot seem to connect at all, either connection, from behind a Verizon FiOS WiFi connection.

    Reply
  32. Jerome Avatar
    Jerome

    hi JEWEL AHMMED can not browse internet ,you can do this
    vpn →property→network→double click tcp/ipv4→advanced→donet select the first one;

    Reply
  33. JASTY Avatar
    JASTY

    I followed the exact same steps and installed VPN on Windows 2012 Serer. I am trying to connect from Windows 7 to windows 2012 server on Amazon Cloud and getting the below error.
    Error 720: A connection to the remote computer could not be established. You might need to change the network settings for this connection.

    Any help is appreciated?

    Thanks

    Reply
  34. wyse Avatar
    wyse

    i i have set up the vpn on mine server 2012 in the office, now am trying to access it at home, it says error connecting to vpn .ERROR 800, what am i doing wrong

    Reply
  35. Devereaux Avatar
    Devereaux

    Thanks for the post Thomas. Is there a way to do this -install role “Remote Access” via Powershell?

    I tried numerous times to do so via Server manager and get a Failure – restart pending . However, nothing seems to be there. There is no update available or restart really pending. After restart and tried again it keeps failing. a DISM

    Reply
    1. Thomas Maurer Avatar
      Thomas Maurer

      you should be able to use PowerShell with the following command

      Install-WindowsFeature RemoteAccess -IncludeAllSubFeature -IncludeManagementTools

      Reply
  36. Antony Avatar
    Antony

    Hi all,

    I just tried to configure Vpn on window server2012 via teamviewer remoteacces,during the course of configuration, server ask me to “click here to configure dhcp server”,when I clicked it, Iit keep me waiting for a while, then the server suddenly shut down,so I can’t continue to configure, may I know what caused this happen? and this will affect my other applications data were installed on my server2012?thanks

    Reply
  37. Antony Avatar
    Antony

    I configurating Vpn under workgroup,just thinking There is any ip conflic possibilities if I setup a ip range .because there is no shop and ad setup the win server 2012, appreciate your suggestions, thanks
    Anthony

    Reply
  38. Ali Avatar
    Ali

    I configure VPN successfully, But when I connect with my VPN, I can not browse Internet. What can i do?

    Reply
  39. jimoh Avatar
    jimoh

    How can I install vpn on windows server 2012 with active directory.

    Reply
  40. jimoh Avatar
    jimoh

    How can I install vpn on windows server 2012 without active directory, I meant to say. Thanks

    Reply
  41. Ben Avatar
    Ben

    Is it possible to use the host’s gateway when you configure the VPN per this article?

    When you set up the static IP range as suggested above (e.g 192.168.1.100 – 192.168.1.200), it does not allow you to set a gateway address. If I connect to the VPN server, the VPN settings on the client show an address in the range, but the gateway address is blank. I want to be able to connect to the Internet via the host’s gateway. This is on a machine with a single NIC with a public IP address.

    Reply
  42. Luís Avatar
    Luís

    Hello, this worked for a server on my client with W2012 Foundation with fixed IP.

    Don’t know it it works on a server with Dynamic IP from ISP.

    For everyone:

    – open the specified ports on the ROUTER from your ISP
    – go to active directory and select the user you want to useon VPN access, choose properties, choose dial-in tab and check ALLOW ACCESS
    – and follow the rest of the tutorial. the points above were missing because for those who doesn’t understand very much of IT.
    – On the client VPN connection (from Miguel):

    1. Right-click the VPN connection and click Properties.
    2. Select the Security tab.
    3. Under Type of VPN: select Point to Point Tunneling Protocol (PPTP).
    4. Under Data encryption: select Optional encryption (connect even if no encryption).
    5. Make sure Allow these protocols is selected
    6. Check mark Microsoft CHAP Version 2 (MS-CHAP v2).

    – when asking for login use your domain/user <—– this user must have DIAL-IN checked !!!

    Reply
  43. Daniel Avatar
    Daniel

    My server 2012 is behind a cisco router which works as our dhcp server and connect all user to internet.
    Can i setup VPN on server 2012 in this type of senerio pls help, how can i achieve this.

    Reply
  44. Rusty Avatar
    Rusty

    Hi,

    I was following your guide but some of the images around steps 8&9 are missing so I just left things default.
    The wizard finished successfully but then I was kicked off the RDP session and have been unable to log back in since. I cannot even ping the server in question.
    Since it’s an AD server I can’t even just log in remotely – I’m going to have to reboot etc. to see what’s up but do you have any hints?

    Reply
  45. Inamul Avatar
    Inamul

    Dear Thomas,

    Thanks for the sharing the same for us and it has great helped us.

    Now I have installed and configure VPN on my server, and I need to use this network from outsite the office LAN (i.e home and another network), can you please help me out We have a cyberoam (CR50ING) firwall available and we are unable to findout the way.

    Please help us, your help will be appreciate.

    Reply
  46. Martijn Avatar
    Martijn

    Hi there!

    Is it possible to elaborate on this step?

    “Now if this is a standalone server which has only a single Public IP address, add a secondary IP address to the server network interface which is in the same subnet as the IP address pool.”

    I have that situation (not using DHCP, static IP addresses and single public IP address) and am able to connect through VPN, but the client then doesn’t have any internet access. ipconfig gives me this on the client:

    IP Address. . . . . . . . . . . . : 192.168.16.16
    Subnet Mask . . . . . . . . . . . : 255.255.255.255
    Default Gateway . . . . . . . . . : 192.168.16.16

    Which is a bit weird to have gateway and IP address the same if you ask me. So please elaborate on that step.

    Thanks

    Reply
  47. Jon Avatar
    Jon

    Thank you!

    Reply
  48. Paul Dennis Avatar
    Paul Dennis

    I have the same issue as Martijn I cannot get internet access out. In control panel the dial in connect has no intenrnet access. I have same routing table issues the gate wau and ip address of the client are the same. The client is 192.168.1.8

    Destination,Network mask,Gateway,Interface,Metric,Protocol
    0.0.0.0,0.0.0.0,94.46.223.65,Ethernet,261,Network management
    94.46.223.64,255.255.255.252,0.0.0.0,Ethernet,261,Local
    94.46.223.66,255.255.255.255,0.0.0.0,Ethernet,261,Local
    94.46.223.67,255.255.255.255,0.0.0.0,Ethernet,261,Local
    127.0.0.0,255.0.0.0,127.0.0.1,Loopback,51,Local
    127.0.0.1,255.255.255.255,127.0.0.1,Loopback,306,Local
    192.168.1.0,255.255.255.0,0.0.0.0,Ethernet,261,Local
    192.168.1.3,255.255.255.255,0.0.0.0,Ethernet,261,Local
    192.168.1.7,255.255.255.255,0.0.0.0,Internal,286,Local
    192.168.1.8,255.255.255.255,192.168.1.8,Internal,31,Network management
    192.168.1.255,255.255.255.255,0.0.0.0,Ethernet,261,Local
    224.0.0.0,240.0.0.0,0.0.0.0,Internal,286,Local
    255.255.255.255,255.255.255.255,0.0.0.0,Internal,286,Local

    Reply
  49. numan Avatar
    numan

    hi I have done everything but when I try to connect my client from home router it do not connect with office server the connection shows “WAN miniport SSTP”. but when I connect same router that is connected with my server mean office router then it works fine.

    Reply
  50. robert Avatar
    robert

    Doesn’t work, followed all steps, it just throws stupid errors that mean nothing like ” the local comp0uter aborted the connection” or ” the selected authentication doesn’t work”

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.