Windows Server 2016 - Setup SSTP OR IKEV2 VPN ON Server

[@davespin9034]

Awesome video. Saved my butt. Curious, seems you left out granting access via network policy server. ? Did you not need it because of the tick in AD under dialup?

[@kevinruijter7943]

Many thanks! Video helped me out a lot to get everything set up. I'm still kind of confused on how to set it up when you use a different server for RCA than you use for VPN but it worked out. Keep it up! Many thanks!

[@TheApens]

I've followed the 2 video's and read most of the comments. Did I understand it correctly that this guide does NOT cover installing a VPN to use to work from home and VPN into the office network, so that the employee can then RDP to their own PC and work on their PC in the office?

[@glaucoroschel4755]

Hi, I need to generate a CA to be able to add it on OpenVPN server and after that, the users can connect through the OpenVPN client using their username and password from the Domain Controller in a safe way (encrypted) by 636 port LDPAS. How Can I setup a correct certificate for that? If I follow this video it will work for OpenVPN server?

[@Windows10NinjaWorld]

Yes these certificates should work but much easier to use openssl.

[@mikestreksgaming5890]

Well I got SSTP to work, but when I try IKEv2 (which is what we want to be on) does not connect. It says "IKE failed to find valid machine certificate. Contact your Network Security Administrator about installing a valid certificate in the appropriate Certificate Store." Let's just say researching this issue shall be ongoing for me.

[@Windows10NinjaWorld]

This often happens when CA is not setup correctly or the IP or domain is not 100% - usually just going over everything from start works... Also, when CA is on DC there could be problems. Please see other comments in our 3 certificate/VPN videos for similar matters.

[@mikestreksgaming5890]

Windows Ninja Thanks for the reply! I’ll go take a look.

[@albertogsm4330]

Thank you very much for your eplanation. I just followed every step of both your videos. And when I try to connect from windows 10 (with SSTP) it gives me the next message: "Connetion cannot be stablished. The destination denied especifically the connection" If i set PPTP it works perfectly" If I try to set IKEv2 it gives me the net message: "Type of certificate not valid" Any idea about the issue? Thank you very much again!!

[@Windows10NinjaWorld]

This has been covered in previous comments... But I have had such too... Generally a full removal of such certificates from CA and VPN server and a carefull redo again ensuring 100% of each step - esp. server name and ip address!

[@albertogsm4330]

@@Windows10NinjaWorld Thanks for your quick response. What do you mean with server name and ip address? I followed all your steps perfectly, and the only thing I couldn't do was downloading the certificate from the server beeing outside of the office. I am at home and I typed the external IP address of my office but I couldnt reach it. I had to stablish a PPTP vpn to be able to download the certificate as you showed us. Which ports should be opened in the office router? Should I make any exception in my bitdefender firewall on server? I watched your video about PKVIEW and CRTUTIL and my cercificate is working fine.

[@Windows10NinjaWorld]

Ahh! Without the certificate on the client computer you will get such!

[@albertogsm4330]

@@Windows10NinjaWorld I must explained myself bad, because I was able to get the certificate via PPTP and afer I installed it in my client computer. It doesn't work either. My CA is working perfectly as I proved before. It must be somthing with ports or any other issue....May you please give me any clue?

[@albertogsm4330]

@@Windows10NinjaWorld I JUST OPENED THE PORT 443 IN MY ROUTER AND NOW IT THE ERROR IS DIFFERENT: "The CN name of the certificate is not the same that the value passed through" Any clue?

[@alg3898]

Following your instructions exactly (both videos), but the SSTP VPN always returns "error 0x80072afc: The requested name is valid, but no data of the requested type was found." Trying to switch the configurations to work for IKEv2 always returns "error 868: the remote connection was not made because the name of the remote access server did not resolve." Where did I go wrong? I suspect I need to further configure the DNS, but I've no idea what I can or should do. Currently running tests on a lone DC within a company network. All firewall settings are allowing traffic over TCP port 443.

[@Martin-ot7xj]

Hi there, please make a tutorial video about how to install and configure sstp VPN server 2019 in a Non-Domain Environment. install in standalone windows server 2019 (workgroup ) thnx

[@Windows10NinjaWorld]

should try when have some free time!

[@vyjhala]

will you hellp me ? i follow your steps configure vpn sucessfully in window server 2016 on aws also i able to connect from client side but issue is after connection establsihed showing there is no internet connectivity in vpn adapter status as well as in my adpater how to solve this isssue @Windows Ninja

[@whizpez]

Almost had a stroke when that ORANGE coloured windows menu popped up at 1:46

[@jiml07]

I got to the point where I was ready to download the certificate, but then I got stuck. I have IIS inatalled, but don't see the certificate location.

[@CaptianYan]

The certificate downloaded from the server only included the public key right? How did it work? Since we will need a PKCS12 certificate with private key for IKEv2? And, how did you make the client be able to connect to the Internet without using splitting tunnel? Only chose the NAT option? It is not working for me.

[@Windows10NinjaWorld]

Yes the key is not exported. All we did was what you saw in the video. To access over the internet in the previous video you would add you public ip and public domain name to the certificate. The rest is just allowing your router and any external firewall to not block and/or forward to the vpn server.

[@CaptianYan]

Thanks for response. Now, the SSTP works for me. But when I changed to IKEv2, it will show that "invalid certificate type". Do you know how to solve this? I followed you step by step from previous video.

[@Windows10NinjaWorld]

good to hear you are almost there. You might want to generate another client ans server certificate, change the VPN server for the new certificate and try. If not tell me the full error message. Also for internet firewall see blogs.technet.microsoft.com/rrasblog/2006/06/14/which-ports-to-unblock-for-vpn-traffic-to-pass-through/ you need to unblock/forward those ports.

[@Windows10NinjaWorld]

On the vpn server for IKEv2 did you tick use certificate?

[@CaptianYan]

LOL, I also have that page in my bookmark. It was tested in my local network for now. So the router's firewall will not affect it. I have made it work. Actually, I need to use the server's ip address as common name since I did not have a local DNS server. This step is really important when using IKEv2. It really requires that the server name or address is exactly same as certificate common name. In this step, my step is different from your tutorial. Also, I need to export the key with private key together installed in Client side. Otherwise, I could get 13801 error. "The trusted root for the certificate is not present on the client." technet.microsoft.com/en-us/library/dd941612(v=ws.10).aspx Now, everything is working and I change some parameters and make it available to access from outside network. It works on both windows and Macbook now. I need to modify the profile in Apple Configurator 2 to make IOS work too... I found that the whole process is simple but you really need to take care of the details... It is really annoying... In addition, I found that IKEv1 and IKEv2 are both much faster than L2TP over IPSec and openVPN in Raspberry Pi 2. Raspberry Pi 2 may be lack of performance. But I have tested L2TP over IPSec in MacOS server with i5 4278U and Windows Server 2016 with i7 4700MQ. They have same result which can reach 30Mbps of total download 100Mbps when doing speedtest.net. But IKEv1 with CiscoASA 5510, IKEv2 with WIndows Server 2016 can reach 80-90 Mbps of total download 100Mbps. OpenVPN with Raspberry Pi 2 only can reach 20 Mbps of total download 100Mbps. Is it a common result?

[@siclesleon]

I don't have a domain controller in my server. Do you really need one for the CA templates?

[@Windows10NinjaWorld]

A DC gives a domain name for your system and you would probably add DNS etc to help CA and OCSP etc... you can try without but you would lose many features.

[@gabriellami2685]

I can connect through PPTP but not SSTP I get "The certificate's CN name does not match the passed value" Why?

[@Windows10NinjaWorld]

are you connecting by ip address or domain? you need to have those details in the certificate. This is part of 3 videos.

[@AymanSartawi]

Hello, SSTP worked fine but without internet access and IKEv2 is showing the following error "IKE authentication credentials are unacceptable" Thanks

[@Windows10NinjaWorld]

Great that some progress is made. Such issues happen when the OCSP or VPN or certificate has an issue. This matter has been covered before. Please see our 3 CA videos and previous comments.

[@Windows10NinjaWorld]

Check VPN server to see that internet access is enabled for clients. Also think about firewalls, network policy restrictions etc if this is a long running business server.

[@ARMAGEDDON787]

Hi, i dont have "Certificate Template" under "Certifiation Authority (local) in MMC !! can you help me ?

[@Windows10NinjaWorld]

Have you followed the previous tutorial for this?

[@ARMAGEDDON787]

@@Windows10NinjaWorld sorry i didn't see previous tutorial, now i have a new problem: "Policy Match Error" when i want to connect to vpn with Ikev2 !

[@Windows10NinjaWorld]

@@ARMAGEDDON787 there are 3 tutorials for this to do on a lan using internal ips. If the certificate is not correctly configured then the client will have difficulty over the higher grade vpn links. I would suggest redoing it 100% as the videos or even a small change will cause problems.

[@ARMAGEDDON787]

@@Windows10NinjaWorld i will try again, thank you.

[@vinstavinsta6321]

Hi, great videos! I have followed your steps from your creating the cert to setting up the SSTP VPN. I however cannot seem to connect . Its giving me the error of : The certificates CN name does not match the passed value. Can you help please. And maybe could help further via skype call maybe?

[@Windows10NinjaWorld]

Unfortunately I do not do Skype - sorry! Some issues to look for: 1. is it the Domain Controller that you did the certificates on or another domain JOINED server? If the controller you get cert mismatches. 2. Did you put the CN as IP address and another CN as your servers FQDN also? 3. DO you have a network policy service setup - you would need to configure this as this shall block connections. 4 As one user before look at their comments also in the past just do the certificate creations again and setup the VPN server to use the new certificate. 5. Are you connecting from outside the LAN - could cause name resolution issues etc. 6. Is the CA certificate installed on the workstation?

[@vinstavinsta6321]

Windows Ninja wow so many questions! Hmmm making me think. Ok i want to rebuild from scratch. Let me tell you my setup. I have a hp proliant server with 16gb ram installed and 1tb hdd. On that i have a esxi 6.5 server. On that i have (or will) build (or rebuild) 4 VMs all running winsvr2016 ( all with 4gb ram and 250gb hdd each) 1 vm for DC (AD, DNS, DHCP)(dc.vinsta.vinsta) 1 vm for file server (fs.vinsta.vinsta) 1 vm for cert auth server (ca.vinsta.vinsta) and finally 1 vm for vpn (vpn.vinsta.vinsta). Is this a good starting point to follow your videos. Can you advise on my setup?

[@Windows10NinjaWorld]

Well first point is that you are having 4 VM each on 4GB - 4 x 4 = 16 GB so, not much left for the base system that controls the VM - yes it will "steal" back a bit automatically. But just on those you system would be slow. Personally I would add the AD to the host - speeds up things and file servers etc I prefer to run on the host as in VM world they would run very slowly - unless you told me you had 256 GB rack servers etc! Why do you have two VPN guests as servers - just put the CA and VPN server on the same - this might be the issue as the VPN server might be having issues getting the CA server etc - maybe not registered etc. A simpler solution: Host = AD + DHCP + DNS + file server running Server 2016 and 1 guest = VPN and CA in VMware workstation. A much faster setup with only 4GB taken by the one VM guest and the remaining 12 for the memory and disk intensive roles. By having the VPN and CA on same server all should be recognized and work. If you want to stick with ESXI VMWare bare metal host - do the four above in one guest and then VPN and CA in another. Having one CA on one VM is more secure but does consume resources and unless properly connected you VPN guest server would have issues regarding getting certs etc. I hope the above makes sense - bottom line it is just one server with 16GB - splitting this into tiny chunks means you have 4 servers stealing the very limited computer resources and for what gain? Is it for security? If yes, then there are better solutions e.g. get another server box with 8GB and use that as the CA server etc. You have all 4 on the same box - if your CA is compromised the chances are that all other systems would be too!

[@vinstavinsta6321]

Windows Ninja wow thanks for the swift reply!!! Hmmm you have again given me alot to think about. This is my own hp box i have which i am using for testing purposes. Reason im testing is because a client of mine wants this solution so im just practicing. Later on in terms of bare metal or direct svr 2016 or 2 boxes wont really matter as my client has a proper enterprise setup. Client wants to use ESXi 6.5 so we will have to stick with that instead of putting svr2016 direct on the hp box. So how about this for my specific setup after your notes. Hp proliant bare metal svr (16GB Ram + 1TB HDD) ESXI 6.5 on that. 1 SVR2016 VM as a DC,AD,DNS,DHCP @ 6GB ram (dc.vinsta.vinsta) 1 SVR2016 VM as VPN/CA @ 6GB (Vpnca.vinsta.vinsta) 1 SVR2016 VM as File SVR @ 3GB (Fs.vinsta.vinsta) (1GB ram left to run ESXI should be more than enough) Would that be okay for me to start your solution??

[@Windows10NinjaWorld]

I also noticed that you domain naming system is obviously an internal LAN type vinsta.vinsta - yes this can work... but you would need the CA server to be AD joined with forest vinsta.vinsta and CA server name something like CA.vinsta.vinsta and AD joined and certs registered in your AD. Then VPN server AD joined and when setup it sees such certs when the VPN is setup and the correct cert is used. You may have issues at the time of workstations tying to connect as they would need the CA root cert installed - maybe a manual install would be better on the workstaion computer trying to connect. I can see a million issues and troubleshooting till next year - my simple solution below is clean and nice. You could also save money by just using hyper-v for the VM guests and install Server on the hardware as native!

[@MoonWalkCTO]

No certificate templates without a Domain Controller - this way will not work with a stand-alone server

[@Windows10NinjaWorld]

If you follow the previous videos you should see the setup.