HOW TO INSTALL AND CONFIGURE PPTP VPN IN WINDOWS SERVER 2019

WHAT IS VPN?

A virtual private network extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network

VPN stands for “Virtual Private Network” and describes the opportunity to establish a protected network connection when using public networks. VPNs encrypt your internet traffic and disguise your online identity. This makes it more difficult for third parties to track your activities online and steal data. The encryption takes place in real time.

How does a VPN work?

A VPN hides your IP address by letting the network redirect it through a specially configured remote server run by a VPN host. This means that if you surf online with a VPN, the VPN server becomes the source of your data. This means your Internet Service Provider (ISP) and other third parties cannot see which websites you visit or what data you send and receive online. A VPN works like a filter that turns all your data into “gibberish”. Even if someone were to get their hands on your data, it would be useless.

What are the benefits of a VPN connection?

A VPN connection disguises your data traffic online and protects it from external access. Unencrypted data can be viewed by anyone who has network access and wants to see it. With a VPN, hackers and cyber criminals can’t decipher this data.

Secure encryption: To read the data, you need an encryption key . Without one, it would take millions of years for a computer to decipher the code in the event of a brute force attack . With the help of a VPN, your online activities are hidden even on public networks.

Disguising your whereabouts : VPN servers essentially act as your proxies on the internet. Because the demographic location data comes from a server in another country, your actual location cannot be determined. In addition, most VPN services do not store logs of your activities. Some providers, on the other hand, record your behavior, but do not pass this information on to third parties. This means that any potential record of your user behavior remains permanently hidden.

Access to regional content: Regional web content is not always accessible from everywhere. Services and websites often contain content that can only be accessed from certain parts of the world. Standard connections use local servers in the country to determine your location. This means that you cannot access content at home while traveling, and you cannot access international content from home. With VPN location spoofing , you can switch to a server to another country and effectively “change” your location.

Secure data transfer: If you work remotely, you may need to access important files on your company’s network. For security reasons, this kind of information requires a secure connection. To gain access to the network, a VPN connection is often required. VPN services connect to private servers and use encryption methods to reduce the risk of data leakage.

Why should you use a VPN connection?

Your ISP usually sets up your connection when you connect to the internet. It tracks you via an IP address. Your network traffic is routed through your ISP’s servers, which can log and display everything you do online.

Your ISP may seem trustworthy, but it may share your browsing history with advertisers, the police or government, and/or other third parties. ISPs can also fall victim to attacks by cyber criminals: If they are hacked, your personal and private data can be compromised.

This is especially important if you regularly connect to public Wi-Fi networks. You never know who might be monitoring your internet traffic and what they might steal from you, including passwords, personal data, payment information, or even your entire identity.

What should a good VPN do?

You should rely on your VPN to perform one or more tasks. The VPN itself should also be protected against compromise. These are the features you should expect from a comprehensive VPN solution:

  • Encryption of your IP address: The primary job of a VPN is to hide your IP address from your ISP and other third parties. This allows you to send and receive information online without the risk of anyone but you and the VPN provider seeing it.
  • Encryption of protocols: A VPN should also prevent you from leaving traces, for example, in the form of your internet history, search history and cookies. The encryption of cookies is especially important because it prevents third parties from gaining access to confidential information such as personal data, financial information and other content on websites.
  • Kill switch: If your VPN connection is suddenly interrupted, your secure connection will also be interrupted. A good VPN can detect this sudden downtime and terminate preselected programs, reducing the likelihood that data is compromised.
  • Two-factor authentication: By using a variety of authentication methods, a strong VPN checks everyone who tries to log in. For example, you might be prompted to enter a password, after which a code is sent to your mobile device. This makes it difficult for uninvited third parties to access your secure connection

What Is PPTP?

PPTP stands for Point-to-Point Tunneling Protocol, and it’s a VPN Protocol that was introduced back in 1995, though it was in development ten years prior to that date. PPTP improved on the previous PPP standard which lacked the tunneling feature. What started out as a protocol implement in Windows systems quickly became a widespread VPN protocol available on numerous platforms.

Being a VPN protocol, PPTP is a set of rules that’s responsible for ensuring the VPN CLIENT — VPN SERVER communication process is handled properly.

Here’s How PPTP Works

Basically, the PPTP client establishes a connection (also called a “tunnel”) to the PPTP server through it transports all your online data and traffic, securing it with its encryption at the same time.

That’s the simpler explanation. If you want a more complex definition, you should know that PPTP encapsulates network data and puts into an IP envelope. From then on, every time a router or any other device will encounter that data, it will treat it as an IP packet. Once the data is received by the PPTP server, it’s forwarded to the web or the destination device.

The PPTP tunnel is established by communicating with the peer on TCP port 1723. That connection is then used to establish and manage the encapsulating tunnel to the same peer. Also, at both ends of the PPTP encryption tunnel, the protocol will authenticate the data packets which are transferred.

General Technical Details About PPTP

  • In order to establish a connection to a server, PPTP only needs the server address, and a username alongside a password.
  • A PPTP connection is very cross-platform compatible. The protocol works on Windows, Linux, macOS, iOS, Android, Tomato, DD-WRT, and other operating systems and devices.
  • PPTP uses GRE (General Routing Encapsulation), TCP port 1723, and IP port 47.
  • PPTP supports encryption keys up to 128-bits, and it uses MPPE (Microsoft Point-to-Point Encryption).

Tunneling Types Supported by PPTP

  • Voluntary Tunneling – This type of tunneling is initiated by the client, so no ISP or bridge support is required.
  • Compulsory Tunneling – Since this type of tunneling is initiated by the PPTP server, router and network access server support is necessary.

WHAT IS WINDOWS SERVER 2019

Windows Server 2019 is the ninth version of the Windows Server operating system by Microsoft, as part of the Windows NT family of operating systems. It is the second version of the server operating system based on the Windows 10 platform, after Windows Server 2016

Configuring Point to Pointing Tunneling Virtual Private Network on a Windows Server 2019 is straightforward. We can use this method of deploying a VPN where the Secure Socket Layer type of VPN is not possible. In this method of configuring VPN, we need to open the port 1723 and enable a feature called Generic Routing Encapsulation (GRE) on the edge firewall or router under security settings. I am going to explain the step by step and cover the entire setup process from install and configure Remote Access Role to configure Client device to connect the network where we have installed the PPTP VPN.

So, let get to the server and start the Remote Access Role installation and subsequently look at configuring VPN policy on the Network Policy Server on the Windows Server 2019. If you are ready to take a configuration task, we are here, to begin with, so let us get started.

  • Add Remote Access Server Role
  • Configure Remote Access with VPN Access
  • Configure Remote Access Settings for VPN
  • Configure Dian-in connection on the user object
  • Configure Dial-in policy on Network Policy Server
  • Crete VPN network connection on Windows 10 device
  • Connect VPN Server over the Internet

Add Remote Access Server Role

The first step in deploying a VPN server is Adding the Remote Access Server Role on the server—the remote access server role to be installed by going to the Server Manager Dashboard. Once the Server Manager windows would open, click on the Add Roles and Features, and the ‘Add Roles and Features’ wizard would start, and we can go through this wizard to complete the Remote Access role installation.

A screenshot of a social media post

Description automatically generated

The wizard will start with instructions on using this tool to add the roles and features. If you don’t want to see this page, you can click the checkbox next to ‘Skip this page by default,’ and you won’t be prompted with this page anymore.

A screenshot of a social media post

Description automatically generated

In this wizard, we are going to use the role-based installation to add this role, so select Role-based or Feature-based Installation to begin with and click Next to continue.

A screenshot of a cell phone

Description automatically generated

Make sure the local server in the server pool and select it and click Next.

A screenshot of a social media post

Description automatically generated

In the Select Server Role page, select Remote Access checkbox, and click Nex

A screenshot of a social media post

Description automatically generated

On the next page, leave the Features as it is and click Next.

A screenshot of a social media post

Description automatically generated

If you need more details, you may go through the details about remote access on this page, and once you are ready to move, click Nex

A screenshot of a cell phone

Description automatically generated

This step is significant, select the Direct Access and VPN (RAS) alone, and you would be prompted with related features on the pop-up and click Add Features, which will return to select the role services page.

A screenshot of a social media post

Description automatically generated

i

We have selected the roles services and its feature, and we are right to move to continue, click Next.

A screenshot of a cell phone

Description automatically generated

The next page is an information page, and it describes that adding this role service also install the Web Server (IIS) role, Click Next to continue.

A screenshot of a cell phone

Description automatically generated

The Web Server (IIS) role will install this role services, leave the default selection, and click Next.

A screenshot of a social media post

Description automatically generated

On the confirmation page, verify that the Roles mentioned above and Role Services correct and click Install to start the Remote Access role installation. Sit back and relax for a few minutes to get the installation to complete.

A screenshot of a social media post

Description automatically generated

The Remote Access role installation started. Let wait till the installation complete, and then we start the configuration.

A screenshot of a cell phone

Description automatically generated

You would notice the installation succeeded message and there is a link to open the getting started wizard to start the configuration of the Remote Access Role, click the link.

A screenshot of a cell phone

Description automatically generated

Clicking the link will start Configure Remote Access Wizard, on the wizard click Deploy VPN only tab as in the screen below.

Configure Remote Access with VPN Access

A screenshot of a social media post

Description automatically generated

On the Configure Remote Access prompt select the Deploy VPN Only to define the Remote Access multiple configuration methods.

The Routing and Remote Access management console will be opened and right-click on the server node and click ‘Configure and Enable Routing and Remote Access.’

A screenshot of a social media post

Description automatically generated

The Routing and Remote Access Server Setup Wizard will start with a Welcome Screen, Click Next to begin the wizard.

A screenshot of a cell phone

Description automatically generated

Select the Radio button next to Custom Configuration and click Next.

A screenshot of a social media post

Description automatically generated

On the Custom Configuration page, select the checkbox next to VPN Access and click Next.

A screenshot of a cell phone

Description automatically generated

The VPN Access configuration selected on the wizard, and that is the end of the wizard and click Finish.

A screenshot of a cell phone

Description automatically generated

Click OK to the warning message that the Remote Access Configuration couldn’t open the required port. We will open the port on the Windows Firewall manually.

A screenshot of a cell phone

Description automatically generated

As we have configured Routing and Remote Access services with VPN Access and the wizard will end by prompting to start service.

A screenshot of a cell phone

Description automatically generated

Once the Routing and Remote Access Service Started, you will see a green arrow on the server node implying that the service started and running.

Configure Remote Access Settings for VPN

There are specific settings we need to update to set the VPN to function securely and get the IP4 IPs to the client system.

Right-click the server node and click properties as in the screen belowf

A screenshot of a social media post

Description automatically generated

On the Remote Access, Server Properties go to the IPV4 tab and Select the Static Address pool radio button under IPv4 Assignment and click add to add IP address pool. Choose an IP address Pool and type start and end IP address of the pool. The IPV4 address pool is a static one, and if you are running the DHCP server on the server, you can leave the IP address to assign from the DHCP server. As we are not running a DHCP service, we are creating a static address pool in this example.

A screenshot of a cell phone

Description automatically generated

Choose IP address pool and type start and end IP address on the Add dialog box. We have chosen 172.16.1.1 to 172.16.1.10 range to assign the IP addresses to the VPN clients.

A screenshot of a cell phone

Description automatically generated

Click OK once the IP address properly typed.

A screenshot of a cell phone

Description automatically generated
HOW TO SETUP VPN USING PPTP

Configure VPN Policy on Network Policy Server

Open the Server Manager window and on the Tools menu select Network Policy Server to begin with configuring VPN Policy

A screenshot of a cell phone

Description automatically generated

Expand the Network Policy Server and select New to create a new policy for VPN access.

28 2

On the New Network Policy Window type VPN Access as Policy Name and in the drop-down list of typer of network access server select Remote Access Server (VPN-Dial Up) and Click Next.

29 2

On the Specify Condition page, select Windows Group and Click Add.

30 1

I have already created an Active Directory group called “vpngroup” for this purpose, and we are going to add that group. Please note that we are adding all users who need VPN access to this group.

HOW TO SETUP VPN USING PPTP
31 1

Once we confirmed the group added, click Next to continue.

32 1

As we are granting access to this AD Group users, we are selecting Access Granted and Clicking Next.

33 1

On the Configure Access methods, select Add and Microsoft Secure Password (EAP-MSCHAP v2 as Extensible Authentication Protocol on the list of authentication methods.

Also, uncheck the boxes near Less Secure Authentication methods.

HOW TO SETUP VPN USING PPTP
34

Once the Authentication method has been selected, click Next.

How to Setup VPN using PPTP

On the Configure Constraints page, leave the defaults and click Next

How to Setup VPN using PPTP

Also, Configure Settings page leave the default and click Next.

How to Setup VPN using PPTP

Click Finish to end the wizard.

How to Setup VPN using PPTP

Create a Windows Firewall rule to open port PPTP VPN

Go to Control Panel>System and Security>Windows Defender Firewall and click Advanced settings.

How to Setup VPN using PPTP

Select Inbound Rule from the left navigation and New Rule on the Actions Menu

How to Setup VPN using PPTP

How to Setup VPN using PPTP
HOW TO SETUP VPN USING PPTP

The PPTP port number is 1723, Select Rule “Apply to TCP” and Specific local ports 1723 and, click Next.

How to Setup VPN using PPTP

Select Allow Connections and click Next.

How to Setup VPN using PPTP

Select all the Network Locations and click Next.

How to Setup VPN using PPTP

Type a name for the Rule and Click Finish

How to Setup VPN using PPTP

Create VPN Network Connection

So, we have completed all server configurations, now is the time to create a VPN connection on the Windows 10 client computer.

Right-click network Icon on the taskbar and select ‘Open Network & Connection Sharing.’ On settings, windows click ‘Network and Sharing Center’ that will open the ‘Network and Sharing Center’ where we need to select ‘Set up a New Connection or Network’ as in the steps provided on the screenshot below.

HOW TO SETUP VPN USING PPTP

Select the steps as in the steps below.

  1. Open Network & Internet Sharing
  2. Network Sharing Center
  3. Set up a New Connection or network
How to Setup VPN using PPTP

There is a Wizard start, and in the connection options, select ‘Connect to a workplace’ and click Next.

How to Setup VPN using PPTP

In the destination name type, a name implies the connection purpose. I left the default name in this example.

Leave the selection of ‘Remember my credentials’ and click create.

  1. Type the VPN server’s internet hostname or IP address.
  2. Give a name to the VPN Connection.
  3. Click Create to create a workplace connect.
How to Setup VPN using PPTP

To change the type of VPN, right-click newly created Network Connection and select properties.

How to Setup VPN using PPTP

On the Security tab, select Point to Point Tunneling Protocol (PPTP) and click OK.

How to Setup VPN using PPTP
HOW TO SETUP VPN USING PPTP

Click Network icon on the taskbar and the newly created VPN connection will appear on the list of connections, click that, and there will be a credentials box open.

How to Setup VPN using PPTP

On the Sign-in prompt type, the AD user and password and click OK.

How to Setup VPN using PPTP

The VPN connection will show connected. Now we can access the internal devices on the office network using their private IP address.

How to Setup VPN using PPTP

Conclusion

In this article, we have gone through step by step instructions on how to 1. Install and configure Remote Access VPN role 2.  Network Policy Server VPN policy 3. Creating windows firewall rule and 4. Making a VPN Connection on the Windows client system and connected to Office network remotely using PPTP. Also, we have one more step to that on the router or Firewall device connecting to the internet we need to add a port forwarding rule to point the VPN server connecting port 1723. On the security settings on the firewall, we need to enable Generic Routing Encapsulation to connect the VPN from remote windows client to the VPN Server that we just configured.

You may have some questions or feedback to share with me, please click the comments below and share your thoughts. I am so happy to answer your questions.Tags:

Related Post

Leave a Reply

Your email address will not be published.