> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers-2/how-to/how-to-configure-a-remote-access-vpn.md).

# How to Configure a Remote Access VPN Connection

A remote access VPN creates an encrypted tunnel between the server and the user's device over the Internet.

In this guide, you enable the VPN on the network, register the users, and configure the connection on a Windows computer.

> #### 👍 What you get
>
> A working L2TP/IPsec VPN with its users, and a Windows client configured to connect securely without losing Internet access.

> #### 📘 NAT limit: one connection at a time
>
> Behind NAT, L2TP only supports one simultaneous connection per port it uses: a second user who tries to connect through that same port will be rejected. 
>
> If you need multiple connections from the same private network, set up [WireGuard](/docs-en/productos/servers/how-to/how-to-configure-wireguard-for-multiple-vpn-connections.md) instead.

### Before you start

* Sign in to the Plenit platform with an active organization.
* Have a **Servers** or **Remote Desktop** to enable the VPN on the network.
* Have access to the Windows computer you are going to connect from.

### Step 1. Enable the VPN on the network

1. Go to the subscription of **Servers** from its card.
2. In the side menu, open **VPN** and go to the subsection **Remote Access**.
3. Select the network you are going to use and change its status from **OFF** to **ON**.

With the network enabled, locate the two details you will need in the client:

* **Pre-Shared Key**: the shared key. You can see it with the eye icon in the column *Pre-Shared Key*.
* **public IP**: the address the VPN connection is established against.

{/\* 📸 CAPTURE 1 · Remote Access subsection with the network ON, the Pre-Shared Key and the public IP \*/}

![Remote access VPN enabled with the Pre-Shared Key and the public IP](https://REEMPLAZA-URL/servidores-howto-vpn-remoto-01.png)

### Step 2. Create the remote access users

Click **New User**, enter the username and password with its confirmation, and click **Accept**. The user is enabled for the *L2TP over IPsec*. Repeat for each person who will connect.

{/\* 📸 CAPTURE 2 · creation of a remote access user \*/}

![VPN remote access user creation](https://REEMPLAZA-URL/servidores-howto-vpn-remoto-02.png)

> #### 📘 Two levels of authentication
>
> The **Pre-Shared Key** authenticates the network (it is common to the connection); the **username and password** authenticate each person. You need both on the client.

### Step 3. Configure the VPN on the Windows computer

In **Settings → Network & Internet → VPN**, click **Add a VPN connection** and fill out the form:

| Field                  | Value                                      |
| ---------------------- | ------------------------------------------ |
| VPN provider           | `Windows (built-in)`                       |
| Connection name        | A descriptive name                         |
| Server name or address | The **public IP** from Step 1              |
| VPN type               | `L2TP/IPsec with pre-shared key`           |
| Pre-shared key         | The **Pre-Shared Key** from Step 1         |
| Username               | The user from Step 2 (for example `user1`) |
| Password               | That user's password                       |

Click **Save**.

#### Adjust routing so you don't lose Internet

In L2TP, Windows sends by default **all** traffic through the VPN, so the computer may be left without Internet access.

To avoid this, open **Control Panel → Network and Internet → Network and Sharing Center → Change adapter settings**. On the VPN, right-click → **Properties**.

In **Networking tab**, choose your stack (IPv4 or IPv6), click **Properties → Advanced options** and **disable** *Use default gateway on remote network*. Accept.

#### Adjust security

In **Properties → Security**, set **Data encryption** to *Require encryption (disconnect if server does not accept)*, keep **Microsoft CHAP version 2** enabled, and accept.

{/\* 📸 CAPTURE 3 · default gateway option disabled and security settings \*/}

![Routing and security adjustment for the VPN connection in Windows](https://REEMPLAZA-URL/servidores-howto-vpn-remoto-03.png)

#### PowerShell alternative

If you are going to configure several computers, you can skip the entire GUI by creating the connection and split tunneling all at once. From PowerShell as administrator:

```powershell
# Create the L2TP/IPsec connection with the Pre-Shared Key
Add-VpnConnection -Name "Plenit VPN" -ServerAddress <PUBLIC-IP> `
  -TunnelType L2tp -L2tpPsk "<PRE-SHARED-KEY>" `
  -AuthenticationMethod MSChapv2 -EncryptionLevel Required -Force -RememberCredential

# Equivalent to disabling "use default gateway": you don't lose Internet
Set-VpnConnection -Name "Plenit VPN" -SplitTunneling $true
```

### Validate the connection

Connect the VPN from network settings. If it is established, the computer accesses the server's services securely. To check it from the terminal:

```powershell
Get-VpnConnection -Name "Plenit VPN"
rasdial "Plenit VPN" <user> <password>
```

### If something does not fit

| Symptom                                     | Likely cause                                    | What to do                                                                                                                       |
| ------------------------------------------- | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| The computer loses Internet when connecting | The default gateway is still active             | Disable it (or use `Set-VpnConnection -SplitTunneling $true`)                                                                    |
| A second user cannot connect after NAT      | L2TP supports one connection per port           | Use [WireGuard](/docs-en/productos/servers/how-to/how-to-configure-wireguard-for-multiple-vpn-connections.md) for multiple users |
| Authentication fails                        | Incorrect username, password, or Pre-Shared Key | Check the credentials from Step 2 and the PSK from Step 1                                                                        |

### Conclusion

With this, your users access the server through an encrypted tunnel from their Windows computer. Two details make the difference between it working or becoming a headache: disabling the default gateway so you don't lose Internet access, and remembering that L2TP behind NAT is one user per port. If that limit is too tight, WireGuard is the way to go for multiple connections at once.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.plenit.com/docs-en/productos/servers-2/how-to/how-to-configure-a-remote-access-vpn.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.