> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-configure-a-remote-access-vpn.md).
# How to Configure a Remote Access VPN Connection
A remote access VPN creates an encrypted tunnel between the server and the user's device over the Internet.
In this guide, you enable the VPN on the network, create the users, and configure the connection on a Windows computer.
> #### 👍 What you get
>
> A working L2TP/IPsec VPN with its users, and a Windows client configured to connect securely without losing Internet access.
> #### 📘 NAT limitation: one connection at a time
>
> Behind NAT, L2TP only allows one simultaneous connection per port it uses: a second user trying to connect through that same port will be rejected.
>
> If you need multiple connections from the same private network, set up [WireGuard](/docs-en/productos/servers/how-to/how-to-configure-wireguard-for-multiple-vpn-connections.md) instead.
### Before you begin
* Sign in to the Plenit platform with an active organization.
* Have a **Servers** or **Remote Desktop** subscription to enable the VPN on the network.
* Have access to the Windows computer from which you will connect.
### Step 1. Enable the VPN on the network
1. Go into the **Servers** subscription from its card.
2. In the side menu, open **VPN** and go to the subsection **Remote Access**.
3. Select the network you will use and change its status from **OFF** to **ON**.
With the network enabled, locate the two details you will need on the client:
* **Pre-Shared Key**: the shared key. You can see it with the eye icon in the *Pre-Shared Key*.
* **Public IP**: the address to which the VPN connection is established.
### Step 2. Create the remote access users
Click **New User**, enter the username and password with its confirmation, and click **OK**. The user is enabled for the *L2TP over IPsec*VPN type. Repeat for each person who will connect.
.png?alt=media\&token=501e50ae-0b08-477e-b6a4-3232d437dbd3)
> #### 📘 Two levels of authentication
>
> The **Pre-Shared Key** authenticates the network (it is common to the connection); the **username and password** authenticate each person. You need both on the client.
### Step 3. Configure the VPN on the Windows computer
In **Settings → Network & Internet → VPN**, click **Add a VPN connection** and fill out the form:
| Field | Value |
| ---------------------- | ------------------------------------------ |
| VPN provider | `Windows (built-in)` |
| Connection name | An identifying name |
| Server name or address | The **Public IP** from Step 1 |
| VPN type | `L2TP/IPsec with pre-shared key` |
| Pre-shared key | The **Pre-Shared Key** from Step 1 |
| Username | The user from Step 2 (for example `user1`) |
| Password | That user's password |
Click **Save**.
#### Adjust routing so you don't lose Internet
In L2TP, Windows sends by default **all** traffic through the VPN, so the computer may be left without Internet.
To avoid this, open **Control Panel → Network and Internet → Network and Sharing Center → Change adapter settings**. On the VPN, right click → **Properties**.
In **Networking**, choose your stack (IPv4 or IPv6), click **Properties → Advanced options** and **uncheck** *Use default gateway on remote network*. Accept.
#### Adjust security
In **Properties → Security**, set **Data encryption** to *Require encryption (disconnect if server declines)*, keep **Microsoft CHAP Version 2** enabled, and accept.
.png?alt=media\&token=57fa0b64-9fe5-450d-a29a-8bf5566310ef)
#### PowerShell alternative
If you're going to configure several computers, you can skip the entire GUI by creating the connection and split tunneling all at once. From PowerShell as administrator:
```powershell
# Create the L2TP/IPsec connection with the Pre-Shared Key
Add-VpnConnection -Name "Plenit VPN" -ServerAddress `
-TunnelType L2tp -L2tpPsk "" `
-AuthenticationMethod MSChapv2 -EncryptionLevel Required -Force -RememberCredential
# Equivalent to unchecking "use default gateway": you don't lose Internet
Set-VpnConnection -Name "Plenit VPN" -SplitTunneling $true
```
### Validate the connection
Connect the VPN from network settings. If it is established, the computer accesses the server's services securely. To check it from the command line:
```powershell
Get-VpnConnection -Name "Plenit VPN"
rasdial "Plenit VPN"
```
### If something doesn't match
| Symptom | Likely cause | What to do |
| ------------------------------------------- | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| The computer loses Internet when connecting | The default gateway is still active | Disable it (or use `Set-VpnConnection -SplitTunneling $true`) |
| A second user fails to connect after NAT | L2TP allows one connection per port | Use [WireGuard](/docs-en/productos/servers/how-to/how-to-configure-wireguard-for-multiple-vpn-connections.md) for multiple users |
| Authentication fails | Incorrect username, password, or Pre-Shared Key | Check the credentials from Step 2 and the PSK from Step 1 |
### Conclusion
With this, your users access the server through an encrypted tunnel from their Windows. Two details make the difference between it working or causing trouble: disable the default gateway so you don't lose Internet, and remember that L2TP behind NAT is one user per port. If that limit is tight, WireGuard is the way to go for multiple simultaneous connections.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-configure-a-remote-access-vpn.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media&token=102a7e40-2aa7-44e9-84ba-061bead1d2fc)