> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-configure-a-remote-access-vpn.md). # How to Configure a Remote Access VPN Connection A remote access VPN creates an encrypted tunnel between the server and the user's device over the Internet. In this guide, you enable the VPN on the network, register users, and configure the connection on a Windows computer. > #### ๐Ÿ‘ What you get > > A working L2TP/IPsec VPN with its users, and a Windows client configured to connect securely without losing Internet access. > #### ๐Ÿ“˜ NAT limit: one connection at a time > > Behind NAT, L2TP only supports one simultaneous connection per port it uses: a second user who tries to connect through that same port will be rejected. > > If you need multiple connections from the same private network, set up [WireGuard](/docs-en/productos/servers/how-to/how-to-configure-wireguard-for-multiple-vpn-connections.md) instead. ### Before you start * Sign in to the Plenit platform with an active organization. * Have a subscription to **Servers** or **Remote Desktop** to enable the VPN on the network. * Have access to the Windows computer from which you will connect. ### Step 1. Enable the VPN on the network 1. Open the subscription to **Servers** from its card. 2. In the side menu, open **VPN** and go to the subsection **Remote Access**. 3. Select the network you are going to use and change its status from **OFF** to **ON**. With the network enabled, find the two details you will need on the client: * **Pre-Shared Key**: the shared key. You can see it with the eye icon in the column *Pre-Shared Key*. * **Public IP**: the address against which the VPN connection is established. {/\* ๐Ÿ“ธ CAPTURE 1 ยท Remote Access subsection with the network ON, the Pre-Shared Key, and the public IP \*/} ![Enabling the remote access VPN with the Pre-Shared Key and the public IP](https://REEMPLAZA-URL/servidores-howto-vpn-remoto-01.png) ### Step 2. Create the remote access users Click **New User**, enter the username and password with its confirmation, and click **Accept**. The user is enabled for the *L2TP over IPsec*VPN type. Repeat for each person who will connect. {/\* ๐Ÿ“ธ CAPTURE 2 ยท creating a remote access user \*/} ![Creating a VPN remote access user](https://REEMPLAZA-URL/servidores-howto-vpn-remoto-02.png) > #### ๐Ÿ“˜ Two levels of authentication > > The **Pre-Shared Key** authenticates the network (it is shared by the connection); the **username and password** authenticate each person. You need both in the client. ### Step 3. Configure the VPN on the Windows computer In **Settings โ†’ Network & Internet โ†’ VPN**, click **Add a VPN connection** and fill in the form: | Field | Value | | ---------------------- | ------------------------------------------ | | VPN provider | `Windows (built-in)` | | Connection name | An identifying name | | Server name or address | The **Public IP** from Step 1 | | VPN type | `L2TP/IPsec with pre-shared key` | | Pre-shared key | The **Pre-Shared Key** from Step 1 | | User name | The user from Step 2 (for example `user1`) | | Password | That user's password | Click **Save**. #### Adjust routing so you don't lose Internet In L2TP, Windows sends **all** traffic through the VPN by default, so the computer may be left without Internet. To avoid this, open **Control Panel โ†’ Network and Internet โ†’ Network and Sharing Center โ†’ Change adapter settings**. On the VPN, right-click โ†’ **Properties**. In **Networking**, choose your stack (IPv4 or IPv6), click **Properties โ†’ Advanced settings** and **disable** *Use default gateway on remote network*. Accept. #### Adjust security In **Properties โ†’ Security**, set **Data encryption** to *Require encryption (disconnect if server declines)*, keep **Microsoft CHAP version 2** enabled, and accept. {/\* ๐Ÿ“ธ CAPTURE 3 ยท default gateway option disabled and security settings \*/} ![Routing and security settings for the VPN connection in Windows](https://REEMPLAZA-URL/servidores-howto-vpn-remoto-03.png) #### PowerShell alternative If you're going to configure several computers, you can skip the entire GUI by creating the connection and split tunneling all at once. From PowerShell as administrator: ```powershell # Create the L2TP/IPsec connection with the Pre-Shared Key Add-VpnConnection -Name "Plenit VPN" -ServerAddress ` -TunnelType L2tp -L2tpPsk "" ` -AuthenticationMethod MSChapv2 -EncryptionLevel Required -Force -RememberCredential # Equivalent to disabling "use default gateway": you don't lose Internet Set-VpnConnection -Name "Plenit VPN" -SplitTunneling $true ``` ### Validate the connection Connect the VPN from network settings. If it connects, the computer accesses the server's services securely. To check it from the terminal: ```powershell Get-VpnConnection -Name "Plenit VPN" rasdial "Plenit VPN" ``` ### If something doesn't match | Symptom | Likely cause | What to do | | ------------------------------------------- | ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | The computer loses Internet when connecting | The default gateway is still active | Disable it (or use `Set-VpnConnection -SplitTunneling $true`) | | A second user can't connect behind NAT | L2TP supports one connection per port | Use [WireGuard](/docs-en/productos/servers/how-to/how-to-configure-wireguard-for-multiple-vpn-connections.md) for multiple users | | Authentication fails | Incorrect username, password, or Pre-Shared Key | Check the Step 2 credentials and the PSK from Step 1 | ### Conclusion With this, your users connect to the server through an encrypted tunnel from their Windows device. Two details make the difference between it working or causing trouble: disable the default gateway so you don't lose Internet, and remember that L2TP behind NAT is one user per port. If that limit is too tight for you, WireGuard is the way to go for multiple simultaneous connections. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-configure-a-remote-access-vpn.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.