sodcalculator

10 Tech How-To

VPN Server Setup on Windows 11: Step-by-Step

Guide 10-9066 · Updated · Step by step

This guide walks you through setting up a VPN server on Windows 11, turning your PC into a secure gateway for remote access to your home network. You’ll be able to connect from a laptop or phone and browse as if you were sitting at home, with your traffic encrypted. Before starting, make sure you have administrator rights on the PC, a static IP address (or a dynamic DNS hostname), and access to your router’s settings for port forwarding.

What You’ll Need

  • A Windows 11 PC that will stay on and connected to the internet (the server).
  • Administrator account on that PC.
  • Router access to forward a port (usually 1723 for PPTP, or 443 for SSTP).
  • A static internal IP for the server (or a DHCP reservation).
  • A public IP address or a dynamic DNS hostname (like from No-IP or DuckDNS) if your ISP assigns dynamic IPs.
  • Optional: a domain certificate if you plan to use SSTP with a custom name.

Step-by-Step

  1. Open Windows Settings. Press Win + I, then go to Network & Internet > VPN.
  2. Add a VPN connection. Click Add VPN, choose Windows (built-in) as the VPN provider, give it a name (e.g., “Home VPN”), and set the server address to your public IP or dynamic DNS hostname. Leave the other fields blank for now.
  3. Enable the routing feature. This is the key step that turns your PC into a server. Open an elevated PowerShell (right-click Start > Windows Terminal (Admin)). Run the following command: 
    Set-VpnServerConfiguration -RoutingMode 1

    This enables the VPN server routing feature that’s hidden in the GUI.

  4. Create a user account for VPN access. Go to Settings > Accounts > Other users > Add account. Choose Sign in without a Microsoft account (if prompted), then Local account. Create a username and a strong password. This account will be used to connect to the VPN.
  5. Allow the user to connect via VPN. Open Computer Management (right-click Start > Computer Management). Go to Local Users and Groups > Groups > Network Configuration Operators. Add your new user to this group. Also add them to the Remote Desktop Users group if you want them to access the desktop.
  6. Configure the VPN server. Still in PowerShell (Admin), run: 
    Set-VpnServerConfiguration -AuthenticationType 1

    This sets authentication to user name and password. You can also set the IP pool:

    Set-VpnServerConfiguration -IPPoolStart 192.168.1.200 -IPPoolEnd 192.168.1.210

    (Adjust the range to your local subnet.)

  7. Start the VPN service. Run: 
    Start-Service -Name 'RasMan'

    And set it to start automatically:

    Set-Service -Name 'RasMan' -StartupType Automatic
  8. Open the firewall port. Windows Firewall should have already created rules, but verify. Run: 
    Get-NetFirewallRule -DisplayGroup 'Routing and Remote Access' | Enable-NetFirewallRule

    If you don’t see a rule for port 1723, add one manually:

    New-NetFirewallRule -DisplayName 'VPN Server' -Direction Inbound -Protocol TCP -LocalPort 1723 -Action Allow
  9. Forward the port on your router. Log into your router’s admin page (usually at 192.168.1.1 or 192.168.0.1). Find Port Forwarding or Virtual Server. Create a rule: external port 1723, internal port 1723, protocol TCP, and the internal IP address of your Windows 11 PC. Save and apply.
  10. Test the VPN connection. From another device (e.g., your phone on cellular data), create a new VPN connection using the same settings: server address = your public IP or DDNS hostname, type = PPTP (or SSTP if you set that up), username and password of the local account you created. Connect and try to access a network resource like a shared folder or the router’s admin page.

Common Mistakes

  • Forgetting to enable routing. Without the PowerShell command, the VPN server won’t route traffic; it will connect but you’ll have no internet access.
  • Using a Microsoft account for VPN login. The VPN server expects a local account; using a Microsoft account often fails.
  • Not forwarding the correct protocol. PPTP uses TCP, not UDP. Some routers mistakenly forward UDP only.
  • ISP blocking port 1723. Many ISPs block this port. If you can’t connect externally, try SSTP on port 443 (which is usually open).
  • Not setting a static IP. If your server’s IP changes, the port forward breaks. Always set a DHCP reservation or static IP.

Tips

  • Use SSTP instead of PPTP. PPTP is old and insecure. SSTP uses SSL (port 443) and is more likely to pass through firewalls. To enable SSTP, you need a certificate; you can use a self-signed one for testing, but for production, get a free certificate from Let’s Encrypt or a paid one.
  • Set up dynamic DNS. If your public IP changes, a DDNS hostname (like yourname.ddns.net) will always point to your current IP. Most routers have built-in DDNS clients.
  • Use a strong password. Your VPN is exposed to the internet; a weak password invites brute-force attacks.
  • Keep Windows updated. Security patches are vital for a server exposed to the internet.
  • Consider a dedicated VPN appliance. For better performance and security, a Raspberry Pi or a router with OpenVPN might be easier, but Windows 11 works fine for light use.

Troubleshooting

  • VPN connects but no internet access. Check that routing is enabled (re-run the Set-VpnServerConfiguration -RoutingMode 1 command). Also check the IP pool range – it must be on the same subnet as your LAN, but not conflicting with existing DHCP addresses.
  • Cannot connect from outside. Verify the port is open by using an online port checker. If it’s closed, check your router’s port forwarding, and also check if your ISP blocks it. Try changing the external port to something like 443 and use SSTP.
  • Error 806 or 628. This usually means the VPN server is not reachable. Double-check the server address, port forwarding, and that the RasMan service is running.
  • Authentication failed. Ensure you’re using a local account, not a Microsoft account. Also check that the user is in the Network Configuration Operators group.
  • VPN works on LAN but not WAN. This is a classic sign that port forwarding is misconfigured. Check that the internal IP is correct and that the router’s firewall isn’t blocking the port.
  • Slow performance. PPTP is inefficient. Switch to SSTP or L2TP/IPsec for better throughput. Also check your upload speed – it limits VPN speed.

Frequently Asked Questions

Is PPTP secure enough for personal use?

PPTP is deprecated and has known vulnerabilities. It’s better than nothing, but for any sensitive data, use SSTP or L2TP/IPsec. Windows 11 supports both.

Can I use a free dynamic DNS service?

Yes, services like No-IP, DuckDNS, and Dynu offer free tiers. You’ll need to update the IP periodically; many routers have built-in clients that do this automatically.

Do I need a static IP from my ISP?

Not necessarily. A dynamic IP works if you use a DDNS hostname. However, a static IP is more reliable and avoids the need for DDNS updates.

Can I connect from a phone?

Yes, both Android and iOS have built-in VPN clients that support PPTP and L2TP/IPsec (though iOS removed PPTP). For SSTP, you’ll need a third-party app.

Will the VPN work if the PC is in sleep mode?

No. The server must be awake and connected to the internet. Configure power settings to prevent sleep, or use Wake-on-LAN if you need to wake it remotely.

How many devices can connect simultaneously?

Windows 11’s built-in VPN server supports up to 256 concurrent connections, but practical limits are lower due to bandwidth and hardware. For a home setup, 5-10 devices is fine.

Related

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →