How to Configure a Secure IKEv2 Remote Access VPN with RRAS
Applies to: Windows Server 2019, 2022 and 2025.
IKEv2 offers certificate-based encrypted remote access and supports mobility better than legacy PPTP. Certificate, DNS and firewall preparation are essential.
Network changes can immediately interrupt management access. Maintain console access, export the current configuration and use approved test addresses. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Deploy a trusted server certificate matching the public VPN name.
- Publish UDP 500 and 4500 through the edge firewall.
- Define VPN address allocation and DNS.
- Configure NPS or approved authentication policy.
Procedure
Step 1: Install VPN role services
Add Remote Access and VPN tools.
Install-WindowsFeature RemoteAccess,DirectAccess-VPN -IncludeManagementToolsStep 2: Configure RRAS
Use the RRAS wizard for VPN access and select the correct external interface.
Step 3: Choose address allocation
Use a dedicated static pool or DHCP design that does not overlap existing subnets.
Step 4: Bind the certificate
In RRAS security properties choose the approved certificate for IKEv2/SSTP as appropriate.
Step 5: Restrict protocols
Disable PPTP and any protocol not required by the client design.
Step 6: Test a standard client
Validate authentication, routes, DNS and access policy.
Verification
Check RemoteAccess service, active ports and RRAS events.
Get-Service RemoteAccess
Get-NetUDPEndpoint | Where LocalPort -In 500,4500
Get-WinEvent -LogName System -MaxEvents 100 | Where ProviderName -Match 'RemoteAccess|Ras'Rollback
Disable new VPN ports and restore the former RRAS configuration from console. Revoke test certificates when issued only for the failed deployment.
Security and operational notes
Use individual identities and MFA where the chosen identity platform supports it. A VPN does not make an unmanaged endpoint trusted.
