How to Configure a Site-to-Site VPN Interface in RRAS
Applies to: Windows Server 2019, 2022 and 2025.
A demand-dial interface can connect two routed networks through an authenticated tunnel. Both sides need non-overlapping prefixes and reciprocal routes.
Network changes can immediately interrupt management access. Maintain console access, export the current configuration and use approved test addresses. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Document local and remote prefixes.
- Choose IKEv2 or another supported secure protocol.
- Exchange public endpoints and certificate requirements.
- Confirm no subnet overlap.
Procedure
Step 1: Install RRAS routing and VPN
Add role services on both gateways.
Install-WindowsFeature RemoteAccess,Routing,DirectAccess-VPN -IncludeManagementToolsStep 2: Enable custom configuration
In RRAS select VPN access and LAN routing.
Step 3: Create demand-dial interface
Use the wizard, set remote public endpoint and select the approved VPN protocol.
Step 4: Configure authentication
Use certificates or securely managed credentials according to policy.
Step 5: Add static routes
Associate every remote prefix with the demand-dial interface.
Step 6: Mirror the configuration
Create reciprocal settings on the peer gateway.
Verification
Bring up the interface and test hosts across each routed subnet.
Get-NetRoute -AddressFamily IPv4
Test-NetConnection 198.51.100.20 -Port 443
tracert 198.51.100.20Rollback
Disable the demand-dial interface, remove its routes and restore firewall rules on both peers.
Security and operational notes
Site-to-site VPN provides transport protection; application authentication and host firewalls remain required.
