SSTP Client - Secure Socket Tunneling Protocol

SSTP (Secure Socket Tunneling Protocol) is a VPN protocol that transports PPP traffic over an SSL/TLS channel. SSTP uses TCP port 443 by default, which lets it pass through most firewalls and proxy servers that usually block other VPN protocols.

Introduction to SSTP

What is SSTP?

SSTP is a proprietary Microsoft protocol that:

Encapsulates PPP traffic inside an SSL/TLS connection
Uses TCP port 443 (the standard HTTPS port)
Provides transport-level security
Supports key negotiation and encryption
Verifies traffic integrity
Passes easily through firewalls and NAT

SSTP Architecture

Components:

SSTP Client - initiates the connection (VyOS router)
SSTP Server - accepts the connection (Windows Server, VyOS, others)
SSL/TLS layer - provides encryption
PPP layer - the transport protocol
HTTP/HTTPS - the underlying transport

Connection establishment stages:

TCP handshake on port 443
TLS handshake - establishing the SSL session
HTTP negotiation - SSTP protocol negotiation
PPP session - establishing the PPP connection
Authentication - PAP/CHAP/MS-CHAP
IP configuration - obtaining an IP address

Advantages of SSTP

Bypassing restrictions:

Uses port 443 (HTTPS) - not blocked by firewalls
Passes through HTTP proxies
Works through NAT with no extra configuration
Looks like ordinary HTTPS traffic

Security:

SSL/TLS encryption (AES-256)
Certificate-based authentication
Protection against MITM attacks
Data integrity verification

Use cases:

Remote access through restrictive firewalls
Corporate networks with strict policies
Public Wi-Fi networks that block VPNs
Backup VPN channel (always available)

When to use SSTP?

Recommended for:

Connecting from networks with restrictive firewalls
Public Wi-Fi that blocks VPN ports
Corporate networks with a port allowlist
Backup channel when IPsec/OpenVPN/WireGuard are blocked
Compatibility with Windows Server SSTP

Use cases:

Remote access VPN for employees
Site-to-Site VPN through restrictive ISPs
Bypassing censorship and DPI (Deep Packet Inspection)
Backup VPN channel

SSTP Client Configuration

Basic setup

configure

# Create the SSTP interface
set interfaces sstpc sstpc0 server 'vpn.example.com'
set interfaces sstpc sstpc0 authentication username 'myuser'
set interfaces sstpc sstpc0 authentication password 'SecretPassword123'

# SSL certificate verification (disable if self-signed)
set interfaces sstpc sstpc0 ssl ca-certificate 'VPN-CA'

# Automatic default route
set interfaces sstpc sstpc0 default-route auto

commit
save

Result:

SSTP connection to vpn.example.com:443
Automatic IP address assignment from the server
Default route through the SSTP tunnel
SSL/TLS encryption

Configuration parameters

Server

# Server FQDN
set interfaces sstpc sstpc0 server 'vpn.company.com'

# Server IP address
set interfaces sstpc sstpc0 server '203.0.113.10'

# Server with a non-standard port (if not 443)
# SSTP always uses port 443; changing it is not supported

Important: The server must be reachable by FQDN or IP on TCP port 443.

Authentication

# Username and password
set interfaces sstpc sstpc0 authentication username 'user@domain.com'
set interfaces sstpc sstpc0 authentication password 'MyPassword'

Authentication types:

PAP (Password Authentication Protocol) - not recommended
CHAP (Challenge Handshake Authentication Protocol)
MS-CHAP v2 (Microsoft CHAP) - recommended for Windows Server

VyOS automatically negotiates the method with the server.

SSL Certificate

# CA certificate to verify the server
set interfaces sstpc sstpc0 ssl ca-certificate 'VPN-CA'

# For a self-signed certificate, verification can be skipped
# (not recommended in production)
# Simply do not specify ca-certificate

Importing the CA certificate:

# Load the CA cert onto VyOS
configure
set pki ca VPN-CA certificate 'MIIDXTCCAkWgAwIBAgIJ...'
commit

Or load a file:

# Copy the file to VyOS
scp ca.crt vyos@router:/tmp/

# Import it
vyos@router# configure
vyos@router# load /config/auth/ca.crt

Default Route

# Automatically add a default route through SSTP
set interfaces sstpc sstpc0 default-route auto

# Explicitly force the default route
set interfaces sstpc sstpc0 default-route force

# Do not add a default route (split-tunnel)
set interfaces sstpc sstpc0 no-default-route

# Default route with a metric
set interfaces sstpc sstpc0 default-route-distance 10

Options:

auto - add the route if SSTP is the only connection
force - always add the route
no-default-route - do not add the route (split-tunnel)

MTU

# MTU (Maximum Transmission Unit)
set interfaces sstpc sstpc0 mtu 1452

MTU recommendations:

Ethernet MTU: 1500 bytes
SSTP overhead: ~48 bytes (PPP + SSL/TLS + TCP + IP headers)
Recommended MTU: 1452 bytes
For low-speed links: 1400 bytes

TCP MSS clamping:

# Set TCP MSS to prevent fragmentation
set interfaces sstpc sstpc0 ip adjust-mss 1412
set interfaces sstpc sstpc0 ipv6 adjust-mss 1392

DNS Configuration

# Receive DNS from the SSTP server (default)
# (automatically via PPP negotiation)

# Do not use DNS from the server
set interfaces sstpc sstpc0 no-peer-dns

VRF Support

# Place the SSTP interface in a VRF
set interfaces sstpc sstpc0 vrf MANAGEMENT

Use case: Isolating management traffic through a dedicated VPN.

Interface Description

# Add a description
set interfaces sstpc sstpc0 description 'Corporate VPN - Main Link'

IP Configuration

# Automatic IP assignment from the server (default)
# (via PPP negotiation)

# Static IP (if the server requires it)
# SSTP usually uses dynamic IP assignment

Disable Interface

# Temporarily disable the interface
set interfaces sstpc sstpc0 disable

# Enable it again
delete interfaces sstpc sstpc0 disable
commit

Source Validation

# Configure source validation
set interfaces sstpc sstpc0 ip disable-forwarding
set interfaces sstpc sstpc0 ip source-validation strict
set interfaces sstpc sstpc0 ip source-validation loose
set interfaces sstpc sstpc0 ip source-validation disable

Practical scenarios

Scenario 1: Remote Access VPN through a restrictive firewall

Topology:

[User Laptop] ---- [Restrictive Firewall] ---- [Internet] ---- [SSTP Server]
                    (only port 443 allowed)

Goal: Connect to the corporate network from public Wi-Fi that blocks all ports except 80/443.

VyOS configuration:

configure

# SSTP interface
set interfaces sstpc sstpc0 server 'vpn.company.com'
set interfaces sstpc sstpc0 authentication username 'employee@company.com'
set interfaces sstpc sstpc0 authentication password 'StrongPassword!23'
set interfaces sstpc sstpc0 ssl ca-certificate 'COMPANY-CA'
set interfaces sstpc sstpc0 default-route auto
set interfaces sstpc sstpc0 mtu 1452
set interfaces sstpc sstpc0 description 'Corporate VPN'

# LAN interface (for clients behind VyOS)
set interfaces ethernet eth1 address 192.168.1.1/24

# NAT for the LAN through SSTP
set nat source rule 100 outbound-interface name sstpc0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

# DHCP for LAN clients
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option default-router 192.168.1.1

commit
save

Verification:

# SSTP interface status
show interfaces sstpc sstpc0

# Assigned IP address
show interfaces sstpc sstpc0 brief

# Default route
show ip route

# Connectivity test
ping 8.8.8.8 interface sstpc0

Scenario 2: Site-to-Site VPN over SSTP

Topology:

[Branch Office VyOS] ---- SSTP ---- [HQ SSTP Server]
 192.168.2.0/24                      192.168.1.0/24

Goal: Connect a branch office to headquarters over SSTP (the ISP blocks IPsec).

Branch Office configuration:

configure

# WAN interface
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'WAN - ISP'

# SSTP to headquarters
set interfaces sstpc sstpc0 server 'hq-vpn.company.com'
set interfaces sstpc sstpc0 authentication username 'branch-office-1'
set interfaces sstpc sstpc0 authentication password 'BranchPass123!'
set interfaces sstpc sstpc0 ssl ca-certificate 'HQ-VPN-CA'
set interfaces sstpc sstpc0 no-default-route
set interfaces sstpc sstpc0 mtu 1452
set interfaces sstpc sstpc0 description 'VPN to HQ'

# LAN interface
set interfaces ethernet eth1 address 192.168.2.1/24
set interfaces ethernet eth1 description 'Branch LAN'

# Static route to the HQ network through SSTP
# (assuming the SSTP server assigns 10.10.0.x addresses)
set protocols static route 192.168.1.0/24 interface sstpc0

# NAT for internet through WAN
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.2.0/24
set nat source rule 100 translation address masquerade

# DHCP for the LAN
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 range 0 start 192.168.2.100
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 range 0 stop 192.168.2.200
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 option default-router 192.168.2.1

# DNS forwarding
set service dns forwarding listen-address 192.168.2.1
set service dns forwarding allow-from 192.168.2.0/24

commit
save

Verification:

# SSTP connection
show interfaces sstpc sstpc0

# Routing table
show ip route

# Ping the HQ network
ping 192.168.1.1 source-address 192.168.2.1

Scenario 3: Dual VPN (SSTP + WireGuard Failover)

Topology:

                 ┌─ WireGuard (Primary, fast)
[VyOS Router] ───┤
                 └─ SSTP (Backup, always works)

Goal: The primary channel goes over WireGuard for performance, with SSTP as a backup in case of blocking.

Configuration:

configure

# Primary VPN: WireGuard
set interfaces wireguard wg0 address 10.10.0.1/30
set interfaces wireguard wg0 port 51820
set interfaces wireguard wg0 private-key 'WIREGUARD_PRIVATE_KEY'
set interfaces wireguard wg0 peer hq public-key 'HQ_PUBLIC_KEY'
set interfaces wireguard wg0 peer hq allowed-ips '10.10.0.2/32'
set interfaces wireguard wg0 peer hq allowed-ips '192.168.1.0/24'
set interfaces wireguard wg0 peer hq address 'vpn.company.com'
set interfaces wireguard wg0 peer hq port 51820
set interfaces wireguard wg0 description 'Primary VPN - WireGuard'

# Backup VPN: SSTP
set interfaces sstpc sstpc0 server 'vpn.company.com'
set interfaces sstpc sstpc0 authentication username 'backup-vpn@company.com'
set interfaces sstpc sstpc0 authentication password 'BackupVPN!Pass'
set interfaces sstpc sstpc0 ssl ca-certificate 'COMPANY-CA'
set interfaces sstpc sstpc0 no-default-route
set interfaces sstpc sstpc0 mtu 1452
set interfaces sstpc sstpc0 description 'Backup VPN - SSTP'

# Static routes with metrics
# WireGuard - lower distance (preferred)
set protocols static route 192.168.1.0/24 interface wg0
set protocols static route 192.168.1.0/24 interface wg0 distance 10

# SSTP - higher distance (backup)
set protocols static route 192.168.1.0/24 interface sstpc0
set protocols static route 192.168.1.0/24 interface sstpc0 distance 20

commit
save

Failover logic:

WireGuard is used by default (distance 10)
If WireGuard goes down, traffic automatically switches to SSTP (distance 20)
SSTP always works because it uses port 443

Verification:

# Routing table - there should be two routes
show ip route 192.168.1.0/24

# Check the active route
show ip route

# Simulate a failover
disconnect interface wg0

# Check the switch to SSTP
show ip route 192.168.1.0/24

Scenario 4: SSTP through an HTTP Proxy

Goal: Connect to the VPN through a corporate HTTP proxy.

Configuration:

configure

# SSTP supports an HTTP CONNECT proxy
# Proxy configuration in VyOS 1.4/1.5 may require additional settings

# Basic SSTP
set interfaces sstpc sstpc0 server 'vpn.company.com'
set interfaces sstpc sstpc0 authentication username 'user@company.com'
set interfaces sstpc sstpc0 authentication password 'Password123'
set interfaces sstpc sstpc0 ssl ca-certificate 'COMPANY-CA'

commit
save

Note: The VyOS SSTP client may not support an HTTP proxy directly. In that case use:

A direct connection (if available)
An SSH tunnel through the proxy with SSTP running over it
A different VPN protocol (OpenVPN with http-proxy)

Scenario 5: SSTP in Yandex Cloud

Goal: Connect a VyOS instance in Yandex Cloud to a corporate SSTP server.

Topology:

[VyOS in Yandex Cloud] ---- [Internet] ---- [Corporate SSTP Server]
   10.128.0.5/24                              vpn.company.ru

Configuration:

configure

# WAN interface (Yandex Cloud external IP)
set interfaces ethernet eth0 address 10.128.0.5/24
set interfaces ethernet eth0 description 'Yandex Cloud Network'

# SSTP to the corporate server
set interfaces sstpc sstpc0 server 'vpn.company.ru'
set interfaces sstpc sstpc0 authentication username 'cloud-vyos@company.ru'
set interfaces sstpc sstpc0 authentication password 'CloudVPN!2024'
set interfaces sstpc sstpc0 ssl ca-certificate 'CORP-CA'
set interfaces sstpc sstpc0 no-default-route
set interfaces sstpc sstpc0 mtu 1420
set interfaces sstpc sstpc0 description 'VPN to Corporate Network'

# Routes to corporate networks through SSTP
set protocols static route 192.168.0.0/16 interface sstpc0
set protocols static route 10.0.0.0/8 interface sstpc0

# Default route through the Yandex Cloud gateway
set protocols static route 0.0.0.0/0 next-hop 10.128.0.1

# Firewall for outbound SSTP
set firewall ipv4 name YANDEX-OUT default-action accept
set firewall ipv4 name YANDEX-OUT rule 100 action accept
set firewall ipv4 name YANDEX-OUT rule 100 destination port 443
set firewall ipv4 name YANDEX-OUT rule 100 protocol tcp

commit
save

Yandex Cloud specifics:

MTU in Yandex Cloud is 1500; use an SSTP MTU of 1420-1452
SSTP works through the Yandex Cloud NAT gateway
No additional security group rules are required for outbound port 443

Verification:

# SSTP status
show interfaces sstpc sstpc0

# Ping the corporate network
ping 192.168.1.1 interface sstpc0

# Traceroute
traceroute 192.168.1.1

Scenario 6: SSTP in VK Cloud

Goal: Connect a VyOS instance in VK Cloud to a VPN server.

Configuration:

configure

# WAN interface (VK Cloud private network)
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'VK Cloud Network'

# SSTP to the VPN server
set interfaces sstpc sstpc0 server 'vpn.example.ru'
set interfaces sstpc sstpc0 authentication username 'vkcloud-client'
set interfaces sstpc sstpc0 authentication password 'VKCloudVPN!123'
set interfaces sstpc sstpc0 ssl ca-certificate 'VPN-CA'
set interfaces sstpc sstpc0 default-route auto
set interfaces sstpc sstpc0 mtu 1450
set interfaces sstpc sstpc0 description 'VPN Connection'

# NAT for internal networks through SSTP
set interfaces ethernet eth1 address 192.168.100.1/24

set nat source rule 100 outbound-interface name sstpc0
set nat source rule 100 source address 192.168.100.0/24
set nat source rule 100 translation address masquerade

commit
save

VK Cloud specifics:

MTU in VK Cloud is 1500; use an SSTP MTU of 1450
SSTP works through VK Cloud NAT
Check the security groups for port 443

Scenario 7: Split-Tunnel SSTP

Goal: Route only corporate traffic through the VPN, with internet access going directly.

Configuration:

configure

# SSTP without a default route
set interfaces sstpc sstpc0 server 'vpn.company.com'
set interfaces sstpc sstpc0 authentication username 'user@company.com'
set interfaces sstpc sstpc0 authentication password 'Password123'
set interfaces sstpc sstpc0 ssl ca-certificate 'COMPANY-CA'
set interfaces sstpc sstpc0 no-default-route
set interfaces sstpc sstpc0 mtu 1452
set interfaces sstpc sstpc0 description 'Split-Tunnel VPN'

# Only corporate networks through SSTP
set protocols static route 192.168.0.0/16 interface sstpc0
set protocols static route 10.0.0.0/8 interface sstpc0

# Internet through WAN
set interfaces ethernet eth0 address dhcp

# Default route through WAN
set protocols static route 0.0.0.0/0 dhcp-interface eth0

# NAT for internet through WAN
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

commit
save

Split-tunnel advantages:

Internet traffic does not load the VPN
Faster for users
Less load on the VPN server

Monitoring and debugging

Checking SSTP status

# General information
show interfaces sstpc

# Detailed information for a specific interface
show interfaces sstpc sstpc0

# Brief output
show interfaces sstpc sstpc0 brief

# Statistics
show interfaces sstpc sstpc0 statistics

Example output:

sstpc0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1452
    inet 10.10.0.2 peer 10.10.0.1/32
    RX: bytes    packets  errors  dropped  overrun       mcast
        5242880    4096       0        0        0           0
    TX: bytes    packets  errors  dropped carrier collisions
        2621440    2048       0        0       0           0

Operational Commands

# Connect the SSTP session
connect interface sstpc0

# Disconnect the SSTP session
disconnect interface sstpc0

# Check SSTP log messages
show log | match sstpc

# Check the authentication log
show log auth | match sstpc

Debugging SSTP

# SSTP logs in real time
monitor log | match sstpc

# System logs
show log tail

# dmesg for kernel-level issues
show log kernel tail

Debug information includes:

TCP connection establishment
TLS handshake
HTTP negotiation
PPP LCP negotiation
Authentication attempts
IP address assignment

Packet Capture

# Capture SSTP traffic (TCP port 443)
monitor traffic interface eth0 filter "tcp port 443 and host vpn.company.com"

# Capture traffic on the SSTP interface
monitor traffic interface sstpc0

# Save the capture to a file
monitor traffic interface eth0 filter "tcp port 443" save /tmp/sstp-capture.pcap

Analysis in Wireshark:

TCP SYN/ACK (3-way handshake)
TLS Client/Server Hello
TLS Certificate Exchange
HTTP SSTP negotiation (after TLS)
Encrypted PPP frames (after SSTP is established)

Checking DNS

# DNS resolution for the server
nslookup vpn.company.com

# Ping the server
ping vpn.company.com

# Check port 443
telnet vpn.company.com 443

Performance monitoring

# Bandwidth monitoring
monitor bandwidth interface sstpc0

# Real-time traffic statistics
show interfaces sstpc sstpc0 statistics

# Connection uptime
show interfaces sstpc sstpc0 | grep "uptime"

Troubleshooting

Problem: SSTP does not establish a connection

Symptoms:

The interface is in the DOWN state
No IP address
Connection timeout

Diagnostics:

# 1. Check DNS resolution
nslookup vpn.company.com

# 2. Check connectivity to the server
ping vpn.company.com

# 3. Check port 443
telnet vpn.company.com 443

# 4. Check the SSTP logs
show log | match sstpc

# 5. Attempt to connect
connect interface sstpc0

# 6. Check the output
show log tail

Common causes:

Server unreachable:

# In the logs: "Connection refused" or "Timeout"
# Fix: check DNS, firewall, routing
ping vpn.company.com
traceroute vpn.company.com

Invalid credentials:

# In the logs: "authentication failed" or "Access denied"
# Fix: check the username/password
set interfaces sstpc sstpc0 authentication username 'correct-user'
set interfaces sstpc sstpc0 authentication password 'correct-pass'
commit

SSL certificate issues:

# In the logs: "certificate verification failed" or "SSL handshake failed"
# Fix: check the CA certificate

# Import the correct CA cert
set pki ca VPN-CA certificate 'MIID...'
set interfaces sstpc sstpc0 ssl ca-certificate 'VPN-CA'

# Or disable verification (for testing only)
delete interfaces sstpc sstpc0 ssl ca-certificate
commit

Firewall blocking port 443:

# Check the firewall
show firewall

# Allow outbound port 443
set firewall ipv4 name WAN-OUT rule 100 action accept
set firewall ipv4 name WAN-OUT rule 100 destination port 443
set firewall ipv4 name WAN-OUT rule 100 protocol tcp
commit

Problem: The connection establishes but there is no internet

Diagnostics:

# 1. Check the IP address
show interfaces sstpc sstpc0
# There should be an IP address from the server

# 2. Check the default route
show ip route 0.0.0.0/0
# It should point to sstpc0 (for full-tunnel)

# 3. Ping the SSTP server gateway
ping 10.10.0.1 interface sstpc0

# 4. Ping a public IP
ping 8.8.8.8 interface sstpc0

# 5. Check DNS
nslookup google.com

# 6. Check NAT (if used)
show nat source statistics

Solutions:

No default route:

set interfaces sstpc sstpc0 default-route force
commit

DNS not working:

# Use DNS from the server (default)
delete interfaces sstpc sstpc0 no-peer-dns

# Or public DNS
set system name-server 8.8.8.8
set system name-server 8.8.4.4
commit

NAT not configured (for LAN clients):

set nat source rule 100 outbound-interface name sstpc0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade
commit

Problem: Frequent disconnects/reconnects

Symptoms:

SSTP reconnects constantly
In the logs: “Connection lost” or “PPP terminated”

Diagnostics:

# 1. Check the uptime
show interfaces sstpc sstpc0 | grep uptime

# 2. Check the logs
show log | match "sstpc0"

# 3. Error statistics
show interfaces sstpc sstpc0 statistics

Causes and solutions:

Unstable internet connection:

# Check the WAN interface
show interfaces ethernet eth0 statistics

# Check for packet loss
ping 8.8.8.8 count 100

# Fix: resolve the WAN issues

MTU problems:

# Packets dropping due to MTU
# Fix: reduce the MTU
set interfaces sstpc sstpc0 mtu 1400
set interfaces sstpc sstpc0 ip adjust-mss 1360
commit

Server timeout:

# The SSTP server drops idle connections
# Fix: send keepalive traffic or check the server settings

SSL session timeout:

# TLS session expiring
# Fix: check the SSL settings on the server

Problem: Low speed

Diagnostics:

# 1. Bandwidth test with iperf3
# On the server
iperf3 -s

# On VyOS
iperf3 -c server-ip -i 1 -t 30

# 2. Check the MTU
ping 8.8.8.8 size 1452 do-not-fragment interface sstpc0

# 3. Check CPU usage
show system resources

# 4. Interface statistics
show interfaces sstpc sstpc0 statistics

Solutions:

MTU fragmentation:

# Path MTU Discovery
# Reduce the MTU
set interfaces sstpc sstpc0 mtu 1400
set interfaces sstpc sstpc0 ip adjust-mss 1360
commit

TCP over TCP problem:

# SSTP uses TCP (PPP over SSL over TCP)
# TCP-over-TCP can cause performance issues
# Fix: use a UDP-based VPN (WireGuard, OpenVPN UDP) for better performance

Server overload:

# The server is overloaded
# Fix: check the load on the server, add capacity

Problem: SSL certificate errors

Symptoms:

“certificate verification failed”
“SSL handshake error”

Diagnostics:

# 1. Check the server certificate
openssl s_client -connect vpn.company.com:443 -showcerts

# 2. Check the CA certificate in VyOS
show pki ca VPN-CA

# 3. Check the logs
show log | match "ssl"

Solutions:

# 1. Import the correct CA cert
# Obtain the CA cert from the server administrator
set pki ca VPN-CA certificate 'MIIDXTCCAkWgAwIBAgIJ...'
set interfaces sstpc sstpc0 ssl ca-certificate 'VPN-CA'
commit

# 2. For a self-signed certificate (testing only)
delete interfaces sstpc sstpc0 ssl ca-certificate
commit

# 3. Check the hostname in the certificate
# The server FQDN must match the CN in the certificate
set interfaces sstpc sstpc0 server 'vpn.company.com'  # not an IP address
commit

Security Best Practices

1. Using certificates

# Always verify the SSL certificate in production
set interfaces sstpc sstpc0 ssl ca-certificate 'TRUSTED-CA'

# Do not disable certificate verification without a good reason

2. Protecting credentials

# Use strong passwords
set interfaces sstpc sstpc0 authentication password 'ComplexP@ssw0rd!2024'

# Restrict access to the configuration
set system login user admin authentication plaintext-password 'AdminPassword'
set system login user admin level admin

3. Firewall on the interface

# Create a firewall for the SSTP interface
set firewall ipv4 name SSTP-IN default-action drop
set firewall ipv4 name SSTP-IN rule 10 action accept
set firewall ipv4 name SSTP-IN rule 10 state established
set firewall ipv4 name SSTP-IN rule 10 state related

set firewall ipv4 name SSTP-IN rule 20 action drop
set firewall ipv4 name SSTP-IN rule 20 state invalid

# Apply it to the SSTP interface
set interfaces sstpc sstpc0 firewall in name SSTP-IN

commit

4. Traffic limiting

# Rate limiting to protect against abuse
set firewall ipv4 name SSTP-IN rule 5 action accept
set firewall ipv4 name SSTP-IN rule 5 protocol icmp
set firewall ipv4 name SSTP-IN rule 5 limit rate 10/second

commit

5. Connection monitoring

# Logging SSTP events
set system syslog global facility all level info

# Sending logs to a syslog server
set system syslog host 192.168.1.100 facility all level warning

commit

6. Split-tunnel for security

# Use split-tunnel where possible
# Only corporate traffic through the VPN
set interfaces sstpc sstpc0 no-default-route
set protocols static route 192.168.0.0/16 interface sstpc0

# Internet through the local connection

Performance Tuning

1. MTU Optimization

# Optimal MTU for SSTP
set interfaces sstpc sstpc0 mtu 1452

# TCP MSS clamping
set interfaces sstpc sstpc0 ip adjust-mss 1412
set interfaces sstpc sstpc0 ipv6 adjust-mss 1392

commit

2. QoS for critical traffic

# Priority queueing for VoIP over SSTP
set traffic-policy shaper SSTP-QOS bandwidth 100mbit
set traffic-policy shaper SSTP-QOS class 10 match VoIP ip protocol udp
set traffic-policy shaper SSTP-QOS class 10 match VoIP ip source port 5060-5090
set traffic-policy shaper SSTP-QOS class 10 bandwidth 10%
set traffic-policy shaper SSTP-QOS class 10 priority 7

set traffic-policy shaper SSTP-QOS default bandwidth 90%
set traffic-policy shaper SSTP-QOS default priority 1

set interfaces sstpc sstpc0 traffic-policy out SSTP-QOS
commit

3. Connection Optimization

# Use DNS from the server for fast resolution
delete interfaces sstpc sstpc0 no-peer-dns

# Optimize TCP parameters (system level)
# Requires shell access

Comparing SSTP with other VPNs

Characteristic	SSTP	IPsec	OpenVPN	WireGuard
Firewall bypass	Excellent (443)	Poor (UDP 500/4500)	Good (configurable)	Moderate (UDP)
Performance	Moderate	Good	Fair	Excellent
Security	Excellent (SSL/TLS)	Excellent	Good	Excellent
Compatibility	Windows native	Excellent	Excellent	Good
NAT traversal	Excellent	Difficult	Excellent	Excellent
Setup Complexity	Medium	Difficult	Moderate	Simple
TCP overhead	High (TCP over TCP)	Low	Medium (UDP mode)	Low

When to choose SSTP:

You need to bypass strict firewalls (only 443 is allowed)
Windows Server infrastructure
Public Wi-Fi that blocks VPNs
Backup channel when other VPNs are blocked

When NOT to choose SSTP:

You need maximum performance (choose WireGuard)
Low latency is critical (the TCP-over-TCP problem)
Non-Windows environment (choose OpenVPN/WireGuard)

Best Practices

1. Naming Convention

# Use clear names
set interfaces sstpc sstpc0 description 'Corporate VPN - Primary'
set interfaces sstpc sstpc1 description 'Backup VPN - Secondary'

2. MTU Configuration

# Always configure MTU and MSS
set interfaces sstpc sstpc0 mtu 1452
set interfaces sstpc sstpc0 ip adjust-mss 1412

# Test the optimal MTU
ping 8.8.8.8 size 1452 do-not-fragment interface sstpc0

3. Monitoring and Alerting

# Syslog for tracking events
set system syslog global facility all level info
set system syslog host 192.168.1.100 facility all level warning

# SNMP monitoring
set service snmp community public authorization ro
set service snmp community public network 192.168.1.0/24

4. Backup Configuration

# Regular configuration backups
show configuration commands | save /config/backup-$(date +%Y%m%d).conf

# Script for automated backups

5. Certificate Management

# Renew CA certificates regularly
# Check expiration dates
show pki ca VPN-CA

# Keep backup CA certs

6. Documentation

# Document everything in the description
set interfaces sstpc sstpc0 description 'Corporate SSTP - vpn.company.com - Port 443'

Migrating from VyOS 1.4 to 1.5

The SSTP configuration is compatible across versions:

VyOS 1.4:

set interfaces sstpc sstpc0 server 'vpn.example.com'
set interfaces sstpc sstpc0 authentication username 'user'
set interfaces sstpc sstpc0 authentication password 'pass'

VyOS 1.5:

set interfaces sstpc sstpc0 server 'vpn.example.com'
set interfaces sstpc sstpc0 authentication username 'user'
set interfaces sstpc sstpc0 authentication password 'pass'

Changes: The syntax stays the same; the migration is transparent.

Conclusion

SSTP provides a reliable VPN solution for scenarios with restrictive firewalls:

Advantages:

Firewall bypass over port 443
SSL/TLS encryption
Operation through an HTTP proxy
Windows Server compatibility
Simple setup

Use cases:

Remote access VPN through restrictive networks
Backup VPN channel (always available)
Site-to-Site through an ISP with blocking
Corporate networks with strict policies

Best practices:

Correct MTU (1452) and MSS clamping configuration
SSL certificate verification in production
Firewall rules for protection
Monitoring and logging
Split-tunnel where possible
Redundancy through dual VPN

SSTP in VyOS delivers a reliable VPN connection in the most restrictive network environments, making it an excellent complement to IPsec, OpenVPN, and WireGuard for a comprehensive VPN strategy.

Additional resources

Reviewed by OpenNix LLC · Last updated on 29 July 2026

PPPoE - Point-to-Point Protocol over Ethernet WWAN (Wireless WAN)