# SSTP Client - Secure Socket Tunneling Protocol

> SSTP Client in VyOS - secure VPN over SSL/TLS on port 443 to bypass firewalls, with authentication and Windows SSTP server integration

Source: https://opennix.org/en/docs/vyos/interfaces/vyos-sstp/


SSTP (Secure Socket Tunneling Protocol) is a VPN protocol that transports PPP traffic over an SSL/TLS channel. SSTP uses TCP port 443 by default, which lets it pass through most firewalls and proxy servers that usually block other VPN protocols.

## Introduction to SSTP

### What is SSTP?

SSTP is a proprietary Microsoft protocol that:
- Encapsulates PPP traffic inside an SSL/TLS connection
- Uses TCP port 443 (the standard HTTPS port)
- Provides transport-level security
- Supports key negotiation and encryption
- Verifies traffic integrity
- Passes easily through firewalls and NAT

### SSTP Architecture

**Components:**
- SSTP Client - initiates the connection (VyOS router)
- SSTP Server - accepts the connection (Windows Server, VyOS, others)
- SSL/TLS layer - provides encryption
- PPP layer - the transport protocol
- HTTP/HTTPS - the underlying transport

**Connection establishment stages:**
1. TCP handshake on port 443
2. TLS handshake - establishing the SSL session
3. HTTP negotiation - SSTP protocol negotiation
4. PPP session - establishing the PPP connection
5. Authentication - PAP/CHAP/MS-CHAP
6. IP configuration - obtaining an IP address

### Advantages of SSTP

**Bypassing restrictions:**
- Uses port 443 (HTTPS) - not blocked by firewalls
- Passes through HTTP proxies
- Works through NAT with no extra configuration
- Looks like ordinary HTTPS traffic

**Security:**
- SSL/TLS encryption (AES-256)
- Certificate-based authentication
- Protection against MITM attacks
- Data integrity verification

**Use cases:**
- Remote access through restrictive firewalls
- Corporate networks with strict policies
- Public Wi-Fi networks that block VPNs
- Backup VPN channel (always available)

### When to use SSTP?

**Recommended for:**
- Connecting from networks with restrictive firewalls
- Public Wi-Fi that blocks VPN ports
- Corporate networks with a port allowlist
- Backup channel when IPsec/OpenVPN/WireGuard are blocked
- Compatibility with Windows Server SSTP

**Use cases:**
- Remote access VPN for employees
- Site-to-Site VPN through restrictive ISPs
- Bypassing censorship and DPI (Deep Packet Inspection)
- Backup VPN channel

## SSTP Client Configuration

### Basic setup

```bash
configure

# Create the SSTP interface
set interfaces sstpc sstpc0 server 'vpn.example.com'
set interfaces sstpc sstpc0 authentication username 'myuser'
set interfaces sstpc sstpc0 authentication password 'SecretPassword123'

# SSL certificate verification (disable if self-signed)
set interfaces sstpc sstpc0 ssl ca-certificate 'VPN-CA'

# Automatic default route
set interfaces sstpc sstpc0 default-route auto

commit
save
```

**Result:**
- SSTP connection to vpn.example.com:443
- Automatic IP address assignment from the server
- Default route through the SSTP tunnel
- SSL/TLS encryption

### Configuration parameters

#### Server

```bash
# Server FQDN
set interfaces sstpc sstpc0 server 'vpn.company.com'

# Server IP address
set interfaces sstpc sstpc0 server '203.0.113.10'

# Server with a non-standard port (if not 443)
# SSTP always uses port 443; changing it is not supported
```

**Important:** The server must be reachable by FQDN or IP on TCP port 443.

#### Authentication

```bash
# Username and password
set interfaces sstpc sstpc0 authentication username 'user@domain.com'
set interfaces sstpc sstpc0 authentication password 'MyPassword'
```

**Authentication types:**
- PAP (Password Authentication Protocol) - not recommended
- CHAP (Challenge Handshake Authentication Protocol)
- MS-CHAP v2 (Microsoft CHAP) - recommended for Windows Server

VyOS automatically negotiates the method with the server.

#### SSL Certificate

```bash
# CA certificate to verify the server
set interfaces sstpc sstpc0 ssl ca-certificate 'VPN-CA'

# For a self-signed certificate, verification can be skipped
# (not recommended in production)
# Simply do not specify ca-certificate
```

**Importing the CA certificate:**

```bash
# Load the CA cert onto VyOS
configure
set pki ca VPN-CA certificate 'MIIDXTCCAkWgAwIBAgIJ...'
commit
```

Or load a file:

```bash
# Copy the file to VyOS
scp ca.crt vyos@router:/tmp/

# Import it
vyos@router# configure
vyos@router# load /config/auth/ca.crt
```

#### Default Route

```bash
# Automatically add a default route through SSTP
set interfaces sstpc sstpc0 default-route auto

# Explicitly force the default route
set interfaces sstpc sstpc0 default-route force

# Do not add a default route (split-tunnel)
set interfaces sstpc sstpc0 no-default-route

# Default route with a metric
set interfaces sstpc sstpc0 default-route-distance 10
```

**Options:**
- `auto` - add the route if SSTP is the only connection
- `force` - always add the route
- `no-default-route` - do not add the route (split-tunnel)

#### MTU

```bash
# MTU (Maximum Transmission Unit)
set interfaces sstpc sstpc0 mtu 1452
```

**MTU recommendations:**
- Ethernet MTU: 1500 bytes
- SSTP overhead: ~48 bytes (PPP + SSL/TLS + TCP + IP headers)
- Recommended MTU: 1452 bytes
- For low-speed links: 1400 bytes

**TCP MSS clamping:**

```bash
# Set TCP MSS to prevent fragmentation
set interfaces sstpc sstpc0 ip adjust-mss 1412
set interfaces sstpc sstpc0 ipv6 adjust-mss 1392
```

#### DNS Configuration

```bash
# Receive DNS from the SSTP server (default)
# (automatically via PPP negotiation)

# Do not use DNS from the server
set interfaces sstpc sstpc0 no-peer-dns
```

#### VRF Support

```bash
# Place the SSTP interface in a VRF
set interfaces sstpc sstpc0 vrf MANAGEMENT
```

**Use case:** Isolating management traffic through a dedicated VPN.

#### Interface Description

```bash
# Add a description
set interfaces sstpc sstpc0 description 'Corporate VPN - Main Link'
```

#### IP Configuration

```bash
# Automatic IP assignment from the server (default)
# (via PPP negotiation)

# Static IP (if the server requires it)
# SSTP usually uses dynamic IP assignment
```

#### Disable Interface

```bash
# Temporarily disable the interface
set interfaces sstpc sstpc0 disable

# Enable it again
delete interfaces sstpc sstpc0 disable
commit
```

#### Source Validation

```bash
# Configure source validation
set interfaces sstpc sstpc0 ip disable-forwarding
set interfaces sstpc sstpc0 ip source-validation strict
set interfaces sstpc sstpc0 ip source-validation loose
set interfaces sstpc sstpc0 ip source-validation disable
```

## Practical scenarios

### Scenario 1: Remote Access VPN through a restrictive firewall

**Topology:**
```
[User Laptop] ---- [Restrictive Firewall] ---- [Internet] ---- [SSTP Server]
                    (only port 443 allowed)
```

**Goal:** Connect to the corporate network from public Wi-Fi that blocks all ports except 80/443.

**VyOS configuration:**

```bash
configure

# SSTP interface
set interfaces sstpc sstpc0 server 'vpn.company.com'
set interfaces sstpc sstpc0 authentication username 'employee@company.com'
set interfaces sstpc sstpc0 authentication password 'StrongPassword!23'
set interfaces sstpc sstpc0 ssl ca-certificate 'COMPANY-CA'
set interfaces sstpc sstpc0 default-route auto
set interfaces sstpc sstpc0 mtu 1452
set interfaces sstpc sstpc0 description 'Corporate VPN'

# LAN interface (for clients behind VyOS)
set interfaces ethernet eth1 address 192.168.1.1/24

# NAT for the LAN through SSTP
set nat source rule 100 outbound-interface name sstpc0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

# DHCP for LAN clients
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 start 192.168.1.100
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 range 0 stop 192.168.1.200
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 option default-router 192.168.1.1

commit
save
```

**Verification:**

```bash
# SSTP interface status
show interfaces sstpc sstpc0

# Assigned IP address
show interfaces sstpc sstpc0 brief

# Default route
show ip route

# Connectivity test
ping 8.8.8.8 interface sstpc0
```

### Scenario 2: Site-to-Site VPN over SSTP

**Topology:**
```
[Branch Office VyOS] ---- SSTP ---- [HQ SSTP Server]
 192.168.2.0/24                      192.168.1.0/24
```

**Goal:** Connect a branch office to headquarters over SSTP (the ISP blocks IPsec).

**Branch Office configuration:**

```bash
configure

# WAN interface
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'WAN - ISP'

# SSTP to headquarters
set interfaces sstpc sstpc0 server 'hq-vpn.company.com'
set interfaces sstpc sstpc0 authentication username 'branch-office-1'
set interfaces sstpc sstpc0 authentication password 'BranchPass123!'
set interfaces sstpc sstpc0 ssl ca-certificate 'HQ-VPN-CA'
set interfaces sstpc sstpc0 no-default-route
set interfaces sstpc sstpc0 mtu 1452
set interfaces sstpc sstpc0 description 'VPN to HQ'

# LAN interface
set interfaces ethernet eth1 address 192.168.2.1/24
set interfaces ethernet eth1 description 'Branch LAN'

# Static route to the HQ network through SSTP
# (assuming the SSTP server assigns 10.10.0.x addresses)
set protocols static route 192.168.1.0/24 interface sstpc0

# NAT for internet through WAN
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.2.0/24
set nat source rule 100 translation address masquerade

# DHCP for the LAN
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 range 0 start 192.168.2.100
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 range 0 stop 192.168.2.200
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 option default-router 192.168.2.1

# DNS forwarding
set service dns forwarding listen-address 192.168.2.1
set service dns forwarding allow-from 192.168.2.0/24

commit
save
```

**Verification:**

```bash
# SSTP connection
show interfaces sstpc sstpc0

# Routing table
show ip route

# Ping the HQ network
ping 192.168.1.1 source-address 192.168.2.1
```

### Scenario 3: Dual VPN (SSTP + WireGuard Failover)

**Topology:**
```
                 ┌─ WireGuard (Primary, fast)
[VyOS Router] ───┤
                 └─ SSTP (Backup, always works)
```

**Goal:** The primary channel goes over WireGuard for performance, with SSTP as a backup in case of blocking.

**Configuration:**

```bash
configure

# Primary VPN: WireGuard
set interfaces wireguard wg0 address 10.10.0.1/30
set interfaces wireguard wg0 port 51820
set interfaces wireguard wg0 private-key 'WIREGUARD_PRIVATE_KEY'
set interfaces wireguard wg0 peer hq public-key 'HQ_PUBLIC_KEY'
set interfaces wireguard wg0 peer hq allowed-ips '10.10.0.2/32'
set interfaces wireguard wg0 peer hq allowed-ips '192.168.1.0/24'
set interfaces wireguard wg0 peer hq address 'vpn.company.com'
set interfaces wireguard wg0 peer hq port 51820
set interfaces wireguard wg0 description 'Primary VPN - WireGuard'

# Backup VPN: SSTP
set interfaces sstpc sstpc0 server 'vpn.company.com'
set interfaces sstpc sstpc0 authentication username 'backup-vpn@company.com'
set interfaces sstpc sstpc0 authentication password 'BackupVPN!Pass'
set interfaces sstpc sstpc0 ssl ca-certificate 'COMPANY-CA'
set interfaces sstpc sstpc0 no-default-route
set interfaces sstpc sstpc0 mtu 1452
set interfaces sstpc sstpc0 description 'Backup VPN - SSTP'

# Static routes with metrics
# WireGuard - lower distance (preferred)
set protocols static route 192.168.1.0/24 interface wg0
set protocols static route 192.168.1.0/24 interface wg0 distance 10

# SSTP - higher distance (backup)
set protocols static route 192.168.1.0/24 interface sstpc0
set protocols static route 192.168.1.0/24 interface sstpc0 distance 20

commit
save
```

**Failover logic:**
- WireGuard is used by default (distance 10)
- If WireGuard goes down, traffic automatically switches to SSTP (distance 20)
- SSTP always works because it uses port 443

**Verification:**

```bash
# Routing table - there should be two routes
show ip route 192.168.1.0/24

# Check the active route
show ip route

# Simulate a failover
disconnect interface wg0

# Check the switch to SSTP
show ip route 192.168.1.0/24
```

### Scenario 4: SSTP through an HTTP Proxy

**Goal:** Connect to the VPN through a corporate HTTP proxy.

**Configuration:**

```bash
configure

# SSTP supports an HTTP CONNECT proxy
# Proxy configuration in VyOS 1.4/1.5 may require additional settings

# Basic SSTP
set interfaces sstpc sstpc0 server 'vpn.company.com'
set interfaces sstpc sstpc0 authentication username 'user@company.com'
set interfaces sstpc sstpc0 authentication password 'Password123'
set interfaces sstpc sstpc0 ssl ca-certificate 'COMPANY-CA'

commit
save
```

**Note:** The VyOS SSTP client may not support an HTTP proxy directly. In that case use:
- A direct connection (if available)
- An SSH tunnel through the proxy with SSTP running over it
- A different VPN protocol (OpenVPN with http-proxy)

### Scenario 5: SSTP in Yandex Cloud

**Goal:** Connect a VyOS instance in Yandex Cloud to a corporate SSTP server.

**Topology:**
```
[VyOS in Yandex Cloud] ---- [Internet] ---- [Corporate SSTP Server]
   10.128.0.5/24                              vpn.company.ru
```

**Configuration:**

```bash
configure

# WAN interface (Yandex Cloud external IP)
set interfaces ethernet eth0 address 10.128.0.5/24
set interfaces ethernet eth0 description 'Yandex Cloud Network'

# SSTP to the corporate server
set interfaces sstpc sstpc0 server 'vpn.company.ru'
set interfaces sstpc sstpc0 authentication username 'cloud-vyos@company.ru'
set interfaces sstpc sstpc0 authentication password 'CloudVPN!2024'
set interfaces sstpc sstpc0 ssl ca-certificate 'CORP-CA'
set interfaces sstpc sstpc0 no-default-route
set interfaces sstpc sstpc0 mtu 1420
set interfaces sstpc sstpc0 description 'VPN to Corporate Network'

# Routes to corporate networks through SSTP
set protocols static route 192.168.0.0/16 interface sstpc0
set protocols static route 10.0.0.0/8 interface sstpc0

# Default route through the Yandex Cloud gateway
set protocols static route 0.0.0.0/0 next-hop 10.128.0.1

# Firewall for outbound SSTP
set firewall ipv4 name YANDEX-OUT default-action accept
set firewall ipv4 name YANDEX-OUT rule 100 action accept
set firewall ipv4 name YANDEX-OUT rule 100 destination port 443
set firewall ipv4 name YANDEX-OUT rule 100 protocol tcp

commit
save
```

**Yandex Cloud specifics:**
- MTU in Yandex Cloud is 1500; use an SSTP MTU of 1420-1452
- SSTP works through the Yandex Cloud NAT gateway
- No additional security group rules are required for outbound port 443

**Verification:**

```bash
# SSTP status
show interfaces sstpc sstpc0

# Ping the corporate network
ping 192.168.1.1 interface sstpc0

# Traceroute
traceroute 192.168.1.1
```

### Scenario 6: SSTP in VK Cloud

**Goal:** Connect a VyOS instance in VK Cloud to a VPN server.

**Configuration:**

```bash
configure

# WAN interface (VK Cloud private network)
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'VK Cloud Network'

# SSTP to the VPN server
set interfaces sstpc sstpc0 server 'vpn.example.ru'
set interfaces sstpc sstpc0 authentication username 'vkcloud-client'
set interfaces sstpc sstpc0 authentication password 'VKCloudVPN!123'
set interfaces sstpc sstpc0 ssl ca-certificate 'VPN-CA'
set interfaces sstpc sstpc0 default-route auto
set interfaces sstpc sstpc0 mtu 1450
set interfaces sstpc sstpc0 description 'VPN Connection'

# NAT for internal networks through SSTP
set interfaces ethernet eth1 address 192.168.100.1/24

set nat source rule 100 outbound-interface name sstpc0
set nat source rule 100 source address 192.168.100.0/24
set nat source rule 100 translation address masquerade

commit
save
```

**VK Cloud specifics:**
- MTU in VK Cloud is 1500; use an SSTP MTU of 1450
- SSTP works through VK Cloud NAT
- Check the security groups for port 443

### Scenario 7: Split-Tunnel SSTP

**Goal:** Route only corporate traffic through the VPN, with internet access going directly.

**Configuration:**

```bash
configure

# SSTP without a default route
set interfaces sstpc sstpc0 server 'vpn.company.com'
set interfaces sstpc sstpc0 authentication username 'user@company.com'
set interfaces sstpc sstpc0 authentication password 'Password123'
set interfaces sstpc sstpc0 ssl ca-certificate 'COMPANY-CA'
set interfaces sstpc sstpc0 no-default-route
set interfaces sstpc sstpc0 mtu 1452
set interfaces sstpc sstpc0 description 'Split-Tunnel VPN'

# Only corporate networks through SSTP
set protocols static route 192.168.0.0/16 interface sstpc0
set protocols static route 10.0.0.0/8 interface sstpc0

# Internet through WAN
set interfaces ethernet eth0 address dhcp

# Default route through WAN
set protocols static route 0.0.0.0/0 dhcp-interface eth0

# NAT for internet through WAN
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade

commit
save
```

**Split-tunnel advantages:**
- Internet traffic does not load the VPN
- Faster for users
- Less load on the VPN server

## Monitoring and debugging

### Checking SSTP status

```bash
# General information
show interfaces sstpc

# Detailed information for a specific interface
show interfaces sstpc sstpc0

# Brief output
show interfaces sstpc sstpc0 brief

# Statistics
show interfaces sstpc sstpc0 statistics
```

**Example output:**

```
sstpc0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1452
    inet 10.10.0.2 peer 10.10.0.1/32
    RX: bytes    packets  errors  dropped  overrun       mcast
        5242880    4096       0        0        0           0
    TX: bytes    packets  errors  dropped carrier collisions
        2621440    2048       0        0       0           0
```

### Operational Commands

```bash
# Connect the SSTP session
connect interface sstpc0

# Disconnect the SSTP session
disconnect interface sstpc0

# Check SSTP log messages
show log | match sstpc

# Check the authentication log
show log auth | match sstpc
```

### Debugging SSTP

```bash
# SSTP logs in real time
monitor log | match sstpc

# System logs
show log tail

# dmesg for kernel-level issues
show log kernel tail
```

**Debug information includes:**
- TCP connection establishment
- TLS handshake
- HTTP negotiation
- PPP LCP negotiation
- Authentication attempts
- IP address assignment

### Packet Capture

```bash
# Capture SSTP traffic (TCP port 443)
monitor traffic interface eth0 filter "tcp port 443 and host vpn.company.com"

# Capture traffic on the SSTP interface
monitor traffic interface sstpc0

# Save the capture to a file
monitor traffic interface eth0 filter "tcp port 443" save /tmp/sstp-capture.pcap
```

**Analysis in Wireshark:**
- TCP SYN/ACK (3-way handshake)
- TLS Client/Server Hello
- TLS Certificate Exchange
- HTTP SSTP negotiation (after TLS)
- Encrypted PPP frames (after SSTP is established)

### Checking DNS

```bash
# DNS resolution for the server
nslookup vpn.company.com

# Ping the server
ping vpn.company.com

# Check port 443
telnet vpn.company.com 443
```

### Performance monitoring

```bash
# Bandwidth monitoring
monitor bandwidth interface sstpc0

# Real-time traffic statistics
show interfaces sstpc sstpc0 statistics

# Connection uptime
show interfaces sstpc sstpc0 | grep "uptime"
```

## Troubleshooting

### Problem: SSTP does not establish a connection

**Symptoms:**
- The interface is in the DOWN state
- No IP address
- Connection timeout

**Diagnostics:**

```bash
# 1. Check DNS resolution
nslookup vpn.company.com

# 2. Check connectivity to the server
ping vpn.company.com

# 3. Check port 443
telnet vpn.company.com 443

# 4. Check the SSTP logs
show log | match sstpc

# 5. Attempt to connect
connect interface sstpc0

# 6. Check the output
show log tail
```

**Common causes:**

1. **Server unreachable:**
```bash
# In the logs: "Connection refused" or "Timeout"
# Fix: check DNS, firewall, routing
ping vpn.company.com
traceroute vpn.company.com
```

2. **Invalid credentials:**
```bash
# In the logs: "authentication failed" or "Access denied"
# Fix: check the username/password
set interfaces sstpc sstpc0 authentication username 'correct-user'
set interfaces sstpc sstpc0 authentication password 'correct-pass'
commit
```

3. **SSL certificate issues:**
```bash
# In the logs: "certificate verification failed" or "SSL handshake failed"
# Fix: check the CA certificate

# Import the correct CA cert
set pki ca VPN-CA certificate 'MIID...'
set interfaces sstpc sstpc0 ssl ca-certificate 'VPN-CA'

# Or disable verification (for testing only)
delete interfaces sstpc sstpc0 ssl ca-certificate
commit
```

4. **Firewall blocking port 443:**
```bash
# Check the firewall
show firewall

# Allow outbound port 443
set firewall ipv4 name WAN-OUT rule 100 action accept
set firewall ipv4 name WAN-OUT rule 100 destination port 443
set firewall ipv4 name WAN-OUT rule 100 protocol tcp
commit
```

### Problem: The connection establishes but there is no internet

**Diagnostics:**

```bash
# 1. Check the IP address
show interfaces sstpc sstpc0
# There should be an IP address from the server

# 2. Check the default route
show ip route 0.0.0.0/0
# It should point to sstpc0 (for full-tunnel)

# 3. Ping the SSTP server gateway
ping 10.10.0.1 interface sstpc0

# 4. Ping a public IP
ping 8.8.8.8 interface sstpc0

# 5. Check DNS
nslookup google.com

# 6. Check NAT (if used)
show nat source statistics
```

**Solutions:**

1. **No default route:**
```bash
set interfaces sstpc sstpc0 default-route force
commit
```

2. **DNS not working:**
```bash
# Use DNS from the server (default)
delete interfaces sstpc sstpc0 no-peer-dns

# Or public DNS
set system name-server 8.8.8.8
set system name-server 8.8.4.4
commit
```

3. **NAT not configured (for LAN clients):**
```bash
set nat source rule 100 outbound-interface name sstpc0
set nat source rule 100 source address 192.168.1.0/24
set nat source rule 100 translation address masquerade
commit
```

### Problem: Frequent disconnects/reconnects

**Symptoms:**
- SSTP reconnects constantly
- In the logs: "Connection lost" or "PPP terminated"

**Diagnostics:**

```bash
# 1. Check the uptime
show interfaces sstpc sstpc0 | grep uptime

# 2. Check the logs
show log | match "sstpc0"

# 3. Error statistics
show interfaces sstpc sstpc0 statistics
```

**Causes and solutions:**

1. **Unstable internet connection:**
```bash
# Check the WAN interface
show interfaces ethernet eth0 statistics

# Check for packet loss
ping 8.8.8.8 count 100

# Fix: resolve the WAN issues
```

2. **MTU problems:**
```bash
# Packets dropping due to MTU
# Fix: reduce the MTU
set interfaces sstpc sstpc0 mtu 1400
set interfaces sstpc sstpc0 ip adjust-mss 1360
commit
```

3. **Server timeout:**
```bash
# The SSTP server drops idle connections
# Fix: send keepalive traffic or check the server settings
```

4. **SSL session timeout:**
```bash
# TLS session expiring
# Fix: check the SSL settings on the server
```

### Problem: Low speed

**Diagnostics:**

```bash
# 1. Bandwidth test with iperf3
# On the server
iperf3 -s

# On VyOS
iperf3 -c server-ip -i 1 -t 30

# 2. Check the MTU
ping 8.8.8.8 size 1452 do-not-fragment interface sstpc0

# 3. Check CPU usage
show system resources

# 4. Interface statistics
show interfaces sstpc sstpc0 statistics
```

**Solutions:**

1. **MTU fragmentation:**
```bash
# Path MTU Discovery
# Reduce the MTU
set interfaces sstpc sstpc0 mtu 1400
set interfaces sstpc sstpc0 ip adjust-mss 1360
commit
```

2. **TCP over TCP problem:**
```bash
# SSTP uses TCP (PPP over SSL over TCP)
# TCP-over-TCP can cause performance issues
# Fix: use a UDP-based VPN (WireGuard, OpenVPN UDP) for better performance
```

3. **Server overload:**
```bash
# The server is overloaded
# Fix: check the load on the server, add capacity
```

### Problem: SSL certificate errors

**Symptoms:**
- "certificate verification failed"
- "SSL handshake error"

**Diagnostics:**

```bash
# 1. Check the server certificate
openssl s_client -connect vpn.company.com:443 -showcerts

# 2. Check the CA certificate in VyOS
show pki ca VPN-CA

# 3. Check the logs
show log | match "ssl"
```

**Solutions:**

```bash
# 1. Import the correct CA cert
# Obtain the CA cert from the server administrator
set pki ca VPN-CA certificate 'MIIDXTCCAkWgAwIBAgIJ...'
set interfaces sstpc sstpc0 ssl ca-certificate 'VPN-CA'
commit

# 2. For a self-signed certificate (testing only)
delete interfaces sstpc sstpc0 ssl ca-certificate
commit

# 3. Check the hostname in the certificate
# The server FQDN must match the CN in the certificate
set interfaces sstpc sstpc0 server 'vpn.company.com'  # not an IP address
commit
```

## Security Best Practices

### 1. Using certificates

```bash
# Always verify the SSL certificate in production
set interfaces sstpc sstpc0 ssl ca-certificate 'TRUSTED-CA'

# Do not disable certificate verification without a good reason
```

### 2. Protecting credentials

```bash
# Use strong passwords
set interfaces sstpc sstpc0 authentication password 'ComplexP@ssw0rd!2024'

# Restrict access to the configuration
set system login user admin authentication plaintext-password 'AdminPassword'
set system login user admin level admin
```

### 3. Firewall on the interface

```bash
# Create a firewall for the SSTP interface
set firewall ipv4 name SSTP-IN default-action drop
set firewall ipv4 name SSTP-IN rule 10 action accept
set firewall ipv4 name SSTP-IN rule 10 state established
set firewall ipv4 name SSTP-IN rule 10 state related

set firewall ipv4 name SSTP-IN rule 20 action drop
set firewall ipv4 name SSTP-IN rule 20 state invalid

# Apply it to the SSTP interface
set interfaces sstpc sstpc0 firewall in name SSTP-IN

commit
```

### 4. Traffic limiting

```bash
# Rate limiting to protect against abuse
set firewall ipv4 name SSTP-IN rule 5 action accept
set firewall ipv4 name SSTP-IN rule 5 protocol icmp
set firewall ipv4 name SSTP-IN rule 5 limit rate 10/second

commit
```

### 5. Connection monitoring

```bash
# Logging SSTP events
set system syslog global facility all level info

# Sending logs to a syslog server
set system syslog host 192.168.1.100 facility all level warning

commit
```

### 6. Split-tunnel for security

```bash
# Use split-tunnel where possible
# Only corporate traffic through the VPN
set interfaces sstpc sstpc0 no-default-route
set protocols static route 192.168.0.0/16 interface sstpc0

# Internet through the local connection
```

## Performance Tuning

### 1. MTU Optimization

```bash
# Optimal MTU for SSTP
set interfaces sstpc sstpc0 mtu 1452

# TCP MSS clamping
set interfaces sstpc sstpc0 ip adjust-mss 1412
set interfaces sstpc sstpc0 ipv6 adjust-mss 1392

commit
```

### 2. QoS for critical traffic

```bash
# Priority queueing for VoIP over SSTP
set traffic-policy shaper SSTP-QOS bandwidth 100mbit
set traffic-policy shaper SSTP-QOS class 10 match VoIP ip protocol udp
set traffic-policy shaper SSTP-QOS class 10 match VoIP ip source port 5060-5090
set traffic-policy shaper SSTP-QOS class 10 bandwidth 10%
set traffic-policy shaper SSTP-QOS class 10 priority 7

set traffic-policy shaper SSTP-QOS default bandwidth 90%
set traffic-policy shaper SSTP-QOS default priority 1

set interfaces sstpc sstpc0 traffic-policy out SSTP-QOS
commit
```

### 3. Connection Optimization

```bash
# Use DNS from the server for fast resolution
delete interfaces sstpc sstpc0 no-peer-dns

# Optimize TCP parameters (system level)
# Requires shell access
```

## Comparing SSTP with other VPNs

| Characteristic | SSTP | IPsec | OpenVPN | WireGuard |
|---------------|------|-------|---------|-----------|
| **Firewall bypass** | Excellent (443) | Poor (UDP 500/4500) | Good (configurable) | Moderate (UDP) |
| **Performance** | Moderate | Good | Fair | Excellent |
| **Security** | Excellent (SSL/TLS) | Excellent | Good | Excellent |
| **Compatibility** | Windows native | Excellent | Excellent | Good |
| **NAT traversal** | Excellent | Difficult | Excellent | Excellent |
| **Setup Complexity** | Medium | Difficult | Moderate | Simple |
| **TCP overhead** | High (TCP over TCP) | Low | Medium (UDP mode) | Low |

**When to choose SSTP:**
- You need to bypass strict firewalls (only 443 is allowed)
- Windows Server infrastructure
- Public Wi-Fi that blocks VPNs
- Backup channel when other VPNs are blocked

**When NOT to choose SSTP:**
- You need maximum performance (choose WireGuard)
- Low latency is critical (the TCP-over-TCP problem)
- Non-Windows environment (choose OpenVPN/WireGuard)

## Best Practices

### 1. Naming Convention

```bash
# Use clear names
set interfaces sstpc sstpc0 description 'Corporate VPN - Primary'
set interfaces sstpc sstpc1 description 'Backup VPN - Secondary'
```

### 2. MTU Configuration

```bash
# Always configure MTU and MSS
set interfaces sstpc sstpc0 mtu 1452
set interfaces sstpc sstpc0 ip adjust-mss 1412

# Test the optimal MTU
ping 8.8.8.8 size 1452 do-not-fragment interface sstpc0
```

### 3. Monitoring and Alerting

```bash
# Syslog for tracking events
set system syslog global facility all level info
set system syslog host 192.168.1.100 facility all level warning

# SNMP monitoring
set service snmp community public authorization ro
set service snmp community public network 192.168.1.0/24
```

### 4. Backup Configuration

```bash
# Regular configuration backups
show configuration commands | save /config/backup-$(date +%Y%m%d).conf

# Script for automated backups
```

### 5. Certificate Management

```bash
# Renew CA certificates regularly
# Check expiration dates
show pki ca VPN-CA

# Keep backup CA certs
```

### 6. Documentation

```bash
# Document everything in the description
set interfaces sstpc sstpc0 description 'Corporate SSTP - vpn.company.com - Port 443'
```

## Migrating from VyOS 1.4 to 1.5

The SSTP configuration is compatible across versions:

**VyOS 1.4:**
```bash
set interfaces sstpc sstpc0 server 'vpn.example.com'
set interfaces sstpc sstpc0 authentication username 'user'
set interfaces sstpc sstpc0 authentication password 'pass'
```

**VyOS 1.5:**
```bash
set interfaces sstpc sstpc0 server 'vpn.example.com'
set interfaces sstpc sstpc0 authentication username 'user'
set interfaces sstpc sstpc0 authentication password 'pass'
```

**Changes:** The syntax stays the same; the migration is transparent.

## Conclusion

SSTP provides a reliable VPN solution for scenarios with restrictive firewalls:

**Advantages:**
- Firewall bypass over port 443
- SSL/TLS encryption
- Operation through an HTTP proxy
- Windows Server compatibility
- Simple setup

**Use cases:**
- Remote access VPN through restrictive networks
- Backup VPN channel (always available)
- Site-to-Site through an ISP with blocking
- Corporate networks with strict policies

**Best practices:**
- Correct MTU (1452) and MSS clamping configuration
- SSL certificate verification in production
- Firewall rules for protection
- Monitoring and logging
- Split-tunnel where possible
- Redundancy through dual VPN

SSTP in VyOS delivers a reliable VPN connection in the most restrictive network environments, making it an excellent complement to IPsec, OpenVPN, and WireGuard for a comprehensive VPN strategy.

## Additional resources

- [VyOS SSTP Client Documentation](https://docs.vyos.io/en/latest/configuration/interfaces/sstp-client.html)
- [SSTP Protocol Specification - MS-SSTP](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sstp/)
- [SSL/TLS Best Practices](https://ssl-config.mozilla.org/)
- [PPP Protocol - RFC 1661](https://tools.ietf.org/html/rfc1661)
- [WireGuard VPN](/docs/vyos/vpn/vyos-wireguard/) - for comparison
- [OpenVPN](/docs/vyos/vpn/vyos-openvpn/) - an alternative VPN
- [IPsec VPN](/docs/vyos/vpn/vyos-ipsec/) - enterprise VPN