Documentation
VyOS Documentation
VPN on VyOS
SSTP Server - SSL VPN over Port 443

SSTP Server - SSL VPN over Port 443

SSTP Server - SSL VPN over Port 443

Overview

SSTP (Secure Socket Tunneling Protocol) is a proprietary VPN protocol developed by Microsoft that carries PPP traffic over a secured SSL/TLS channel. SSTP is an excellent choice for organizations with strict firewall restrictions, because it uses the standard HTTPS port (TCP 443).

Key advantages of SSTP

  1. Firewall traversal - uses TCP port 443 (HTTPS), which lets it pass through virtually any corporate firewall and NAT
  2. Strong security - uses SSL/TLS for authentication and encryption, providing protection at the transport layer
  3. Windows compatibility - built-in support in Windows Vista and later without the need to install additional software
  4. Stable connection - uses TCP, ensuring reliable packet delivery
  5. Simple setup - relatively simple configuration on both the server and the client

Technical characteristics

  • Transport protocol: TCP port 443
  • Tunneling: PPP over SSL/TLS
  • Encryption: SSL/TLS (typically TLS 1.2 or higher)
  • Authentication: PAP, CHAP, MSCHAP, MSCHAPv2
  • IPv6 support: Yes
  • Backend in VyOS: accel-ppp

SSTP architecture

┌─────────────────┐                                  ┌─────────────────┐
│  SSTP Client    │                                  │  SSTP Server    │
│                 │                                  │                 │
│  ┌───────────┐  │  SSL/TLS Handshake (TCP 443)   │  ┌───────────┐  │
│  │    PPP    │  │ ────────────────────────────────> │    PPP    │  │
│  │  Session  │  │                                  │  Session  │  │
│  └─────┬─────┘  │  Encrypted PPP over HTTPS       │  └─────┬─────┘  │
│        │        │ <───────────────────────────────> │        │        │
│  ┌─────▼─────┐  │                                  │  ┌─────▼─────┐  │
│  │ SSL/TLS   │  │  Certificate Validation         │  │ SSL/TLS   │  │
│  │ Transport │  │ ────────────────────────────────> │ Transport │  │
│  └─────┬─────┘  │                                  │  └─────┬─────┘  │
│        │        │                                  │        │        │
│  ┌─────▼─────┐  │  TCP Connection (port 443)      │  ┌─────▼─────┐  │
│  │    TCP    │  │ <───────────────────────────────> │    TCP    │  │
│  │   443     │  │                                  │    443     │  │
│  └───────────┘  │                                  │  └───────────┘  │
└─────────────────┘                                  └─────────────────┘

Use cases

SSTP is recommended when:

  • Access is needed through strict corporate firewalls that block all ports except 80 and 443
  • Clients are predominantly Windows
  • A stable VPN connection is required without additional software on Windows clients
  • Integration with an existing PKI infrastructure is needed
  • Compatibility with RADIUS for centralized authentication is critical

SSTP is NOT recommended when:

  • Maximum performance is required (UDP-based protocols are faster)
  • Most clients run Linux/macOS (OpenVPN or WireGuard is a better fit)
  • Protocol openness and auditability are critical (SSTP is proprietary)
  • Support for mobile platforms iOS/Android is needed (IKEv2 or OpenVPN is better)

System requirements

VyOS server requirements

  • VyOS 1.3 or higher (1.4 or 1.5 recommended)
  • At least 512 MB RAM (1 GB recommended for 50+ concurrent connections)
  • Access to TCP port 443 from the external network
  • A configured PKI infrastructure or the ability to generate self-signed certificates

Client requirements

  • Windows: Vista SP1 and later (built-in client)
  • Linux: sstp-client (requires installation)
  • macOS: no built-in support (third-party software required)
  • Android/iOS: limited support through third-party apps

Network requirements

  • Inbound traffic allowed on TCP port 443
  • NAT transparency (SSTP works through NAT)
  • A sufficient pool of IP addresses for VPN clients
  • Configured routing for access to internal resources

Configuring SSL/TLS certificates

SSTP requires an SSL/TLS certificate to secure the connection. VyOS supports both using its own PKI infrastructure and importing external certificates.

Option 1: Using the built-in VyOS PKI

Step 1: Creating your own Certificate Authority (CA)

# Generate the CA private key and certificate
generate pki ca install VPN-CA

# Optional: view the created CA
show pki ca VPN-CA

This command creates:

  • The CA private key (2048-bit RSA by default)
  • A self-signed CA certificate
  • Installs them into the VyOS configuration

Step 2: Generating the server certificate

# Generate a certificate for the SSTP server signed by our CA
generate pki certificate sign VPN-CA install SSTP-Server

# Optional: view the created certificate
show pki certificate SSTP-Server

This command creates a server certificate signed by your CA.

Step 3: Generating a certificate with additional parameters

For a production environment, it is recommended to specify additional parameters:

# Generate a CA with specified parameters
generate pki ca install VPN-CA \
  common-name "OpenNix VPN CA" \
  country "RU" \
  state "Moscow" \
  locality "Moscow" \
  organization "OpenNix" \
  organizational-unit "IT Security"

# Generate a server certificate with Subject Alternative Names
generate pki certificate sign VPN-CA install SSTP-Server \
  common-name "vpn.example.com" \
  country "RU" \
  state "Moscow" \
  locality "Moscow" \
  organization "OpenNix" \
  organizational-unit "IT Security" \
  subject-alt-name "vpn.example.com" \
  subject-alt-name "sstp.example.com"

Important: Subject Alternative Names (SAN) are critically important for modern clients that verify that the server name matches the certificate.

Option 2: Importing existing certificates

If you already have certificates from a commercial CA (Let’s Encrypt, Sectigo, DigiCert, etc.):

# Enter configuration mode
configure

# Import the CA certificate
set pki ca Public-CA certificate "-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAKL0UG+mRkmUMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
...
-----END CERTIFICATE-----"

# Import the server certificate
set pki certificate SSTP-Server certificate "-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAKL0UG+mRkmUMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
...
-----END CERTIFICATE-----"

# Import the certificate private key
set pki certificate SSTP-Server private key "-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDH...
...
-----END PRIVATE KEY-----"

# Save the configuration
commit
save

Option 3: Using Let’s Encrypt

For public VPN servers, you can use free Let’s Encrypt certificates:

# On VyOS, install certbot (in operational mode)
sudo apt update
sudo apt install certbot

# Obtain a certificate (make sure port 80 is available)
sudo certbot certonly --standalone -d vpn.example.com

# Certificates will be saved to:
# /etc/letsencrypt/live/vpn.example.com/fullchain.pem
# /etc/letsencrypt/live/vpn.example.com/privkey.pem
# /etc/letsencrypt/live/vpn.example.com/chain.pem

# Import into the VyOS PKI
configure

# Import the CA chain
set pki ca LetsEncrypt certificate "$(cat /etc/letsencrypt/live/vpn.example.com/chain.pem)"

# Import the server certificate
set pki certificate SSTP-Server certificate "$(cat /etc/letsencrypt/live/vpn.example.com/cert.pem)"

# Import the private key
set pki certificate SSTP-Server private key "$(cat /etc/letsencrypt/live/vpn.example.com/privkey.pem)"

commit
save

Important: Let’s Encrypt certificates are valid for 90 days and require automatic renewal.

Verifying installed certificates

# Show all installed CAs
show pki ca

# Show all installed certificates
show pki certificate

# Show the details of a specific certificate
show pki certificate SSTP-Server

# Check the certificate validity period
show pki certificate SSTP-Server | grep "Valid"

Exporting the CA certificate for clients

Clients must trust your CA (if you are using your own PKI):

# Show the CA certificate in PEM format
show pki ca VPN-CA certificate pem

# Save to a file (in operational mode)
show pki ca VPN-CA certificate pem | sudo tee /tmp/vpn-ca.crt

Then distribute the /tmp/vpn-ca.crt file to clients so they can import it into their trusted certificate stores.

Basic SSTP server configuration

Minimal working configuration

configure

# Configure SSL certificates
set vpn sstp ssl ca-certificate 'VPN-CA'
set vpn sstp ssl certificate 'SSTP-Server'

# Configure authentication
set vpn sstp authentication mode 'local'
set vpn sstp authentication local-users username 'testuser' password 'SecurePass123!'

# Configure IP addressing for clients
set vpn sstp client-ip-pool SSTP-POOL range '10.100.0.10-10.100.0.100'
set vpn sstp gateway-address '10.100.0.1'

# Configure DNS servers for clients
set vpn sstp name-server '8.8.8.8'
set vpn sstp name-server '8.8.4.4'

# Apply the configuration
commit
save
exit

Once the configuration is applied, the SSTP server will listen on port 443 and be ready to accept connections.

Verifying server operation

# Check that the service is running
show vpn sstp-server sessions

# Check the status of the system service
sudo systemctl status accel-ppp@sstp

# Check that the port is being listened on
sudo netstat -tlnp | grep 443

Authentication methods

Local authentication

Local authentication stores user credentials directly in the VyOS configuration.

Basic setup with local users

configure

# Enable local authentication mode
set vpn sstp authentication mode 'local'

# Add users
set vpn sstp authentication local-users username 'john' password 'JohnPass123!'
set vpn sstp authentication local-users username 'mary' password 'MarySecure456!'
set vpn sstp authentication local-users username 'admin' password 'AdminP@ssw0rd!'

# Optional: assign a static IP to a specific user
set vpn sstp authentication local-users username 'admin' static-ip '10.100.0.10'

# Optional: rate-limit a user
set vpn sstp authentication local-users username 'john' rate-limit download '10000'
set vpn sstp authentication local-users username 'john' rate-limit upload '5000'

commit
save

PPP authentication protocols

SSTP supports several PPP authentication protocols:

configure

# Allow only MSCHAPv2 (recommended, the most secure)
set vpn sstp authentication protocols 'mschap-v2'

# Allow MSCHAP and MSCHAPv2
set vpn sstp authentication protocols 'mschap'
set vpn sstp authentication protocols 'mschap-v2'

# Allow CHAP (less secure)
set vpn sstp authentication protocols 'chap'

# Allow PAP (insecure, for testing only)
set vpn sstp authentication protocols 'pap'

commit
save

Security recommendations:

  • Use only mschap-v2 for production environments
  • Avoid pap - passwords are transmitted in plaintext
  • chap is acceptable but less secure than mschap-v2

RADIUS authentication

RADIUS allows you to centrally manage users and access policies.

Basic RADIUS setup

configure

# Enable RADIUS authentication
set vpn sstp authentication mode 'radius'

# Configure the primary RADIUS server
set vpn sstp authentication radius server 192.168.1.10 key 'RadiusSecret123'
set vpn sstp authentication radius server 192.168.1.10 port '1812'

# Configure the backup RADIUS server
set vpn sstp authentication radius server 192.168.1.11 key 'RadiusSecret123'
set vpn sstp authentication radius server 192.168.1.11 port '1812'

# Optional: configure timeouts
set vpn sstp authentication radius timeout '5'
set vpn sstp authentication radius acct-timeout '3'

# Optional: configure the number of retries
set vpn sstp authentication radius max-try '3'

# Optional: enable RADIUS accounting
set vpn sstp authentication radius acct-port '1813'

commit
save

RADIUS with dynamic attributes

RADIUS can pass additional parameters for users:

configure

# Allow the RADIUS server to assign IP addresses
set vpn sstp authentication radius dynamic-author server '192.168.1.10'
set vpn sstp authentication radius dynamic-author key 'DynAuthSecret'

# Configure the source IP for RADIUS requests
set vpn sstp authentication radius source-address '192.168.1.1'

commit
save

RADIUS attributes supported by accel-ppp:

  • Framed-IP-Address - static IP for the client
  • Framed-Route - routes for the client
  • Framed-IP-Netmask - subnet mask
  • Session-Timeout - maximum session duration
  • Idle-Timeout - inactivity timeout
  • Acct-Interim-Interval - accounting update interval

Example FreeRADIUS configuration

On the FreeRADIUS server side (/etc/freeradius/3.0/clients.conf):

client vyos-sstp {
    ipaddr = 192.168.1.1
    secret = RadiusSecret123
    shortname = vyos-sstp-server
    nas_type = other
}

Users file (/etc/freeradius/3.0/users):

john Cleartext-Password := "JohnPass123!"
    Framed-IP-Address = 10.100.0.50,
    Session-Timeout = 28800

mary Cleartext-Password := "MarySecure456!"
    Framed-IP-Address = 10.100.0.51,
    Acct-Interim-Interval = 300

Combined authentication

VyOS supports fallback from RADIUS to local authentication:

configure

# Primary method - RADIUS
set vpn sstp authentication mode 'radius'
set vpn sstp authentication radius server 192.168.1.10 key 'RadiusSecret123'

# Fall back to local authentication if RADIUS is unavailable
set vpn sstp authentication local-users username 'emergency' password 'EmergencyAccess!'

commit
save

Configuring IP address pools

IPv4 addressing

Simple address range

configure

# Define an address pool for clients
set vpn sstp client-ip-pool SSTP-POOL range '10.100.0.10-10.100.0.100'

# Specify the gateway address (the server's address on the VPN network)
set vpn sstp gateway-address '10.100.0.1'

commit
save

Multiple address pools

configure

# Pool for regular users
set vpn sstp client-ip-pool USERS range '10.100.1.10-10.100.1.100'

# Pool for administrators
set vpn sstp client-ip-pool ADMINS range '10.100.2.10-10.100.2.20'

# Pool for guest access
set vpn sstp client-ip-pool GUESTS range '10.100.3.10-10.100.3.50'

# Gateway address
set vpn sstp gateway-address '10.100.0.1'

commit
save

When using RADIUS, pools can be assigned dynamically through the Framed-Pool attribute.

Using subnets instead of ranges

configure

# Define a pool via a subnet
set vpn sstp client-ip-pool SUBNET subnet '10.100.10.0/24'

# Gateway address
set vpn sstp gateway-address '10.100.10.1'

commit
save

IPv6 addressing

SSTP fully supports IPv6 for VPN clients.

Basic IPv6 setup

configure

# Enable IPv6 support
set vpn sstp ppp-options ipv6 'allow'

# Define an IPv6 pool for clients
set vpn sstp client-ipv6-pool IPv6-POOL prefix '2001:db8:1000::/48' mask '64'

# Optional: delegate prefixes to clients
set vpn sstp client-ipv6-pool IPv6-POOL delegate '2001:db8:2000::/48' delegation-prefix '56'

commit
save

This configuration:

  • Assigns each client an IPv6 address from the 2001:db8:1000::/48 prefix with a /64 mask
  • Optionally delegates a /56 prefix to the client from the 2001:db8:2000::/48 range

Dual-stack (IPv4 + IPv6)

configure

# IPv4 configuration
set vpn sstp client-ip-pool SSTP-V4 range '10.100.0.10-10.100.0.100'
set vpn sstp gateway-address '10.100.0.1'

# IPv6 configuration
set vpn sstp ppp-options ipv6 'allow'
set vpn sstp client-ipv6-pool SSTP-V6 prefix '2001:db8:1000::/48' mask '64'

# DNS servers for both protocols
set vpn sstp name-server '8.8.8.8'
set vpn sstp name-server '2001:4860:4860::8888'

commit
save

Forcing the use of IPv6

configure

# Require IPv6 (reject clients without IPv6 support)
set vpn sstp ppp-options ipv6 'require'

# Alternatively: prefer IPv6 but allow IPv4
set vpn sstp ppp-options ipv6 'prefer'

commit
save

DNS and WINS servers

Configuring DNS servers

configure

# Assign DNS servers to clients
set vpn sstp name-server '8.8.8.8'
set vpn sstp name-server '8.8.4.4'

# Or use internal DNS servers
set vpn sstp name-server '192.168.1.10'
set vpn sstp name-server '192.168.1.11'

# IPv6 DNS servers
set vpn sstp name-server '2001:4860:4860::8888'
set vpn sstp name-server '2001:4860:4860::8844'

commit
save

Configuring WINS servers

For networks with a Windows infrastructure:

configure

# Assign WINS servers for NetBIOS name resolution
set vpn sstp wins-server '192.168.1.100'
set vpn sstp wins-server '192.168.1.101'

commit
save

Additional PPP parameters

MTU and MRU

configure

# Set the MTU for PPP interfaces
set vpn sstp ppp-options mtu '1400'

# Set the MRU (Maximum Receive Unit)
set vpn sstp ppp-options mru '1400'

commit
save

Recommendations:

  • Standard MTU for Ethernet: 1500
  • Recommended for SSTP: 1400-1420 (accounting for SSL/TLS and PPP overhead)
  • If you experience fragmentation issues, try lowering it to 1380

LCP parameters

configure

# Configure the interval of LCP echo requests (seconds)
set vpn sstp ppp-options lcp-echo-interval '30'

# Number of missed echo replies before the connection is dropped
set vpn sstp ppp-options lcp-echo-failure '3'

# LCP request timeout
set vpn sstp ppp-options lcp-echo-timeout '5'

commit
save

LCP (Link Control Protocol) echo is used to detect “dead” connections:

  • lcp-echo-interval: how often to send echo requests
  • lcp-echo-failure: how many missed replies are tolerated
  • The connection will be dropped after interval × failure seconds without replies

Disable CCP (Compression Control Protocol)

configure

# Disable compression at the PPP level (recommended, since SSL/TLS already compresses)
set vpn sstp ppp-options disable-ccp

commit
save

IPv6 PPP parameters

configure

# Allow IPv6CP (IPv6 Control Protocol)
set vpn sstp ppp-options ipv6 'allow'

# Force IPv6 to be required
set vpn sstp ppp-options ipv6 'require'

# Prefer IPv6 but allow IPv4-only clients
set vpn sstp ppp-options ipv6 'prefer'

# Assign a specific IPv6 interface identifier to the server
set vpn sstp ppp-options ipv6-intf-id '::1'

# Assign a specific IPv6 interface identifier to clients
set vpn sstp ppp-options ipv6-peer-intf-id '::2'

# Accept any interface identifier from the client
set vpn sstp ppp-options ipv6-accept-peer-intf-id

commit
save

Rate limiting

Rate limiting for specific users

configure

# Rate-limit a local user
set vpn sstp authentication local-users username 'john' rate-limit download '20000'
set vpn sstp authentication local-users username 'john' rate-limit upload '10000'

# Values are specified in Kbps (kilobits per second)
# 20000 Kbps = 20 Mbps download
# 10000 Kbps = 10 Mbps upload

commit
save

Rate limiting via RADIUS

The RADIUS server can pass attributes to limit the rate. Example FreeRADIUS configuration:

john Cleartext-Password := "password"
    Filter-Id = "rate-limit=20000/10000"

Where the format is: rate-limit=download_kbps/upload_kbps

Global rate limiting

To apply limits to all users, use scripts or settings at the accel-ppp level.

Advanced settings

Changing the listening port

By default, SSTP uses port 443. To change it:

configure

# Use a non-standard port (for example, 8443)
set vpn sstp port '8443'

commit
save

Note: Using a non-standard port reduces one of the main advantages of SSTP - its ability to traverse firewalls.

Maximum number of clients

configure

# Limit the maximum number of concurrent connections
set vpn sstp max-concurrent-sessions '100'

commit
save

Session timeouts

configure

# Set the inactive session timeout (seconds)
set vpn sstp ppp-options session-timeout '3600'

commit
save

Logging

configure

# Enable detailed logging
set vpn sstp log level '5'

# Logging levels:
# 0 - off
# 1 - critical errors
# 2 - errors
# 3 - warnings
# 4 - information
# 5 - debug (maximum verbosity)

commit
save

Logs are available through journalctl:

sudo journalctl -u accel-ppp@sstp -f

Extended Scripts

VyOS allows you to run custom scripts on various events:

configure

# Script when the connection is established
set vpn sstp extended-scripts on-up '/config/scripts/sstp-up.sh'

# Script when the connection is dropped
set vpn sstp extended-scripts on-down '/config/scripts/sstp-down.sh'

# Script when the session changes
set vpn sstp extended-scripts on-change '/config/scripts/sstp-change.sh'

# Script on authentication
set vpn sstp extended-scripts on-pre-up '/config/scripts/sstp-pre-up.sh'

commit
save

Example on-up script

Create the file /config/scripts/sstp-up.sh:

#!/bin/bash
# SSTP on-up script
# Available variables:
# PEERNAME - username
# CALLING_SID - client IP address
# CALLED_SID - server IP address
# IFNAME - PPP interface (for example, ppp0)
# IPLOCAL - local VPN IP address
# IPREMOTE - remote VPN IP address

logger "SSTP: User $PEERNAME connected from $CALLING_SID via $IFNAME ($IPREMOTE)"

# Example: add a static route for a specific user
if [ "$PEERNAME" = "admin" ]; then
    ip route add 192.168.100.0/24 via $IPREMOTE dev $IFNAME
fi

# Example: send a notification
curl -X POST https://monitoring.example.com/vpn-connect \
    -d "user=$PEERNAME&ip=$CALLING_SID&vpn_ip=$IPREMOTE"

Do not forget to make the script executable:

sudo chmod +x /config/scripts/sstp-up.sh

SNMP monitoring

configure

# Enable SNMP for SSTP monitoring
set vpn sstp snmp master-agent

commit
save

Once SNMP is enabled, you can monitor:

  • The number of active sessions
  • Traffic statistics
  • Information about connected users

Configuration examples for cloud providers

Example 1: SSTP VPN on Yandex Cloud to bypass strict firewalls

Scenario: A company has remote employees working from locations with very strict corporate firewalls that block all ports except 80 and 443. SSTP is the ideal solution because it uses the standard HTTPS port.

Topology

┌────────────────────────────────────────────────────────────────┐
│                      Yandex Cloud                              │
│  ┌──────────────────────────────────────────────────────────┐  │
│  │ VPC: 10.128.0.0/16                                       │  │
│  │                                                          │  │
│  │  ┌─────────────────────┐      ┌──────────────────────┐  │  │
│  │  │  VyOS SSTP Server   │      │  Internal Resources  │  │  │
│  │  │  eth0: 51.250.X.X   │──────│  Web: 10.128.1.10    │  │  │
│  │  │  eth1: 10.128.0.10  │      │  DB:  10.128.1.20    │  │  │
│  │  │  SSTP: 10.100.0.1   │      │  App: 10.128.1.30    │  │  │
│  │  └─────────────────────┘      └──────────────────────┘  │  │
│  └──────────────────────────────────────────────────────────┘  │
└────────────────────────────────────────────────────────────────┘
                         ▲
                         │ SSTP (TCP 443)
                         │
              ┌──────────┴──────────┐
              │                     │
         ┌────▼──────┐      ┌──────▼────┐
         │  Windows  │      │  Windows  │
         │  Client 1 │      │  Client 2 │
         │  (Office) │      │  (Home)   │
         └───────────┘      └───────────┘

VyOS configuration

configure

# Interfaces
set interfaces ethernet eth0 address 'dhcp'
set interfaces ethernet eth0 description 'WAN - Yandex Cloud'

set interfaces ethernet eth1 address '10.128.0.10/24'
set interfaces ethernet eth1 description 'LAN - Internal Network'

# NAT for VPN clients
set nat source rule 100 outbound-interface 'eth1'
set nat source rule 100 source address '10.100.0.0/24'
set nat source rule 100 translation address 'masquerade'

# PKI - generating certificates
# (run before configure)
# generate pki ca install SSTP-CA common-name "Yandex Cloud VPN CA"
# generate pki certificate sign SSTP-CA install SSTP-Server common-name "vpn.company.ru"

# SSTP configuration
set vpn sstp ssl ca-certificate 'SSTP-CA'
set vpn sstp ssl certificate 'SSTP-Server'

# Authentication via RADIUS (integration with Active Directory)
set vpn sstp authentication mode 'radius'
set vpn sstp authentication radius server 10.128.1.50 key 'YandexCloudRadiusSecret2025'
set vpn sstp authentication radius server 10.128.1.50 port '1812'
set vpn sstp authentication radius server 10.128.1.51 key 'YandexCloudRadiusSecret2025'
set vpn sstp authentication radius timeout '10'

# Backup local authentication
set vpn sstp authentication local-users username 'admin' password 'EmergencyAccess2025!'
set vpn sstp authentication local-users username 'admin' static-ip '10.100.0.5'

# IP pools
set vpn sstp client-ip-pool VPN-USERS range '10.100.0.10-10.100.0.100'
set vpn sstp gateway-address '10.100.0.1'

# DNS servers (internal corporate DNS)
set vpn sstp name-server '10.128.1.10'
set vpn sstp name-server '10.128.1.11'

# WINS for access to internal Windows resources
set vpn sstp wins-server '10.128.1.50'

# PPP parameters optimized for SSTP
set vpn sstp ppp-options mtu '1400'
set vpn sstp ppp-options lcp-echo-interval '30'
set vpn sstp ppp-options lcp-echo-failure '3'
set vpn sstp ppp-options disable-ccp

# Authentication protocols (secure only)
set vpn sstp authentication protocols 'mschap-v2'

# Logging
set vpn sstp log level '4'

# Firewall for SSTP
set firewall name WAN_LOCAL rule 100 action 'accept'
set firewall name WAN_LOCAL rule 100 protocol 'tcp'
set firewall name WAN_LOCAL rule 100 destination port '443'
set firewall name WAN_LOCAL rule 100 description 'Allow SSTP VPN'

set firewall interface eth0 local name 'WAN_LOCAL'

# Routing for VPN clients
set protocols static route 10.128.1.0/24 next-hop 10.128.0.1

# SNMP for monitoring
set vpn sstp snmp master-agent

commit
save
exit

Configuring the Windows client

On the user’s computer (Windows 10/11):

  1. Importing the CA certificate:

    • Copy the vpn-ca.crt file to the computer
    • Double-click → “Install Certificate”
    • “Local Machine” → “Place all certificates in the following store”
    • “Trusted Root Certification Authorities”

  2. Creating the VPN connection:

    • Settings → Network & Internet → VPN → “Add a VPN connection”
    • VPN provider: Windows (built-in)
    • Connection name: “Yandex Cloud Office VPN”
    • Server name or address: vpn.company.ru (or 51.250.X.X)
    • VPN type: “Secure Socket Tunneling Protocol (SSTP)”
    • Type of sign-in info: “User name and password”
    • Save

  3. Connecting:

    • Click on the created VPN connection
    • Enter the RADIUS credentials (AD username/password)
    • Click “Connect”

Automatic monitoring script

Create /config/scripts/sstp-monitor.sh:

#!/bin/bash
# SSTP monitoring script for Yandex Cloud

WEBHOOK_URL="https://monitoring.company.ru/api/vpn/events"

# Function to send metrics
send_metric() {
    local metric_name=$1
    local metric_value=$2

    curl -s -X POST "$WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "{\"metric\":\"$metric_name\",\"value\":$metric_value,\"timestamp\":$(date +%s)}"
}

# Get the number of active sessions
active_sessions=$(cli-shell-api showCfg | grep -c "ppp")

# Send the metric
send_metric "sstp_active_sessions" "$active_sessions"

Add to cron:

set system task-scheduler task monitor-sstp executable path '/config/scripts/sstp-monitor.sh'
set system task-scheduler task monitor-sstp interval '5m'

Example 2: SSTP VPN on VK Cloud for corporate access

Scenario: A mid-sized business hosts its infrastructure on VK Cloud and needs secure remote access for employees. It uses integration with a corporate FreeRADIUS and dynamic resource assignment.

Topology

┌─────────────────────────────────────────────────────────────────┐
│                         VK Cloud                                │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │ Private Network: 192.168.0.0/16                           │  │
│  │                                                           │  │
│  │  ┌──────────────────┐    ┌──────────────────────────┐    │  │
│  │  │  VyOS Gateway    │    │   FreeRADIUS Server      │    │  │
│  │  │  Ext: 95.X.X.X   │────│   192.168.0.50           │    │  │
│  │  │  Int: 192.168.0.1│    │   (AD integration)       │    │  │
│  │  │  VPN: 10.50.0.1  │    └──────────────────────────┘    │  │
│  │  └──────────────────┘                                     │  │
│  │         │                                                 │  │
│  │         │                                                 │  │
│  │  ┌──────▼───────────────────────────────────────────┐    │  │
│  │  │        Corporate Network Segments                │    │  │
│  │  │  - Management:   192.168.10.0/24                 │    │  │
│  │  │  - Servers:      192.168.20.0/24                 │    │  │
│  │  │  - Workstations: 192.168.30.0/24                 │    │  │
│  │  │  - DMZ:          192.168.100.0/24                │    │  │
│  │  └──────────────────────────────────────────────────┘    │  │
│  └───────────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────┘

VyOS configuration on VK Cloud

configure

# Interfaces
set interfaces ethernet eth0 address 'dhcp'
set interfaces ethernet eth0 description 'WAN - VK Cloud External'

set interfaces ethernet eth1 address '192.168.0.1/16'
set interfaces ethernet eth1 description 'LAN - Corporate Network'

# PKI - using Let's Encrypt for a public domain
# (certificate obtained in advance via certbot)
set pki ca LetsEncrypt certificate "-----BEGIN CERTIFICATE-----
[Let's Encrypt Chain Certificate]
-----END CERTIFICATE-----"

set pki certificate SSTP-VKCloud certificate "-----BEGIN CERTIFICATE-----
[Server Certificate for vpn.company.cloud]
-----END CERTIFICATE-----"

set pki certificate SSTP-VKCloud private key "-----BEGIN PRIVATE KEY-----
[Private Key]
-----END PRIVATE KEY-----"

# SSTP server
set vpn sstp ssl ca-certificate 'LetsEncrypt'
set vpn sstp ssl certificate 'SSTP-VKCloud'

# RADIUS authentication with FreeRADIUS
set vpn sstp authentication mode 'radius'
set vpn sstp authentication radius server 192.168.0.50 key 'VKCloudRadius2025Secret'
set vpn sstp authentication radius server 192.168.0.50 port '1812'
set vpn sstp authentication radius server 192.168.0.50 acct-port '1813'
set vpn sstp authentication radius timeout '5'
set vpn sstp authentication radius acct-timeout '3'
set vpn sstp authentication radius max-try '3'

# Dynamic authorization for changing session parameters
set vpn sstp authentication radius dynamic-author server '192.168.0.50'
set vpn sstp authentication radius dynamic-author key 'DynamicAuthKey2025'

# IP pools for different user groups
set vpn sstp client-ip-pool ADMINS range '10.50.1.10-10.50.1.30'
set vpn sstp client-ip-pool EMPLOYEES range '10.50.2.10-10.50.2.100'
set vpn sstp client-ip-pool CONTRACTORS range '10.50.3.10-10.50.3.50'

set vpn sstp gateway-address '10.50.0.1'

# DNS servers (internal)
set vpn sstp name-server '192.168.0.10'
set vpn sstp name-server '192.168.0.11'

# PPP parameters
set vpn sstp ppp-options mtu '1420'
set vpn sstp ppp-options lcp-echo-interval '30'
set vpn sstp ppp-options lcp-echo-failure '4'
set vpn sstp ppp-options disable-ccp

# Secure authentication
set vpn sstp authentication protocols 'mschap-v2'

# Extended scripts for logging and integration
set vpn sstp extended-scripts on-up '/config/scripts/sstp-on-up.sh'
set vpn sstp extended-scripts on-down '/config/scripts/sstp-on-down.sh'

# Firewall
set firewall name WAN_LOCAL rule 110 action 'accept'
set firewall name WAN_LOCAL rule 110 protocol 'tcp'
set firewall name WAN_LOCAL rule 110 destination port '443'
set firewall name WAN_LOCAL rule 110 description 'SSTP VPN'
set firewall name WAN_LOCAL rule 110 recent count '4'
set firewall name WAN_LOCAL rule 110 recent time 'minute'
set firewall name WAN_LOCAL rule 110 state new 'enable'

set firewall interface eth0 local name 'WAN_LOCAL'

# NAT for VPN clients
set nat source rule 200 outbound-interface 'eth1'
set nat source rule 200 source address '10.50.0.0/16'
set nat source rule 200 translation address 'masquerade'

# Routing
set protocols static route 192.168.0.0/16 next-hop 192.168.0.1

# SNMP
set vpn sstp snmp master-agent

# System logging
set system syslog global facility all level 'info'
set system syslog host 192.168.0.60 facility all level 'info'
set system syslog host 192.168.0.60 port '514'

commit
save
exit

FreeRADIUS configuration for group policy

File /etc/freeradius/3.0/mods-config/files/authorize:

# Administrators - full access, high speed
DEFAULT Group == "VPN-Admins", Auth-Type := LDAP
    Framed-Pool = "ADMINS",
    Framed-IP-Netmask = 255.255.255.0,
    Framed-Route = "192.168.0.0/16 192.168.0.1",
    Session-Timeout = 43200,
    Idle-Timeout = 1800

# Employees - standard access, medium speed
DEFAULT Group == "VPN-Employees", Auth-Type := LDAP
    Framed-Pool = "EMPLOYEES",
    Framed-IP-Netmask = 255.255.255.0,
    Framed-Route = "192.168.20.0/24 192.168.0.1",
    Framed-Route = "192.168.30.0/24 192.168.0.1",
    Session-Timeout = 28800,
    Idle-Timeout = 900,
    Filter-Id = "rate-limit=50000/25000"

# Contractors - limited access, low speed
DEFAULT Group == "VPN-Contractors", Auth-Type := LDAP
    Framed-Pool = "CONTRACTORS",
    Framed-IP-Netmask = 255.255.255.0,
    Framed-Route = "192.168.100.0/24 192.168.0.1",
    Session-Timeout = 14400,
    Idle-Timeout = 600,
    Filter-Id = "rate-limit=10000/5000"

on-up script for integration with monitoring systems

Create /config/scripts/sstp-on-up.sh:

#!/bin/bash
# SSTP on-up integration script for VK Cloud

# Environment variables from accel-ppp:
# PEERNAME, CALLING_SID, IFNAME, IPLOCAL, IPREMOTE

# Log to syslog
logger -t sstp-auth "User $PEERNAME connected from $CALLING_SID, assigned IP $IPREMOTE via $IFNAME"

# Send the event to the monitoring system
curl -s -X POST "http://192.168.0.60:9200/vpn-events/_doc" \
    -H "Content-Type: application/json" \
    -d "{
        \"timestamp\": \"$(date -Iseconds)\",
        \"event_type\": \"vpn_connect\",
        \"username\": \"$PEERNAME\",
        \"source_ip\": \"$CALLING_SID\",
        \"vpn_ip\": \"$IPREMOTE\",
        \"interface\": \"$IFNAME\"
    }"

# Update the active VPN sessions table in the database
psql -h 192.168.0.70 -U vpnmonitor -d monitoring -c \
    "INSERT INTO active_vpn_sessions (username, source_ip, vpn_ip, interface, connected_at)
     VALUES ('$PEERNAME', '$CALLING_SID', '$IPREMOTE', '$IFNAME', NOW())"

# Check the user against the whitelist and apply additional policies
if grep -q "^$PEERNAME$" /config/scripts/vpn-privileged-users.txt; then
    # Grant access to the management subnet for privileged users
    ip route add 192.168.10.0/24 via $IPREMOTE dev $IFNAME
    logger -t sstp-auth "Privileged access granted to $PEERNAME"
fi

on-down script for cleanup

Create /config/scripts/sstp-on-down.sh:

#!/bin/bash
# SSTP on-down cleanup script

logger -t sstp-auth "User $PEERNAME disconnected from $CALLING_SID, IP $IPREMOTE"

# Remove from the active sessions database
psql -h 192.168.0.70 -U vpnmonitor -d monitoring -c \
    "DELETE FROM active_vpn_sessions WHERE username='$PEERNAME' AND vpn_ip='$IPREMOTE'"

# Send the event to monitoring
curl -s -X POST "http://192.168.0.60:9200/vpn-events/_doc" \
    -H "Content-Type: application/json" \
    -d "{
        \"timestamp\": \"$(date -Iseconds)\",
        \"event_type\": \"vpn_disconnect\",
        \"username\": \"$PEERNAME\",
        \"source_ip\": \"$CALLING_SID\",
        \"vpn_ip\": \"$IPREMOTE\"
    }"

Make the scripts executable:

sudo chmod +x /config/scripts/sstp-on-up.sh
sudo chmod +x /config/scripts/sstp-on-down.sh

Monitoring and management

Viewing active sessions

# Show all active SSTP sessions
show vpn sstp-server sessions

# Example output:
# ifname | username | ip            | calling-sid     | rate-limit | type | comp | state    | uptime
# -------+----------+---------------+-----------------+------------+------+------+----------+----------
# ppp0   | john     | 10.100.0.10   | 203.0.113.45    |            | sstp |      | active   | 00:15:32
# ppp1   | mary     | 10.100.0.11   | 198.51.100.22   | 20000/10000| sstp |      | active   | 01:05:18
# ppp2   | admin    | 10.100.0.5    | 192.0.2.100     |            | sstp |      | active   | 02:30:45

Server statistics

# Show overall SSTP server statistics
show vpn sstp-server statistics

# Example output:
# uptime: 5d 12h 30m
# cpu: 2%
# mem(rss/virt): 45M/120M
# core:
#   mempool_allocated: 512Kb
#   mempool_available: 256Kb
#   thread_count: 4
#   thread_active: 1
#   context_count: 3
#   context_sleeping: 0
#   context_pending: 0
#   md_handler_count: 3
#   md_handler_pending: 0
# sessions:
#   starting: 0
#   active: 3
#   finishing: 0

Forcibly disconnecting a user

# Disconnect a specific session by interface
sudo pkill -f "ppp0"

# Or use accel-cmd (if available)
sudo accel-cmd terminate if ppp0

# Disconnect by username
sudo accel-cmd terminate username john

Viewing detailed session information

# Information about PPP interfaces
show interfaces ppp

# Details of a specific interface
show interfaces ppp ppp0

# Traffic statistics
show interfaces ppp ppp0 statistics

Diagnostics and troubleshooting

Checking the service status

# Check the accel-ppp SSTP status
sudo systemctl status accel-ppp@sstp

# Restart the service
sudo systemctl restart accel-ppp@sstp

# Stop/start
sudo systemctl stop accel-ppp@sstp
sudo systemctl start accel-ppp@sstp

Viewing logs

# SSTP server logs in real time
sudo journalctl -u accel-ppp@sstp -f

# Last 100 lines of logs
sudo journalctl -u accel-ppp@sstp -n 100

# Logs for the current boot
sudo journalctl -u accel-ppp@sstp -b 0

# Logs from a specific time
sudo journalctl -u accel-ppp@sstp --since "2025-01-15 10:00:00"

# Logs for a specific period
sudo journalctl -u accel-ppp@sstp --since "2025-01-15 10:00:00" --until "2025-01-15 12:00:00"

# Filter by severity level
sudo journalctl -u accel-ppp@sstp -p err

# Export logs to a file
sudo journalctl -u accel-ppp@sstp > /tmp/sstp-logs.txt

Common problems and solutions

Problem 1: Client cannot connect - certificate error

Symptoms:

  • The Windows client returns the error “The remote connection was not made because the attempted VPN tunnels failed”
  • In the logs: “SSL handshake failed”

Solution:

# 1. Check that the certificate is installed correctly
show pki certificate SSTP-Server

# 2. Make sure the Common Name or SAN matches the server address
# 3. Check the certificate validity period
show pki certificate SSTP-Server | grep Valid

# 4. Export the CA certificate for the client
show pki ca VPN-CA certificate pem

# 5. The client must install the CA certificate as trusted

Problem 2: The connection is established but there is no access to internal resources

Symptoms:

  • The VPN connection shows “Connected”
  • Ping to the gateway (10.100.0.1) works
  • Ping to internal resources does not work

Solution:

# 1. Check the NAT rules
show nat source rules

# 2. Check the routing
show ip route

# 3. Check the firewall rules
show firewall

# 4. Make sure IP forwarding is enabled (should be enabled by default)
sysctl net.ipv4.ip_forward
# Should be: net.ipv4.ip_forward = 1

# 5. Check that the correct routes are assigned to the client
# On a Windows client: route print

Problem 3: RADIUS authentication does not work

Symptoms:

  • In the logs: “RADIUS server not responding” or “RADIUS authentication failed”
  • Local users connect normally

Solution:

# 1. Check the RADIUS server availability
ping 192.168.1.10

# 2. Check the RADIUS ports
sudo nmap -p 1812,1813 192.168.1.10

# 3. Test RADIUS via radtest (install freeradius-utils)
sudo apt install freeradius-utils
radtest john password123 192.168.1.10 1812 RadiusSecret123

# 4. Check the RADIUS configuration in VyOS
show vpn sstp authentication radius

# 5. Check the RADIUS server logs
# On the FreeRADIUS server:
sudo journalctl -u freeradius -f

# 6. Enable debug mode on RADIUS (temporarily)
# On FreeRADIUS: sudo freeradius -X

Problem 4: Poor VPN performance

Symptoms:

  • Slow data transfer speed
  • High latency

Solution:

# 1. Check the MTU settings
show vpn sstp ppp-options

# 2. Try different MTU values
configure
set vpn sstp ppp-options mtu 1380
commit
save

# 3. Disable compression (if enabled)
set vpn sstp ppp-options disable-ccp
commit

# 4. Check the server load
show system resources

# 5. Check bandwidth limits
show vpn sstp authentication local-users

# 6. Check the network interfaces
show interfaces ethernet
show interfaces ethernet eth0 statistics

# 7. Test throughput (on the client)
# Windows: Test-NetConnection -ComputerName 10.100.0.1 -DiagnoseRouting

Problem 5: Sessions hang (stale sessions)

Symptoms:

  • The user shows as connected but cannot transfer data
  • Reconnection is impossible because of the existing session

Solution:

# 1. Check the LCP echo parameters
show vpn sstp ppp-options

# 2. Configure more aggressive dead-session detection
configure
set vpn sstp ppp-options lcp-echo-interval 15
set vpn sstp ppp-options lcp-echo-failure 3
commit
save

# 3. Forcibly terminate hung sessions
sudo accel-cmd terminate username john

# 4. Restart the service (last resort)
sudo systemctl restart accel-ppp@sstp

Problem 6: Port 443 is already in use

Symptoms:

  • The accel-ppp@sstp service does not start
  • In the logs: “bind: Address already in use”

Solution:

# 1. Check what is listening on port 443
sudo netstat -tlnp | grep :443
# or
sudo lsof -i :443

# 2. If it is a web server (nginx, apache), move HTTPS to another port
# Or configure SSTP on another port
configure
set vpn sstp port 8443
commit
save

# 3. Update the firewall for the new port
set firewall name WAN_LOCAL rule 110 destination port '8443'
commit

# IMPORTANT: Clients will have to specify vpn.example.com:8443

Diagnostic tools

Checking the SSL/TLS connection

# Test the SSL connection from the server
openssl s_client -connect localhost:443 -showcerts

# Test the SSL connection from outside
openssl s_client -connect vpn.example.com:443 -showcerts

# Check the certificate
echo | openssl s_client -connect vpn.example.com:443 2>/dev/null | openssl x509 -noout -text

Capturing traffic for analysis

# Capture SSTP traffic on the WAN interface
sudo tcpdump -i eth0 -w /tmp/sstp-traffic.pcap port 443

# Capture PPP traffic
sudo tcpdump -i ppp0 -w /tmp/ppp-traffic.pcap

# Real-time analysis
sudo tcpdump -i eth0 -n port 443 -v

Monitoring system resources

# accel-ppp CPU and memory usage
ps aux | grep accel-ppp

# Detailed process statistics
top -p $(pidof accel-ppp)

# VyOS system resources
show system resources

Security recommendations

1. Using trusted certificates

# Always use certificates from trusted CAs for production
# Avoid self-signed certificates for public VPNs
# Renew certificates regularly (Let's Encrypt - every 60 days)

# Use strong keys (at least 2048-bit RSA or ECC)
generate pki ca install VPN-CA key-size 4096

# Add Subject Alternative Names
generate pki certificate sign VPN-CA install SSTP-Server \
    subject-alt-name "vpn.example.com" \
    subject-alt-name "sstp.example.com"

2. Secure authentication

configure

# Use only MSCHAPv2
set vpn sstp authentication protocols 'mschap-v2'

# Avoid PAP and CHAP
delete vpn sstp authentication protocols 'pap'
delete vpn sstp authentication protocols 'chap'

# Integrate with RADIUS/AD for centralized management
set vpn sstp authentication mode 'radius'

# Enable accounting for auditing
set vpn sstp authentication radius acct-port '1813'

commit
save

3. Restricting access

configure

# Limit the number of concurrent connections
set vpn sstp max-concurrent-sessions '50'

# Use session timeouts
set vpn sstp ppp-options session-timeout '28800'  # 8 hours

# Firewall with rate limiting against brute-force
set firewall name WAN_LOCAL rule 110 recent count '5'
set firewall name WAN_LOCAL rule 110 recent time 'minute'

# Geographic filtering (if applicable)
# set firewall name WAN_LOCAL rule 110 source geoip country-code 'RU'

commit
save

4. Network segmentation

configure

# Use separate IP subnets for the VPN
set vpn sstp client-ip-pool VPN range '10.100.0.0-10.100.255.254'

# Apply firewall rules for VPN traffic
set firewall name VPN_TO_LAN default-action 'drop'
set firewall name VPN_TO_LAN rule 10 action 'accept'
set firewall name VPN_TO_LAN rule 10 state established 'enable'
set firewall name VPN_TO_LAN rule 10 state related 'enable'

set firewall name VPN_TO_LAN rule 20 action 'accept'
set firewall name VPN_TO_LAN rule 20 destination address '192.168.1.0/24'
set firewall name VPN_TO_LAN rule 20 protocol 'tcp'
set firewall name VPN_TO_LAN rule 20 destination port '80,443'

# Deny access to the management subnet
set firewall name VPN_TO_LAN rule 100 action 'drop'
set firewall name VPN_TO_LAN rule 100 destination address '192.168.0.0/24'
set firewall name VPN_TO_LAN rule 100 log 'enable'

commit
save

5. Monitoring and logging

configure

# Enable verbose logging
set vpn sstp log level '4'

# Send logs to a centralized syslog server
set system syslog host 192.168.1.100 facility all level 'info'
set system syslog host 192.168.1.100 port '514'

# Enable SNMP for monitoring
set vpn sstp snmp master-agent

# Use extended scripts for auditing
set vpn sstp extended-scripts on-up '/config/scripts/sstp-audit.sh'

commit
save

6. Regular updates

# Update VyOS regularly
add system image <new-version-url>
show system image
set system image default-boot <new-version>
reboot

# Monitor accel-ppp vulnerabilities
# https://github.com/accel-ppp/accel-ppp/security/advisories

# Automatically renew Let's Encrypt certificates
# Create a cron job for certbot renew

7. Disaster Recovery

# Create configuration backups regularly
save /config/backup-$(date +%Y%m%d).config

# Export the PKI certificates
show pki ca VPN-CA certificate pem > /tmp/ca-backup.pem
show pki certificate SSTP-Server certificate pem > /tmp/cert-backup.pem

# Document the configuration
show configuration commands > /tmp/vyos-config-backup.txt

8. DDoS protection

configure

# SYN flood protection at the system level
set firewall syn-flood protection enable

# Limiting new connections
set firewall name WAN_LOCAL rule 110 protocol 'tcp'
set firewall name WAN_LOCAL rule 110 destination port '443'
set firewall name WAN_LOCAL rule 110 connection-limit limit '20'
set firewall name WAN_LOCAL rule 110 connection-limit rate 'minute'

# Connection tracking
set system conntrack expect-table-size '2048'
set system conntrack hash-size '32768'
set system conntrack table-size '262144'

commit
save

Best Practices

Capacity planning

  1. Calculating the required resources:

    • RAM: 100-200 MB per 100 concurrent connections
    • CPU: 1 core per 50-100 connections (depends on traffic)
    • Bandwidth: plan with a 30-50% margin
    • IP addresses: number of users + 20% reserve

  2. Scaling:

    • Up to 100 users: a single VyOS VM (2 vCPU, 2GB RAM)
    • 100-500 users: a VyOS VM (4 vCPU, 4-8GB RAM)
    • 500+ users: consider load balancing

Documentation

# Always add descriptions to the configuration
configure
set vpn sstp description 'SSTP VPN Server for remote employees'
set vpn sstp client-ip-pool EMPLOYEES description 'IP pool for regular employees'
set firewall name WAN_LOCAL rule 110 description 'Allow SSTP VPN from Internet'
commit

Testing

  1. Before deploying to production:

    • Test with different types of clients (Windows 10, 11, Server)
    • Verify operation through various firewalls
    • Load test with the expected number of users
    • Failover scenarios (RADIUS failure, IP pool exhaustion)

  2. Regular checks:

    • Check the logs for errors weekly
    • Test recovery procedures monthly
    • Update certificates and patches quarterly

Change Management

# Always create a backup before making changes
configure
save /config/backup-before-change-$(date +%Y%m%d-%H%M).config

# Make the changes
# ... your changes ...

commit
# Verify that everything works
# If there are problems:
rollback 1

# If everything is fine:
save

Conclusion

SSTP VPN on VyOS provides a reliable and secure remote access solution, especially in environments with restrictive firewalls. Using the standard HTTPS port (443) ensures maximum compatibility and traversal through NAT and firewalls.

Key advantages

  • Simplicity of deployment and management
  • Built-in Windows support without additional software
  • Strong security through SSL/TLS
  • Flexible integration with RADIUS and Active Directory
  • Suitable for corporate and cloud deployments

When to use SSTP

  • Remote employees behind strict corporate firewalls
  • Windows-oriented organizations
  • When simple client-side setup is needed
  • When compatibility with existing PKI infrastructure is required

Alternatives

Consider other VPN protocols if:

  • WireGuard: you need maximum performance and a modern protocol
  • OpenVPN: you need support for all platforms and an open protocol
  • IKEv2/IPsec: you need built-in support for mobile devices (iOS/Android)
  • L2TP/IPsec: you need compatibility with legacy systems

Additional resources

Document prepared: 2025-01-15 Version: 1.0 Compatibility: VyOS 1.3.x, 1.4.x, 1.5.x Author: OpenNix Team

Reviewed by OpenNix Team · Last updated on
PPTP Server - Legacy VPN (Deprecated)IPsec VPN