Configure a VPN on a Windows Server instance - Elastic Compute Service

This topic describes how to set up a virtual private network (VPN) on an ECS instance that runs Windows Server.

Prerequisites

This topic applies to Windows Server 2022, Windows Server 2019, and Windows Server 2016.
This topic uses an ECS instance that runs Windows Server 2022 as an example. For information about how to create an ECS instance, see Create a custom instance.

This procedure uses the Point-to-Point Tunneling Protocol (PPTP). Before you begin, you must add security group rules for the VPN server.

Connect to the ECS instance. For more information, see Connect to a Windows instance.
In the taskbar search box, search for and open Server Manager.
In Server Manager, click Add Roles and Features.

Note
On pages not mentioned in this guide, accept the default settings and click Next.
On the Select installation type page, keep the default selection and click Next.
On the Select destination server page, ensure that the correct server is selected and click Next.
On the Select server roles page, select the Remote Access check box.
On the Select role services page, select the DirectAccess and VPN (RAS) and Routing check boxes.
On the Confirm installation selections page, review your choices and click Install.

In the Server Manager menu bar, choose Tools > Routing and Remote Access.
In the Routing and Remote Access console, right-click the server instance, and then select Configure and Enable Routing and Remote Access.
Follow the steps in the Routing and Remote Access Server Setup Wizard to install the service.

Note
On pages not mentioned in this guide, accept the default settings and click Next.
1. On the Configuration page, select Custom configuration, and then click Next.
2. Select the VPN access, NAT, and LAN routing check boxes, and then click Next.
3. Click Finish to complete the wizard. When the dialog box appears, click Start service.
Assign IP addresses to remote clients.

Right-click the server instance and go to Properties > IPv4 > static address pool > Add.

In the New IPv4 Address Range dialog box, enter 192.168.1.200 as the start IP address and 192.168.1.210 as the end IP address. Click OK. On the IPv4 tab, select the Enable IPv4 forwarding check box.
Add a NAT forwarding rule.
1. In the Routing and Remote Access console tree, select IPv4 > NAT, right-click NAT, and select New Interface.
2. Select the Ethernet interface and click OK.
3. In the Properties dialog box, select Public interface connected to the Internet and Enable NAT on this interface.

In the taskbar search box, search for and open Computer Management.
In the Computer Management console, go to Local Users and Groups. Right-click Users and select New User.
In the New User dialog box, enter a user name and password. Select the User cannot change password and Password never expires check boxes, and then click Create.

In this example, the user name is vpn-user.
After creating the user, right-click the new user name and select Properties.
In the Properties dialog box, click the Dial-in tab, and then select Allow access.

After you configure the VPN server, you can connect to it from a client.

Go to Start > Settings > Network & Internet > VPN and add a new VPN connection.
In the Add a VPN connection window, enter a connection name, server name or address, user name, and password. For the server name or address, use the public IP address of the VPN server. For the user name, use the user name that you created.

For VPN provider, select Windows (built-in). For VPN type, select Automatic. For Type of sign-in info, select User name and password.
Select the VPN connection that you just created and click Connect.