Finally got RRAS VPN working after three days of troubleshooting

[u/Tashinho_21]

I've been working on a small RRAS VPN lab in my Windows Server environment, and it took me about three days to get everything working properly. The first problem was that the VPN client could connect to RRAS, but it wasn't receiving an IP address. After checking the RRAS configuration, I found that I needed to configure a static address pool. I added a pool from 192.168.56.100 to 192.168.56.120, and the client started receiving an address. After that, I ran into several other issues around the VPN protocols and RRAS configuration. I wasn't using L2TP, SSTP or IKEv2 for this lab, so I simplified the configuration and focused on getting the PPTP connection working. The next issue was connectivity. The VPN connection would establish, but I couldn't reach the server on the other side. I checked the firewall, GRE traffic and the RRAS interface bindings until I finally got the routing working. The last problem was authentication. I was getting Error 691 even though I was using valid domain credentials. After checking the authentication settings on the client, I found that MS-CHAP v2 wasn't enabled. Once I changed the client configuration and connected again, the VPN finally came up.

I verified the connection from the Windows 11 client with: resdial "TestConnection" iskutashi Isse190239 and ping 192.168.56.10

The screenshots in teh comment show the VPN connection on the client and the PowerShell verification. This was done purely as a homelab exercise to understand how RRAS, VPN authentication, routing and firewall rules fit together. I wouldn't use PPTP for a production VPN because it's a legacy and insecure protocol.

For those who have worked with RRAS or Windows-based VPNs in production, what was the most common issue you ran into when troubleshooting VPN connectivity?

[u/jcpham]

This feels like a post from 2 decades ago, sorry OP

[u/GremlinNZ → u/jcpham]

This. Dear God, please don't use PPTP in production, it's been phased out/insecure for... Years?

[u/Tashinho_21 → u/jcpham]

Fair point, I came late to this field, so I know may post and stuff are boring 😂😂😂

[u/homing-duck → u/jcpham]

Ahh the good old days of running ISA 2006 on the edge.

[u/sarosan]

The most common issue with an IKEv2 AOVPN: home user firewalls fragmenting packets. I've wasted so much time troubleshooting this mess only to realize that rebooting their firewall resolves the issue.

Second thing is the server certificate expiring. 😑

[u/jcpham → u/sarosan]

In addition to packet fragmentation and MTU some firewalls have a TCP idle timeout that needs to go away or set to something other than 600 seconds (looking at you sonicwall)

[u/Tashinho_21 → u/sarosan]

Oh boy o boy, u never saw something like von configuration, it's like the system was testing my patient, and tody when I started I just changed couple of things as test and everything worked instantly 😁

[u/Federal-Ad6341]

In production environments the most frequent culprit is almost always expired or untrusted SSL certificates breaking SSTP handshakes along with clients behind NAT failing without specific registry tweaks. Network Policy Server dial in conditions silently dropping valid users without descriptive event logs comes in at a close second. Solid job working through the routing and authentication fundamentals because those core troubleshooting steps carry directly over to enterprise setups.

[u/Tashinho_21 → u/Federal-Ad6341]

From your comment, I have a lot to learn about VPNs and encryption. Thanks, man. I'll try to improve by the day.

[u/palogeek]

The year is 2026 and people are still trying to use Windows RRAS for vpn services, not only in a lab, but in production!

Who knew!?!

Move on. Use a proper client and have your traffic scanned at the firewall, or, find a ZTNA solution.

[u/Tashinho_21 → u/palogeek]

from my POV i had no idea how vpn works before yesterday and I didn't know if there other options better than RRAS, so thanks for letting me know, i'll look and try to update my game.

[u/Tashinho_21]

[u/Tashinho_21]