Add a site to a site-to-site (S2S) VPN infrastructure via PPTP/L2TP on Windows Server 2022

6.2. Create VPN tunnels and configure routing between site 3 (Nice) and your physical sites (Brussels and Paris)

To begin, go to the VPN server at site 3 (Nice) to create on-demand connections and configure routing to the other VPN servers at your other sites.

6.2.1. Create the VPN tunnel between site 3 (Nice) and site 1 (Brussels) using PPTP

On the VPN server for site 3 (Nice), go to the "Network Interfaces" section.

Right-click "New on-demand connection interface".

Enter the name of the remote router.
In this first case: brux.

Select the "Connect using a virtual private network (VPN)" option.

Select your preferred protocol: PPTP or L2TP.
L2TP (more stable and secure) is recommended over PPTP (less secure).

Enter the public IP address (the one provided by your ISP) of the remote VPN server.

Important : in our case, this would be the public IP address of our "brux-vpn" server located in Brussels.
However, since everything is virtualized for this tutorial, we used several virtual switches to simulate the interconnection of our physical sites via a WAN.
This is why a private (local) IP address appears in our example.
But in a production environment, this would be a public IP address. This also means opening and correctly forwarding the appropriate ports in your ISP's router or modem/router for the remote VPN server.

Check only the "Route packets on this interface" box.

Click on "Add".

Enter the network ID present at the remote site.
In our case, the subnet used at site 1 (Brussels) is "10.0.1.X".

This gives:

• Destination : 10.0.1.0.
• Subnet mask : 255.255.255.0.

For the metric, simply type the number "1".
This is the priority level, but if only one network path exists to this subnet, simply enter the value "1".

Click on "Next".

Enter the credentials for the "niceuser" user account.

Important : the user account to use is the one created on the remote VPN server, but which corresponds to the source VPN server.
In other words, on our "NICE-VPN" server where we configure this on-demand connection, we must use the "niceuser" user account created on the "BRUX-VPN" VPN server.

Click on "Finish".

Your new on-demand connection "brux" that you just created appears in the "Network Interfaces" section.
Double-click on it.

In the "Options" tab, select the "Permanent connection" type of connection.

In the "Security" tab, you will see the type of VPN network you previously selected in the wizard.

Warning : if you chose the L2TP protocol, you will see in the next step of this tutorial that an additional step is required for it to work.

In the "IPv4 -> Static Routes" section, you will see that a static route has been added with the remote site's subnet and the name of the relevant request connection interface.

Therefore, your VPN server knows that the "10.0.1.0" subnet is accessible via the "brux" request connection interface.

6.2.2. Configure the VPN tunnel between site 3 (Nice) and site 1 (Brussels) to use L2TP

To improve the security and stability of your VPN tunnel, you should switch to the L2TP protocol instead of PPTP.
To do this, in the "Network Interfaces" section of your "NICE-VPN" server, double-click on the "brux" connection request.

In the "Security" tab, choose the VPN network type "L2TP (Layer 2 Tunneling Protocol) with IPsec (L2TP/IPsec)".

Next, click on the "Advanced settings" button located just below.

In the small "Advanced Properties" window that appears, select the "L2TP" option and type the pre-shared key set on the remote VPN server.

In our case, for our connection to the "brux" request, we must therefore specify the pre-shared key defined on the VPN server at site 1 (Brussels).
To define this pre-shared key (if it hasn't already been done), right-click and select "Properties" on the name of the remote VPN server ("BRUX-VPN" in our case).

In the "Security" tab, locate the "Allow custom IPsec policy..." option and the pre-shared key to define.
If this key is already defined, Windows Server will not display it (as a security measure) and will only show asterisks (*****).

Next, in the properties of the "brux" on-demand connection, click OK.

6.2.3. Configure the routing between site 3 (Nice) and site 1 (Brussels)

Although your VPN server knows the path to access the remote network (via the on-demand connection you just created), the on-demand connection interface must also be added to your server's NAT for packets to be routed correctly.

To do this, on the VPN server for site 3 (Nice), go to the "IPv4 -> NAT" section and right-click "New Interface" in the right-hand pane.

In the "New Interface for Network Address Translation (NAT)" window, select the new on-demand connection interface "brux" that you just created and click OK.

Simply select "Private interface connected to the private network" and click OK.

The on-demand connection interface "brux" appears in the "NAT" list.

Note: a router can route packets between multiple networks (even if there are more than two).

Restart your VPN server.