How to set up L2TP/IPsec on Windows
L2TP/IPsec is built into iPhone, iPad, Mac and Windows, so no app is needed. You need the server address, your username and password, and the pre-shared key.
Last reviewed
What you need
- An active L2TP/IPsec configuration from this site
- Server address, username, password and pre-shared key (IPsec) from your configuration page
App
Built into Windows
Where each detail goes
| On your configuration page | In the app or settings |
|---|---|
| Server | Server / Server address / Gateway |
| Username | Account / User name |
| Password | Password |
| Pre-shared key (IPsec) | Secret / Shared secret / Pre-shared key |
Steps
-
Open Settings → Network & internet → VPN → Add VPN.
Illustration — your app may look slightly different. -
VPN provider: Windows (built-in). Server name or address: your Server.
Illustration — your app may look slightly different. -
VPN type: L2TP/IPsec with pre-shared key. Pre-shared key: your Pre-shared key.
Illustration — your app may look slightly different. -
Type of sign-in info: User name and password. Enter your username and password, then Save.
Illustration — your app may look slightly different. -
Click the new VPN and choose Connect.
Illustration — your app may look slightly different.
Check that it works
The VPN status shows "Connected". Search the web for "what is my IP"; the location should match your server country.
Disconnect
Open Settings → Network & internet → VPN and click Disconnect.
Tips
If it fails behind a home router (error 809), Windows may need the registry value AssumeUDPEncapsulationContextOnSendRule = 2 under HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent, followed by a restart. Only change the registry if you are comfortable doing so.
Troubleshooting
Authentication failed
Re-type the username, password and pre-shared key exactly as shown (they are case-sensitive). The configuration may also have expired.
Connects on mobile data but not on Wi-Fi
Some routers block the ports L2TP/IPsec uses (UDP 500 and 4500). Try another network or use WireGuard or OpenVPN.
The L2TP option is missing
Android 12 and newer, and some managed devices, no longer offer L2TP/IPsec. Use WireGuard or OpenVPN instead.