Configure IPsec/L2TP VPN Clients

Note: You may also connect using the faster IPsec/XAuth mode

follow these steps to configure your devices. IPsec/L2TP is natively supported by Android, iOS, OS X, and Windows. There is no additional software to install. Setup should only take a few minutes. In case you are unable to connect, first check to make sure the VPN credentials were entered correctly.

Platforms
Troubleshooting

Windows

Windows 10 and 8.x

Right-click on the wireless/network icon in your system tray.
Select Open Network and Sharing Center. Or, if using Windows 10 version 1709 or newer, select Open Network & Internet settings, then on the page that opens, click Network and Sharing Center.
Click Set up a new connection or network.
Select Connect to a workplace and click Next.
Click Use my Internet connection (VPN).
Enter Your VPN Server IP in the Internet address field.
Enter anything you like in the Destination name field, and then click Create.
Return to Network and Sharing Center. On the left, click Change adapter settings.
Right-click on the new VPN entry and choose Properties.
Click the Security tab. Select "Layer 2 Tunneling Protocol with IPsec (L2TP/IPSec)" for the Type of VPN.
Click Allow these protocols. Check the "Challenge Handshake Authentication Protocol (CHAP)" and "Microsoft CHAP Version 2 (MS-CHAP v2)" checkboxes.
Click the Advanced settings button.
Select Use preshared key for authentication and enter Your VPN IPsec PSK for the Key.
Click OK to close the Advanced settings.
Click OK to save the VPN connection details.

Note: A one-time registry change is required before connecting. See details below.

Alternatively, instead of following the steps above, you may create the VPN connection using these Windows PowerShell commands. Replace Your VPN Server IP and Your VPN IPsec PSK with your own values, enclosed in single quotes:

# Disable persistent command history
Set-PSReadlineOption –HistorySaveStyle SaveNothing
# Create VPN connection
Add-VpnConnection -Name 'My IPsec VPN' -ServerAddress 'Your VPN Server IP' -L2tpPsk 'Your VPN IPsec PSK' -TunnelType L2tp -EncryptionLevel Required -AuthenticationMethod Chap,MSChapv2 -Force -RememberCredential -PassThru
# Ignore the data encryption warning (data is encrypted in the IPsec tunnel)

Windows 7, Vista and XP

Click on the Start Menu and go to the Control Panel.
Go to the Network and Internet section.
Click Network and Sharing Center.
Click Set up a new connection or network.
Select Connect to a workplace and click Next.
Click Use my Internet connection (VPN).
Enter Your VPN Server IP in the Internet address field.
Enter anything you like in the Destination name field.
Check the Don't connect now; just set it up so I can connect later checkbox.
Click Next.
Enter Your VPN Username in the User name field.
Enter Your VPN Password in the Password field.
Check the Remember this password checkbox.
Click Create, and then Close.
Return to Network and Sharing Center. On the left, click Change adapter settings.
Right-click on the new VPN entry and choose Properties.
Click the Options tab and uncheck Include Windows logon domain.
Click the Security tab. Select "Layer 2 Tunneling Protocol with IPsec (L2TP/IPSec)" for the Type of VPN.
Click Allow these protocols. Check the "Challenge Handshake Authentication Protocol (CHAP)" and "Microsoft CHAP Version 2 (MS-CHAP v2)" checkboxes.
Click the Advanced settings button.
Select Use preshared key for authentication and enter Your VPN IPsec PSK for the Key.
Click OK to close the Advanced settings.
Click OK to save the VPN connection details.

Note: This one-time registry change is required if the VPN server and/or client is behind NAT (e.g. home router).

To connect to the VPN: Click on the wireless/network icon in your system tray, select the new VPN entry, and click Connect. If prompted, enter Your VPN Username and Password, then click OK. You can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your public IP address is Your VPN Server IP".