How To: Install and Configure RRAS (Routing and Remote Access) VPN in Windows Server 2012 and 2016

Microsoft Networking

If you’re looking for an easy remote access solution for your network and you’re using Windows Server, you may want to consider installing the Routing and Remote Access Role included in Windows Server. There are different types of VPNs that you can use, such as PPTP, L2TP and SSTP.

This article will assume that you have an Active Directory Domain already configured within your network to control remote access. If you are not using ADDS yet, check out this article to get it configured. Please keep in mind that you will also need to forward the appropriate ports through your outside firewall to allow clients to connect from the outside.

Have a SonicWALL UTM Device? Consider Using SSL VPN Instead: Article Here

Installing the Routing and Remote Access Role

1. Log into the server with administrative credentials
2. Open Server Manager Server Manager Icon
3. On the Dashboard, locate and click Add roles and features
4. Click Next to skip the Before you begin page
5. Choose Role-based or feature-based installation and click Next


6. Make sure that the server you are installing on is selected from the pool. Click Next to continue.


7. Scroll through the list to locate Remote Access and select it. Click Next.

Select Server Roles Remote Access

8. You will be greeted with a welcome page for the Remote Access Role. Click Next to continue.

Remote Access Welcome Page Server 2016

9. Because we’re configuring this server for VPN connectivity, select DirectAccess and VPN (RAS) from the list, then when prompted, click Add Features in the pop up window. Click Next to continue.

Select Role Services Remote Access Wizard Server 2016

Add Features that are Required for DirectAccess and VPN Wizard Server 2016

10. The Wizard will now guide you through installing the Web Server Role (IIS) as the Remote Access Role has dependencies on IIS to function. Click Next to continue.

Web Server Role IIS Wizard Remote Access Server 2016

11. Leave the default options checked and click Next to continue.

Select Role Services Remote Access Wizard Server 2016 IIS Installation

12. Finally check the information provided and click Install to begin installing the Roles.

Confirm Installation Selections Remote Access Wizard Windows Server 2016

13. Once the installation is finished, click Close. Additional configuration will be required.

Installation Progress Configuration Required Remote Access Windows Server 2016

Configure the Remote Access Role

Now that the installation is completed, we will want to actually configure the role.

1. Log into the server with administrative credentials
2. Open Server Manager Server Manager Icon
. In the top right you will see the Action Required flag Action Required Server Manager Server 2016 , click the icon and click Open the Getting Started Wizard.

Open the Getting Started Wizard Remote Access Configuration Required

 Note: When I clicked this in Windows Server 2016 Technical Preview 4, nothing happened. I will continue by opening the Remote Access Management Console.

4. If the getting started wizard does not show up for you, go to Start > All Apps > Windows Administrative Tools > Remote Access Management

5. In the Remote Access Management Console, click DirectAccess and VPN under Configuration, then click Run the Getting Started Wizard

DirectAccess and VPN configuration

6. In the Configure Remote Access Wizard, choose whether to deploy Direct AccessVPN, or Deploy both DirectAccess and VPN (recommended).

Deply both DirectAccess and VPN Recommended

7. Choose the option that describes your network topology best. In most cases, this will be Behind an edge device (with a single network adapter). Then enter the outside host name or public IP Address that clients will use to connect to the server (for example,

Select the network topology of the server remote access windows server 2016

8. Finally, click Finish

Remote Access Getting Started Wizard Finish


We’ve completed all of the initial steps to get the server configured. You will need to configure your clients to connect using the built in VPN client in Microsoft Windows. Be sure that you either configure the correct NPS policies to allow access from your clients, or manually allowing users to connect by changing the setting on the Dial In tab within the user object in Active Directory.

Leave a Reply

Your email address will not be published. Required fields are marked *