Connecting to Windows Server 2016 Essentials VPN without DirectAccess

Georg Dangl by Georg Dangl in Windows Server Thursday, April 27, 2017

Thursday, April 27, 2017

Connecting to Windows Server 2016 Essentials VPN without DirectAccess

Windows Server Essentials is a great option for your home network. I'm using it mostly for DNS, DHCP, client backups, storage and VPN but, really, you can do anything with it. The built-in Connector for Windows clients makes accessing your home network from anywhere charmingly easy, and Microsoft gives you a free *.remotewebaccess.com domain with dynamic DNS and automatic configuration on top of that. External clients connect via Microsoft's DirectAccess back home. In case you haven't heard of it, it's basically Windows-only proprietary VPN.

Before upgrading to Server 2016, I've used VPN extensively on my iPhone & iPad to access my home network. I chose to use L2PT with a PreSharedKey for connecting my iOS devices. Where I could simply use the GUI in Server 2012 R2, Server 2016 is less cooperative:

  Server 2016 Routing & RAS - Legacy Mode Disabled

If you're not fluent in German, the Routing & RAS app tells me that I can't use the GUI for configuration since legacy mode is disabled. And I can't enable it. That's bad, but since Microsoft ❤️ PowerShell, there are commandlets for everything! Just make sure to have the Remote Access Tools for Windows Powershell feature installed (it comes automatically with the Essentials role).

Windows Server 2016 - Remote Access PowerShell tools installation

User mazo22 at HomeServerShow nicely explained the command to set a PreSharedKey:

Set-VpnAuthProtocol -SharedSecret "YourSecretValueHere" -TunnelAuthProtocolsAdvertised PreSharedKey

The PreSharedKey is not persisted during reboots, for security reasons. For convenience reasons, there is Windows Task Scheduler. Create a job, make it run at system start and call C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe as programm and supply the path to your SetPreSharedKey.ps1 as argument.

But, for real: Here's a complete sample script that shows you how to keep the secret safe, even in a script. Don't store the PreSharedKey as plain text in the script!

Connecting your iPhone or iPad to your home server

Simply set up a new VPN connection in your device, use the L2TP type and your regular Active Directory username / password (without the domain specifier). The SharedSecret is what you've just set up.

Happy connecting!


Share this post


comments powered by Disqus

About me

Hi, my name's George! I love coding and blogging about it. I focus on all things around .Net, Web Development and DevOps.

DanglIT

Need a partner for DevOps, Web Services or Software Development?

Contact me at [email protected], +49 (173) 56 45 689 or visit my professional page!

Dangl.Blog();
// Just 💗 Coding

Social Links