Set Up a Secure VPN Connection on Windows: IKEv2, WireGuard, and the L2TP Trap

A standard Windows 10 or 11 machine can hold a secure VPN connection two ways: the built-in client under Settings > Network & internet > VPN, which speaks IKEv2, L2TP/IPsec, SSTP, or PPTP; or the VPN provider's own app, which usually runs WireGuard or a proprietary tunnel that Windows can't configure natively. The built-in route is free but only as secure as the protocol you pick and the server you point it at.

"Secure" here means three things at once: encrypted traffic, a verified server identity, and a tunnel that survives sleep, Wi-Fi switching, and reboots. Most home users get one of the three and assume they have all three. The order below is deliberate — protocol choice first, because on Windows it changes everything downstream.

Pick the Protocol Before You Touch Settings

Windows ships four tunnel types in the built-in VPN client, and one of them is no longer defensible. Get the ranking in your head first, because you can't change protocol after the fact without deleting the profile.

The official guidance is unambiguous. Microsoft's own documentation has flagged PPTP as unsuitable for anything requiring confidentiality since the MS-CHAPv2 authentication weakness was published in 2012, and it keeps the protocol in Windows only for legacy compatibility. L2TP itself isn't broken; the problem is how home setups deploy it, almost always with a static pre-shared key that every device in the office shares.

That shared-key model is the reason to skip L2TP even when it "works fine." Anyone who obtains the PSK — a departing employee, a stolen config file, a screenshot of the router admin page — can impersonate the server to any client that trusts that key. IKEv2 replaces the shared secret with certificates, which lets the client verify the server's identity rather than just matching a password-like string.

WireGuard is the fastest of the set and the easiest to audit, at roughly 4,000 lines of code against the hundreds of thousands in IPsec stacks. Windows still can't create a WireGuard tunnel from the Settings app, so it always arrives through a provider's installer. If your VPN service offers WireGuard, use it. If you're connecting to a corporate or home server you administer yourself, IKEv2 is the native choice and the rest of this guide treats it as the reference protocol.

Read the Windows Build Before You Import a Profile

Two builds behave differently enough to change your steps. Check winver before starting; the dialog names the version and build number.

Windows 11 (any build from 22H2 onward, including the 24H2 and 25H2 releases) puts VPN under Settings > Network & internet > VPN, with the Add VPN button at the top of the list. The same profile editor exists on Windows 10 21H2 and 22H2 at Settings > Network & Internet > VPN, but the 22H2 update moved the "Allow VPN to connect while roaming" toggle and split the metered-connection behavior into a separate screen. If a support article shows a checkbox your machine doesn't have, you're on the wrong build, not the wrong account.

The protocol list also shrinks with edition. Windows 10/11 Home and Pro expose IKEv2, L2TP/IPsec, SSTP, and PPTP in the Add VPN dialog. The Always On VPN profile type is a Windows 10/11 Enterprise and Education feature deployed through PowerShell or Intune, not the Settings dialog, so don't hunt for it on a Home license.

From Windows 11 24H2, Microsoft began rolling out the Windows LAPS and Wi-Fi 7 changes alongside a reorganized Settings app that groups VPN under "Network & internet" with the adapter list rather than its own page. The profile fields are identical; the click path is one level shallower. IKEv2 profiles created on Windows 10 import cleanly into 11 in the reverse direction only if the certificate is present in the machine store.

Imported profiles also inherit the encryption suite from the server, not from Windows. A Windows 11 client negotiating with an old IKEv2 gateway may silently fall back to AES-128 if the gateway doesn't offer AES-256. You can't fix that client-side; the gateway's crypto policy has to change. Confirm the offered suite on the server console before blaming the laptop.

Create the IKEv2 Profile in Six Steps

Have the server address, the authentication method (certificate or username/password), and any pre-shared key your administrator issued in front of you. If you're the administrator, generate the certificate first; the profile can't complete without it.

1: Open Settings > Network & internet > VPN and click Add VPN. 2: Set VPN provider to Windows (built-in), Connection name to anything you'll recognize (the name is local only), and Server name or address to the hostname or IP. 3: Choose VPN type = IKEv2, then Type of sign-in info: Certificate if the server issued one, otherwise User name and password or Smart card. 4: Paste the User name and Password — leave both blank if you chose Certificate, and leave the pre-shared key field alone; IKEv2 with certificates doesn't use one. 5: Tick Remember my sign-in info only on a device with full-disk encryption and a login PIN or password. Skip it on a shared machine. 6: Click Save, then select the profile and press Connect. First connection may take 10–20 seconds while the tunnel negotiates.

If Connect fails immediately with error 809, the server isn't reachable on UDP 500 and 4500 — a firewall, not credentials. Error 691 means the username/password pair was rejected, and on IKEv2 it often points at an expired certificate rather than a wrong password; check the certificate's expiry date in certlm.msc under Personal > Certificates. Error 13801 signals the server certificate chain isn't trusted by the client, which on a self-hosted server usually means the root CA hasn't been imported into Trusted Root Certification Authorities.

Run the connection once over Ethernet before trusting it over Wi-Fi. IKEv2's MOBIKE extension is what lets the tunnel survive a switch from Wi-Fi to cellular or a move between access points, but only if the server advertises MOBIKE support. Many consumer routers running IKEv2 don't, so a laptop that drops the tunnel on every Wi-Fi handoff is telling you the server is the weak link.

Stop Split Tunneling From Leaking Your Real Address

Split tunneling lets some traffic skip the VPN. It's useful for a home NAS on the local subnet; misconfigured, it routes your browser around the tunnel while you believe you're covered.

Windows exposes it under the profile's Properties > Networking tab: untick Use default gateway on remote network to keep internet traffic local, or leave it ticked for full-tunnel. The safer Windows 11 path is the per-app split tunnel in Settings > Network & internet > VPN > (profile) > Allow VPN to connect while roaming, which doesn't touch routing but controls whether the profile auto-connects off your home network.

The failure case worth knowing: unchecking Use default gateway on a public Wi-Fi network leaves your DNS queries going to the café's router while your browsing appears encrypted. An attacker on that network can see every domain you resolve even though page contents stay scrambled. If you untick that box, set DNS manually to the VPN's resolver or a known encrypted resolver.

Per-app splitting in the Settings UI only works with the Windows VPN client, not with provider apps. Apps that already run their own tunnel stack — a corporate client, a game launcher with its own proxy — will conflict with the Windows profile if both claim the default route. Disconnect one before connecting the other.

Check what's actually happening with route print in Command Prompt: a full tunnel shows a 0.0.0.0 route pointing at the VPN adapter's gateway, while a split tunnel keeps your physical adapter's gateway as the default. That one line settles most "is it on?" arguments faster than any status icon.

Kill Switch and DNS: The Two Settings That Decide Whether It Holds

A VPN is only secure while it's connected, and Windows will happily fall back to your normal connection when the tunnel drops. The kill switch is what prevents that fallback.

Windows 11 has no system-wide kill switch toggle. The built-in equivalent is Always On VPN with a device tunnel and a lockdown firewall rule, which requires Enterprise or Education and a deployment tool; there's no Settings path. Practical alternatives: use a provider app with a kill switch (ExpressVPN, NordVPN, Proton VPN, and Mullvad all ship one — confirm in each vendor's current documentation, since feature names change), or build a Windows Firewall outbound rule that blocks all traffic except through the VPN adapter.

The firewall route works on any edition. Create an outbound rule blocking all programs, then add allow rules for the VPN adapter's IP range and the VPN client executable. Test it by disabling the network adapter mid-session and watching whether a browser still loads a page. If it does, your rules have a gap — usually IPv6, which the block-all rule must cover separately because Windows treats v4 and v6 rules as independent.

DNS deserves the same suspicion. With a full tunnel and the provider's DNS pushed through the tunnel, queries are encrypted along with everything else. With split tunneling or a misconfigured adapter, Windows may still prefer the physical adapter's DNS servers. Set the VPN adapter's DNS explicitly in the profile's IPv4 properties, and on Windows 11 22H2 or later enable DNS over HTTPS for that adapter under Settings > Network & internet > Ethernet/Wi-Fi > DNS server assignment.

One measured comparison is worth keeping in mind: WireGuard's handshake uses about 1 round trip and rekeys every 2 minutes by default, while IKEv2 rekeys on a configurable interval, commonly 8 hours on consumer gateways. Neither number makes one more secure in ordinary use, but the rekey cadence is why a WireGuard tunnel that survives a laptop sleep tends to reconnect faster than an IKEv2 one.

Test the Tunnel Yourself in Four Checks

Trust the connection after you've watched it fail and recover, not before. Four checks take about 10 minutes.

1: Address check. Visit a site that reports your public IP both before and after connecting. The two addresses must differ, and the post-connection address must sit in the VPN provider's announced range — most providers publish theirs, and a mismatch means traffic is exiting somewhere unexpected. 2: DNS leak check. Use a DNS leak test service and confirm the resolver shown belongs to the VPN, not your ISP. On Windows, nslookup in Command Prompt against the VPN adapter's DNS server should answer from that server. 3: WebRTC check. Open a browser and run a WebRTC leak test; if it reports your local network address, the browser is bypassing the tunnel for peer-to-peer calls, which leaks the real address to any site that asks. 4: Drop test. Disconnect the physical adapter for 10 seconds while connected, then reconnect. With the kill switch working, no page loads during the gap. Without it, you'll see the fallback in real time.

Repeat check four after every Windows feature update, since Microsoft has shipped updates that reset the firewall's outbound defaults. Note the results somewhere; a connection that passed in March and fails in October tells you which change broke it.

If the drop test fails but everything else passes, the fix order is kill switch first, DNS second, adapter metrics last. Windows prioritizes adapters by a metric value, and a stale Wi-Fi adapter can outrank the VPN even when the tunnel is active — Get-NetIPInterface in PowerShell lists the metrics if you want to see which one Windows prefers.

When the Built-In Client Refuses to Connect

Most connection failures on Windows land in a short list, and the error code points at which one you've hit. Work the code before reinstalling anything.

Error 868 is the one that catches people on captive-portal networks: the VPN profile resolves the server name through the portal's DNS, which blocks it. Connect to a normal network once, or bake the server's IP into the profile instead of its hostname.

If IKEv2 fails on a network you don't control — a hotel, an airport, some corporate guest Wi-Fi — switch the profile to SSTP for that session. SSTP runs over TCP 443, the same port as HTTPS, so it passes through firewalls that block UDP entirely. It's slower, and its security depends on the TLS configuration of the server, which on older Windows Server deployments may still allow TLS 1.0. Check the server's TLS version before relying on SSTP for anything sensitive.

Recreating the profile takes 60 seconds and clears a surprising number of 720 and 691 errors caused by a corrupted credential entry. Delete the profile under Settings, reboot, and re-add it before you start editing registry keys or reinstalling the WAN Miniport drivers.

Cut Connection Time With a Short PowerShell Setup

If you manage more than one Windows machine, the Settings UI costs you minutes per device. Add-VpnConnection does the same job in one line and creates a profile identical to the wizard's.

Run this in an elevated PowerShell window on Windows 10 or 11:

-EncryptionLevel Required forces the client to refuse a connection that falls below the configured cipher strength, which is the setting most people forget. Swap -TunnelType IKEv2 for Sstp when you need the TCP 443 fallback, and drop -RememberCredential on shared hardware.

For a certificate-authenticated profile, add -AuthenticationMethod MachineCertificate and confirm the certificate sits in the Local Machine > Personal store, not the user store. Profiles created this way appear in the Settings list immediately and can be exported and reimported on other machines with Export-VpnProfile, though the export contains the server address and not the certificate.

The time saving is real but modest per device — maybe two minutes against the wizard. The bigger win is consistency: sixty laptops configured by script all negotiate the same way, and one that fails stands out instead of blending in with fifty-nine hand-built variants.

Reconnect Automatically Without Giving Up the Lock

Auto-connect is convenient and slightly risky, so decide which machines get it.

The Connect automatically checkbox on the profile makes Windows dial the VPN whenever the network is available. On a laptop that leaves the house, that means the tunnel comes up on café Wi-Fi before you've logged in to anything, which is when you want it. On a desktop that never moves, it's harmless. On a shared family PC, it means the profile connects under whichever account is signed in.

Always On VPN is the enterprise answer: a device tunnel that connects before user login and a user tunnel that follows the user profile, both enforced through a firewall profile that blocks traffic outside the tunnel. It needs Windows 10/11 Enterprise or Education, a PKI for certificates, and a deployment path such as Intune or a PowerShell script run at provisioning. Home and Pro can't use it; the lockdown firewall rule described earlier is the closest substitute.

Auto-trigger rules in Windows 11 let you connect on demand rather than always. Under the profile's properties you can set it to connect when a specific app launches, or when the network is public. That middle ground — connect on untrusted networks only — covers most laptop use without paying the Always On VPN complexity tax.

Measure the cost before committing to always-on: a full-tunnel IKEv2 connection adds roughly 5–15 ms of latency to nearby servers and reduces throughput by 10–30% depending on the server's capacity and your ISP's peering. For video calls and large uploads, that's the difference between usable and irritating. Confirm on your own link by comparing a speed test with and without the tunnel; the range moves with distance to the server, so treat any published figure as a starting point only.

FAQ

Does Windows 11 have a built-in VPN?

Yes, and it has since Windows 10. Settings > Network & internet > VPN accepts IKEv2, L2TP/IPsec, SSTP, and PPTP profiles without any third-party software. What Windows doesn't include is a VPN service — you still need a server to connect to, either a corporate gateway, a self-hosted box, or a commercial provider that publishes manual IKEv2 settings.

Is L2TP/IPsec still safe to use in 2026?

It's the weakest of the options Windows still offers, and the pre-shared-key model most home setups use is the specific problem. A leaked PSK lets an attacker impersonate the server, and the protocol has no forward secrecy by default. Use it only when a legacy appliance gives you no alternative, and rotate the PSK if anyone who knew it leaves.

Why does my VPN disconnect when the laptop sleeps?

Windows tears down the network stack on sleep, and IKEv2 only re-establishes cleanly if the server supports MOBIKE. WireGuard reconnects faster because it re-handshakes within seconds of the interface coming back. On IKEv2, set the profile to connect automatically and expect a 10–20 second reconnection after wake; a tunnel that never returns points at a server-side timeout.

Will a VPN slow down my internet?

Usually, yes — by 10–30% on a full tunnel in ordinary home use, and more if the server is far away or oversubscribed. WireGuard typically loses less throughput than IKEv2 at the same distance. Split tunneling restores local speed for traffic that doesn't need the tunnel, at the cost of the leak exposure described above.

Can I use the Windows VPN client with NordVPN, ExpressVPN, or Proton VPN?

Only if the provider publishes manual IKEv2 or SSTP server settings, which some do and some don't. Their apps use proprietary or WireGuard tunnels that Windows can't create natively, and their kill switches only work inside the app. Check the provider's manual-setup page before assuming the built-in client will connect.

What's the difference between a VPN and a proxy on Windows?

A proxy reroutes traffic for one app, usually unencrypted, and a VPN encrypts the whole adapter's traffic at the network layer. A proxy hides your address from the destination site; a VPN also hides it from your ISP and the local network. Windows' proxy setting under Settings > Network & internet > Proxy does not encrypt anything.

Does the built-in Windows VPN have a kill switch?

Not as a toggle. The nearest native equivalent is Always On VPN with a lockdown firewall profile, which requires Windows Enterprise or Education. On Home and Pro, you build one from Windows Firewall outbound rules or use a provider app that ships its own. Test it with the adapter-drop method before trusting it.

How do I remove a VPN profile completely?

Settings > Network & internet > VPN > select the profile > Remove, then reboot. If the profile was deployed by an organization, a management policy may recreate it on the next sign-in, so check with your IT administrator before assuming it's gone. On PowerShell, Remove-VpnConnection -Name "Office IKEv2" does the same thing and reports success or the reason it failed.