SSTP VPN: What it is and how it works

What is SSTP?

SSTP, or Secure Socket Tunneling Protocol, is a VPN protocol developed by Microsoft to create encrypted VPN tunnels for secure communication between a client device and a server. It was introduced as a replacement for older protocols like PPTP and L2TP/IPSec, which lacked sufficient security.

SSTP uses SSL/TLS encryption, the same technology behind HTTPS (the secure, encrypted version of HTTP), to provide strong data protection. By working over commonly used network ports, SSTP avoids restrictions and ensures reliable connections.

While the Secure Socket Tunneling Protocol is natively integrated into Windows operating systems, it is not limited to them. Users can also configure it on Linux and BSD systems using third-party applications. Its primary purpose is to secure Point-to-Point Protocol (PPP) traffic, which makes it a dependable choice for protecting sensitive communications.

How does SSTP work?

A key strength of SSTP is its ability to bypass firewalls and avoid detection on restrictive networks, including those imposed by internet service providers (ISPs). SSTP achieves this goal by using TCP port 443, the same port used for HTTPS traffic.

Since port 443 is critical for secure web browsing, most networks, including those running Windows-based SSTP VPNs, keep it open by default. By disguising its VPN traffic as standard HTTPS activity, SSTP avoids detection and restrictions.

SSTP initiates an SSL/TLS handshake, which is the same process used for establishing secure HTTPS connections. This handshake verifies the server's identity and creates a secure, encrypted link between the client and the server. By mimicking standard HTTPS behavior, SSTP ensures that its communication is indistinguishable from regular HTTPS traffic.

After authentication, SSTP encapsulates PPP frames within HTTPS traffic. This process encrypts the data while making it appear as regular HTTPS activity, which allows it to pass through firewall restrictions or network monitoring tools undetected.

Does SSTP provide built-in encryption?

Yes, SSTP provides native encryption through its integration with SSL/TLS. By contrast, protocols like L2TP/IPSec rely on IPSec for encryption and key management. L2TP itself does not provide encryption and must be paired with IPSec to ensure data confidentiality and security. SSTP’s built-in architecture makes it more efficient while maintaining strong protection for secure internet connectivity without requiring the additional setup that L2TP/IPSec depends upon.

What other VPN protocols use SSL/TLS for encryption?

Several VPN protocols, in addition to SSTP, use SSL/TLS encryption to secure data during transmission. Examples include OpenVPN, which uses OpenSSL for authentication and encryption, and SoftEther, which integrates SSL/TLS to create secure tunnels for data transmission across networks. Each protocol has unique features designed for different use cases.

SSTP vs. OpenVPN vs. WireGuard

SSTP, OpenVPN, and WireGuard, a VPN protocol known for its speed and lightweight design, differ in several key areas, including security, compatibility, and performance.

Which protocol should you use to create a secure network connection at a remote site?

If you need a secure network connection at a remote site, SSTP is a good choice for environments running Windows due to its native integration and ease of setup. However, for broader compatibility across other operating systems like macOS, Linux, Android, and iOS, or for higher performance, OpenVPN and WireGuard VPN are better options.

What other secure protocol relies on port 443?

In addition to SSTP and HTTPS, you can configure OpenVPN to use TCP port 443. This configuration allows OpenVPN traffic to resemble HTTPS traffic, which makes it easier for the VPN connection to bypass firewalls and network restrictions.

However, while using port 443 helps evade basic blocks, OpenVPN traffic can still be identified by advanced detection methods like deep packet inspection (DPI) unless obfuscated. With proper obfuscation techniques, all three protocols — SSTP, HTTPS, and OpenVPN — become effective tools for navigating restrictive networks.

Pros and cons of SSTP

Like any VPN protocol, SSTP has its strengths and limitations.

Pros:

• Provides strong security.

• Difficult to block due to its ability to masquerade as HTTPS traffic.

• Easy to use and configure, especially on Windows devices because of native integration.

Cons:

• Closed source, proprietary protocol, which means it lacks public transparency and code auditing.

• Only supports user authentication, which can limit its functionality in more advanced use cases.

• It can be slower compared to other VPN protocols due to its reliance on TCP connections.

How to connect to an SSTP VPN

SSTP is often included as an option in VPN services, whether you’re using it at home or work. If you’re unsure whether your VPN supports SSTP, you can check with your service provider or system administrator. 

Once confirmed, follow these steps to configure the SSTP VPN connection on the Windows 11 operating system:

1. 1.

   Open “Settings” on your Windows computer.

2. 2.

   Click on “Network and internet” and then choose “VPN.”

   
3. 3.

   Click on “Add VPN” in the top right corner.

   
4. 4.

   Select or enter the following details and then press “Save.”

   

   • VPN provider: “Windows (built-in)”
   • Connection name: “My SSTP VPN” (you can give it any name you prefer)
   • Server name or address: “nordvpn.com” (or the server address provided by your VPN service)
   • VPN type: “Secure Socket Tunneling Protocol (SSTP)”
   • Type of sign-in info: “Username and password”
   • User name: [Your VPN username] (Enter your username if your VPN provider requires username/password authentication. You can skip this field if your provider uses another authentication method, such as certificates.)
   • Password: [Your VPN password] (Enter your password if your VPN provider requires it for authentication.)
5. 5.

   Click “Connect.”

   

These are general guidelines for establishing an SSTP VPN connection. The instructions may vary depending on your operating system and VPN provider. If you encounter problems connecting to an SSTP VPN, contact your VPN customer service or system administrator.