What Is L2TP/IPsec?
Built on L2TP, which RFC 2661 described back in 1999, L2TP/IPsec is a legacy VPN protocol with a client built into Windows, macOS and iOS (Android 12 and later dropped it). An L2TP VPN needs no extra app on those systems, yet Microsoft has stopped recommending L2TP and deprecated it for future Windows Server versions. SHP.network does not offer L2TP among its 7 protocols. For a built-in VPN on your own server, SHP.network sets up IKEv2 instead, ready within 10 minutes of payment.
L2TP/IPsec protocol basics
The name L2TP stands for Layer Two Tunneling Protocol. L2TP grew out of Cisco's L2F and borrowed from PPTP; engineers from Cisco, Microsoft and other companies wrote its standard, RFC 2661, published in August 1999. The L2TP protocol carries traffic but encrypts nothing on its own. To protect the data, it runs together with IPsec (as RFC 3193 of November 2001 specified), hence the slash in the name.
How L2TP/IPsec works
Your device first wraps its traffic in PPP frames, and L2TP carries them through an L2TP tunnel over UDP port 1701. IPsec ESP then secures each resulting packet as a whole, so the data travels in two layers of encapsulation. Beforehand, both sides agree on keys through IKE over UDP port 500, or 4500 when a NAT router sits in between. RFC 3193 makes support for IPsec transport mode mandatory in this pairing; tunnel mode stays optional.
L2TP vs PPTP
PPTP comes from the same generation: its specification, RFC 2637, appeared in July 1999, and the protocol runs over TCP port 1723 with GRE. The sign-in method widely used in PPTP setups, MS-CHAP v2, is broken. In 2012, Microsoft warned that published attack code can recover user credentials and advised securing the tunnel with PEAP or moving to L2TP, IKEv2 or SSTP. Apple removed PPTP in iOS 10 and macOS Sierra, and its devices no longer offer it.
L2TP/IPsec advantages and disadvantages
Built-in clients are the protocol's strength, while on security it falls behind newer designs.
| L2TP/IPsec | |
|---|---|
| Built-in client | Windows, macOS and iOS (not Android 12 and later) |
| Open standard | RFC 2661 on the IETF standards track |
| Encryption | IPsec ESP protects every packet |
| Microsoft's view | not recommended, deprecated for future Windows Server versions, off by default in new Windows Server 2025 VPN server setups |
| Pre-shared key | Microsoft calls it less secure than certificates |
| Blocking | fixed ports UDP 500, 4500 and 1701 are easy to block |
| Speed | double encapsulation adds overhead |
L2TP compared to other VPN protocols
In a side-by-side comparison with PPTP and each newer VPN protocol, L2TP/IPsec trails IKEv2 on speed and security, and none of the five resists DPI well.
| L2TP/IPsec | PPTP | IKEv2 | WireGuard | OpenVPN | |
|---|---|---|---|---|---|
| Speed | moderate: double encapsulation adds overhead | high | high | high | moderate |
| Security | not recommended by Microsoft | broken: MS-CHAP v2 credentials can be recovered | IETF standard with years of peer review | formally verified protocol | repeatedly audited, most recently by SRLabs in 2026 |
| Resistance to DPI | weak: fixed ports UDP 500, 4500 and 1701 | weak: TCP 1723 and GRE | weak: fixed UDP ports 500 and 4500 | weak: not built to bypass blocks | weak: not built to bypass blocks |
| Built into the OS | Windows, macOS, iOS | Windows | Windows, macOS, iOS | through the WireGuard app | through the OpenVPN Connect app |
How to set up an L2TP VPN connection
SHP.network leaves L2TP/IPsec out of its protocols, but with root access you can set up an L2TP connection on your own server yourself.
Order a server with a clean OS
Pick a plan and a city on SHP.network and choose no protocol: you get Ubuntu 24.04 without any VPN software. Root access over SSH comes with every plan (including the 7-day trial).
Install the server software
Over SSH, set up strongSwan or Libreswan for IPsec together with xl2tpd. Then add a pre-shared key and user accounts, and open UDP ports 500 and 4500 plus ESP (IP protocol 50) in the firewall that SHP.network configures on every server.
Add the VPN on your device
In the built-in VPN settings, choose L2TP/IPsec and enter the server's IP address, the pre-shared key, your username and password.
Modern alternatives to L2TP
Instead of L2TP/IPsec, pick one of the VPN protocols that SHP.network installs on your server:
Built in like L2TP
IKEv2 works with the VPN clients of Windows, macOS and iOS, and SHP.network sets it up on your server within 10 minutes. On Android, it connects through the strongSwan app.
Built for speed
WireGuard is quick, and a Tamarin proof formally verifies the protocol.
Time-tested and audited
If you are weighing L2TP vs OpenVPN, the latter is worth a look: it has been audited repeatedly, most recently by SRLabs in 2026.
A 7-day trial on the Basic plan costs €1.
Deploy IKEv2 on your serverFrequently asked questions
The Layer Two Tunneling Protocol from RFC 2661 (1999). It carries PPP frames through a tunnel but has no encryption of its own, which is why it runs together with IPsec.
L2TP itself runs on UDP 1701, while the IKE key exchange takes port 500 and NAT traversal 4500, also over UDP.
Not for new setups. Microsoft does not recommend L2TP because it lacks security features, and new Windows Server 2025 VPN server installations refuse it by default, so IKEv2 is the better choice. Where L2TP stays in use, the same vendor advises certificates over pre-shared keys.
Yes. L2TP/IPsec secures the traffic, while PPTP commonly relies on MS-CHAP v2 sign-ins that attackers can crack, and Apple devices no longer offer the older protocol.
IKEv2. Microsoft recommends the move, Windows, macOS and iOS have a built-in IKEv2 client too, and SHP.network installs this protocol on your own server within 10 minutes.
Not on Windows, macOS, iOS and iPadOS, where the client is built in: you need only the server address, a pre-shared key, a username and a password. Android 12 and later no longer include it.