What Is SSTP?
Short for Secure Socket Tunneling Protocol, SSTP is a Microsoft VPN protocol that carries your traffic inside HTTPS, over SSL/TLS on TCP port 443. Windows has the client built in, so no extra app is needed there, while macOS, iOS, Linux and Android connect through third-party apps. SHP.network does not offer SSTP among its 7 protocols. If you want a modern VPN protocol on your own server, SHP.network sets up IKEv2, WireGuard or OpenVPN for you within 10 minutes of payment.
- Still accepted by Windows Server 2025
- Recommended by Microsoft in place of PPTP and L2TP
- Root access on your SHP.network server lets you install SSTP
SSTP VPN protocol basics
Microsoft created the SSTP protocol for remote access to corporate networks at a time when hotels and other venues often blocked PPTP and L2TP/IPsec traffic; many internet providers also dropped the GRE packets that PPTP depends on. SSTP arrived with Windows Server 2008 and Windows Vista SP1 in 2008; Microsoft had published its specification in 2007. Because the tunnel runs over TCP 443, the same port HTTPS websites use, SSTP gets through most firewalls and web proxies. It needs only this one port, while IKEv2, for comparison, relies on UDP 500 and 4500. SSTP's specification, MS-SSTP, is public, so other developers can build compatible clients and servers. With the VPN type set to Automatic, Windows also tries SSTP among other protocols. On the server side, Windows Server accepts these connections through its Routing and Remote Access role.
How SSTP works
Each session goes through several stages before any data moves. Your device opens a TCP connection to port 443 on the server, and the two sides complete a TLS handshake in which the server presents its certificate. Windows accepts that certificate only if a trusted authority issued it and the name on it matches the address you entered. Over the encrypted channel, the client sends an HTTPS request, negotiates the SSTP tunnel and signs you in through PPP. From that point, IP packets travel inside PPP frames, which SSTP wraps into TLS records carried over TCP.
SSTP encryption and cryptography
Encryption comes from TLS, which negotiates the cipher for each session. The server proves its identity through a certificate, and you sign in afterwards over PPP, for example with MS-CHAPv2 or EAP-TLS. To tie the two checks together, SSTP uses crypto binding: the client sends a value based on the PPP sign-in and protected with HMAC-SHA1 or HMAC-SHA256, which stops a man-in-the-middle from relaying the session. In TLS, only the server has to prove who it is; it checks you later, during the PPP sign-in. Without a link between the two checks, a man-in-the-middle could open its own HTTPS connection to the server and pass along the PPP packets you sent the attacker when joining another network, such as a wireless one. The specification makes crypto binding mandatory for every SSTP implementation. With crypto binding, the client proves that it is the device the server signed in and that the sign-in was made for this SSTP connection.
SSTP advantages and disadvantages
SSTP owes its strengths to HTTPS; TCP and a closed Microsoft implementation set the limits.
| SSTP | |
|---|---|
| Built-in client | the SSTP Windows client needs no extra app |
| Firewall traversal | TCP 443 gets through most firewalls |
| Web proxies | the HTTPS connection also works through most web proxies |
| Corporate networks | Windows Server 2025 still accepts SSTP connections |
| Sign-in | PPP supports strong methods such as EAP-TLS |
| Platforms | built into Windows; apps for macOS, iOS, Linux and Android |
| Source code | Microsoft's own implementation is closed, although the protocol specification is public and open-source implementations exist |
| Transport | runs over TCP only |
Is SSTP safe?
Microsoft treats SSTP as a secure option: the company recommends SSTP and IKEv2 in place of PPTP and L2TP, and Windows Server 2025 still accepts the protocol. TLS protects the tunnel, the server proves itself with a certificate, and crypto binding guards the sign-in, which happens inside the encrypted channel. Microsoft's own implementation is closed, though. For new setups, SHP.network recommends WireGuard or OpenVPN. The older protocols that SSTP replaces fare worse: since Windows Server 2025, new Routing and Remote Access setups reject PPTP and L2TP connections by default, and Microsoft says both have well-documented vulnerabilities and no longer meet current security standards. Some SSTP servers are open source: SoftEther VPN Server under the Apache-2.0 license and accel-ppp, a PPTP, L2TP and SSTP server for Linux, under GPL-2.0. On your own server you can run one of them, so the SSTP implementation you use is one whose code anyone can read.
SSTP compared to other VPN protocols
SSTP shares its port with HTTPS websites. OpenVPN, IKEv2 and WireGuard are the protocols SHP.network installs on your own server, which comes with a dedicated IP.
| SSTP | OpenVPN | IKEv2 | WireGuard | |
|---|---|---|---|---|
| Port | TCP 443 | UDP 1194 on SHP.network | UDP 500 and 4500 | UDP 51820 on SHP.network |
| Speed | runs over TCP only | moderate | high | high |
| Security | TLS with a server certificate and crypto binding | repeatedly audited, most recently by SRLabs in 2026 | IETF standard with years of peer review | formally verified protocol |
| Platforms | built into Windows; apps for macOS, iOS, Linux and Android | the OpenVPN Connect app on Windows, macOS, iOS and Android; Linux | built into Windows, macOS and iOS; the strongSwan app on Android | the WireGuard app on Windows, macOS, iOS and Android; Linux |
| Resistance to DPI | TCP 443, the HTTPS port | weak: not built to bypass blocks | weak: fixed UDP ports 500 and 4500 | weak: not built to bypass blocks |
How to set up an SSTP VPN connection
SHP.network does not install SSTP, but your root access is enough to set up an SSTP VPN server yourself.
Order a server with a clean OS
Pick a plan and a city on SHP.network and choose no protocol: the server comes with Ubuntu 24.04 and no VPN software. Root access over SSH is part of every plan (including the 7-day trial).
Install the SSTP server
Over SSH, install SoftEther VPN Server or accel-ppp, enable SSTP and open TCP port 443 in the firewall that SHP.network sets up. Then add a certificate Windows trusts, issued for the exact name you will connect to.
Connect from Windows
In Windows, open Settings, then Network & internet, VPN and Add VPN. Set the provider to Windows (built-in) and the VPN type to SSTP, then enter the server address, your username and password.
Modern alternatives to SSTP
Instead of SSTP, choose among the VPN protocols that SHP.network installs for you, each on a server that belongs only to you:
Built in like SSTP
IKEv2 works with the built-in VPN clients of Windows, macOS and iOS, and SHP.network sets it up on your server within 10 minutes. On Android, IKEv2 connects through the strongSwan app.
High speed
WireGuard is quick and sends its traffic over UDP port 51820 encrypted with ChaCha20-Poly1305. A Tamarin proof formally verifies the protocol. Each device has its own key pair, as with SSH.
Time-tested and audited
OpenVPN has been audited repeatedly, most recently by SRLabs in 2026, and it runs on Windows, macOS, iOS, Android and Linux. SHP.network configures it for UDP port 1194.
Frequently asked questions
Secure Socket Tunneling Protocol. Microsoft designed it to carry PPP traffic inside an HTTPS connection.
TCP 443. The SSTP port is the same one HTTPS websites use, so the firewall needs nothing else opened for it.
SHP.network recommends OpenVPN: its code is open source, it has been audited repeatedly, and it runs on every major system. Where only the built-in Windows client is allowed, SSTP and IKEv2 both work without an extra app. SHP.network also installs OpenVPN for you, while SSTP is something you would set up yourself.
Not with a built-in client, but third-party apps add it. Mac and iPhone use SSTP Connect, a paid App Store download; Linux gets sstp-client and NetworkManager-sstp; and Android has the open-source Open SSTP Client.
Yes. Windows still ships the client and tries SSTP in its Automatic VPN type, Windows Server 2025 accepts the protocol, and in 2024 Microsoft advised moving from PPTP and L2TP to SSTP or IKEv2.