MONO VPN
EN
Technical documentation

How to set up an SSTP server

SSTP runs on top of TLS and uses HTTPS port 443. Below is the basic structure of a stand-alone node, which you need to adapt to your OS, router and provider rules.

Return to MONO VPNCompare protocols

1. DNS and certificate

Create a separate DNS A record for the server name, for example sstp.example.com, and wait for it to spread. The certificate must contain this name, be valid, and have a complete chain of trust. For production, use a certificate from a public certificate authority, not a self-signed one.

2. Server and port

Incoming port

Allow TCP 443 in the firewall and hosting panel. If ACME HTTP-01 is used, TCP 80 is also required during the certificate issuance phase.

Resources

The limit depends on the PPP/SSTP implementation, encryption, bandwidth and number of sessions. Check the load using real metrics of CPU, RAM, traffic and active sessions.

3. Setting up MikroTik

On the router, enable the SSTP server, specify a certificate with the correct Common Name/SAN, set the address pool and PPP profile. Create separate accounts for users with unique passwords and limit access using profile rules.

/interface sstp-server server print
/ppp profile print
/ip pool print
/certificate print

The specific commands depend on the version of RouterOS. Before making changes, save the configuration export and check that control access is not using the same port without filtering.

4. Check

TLS

Check the certificate name and chain through the external client: the hostname must match the DNS name of the connection.

SSTP session

Create a test profile, connect from a supported client, check the address issuance, DNS and traffic availability.

  • Port 443 is accessible from the outside.
  • The certificate has not expired and matches the domain.
  • There is no TLS round trip error or MS-CHAPv2 failure in the logs.
  • Over multiple sessions, CPU and RAM remain within operating range.

Safety

Do not store root passwords, private keys and production configurations in a public repository. Use SSH keys, separate administrative accounts, backups and secret rotation. Before publishing the configuration, check the permissions and make a test connection.