Secure Socket Tunneling Protocol (SSTP): Microsoft's VPN Tunnel Inside HTTPS

SSTP is Microsoft's VPN protocol: it wraps a PPP link inside a TLS session and sends it over TCP port 443, so a firewall sees what looks like ordinary HTTPS. The client ships with Windows since Vista SP1, the server since Windows Server 2008. Microsoft designed the protocol and published its specification as MS-SSTP in 2007, aiming at networks where PPTP (which relies on GRE) and L2TP/IPsec (which needs UDP 500 and 4500) were blocked.

How an SSTP connection is built

The stack runs from PPP frames through SSTP into a TLS record, which lands in a TCP segment on port 443; PPP, the old dial-up link protocol, handles session setup, address assignment and login. The MS-SSTP specification describes the order: TCP connection to port 443, TLS handshake, one HTTPS request plus an OK answer that turns the stream into SSTP mode, then PPP negotiation and user login.

Two separate checks happen. The TLS certificate confirms the server's identity; a self-signed one has to be added to every client manually, otherwise the client refuses the server. The user then logs in during the PPP phase with MS-CHAPv2 or EAP (EAP-TLS supports smart cards), and a crypto binding step ties the PPP keys to the TLS session against man-in-the-middle relaying. SSTP authenticates users only, never devices or machines.

Why firewalls let it through, and what still catches it

Networks rarely close port 443, because that would cut off HTTPS websites, and most web proxies forward the traffic too. A proxy that demands its own username and password is the exception; SSTP cannot pass through those. A firewall that only checks ports sees ordinary HTTPS. A DPI system reading the start of the session can still single out SSTP, since the protocol carries no obfuscation of its own, so under real censorship you need a stealth protocol instead.

The weak points

TCP over TCP on bad links

SSTP lacks a UDP mode. Your browser's TCP connections ride inside SSTP's outer TCP connection, and when a packet drops, both layers retransmit and back off together, a problem known as TCP meltdown. A clean wired line hides it; patchy mobile or long-distance links collapse the speed.

Closed code and Microsoft's roadmap

Microsoft wrote both the specification and the Windows code, which is closed source and cannot be independently audited. Its future depends on Microsoft's decisions, and Azure VPN Gateway users are already being steered toward IKEv2 and OpenVPN.

Thin support beyond Windows

macOS, iOS, Android and Linux come with no built-in SSTP client. Extra installs cover this: sstp-client with a NetworkManager plugin for Linux, open-source clients on Android, paid apps on iOS.

SSTP next to L2TP/IPsec, IKEv2 and OpenVPN

Where SSTP runs besides Windows Server

SoftEther VPN Server, a free open-source package built at the University of Tsukuba, accepts MS-SSTP clients next to OpenVPN, L2TP/IPsec and its own protocol, so a Linux or BSD box can serve Windows users through the client they already have. Volunteer VPN Gate relays built on SoftEther inherit that capability. MikroTik RouterOS has offered SSTP on both ends since RouterOS 5.0, so a MikroTik router can accept remote Windows laptops or connect out to another SSTP server.

SSTP among VPN services

Of the 377 services in the VPNRadarLab main ranking, 19 confirm SSTP support, 38 say they do not offer it and 320 do not mention it at all; the SSTP ranking page lists those that do.

FAQ

Is SSTP TCP or UDP?

TCP only, on port 443 by default (the server operator can move it).

Is SSTP secure?

The TLS layer with certificate-based server authentication and crypto binding is solid. The doubts concern the unauditable Windows code and the fact that DPI can identify the protocol.

Does SSTP work on a Mac or a phone?

Not natively. You need a third-party client on macOS, iOS, Android or Linux.

Who uses SSTP today?

Windows shops running RRAS, MikroTik router owners and SoftEther server operators.

SSTP summary

SSTP carries PPP over TLS on TCP 443 and ships with Windows. It clears port filters and the majority of proxies but not authenticated ones, gets spotted by DPI, and slows on lossy links because of the double TCP layer. SoftEther and MikroTik keep it alive outside Microsoft's own server. For a Windows machine on a network that blocks GRE and IPsec ports it is the quickest working option; elsewhere, IKEv2 or OpenVPN is the better call.