Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone have any experience with connecting an Ubuntu 10.10 machine to a SSTP VPN server? I haven't found anything too great of information on how to do it.

share|improve this question
A google search suggests that maybe this project might have, or might be working on having what you want. – Zoredache Sep 7 '11 at 5:36
up vote 1 down vote accepted

May be sstp-client can do it? And here is network-manager support for it. No packages for Ubuntu, you need to build it yourself.

share|improve this answer


Here is an example of an entry in /etc/network/interfaces:

auto work
iface work inet ppp
    provider work
    options pty "sstpc --ca-cert /path/to/ --nolaunchpppd" \
            plugin sstp-sock /var/run/sstpc/sstpc-uds-sock \
            lock nodefaultroute noipdefault noauth user myusername \
            refuse-pap refuse-chap refuse-eap nobsdcomp nodeflate novj \
            nomultilink \
            persist maxfail 0 \
            debug logfd 2
    pre-up touch /etc/ppp/peers/work


Then you just use ifup work and ifdown work to connect or disconnect.


You'll need to compile the sstp-client and install it. This can be used by following the instructions on or building a deb package using these instructions:

apt-get install build-essential dpkg-dev debhelper ppp-dev libevent-dev libssl-dev
mkdir && cd
wget -o sstp-client-1.0.10.tar.gz
tar xzvf sstp-client-1.0.10
cd sstp-client-1.0.10
dpkg-buildpackage -b -us -uc
cd ..
dpkg -i sstp-client_1.0.10-0ubuntu2_amd64.deb \
        libsstp-client0_1.0.10-0ubuntu2_amd64.deb \
cd /usr/lib/pppd/2.4.5 && ln -s ../2.4.6/ .

Fix symlink

The pppd lib dir is hard-coded to use 2.4.6, and not the installed version, which is why the symlink is required. This is a bug in the debian build description for sstp-client.

Typical connection timeout issue

If you use the pppd pty option (which the example uses) it is vital that the parameters plugin sstp-sock /var/run/sstpc/sstpc-uds-sock are specified. If you don't specify these, you'll end up getting the famous Connection aborted, reason not known error after approximately 60 seconds, and the connection will not transmit packets.

CA certificate requirement

You also must have the CA certificate for the Active Directory domain the Microsoft SSTP VPN server is part of in the local file /path/to/ This can usually be found in the CertEnroll SMB share on one of the Domain Controllers. Export it as a Base64-encoded X509 certificate and rename as appropriate. Use certtool -i < to verify you have the correct certificate with the correct information.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.