The IKEv2/IPSec connection is one of the alternative methods to connect to NordVPN servers on your Windows PC. This is the preferred connection method among privacy enthusiasts because theIKEv2/IPSec security protocolis currently one of the most advanced on the market. That said, this manual setup lacks the additional features of the nativeNordVPN appand is a bit more complicated to set up.
Note: The Windows system configuration downgrades the cipher to the weaker 3DES-CBC encryption.Disclaimer: This connection method will require you to add the certificate to Trusted Root Authorities, which will apply to all certificates. This may put your system at the risk of anMITM attackif someone gets the private key of that certificate. While our private keys are completely secure and the chances of anything bad happening are very small, we recommend this connection method only if you cannot connect using our native app or other alternative way.
To use this connection method, the only file you need to download and install is the NordVPN digital certificate. The connection application itself is already a part ofWindows.
Configuring the NordVPN digital certificate
- Download the NordVPN certificate.
Note: Your browser may try to save the file in its own certificate location or open it immediately. Make sure to download the file instead of just opening it. In Firefox, right-click the link above and select "Save link as." In Internet Explorer, select "Save" instead of "Open.” Chrome will download the file correctly.
Double-click the “root.cer” file that you have just downloaded.
- Click "Open."
- Click "Install certificate."
- Select "Local Machine"and click "Next."
- Select “Place all certificates in the following store” and click “Browse.”
- Select “Trusted root certification authorities.” Click “Ok” and then “Next.”
- Click "Finish."
- Click "Ok" in both the followingwindows.
- Open the “Run” box by pressing the “Windows” key and the “R” key together on your keyboard. Type “certmgr.msc” in the “Run” box to open the certificates management tool.
- Go to “Trusted root certification authorities,” open “Certificates,” and find the “NordVPN Root CA” file.
- Right-click on the “NordVPN Root CA” file and select “Properties.”
- Check the “Enable only for the following purposes” option and uncheckall the boxes except for the “Server authentication” box.
- Click "Ok" and "Apply."
Setting up a VPN connection:
- Open the Windows “Start” menu and type “control panel” in the search bar. In the search results, click on “Control panel.”
- Open the “Network and Internet” section.
- Click on “Network and sharing center.”
- Click "Set up a new connection or network."
- Click “Connect to a workplace” and hit “Next.”
- If asked "Do you want to use a connection that you already have?", select “No, create a new connection” and click “Next.”
- Click “Use my Internet connection (VPN).”
- In the “Internet address” field, type the hostname of the server suggested to you by ourrecommended server utility.
For “Destination name,” enter any name that you wish to have for the connection.
- Open the “Network and sharing center” again and click “Change adapter settings.”
- Right-click the adapter with the name you’ve just created, click “Properties,” and go to the “Security” tab.
- Make sure the configuration is as follows:
Type of VPN: “IKEv2”
Data encryption: “Require encryption (disconnect if server declines)”
Authentication: “Use Extensible Authentication Protocol(EAP)” (select “EAP-MSCHAP v2” in the drop-down menu.)
- Open the “Networking” tab and uncheck the “Internet Protocol Version 6 (TCP/IPv6)” box.
- Click "Ok."
- In the system tray located in the bottom-right corner of the screen, click on either the Wi-Fi or Ethernet connection icon and click “Network & internet settings.”
- In the left sidebar of the settings, select “VPN,” find your created IKEv2 connection, and click on “Advanced options.”
- Click "Edit" and enter yourNordVPN service username and password.
You can find your NordVPN service credentials through theNord Account dashboard:
1. ChooseNordVPNon the left side service board and scroll down and click on "Set up NordVPN manually";
3. Confirm your e-mail address;
4. Copy theservice credentials (manual setup).
- Paste the service credentials to the Username and password windows and save it.
- Click on the network icon again in the system tray in the bottom-right corner of the screen and click “Connect” under “NordVPN IKEv2.”
- That’s it — you should now be connected.
FAQs
Download the NordVPN certificate.
- Download the NordVPN certificate. ...
- Click "Open."
- Click "Install certificate."
- Select "Local Machine" and click "Next."
- Select “Place all certificates in the following store” and click “Browse.”
- Select “Trusted root certification authorities.” Click “o*k” and then “Next.”
- Click "Finish."
Setup the VPN Connection
- Open Network & Internet Settings on the client PC.
- Click VPN on the left side.
- Click + Add a VPN connection.
- Set the fields as follows: Example values are shown in Figure Windows IKEv2 VPN Connection Setup Screen: VPN Provider: Windows (built-in) Connection Name: ExampleCo Mobile VPN. ...
- Click Save.
Tap “Add VPN Profile“.
- Enter the VPN server's IP address or Domain name in the “Server” field.
- Set “IKEv2 EAP (Username/Password)” for “VPN Type.”
- Paste Login username in the “Username” field.
- Paste the password in the “Password” field.
- Enable the CA certificate for Select automatically by checking the check box.
IPSec / IKEv2
IKEv2 forges a secure tunnel connecting the user to the VPN server, while IPSec provides the encryption and authentication.
How to connect to NordVPN on Windows? ›
Setting up and using NordVPN
Click on the NordVPN logo on your desktop, and after the app loads up, click Log In to continue. Your browser will open up and load the Nord Account login page. First, enter your username or email address, press Continue, and then enter your password.
What ports need to be open for IKEv2? ›
IKEv2 uses non-standard UDP ports so you need to ensure that these ports are not blocked on the user's firewall. The ports in use are UDP 500 and 4500.
How do I enable IPsec on Windows? ›
Configure Internet Protocol Security (IPSEC)
- Select Actions > Properties. ...
- Select IPsec Settings > Customize. ...
- Under Key exchange (Main Mode), select Advanced > Customize. ...
- Select Add. ...
- Select the algorithms that you want to use for each purpose. ...
- Move the security method that you have added to the top of the list.
VPN Type – IKEv2 EAP (Username/Password). Username – your IVPN account ID that begins with letters 'ivpnXXXXXXXX' or 'i-XXXX-XXXX-XXXX' (case-sensitive). Password – ivpn .
Which operating system supports IKEv2 VPN? ›
OpenVPN can use a big number of cryptographic algorithms for encryption, such as AES, RC5, Blowfish, ChaCha20, and 3DES. IKEv2 is natively supported by Windows 7 and higher, macOS 10.11 and higher, and most mobile operating systems, including BlackBerry.
How to manually connect to NordVPN? ›
Right-click on the application icon, hover over one of the servers, and click “Connect.” Enter your NordVPN service username and password, then click “o*k.” You can find your NordVPN service credentials (service username and service password) in the Nord Account dashboard: Click Set up NordVPN manually.
Ipsec needs UDP port 500 + ip protocol 50 and 51 - but you can use NAt-T instead, which needs UDP port 4500. On the other hand L2TP uses udp port 1701. If you trying to pass ipsec traffic through a "regular" Wi-Fi router and there is no such option as IPSec pass-through, I recommend opening port 500 and 4500.
What ports are needed for Ike IPsec VPN? ›
IPSec VPN is a layer 3 protocol that communicates over IP protocol 50, Encapsulating Security Payload (ESP). It might also require UDP port 500 for Internet Key Exchange (IKE) to manage encryption keys, and UDP port 4500 for IPSec NAT-Traversal (NAT-T).
Which is better SSL VPN or IPsec IKEv2? ›
IPsec provides network-layer security, encrypting entire data packets, making it a popular choice for full network communications. On the other hand, SSL VPNs focus on application-layer security, ensuring only specific application data is encrypted. The "more secure" label depends on the context.
How to setup IKEv2 VPN server windows 10? ›
Select Network and Internet Options.
- On the VPN tab, click Add VPN Connection.
- In the Subscriptions section, look for domains of IKEv2 VPN servers, as well as the Username and Password VPN.
- Choose: Windows (Built-in) ...
- Connect to IKEv2 VPN server on Windows 10.
- Connection to IKEv2 VPN established successfully.
Using encryption keys for both ends of the VPN connection, IKEv2 is more secure than IKEv1. With its built-in NAT traversal, IKEv2 establishes a connection much faster than IKEv1. IKEv2 takes up less bandwidth and less data overhead.
Does VPN support IKEv2? ›
IKEv2 (Internet Key Exchange version 2) is a VPN encryption protocol used to set up a Security Association in the IPsec protocol suite. IKEv2 connection method generates encryption keys and guarantees a safe data process between your device and the VPN server you're connected to.
How do I connect to a specific server on NordVPN? ›
Open the NordVPN application and go to the Dedicated IP category on the left. Place your mouse over the Dedicated IP, and click on the three-dot button. Choose your assigned dedicated IP country and server.
How do I change the connection protocol in NordVPN? ›
Open NordVPN the app and click on the cog (gear) icon to access the app settings. Click on “Connection.” Under “VPN protocol,” select “OpenVPN (UDP)” or “OpenVPN (TCP)” from the drop-down menu.
Is IKEv2 better than OpenVPN? ›
We found that OpenVPN is known for its high security and moderate speed. IKEv2/IPSec thrives for mobile uses and its ability to reconnect quickly. L2TP/IPSec excels in how easy it is to set up manually. PPTP is one of the oldest and least secure protocols, however, it is fast.
