Introduction
In this article, you will learn how to manually configure an IKEv2/IPSec connection on your Windows PC. This method is a robust alternative for users seeking advanced security and privacy, utilizing one of the most sophisticated protocols available today. That said, this manual setup lacks the additional features of the native NordVPN app and is a bit more complicated to set up.
Before you start:
Manual Windows configurations may use 3DES-CBC encryption due to system limitations. Additionally, installing the certificate in Trusted Root Authorities applies to all certificates, which may put your system at risk of an MITM attack if someone gets the private key of that certificate. While our private keys are completely secure and the chances of anything bad happening are very small, we recommend this method primarily if the native NordVPN app is unavailable.
Here's what to do:
Configuring the NordVPN digital certificate
To use this connection method, the only file you need to download and install is the NordVPN digital certificate. The connection application itself is already a part of Windows.
-
Download the NordVPN certificate. Ensure you save the file rather than just opening it in your browser.
NOTE: Your browser may try to save the file in its own certificate location or open it immediately. In Firefox, right-click the link above and select "Save link as." In Internet Explorer, select "Save" instead of "Open." Chrome will download the file correctly.
- Double-click the root.cer file and click Open.
- Click Install certificate, select Local Machine, and click Next.
- Select Place all certificates in the following store and click Browse.
- Choose Trusted Root Certification Authorities, click OK, and then Next.
- Click Finish, then click Apply, followed by OK in the other windows.
- Press Windows + R, type certmgr.msc, and press Enter.
- Navigate to Trusted Root Certification Authorities > Certificates and locate NordVPN Root CA.
- Right-click NordVPN Root CA, select Properties, and check Enable only for the following purposes.
- Uncheck all boxes except Server Authentication, then click Apply and OK.
Setting up the VPN connection
- Open the Start menu, type Control Panel, and open it.
-
Go to Network and Internet > Network and Sharing Center.
- Click Set up a new connection or network, select Connect to a workplace, and click Next.
-
If prompted, select No, create a new connection, then click
Use my Internet connection (VPN).
-
In the Internet address field, enter the hostname of your
recommended server. You can find this in your
Nord Account under
NordVPN. Scroll down to Advanced settings until you see
Manual Setup. Click
Set up NordVPN manually. Copy the hostname that is written
to you in the Server recommendation tab (e.g., de1161.nordvpn.com)
NOTE: When connecting to IKEv2 manually, you will need to use the Username and Password found in the Service credentials tab of the manual setup section. - In the Network and Sharing Center, click Change adapter settings. Right-click your new connection and select Properties.
- In the Security tab, set the following:
- Type of VPN: IKEv2
- Data encryption: Require encryption (disconnect if server declines)
- Authentication: Use Extensible Authentication Protocol (EAP) and select EAP-MSCHAP v2.
- In the Networking tab, uncheck Internet Protocol Version 6 (TCP/IPv6) and click OK.
- Click the Network icon in your system tray, select VPN, and choose your created connection.
- Click Advanced options, then Edit. Enter your Service Credentials (Username and Password) from the Nord Account manual setup tab and click Save.
- Return to the network list and click Connect under your NordVPN IKEv2 connection.
Additional tips
If you encounter a policy mismatch error, you can resolve it by adding a specific registry key:
- Open the Command Prompt as an Administrator.
- Run the following command:
reg add HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters\ /v NegotiateDH2048_AES256 /t REG_DWORD /d 2 - Restart your device and try connecting again.
Alternatively, you can use the Registry Editor (regedit) to navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters, create a new DWORD named NegotiateDH2048_AES256, and set its value to 2.
