{"id":4290,"date":"2026-06-08T17:57:20","date_gmt":"2026-06-08T14:57:20","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&#038;p=4290"},"modified":"2026-06-08T17:57:20","modified_gmt":"2026-06-08T14:57:20","slug":"how-to-create-a-custom-elements-endpoint-protection-profile-to-allow-vpn-traffic-through-the-firewall-which-ports-to-open","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/how-to-create-a-custom-elements-endpoint-protection-profile-to-allow-vpn-traffic-through-the-firewall-which-ports-to-open\/","title":{"rendered":"How to create a custom Elements Endpoint Protection profile to allow VPN traffic through the firewall? Which ports to open?"},"content":{"rendered":"<h3>Issue:<\/h3>\n<ul>\n<li>After installing Elements Agent (EPP for Computers or for Servers), VPN connection stopped working and is\u00a0blocked by the Windows firewall.<\/li>\n<li>How to create a custom Elements Endpoint Protection profile to allow the VPN connection?<\/li>\n<li>Which ports need to be opened to allow PPTP, L2TP and IPSec VPN connection\u00a0through the firewall?<\/li>\n<\/ul>\n<h3>Resolution:<\/h3>\n<p>In this case, you have to start by creating a custom profile that can be edited.<\/p>\n<p><b>Creating a custom profile:<\/b><\/p>\n<ol>\n<li>Log in to the Elements Security Center\u00a0Portal<\/li>\n<li>Open the <strong>Security configurations<\/strong> section from the menu on the left<\/li>\n<li>Go to the\u00a0<b>Profiles\u00a0<\/b>page<\/li>\n<li>Select the circular symbol with three dots in the middle next to the profile you want to clone<\/li>\n<li>Press on <b>the clone profile<\/b><\/li>\n<li>Enter the name and label of the new custom profile<\/li>\n<\/ol>\n<p>After creating a custom profile, you can start creating new firewall rules.<\/p>\n<p><b>Creating a new VPN firewall rule:<\/b><\/p>\n<ol>\n<li>Select the profile you want to use<\/li>\n<li>Go to the <strong>Firewall<\/strong> settings page<\/li>\n<li>Go to\u00a0<b>Firewall rules<\/b>\u00a0and select\u00a0<b>add rule<\/b><\/li>\n<li>Enter a name and description of the rule, e.g Allow VPN<\/li>\n<\/ol>\n<p>The ports and protocols that need to be allowed vary between each VPN connection type. Verify with your VPN provider the type of VPN connection you are using and which ports to open.<\/p>\n<p><u>To allow common PPTP VPN traffic:<\/u><\/p>\n<ul>\n<li>Allow PPTP tunnel maintenance traffic, open outbound TCP port 1723<\/li>\n<li>Allow PPTP tunneled data to pass through the router, open outbound protocol 47 (GRE)<\/li>\n<\/ul>\n<p><u>To allow common IPSec VPN traffic:<\/u><\/p>\n<ul>\n<li>Allow Internet Key Exchange (IKE), open UDP port 500 outbound<\/li>\n<li>Allow IPSec Network Address Translation (NAT-T), open UDP port 4500 outbound<\/li>\n<li>Allow Encapsulation Security Payload protocol (ESP), open protocol 50 outbound<\/li>\n<li>Allow Authentication Header protocol (AH), open protocol 51 outbound<\/li>\n<li>Allow\u00a0\u00a0IP-in-IP Encapsulation, open protocol 4 outbound.<\/li>\n<\/ul>\n<p>If IPSec IKEv2 VPN connection is not working after creating the above firewall rules, enable\u00a0<b>Allow unknown outbound connections <\/b>from the profile and see if it helps. By default Windows firewall has unknown outbound connections allowed, while the WithSecure firewall profile will block them.\u00a0<\/p>\n<p><u>To allow common L2TP VPN traffic:\u00a0<\/u><\/p>\n<ul>\n<li>Allow L2TP traffic, open UDP port 1701 outbound<\/li>\n<li>Allow protocol 115 outbound<\/li>\n<\/ul>\n<p>Once the firewall rules have been created, the profile needs to be assigned to the target devices.\u00a0<\/p>\n<p><b>Assigning a profile:<\/b><\/p>\n<ol>\n<li>Go to the\u00a0<b>Devices\u00a0<\/b>page<\/li>\n<li>Choose the\u00a0device(s)\u00a0to which you want to assign a profile to<\/li>\n<li>Click on\u00a0<b>Assign\u00a0<\/b>&gt; <b>Assign profile<\/b>\u00a0<\/li>\n<li>Select the profile with the VPN firewall rules and click\u00a0<b>Assign<\/b><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>how do you create a custom Endpoint Protection profile and which ports need to be opened to allow PPTP, IPSEC and L2TP VPN protocols through firewall?<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-4290","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000011362","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:57:20","import_hash":"ea7222d529dadb768d9f6bf015b68319239e3cef","vanilla_article_id":32425,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32425-how-to-create-a-custom-elements-endpoint-protection-profile-to-allow-vpn-traffic-through-the-firewall-which-ports-to-open","vanilla_kb_id":30,"vanilla_category_id":102,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4290"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}