VPN Providers Still Supporting L2TP in 2026

Most VPN brands dropped L2TP years ago. Here's why, where L2TP still works — routers, old smart TVs, locked laptops — and who still supports it in 2026.

You searched for a VPN provider that still supports L2TP because something in front of you is demanding it, not out of nostalgia for old protocols. A router whose built-in client only lists PPTP, L2TP, and OpenVPN. An older smart TV, three menus deep in network settings, that predates anything newer. Or a work laptop where installing software isn't an option, but the operating system's own VPN panel will happily take a server address and a password.

Every result on the first page, though, is a vendor's knowledge base article on connecting to a server you already own and administer. Nobody tells you where to actually buy an L2TP account — most consumer VPN brands dropped the protocol from their apps years ago, and there's no "how to sign up for L2TP" article to rank, because there's nothing left to sign up for.

Why did the industry move away from L2TP?

L2TP itself doesn't encrypt anything. It's a tunneling protocol, and on its own it just moves packets from one point to another in the clear. To make it usable as a VPN, it's paired with IPsec for the encryption layer — which means every packet gets wrapped twice: once by L2TP, once by IPsec. That double encapsulation adds overhead on every hop, and it's the main reason L2TP/IPsec tends to run slower than WireGuard-based protocols, especially on weaker CPUs like the ones inside routers and set-top boxes.

The second reason is more practical for providers dealing with difficult networks. L2TP/IPsec has a fairly rigid signature: fixed ports (UDP 500 for key exchange, UDP 4500 for NAT traversal, sometimes 1701), a predictable handshake, and packet structure that's been public and stable for over two decades. Deep packet inspection systems built to look for VPN traffic can flag this pattern with reasonable confidence. That doesn't mean L2TP always gets blocked — plenty of networks let it through without a second glance — but it's a weaker choice than protocols built specifically to blend in with ordinary traffic.

Add to that a marketing incentive: newer protocols post better throughput numbers in every benchmark, so app makers had every reason to lead with those and let L2TP fade out of the interface. None of this makes L2TP a bad protocol. It makes it an old one, with predictable, well-documented tradeoffs.

Where does L2TP still make sense?

The reason L2TP hasn't disappeared is that it's built into almost everything with a network stack. Consumer routers running stock firmware — the kind that ships from Netgear, TP-Link, or Asus without a custom build — routinely offer L2TP as one of two or three native VPN client options, with WireGuard nowhere in sight unless you flash third-party firmware. If you want your whole home network protected at the router level without replacing the firmware, L2TP is often the only thing available out of the box.

The same goes for older smart TVs and streaming boxes with a manual VPN configuration screen buried in network settings — L2TP is frequently the default and sometimes the only supported option. Corporate and school machines are another common case: IT policy blocks software installation, but the operating system's native network settings are still accessible, and L2TP has been part of Windows, macOS, and Android's built-in networking since long before any of the newer protocols existed. Game consoles, some NAS boxes, and a long tail of embedded devices fall into the same bucket. None of these can run a modern VPN client. All of them can dial an L2TP connection.

Worth checking before you commit to this route: L2TP/IPsec has a known weak spot with double NAT. If the device sits behind two layers of NAT — a phone hotspot feeding a router, say, or a router stuck behind a landlord's router — the tunnel can negotiate successfully and still never pass traffic. That's a network layout problem, not something a support ticket can fix.

What protocols come with a RocketVPN subscription?

RocketVPN kept L2TP/IPsec in the lineup rather than retiring it, because dropping it would cut off exactly the devices described above. A single subscription includes seven protocols, switchable at no extra cost depending on what you're connecting from:

• AmneziaWG — a modified WireGuard with built-in obfuscation; to deep packet inspection it looks like plain UDP, so it keeps working on networks where ordinary WireGuard gets throttled or blocked.
• V2Ray — wraps traffic in TLS handshakes indistinguishable from ordinary HTTPS browsing.
• WireGuard — minimal, kernel-level, ChaCha20 encryption, light on CPU. A good default on phones.
• OpenVPN — the long-standing standard, running over TCP or UDP with AES-256.
• IKEv2/IPsec — built into iOS, macOS, Windows, and most routers, so it needs no third-party app and reconnects almost instantly when you switch between Wi-Fi and mobile data.
• L2TP/IPsec — works out of the box on nearly any device. Slower than the modern options, but nothing to install.
• Shadowsocks — a light, obfuscated SOCKS5 proxy, originally built to get around the Great Firewall.

The subscription also covers 54 locations worldwide, including Moscow and St. Petersburg — servers most providers stopped offering years ago, which is rare on a mainstream plan. Whichever protocol you pick, the location list and the account stay the same; you're just choosing the connection method that fits whatever device is in front of you. There's no separate RocketVPN app to install for any of this — connections run through your operating system's built-in client, or a third-party client where the platform requires one. New to the terminology? What a VPN actually does is covered separately.

What do you need to connect over L2TP/IPsec?

Setting up L2TP doesn't involve downloading anything. You need four pieces of information, all pulled from your account area at rocketvpn.net/cp/ after you sign up:

• the server address for the location you want to connect through
• your account username
• your account password
• on some platforms, a shared secret (also called a pre-shared key) — Windows and some routers ask for this in addition to the username and password

You type these into your device's native VPN settings screen — no separate installer needed, since the L2TP client already ships with the operating system. Most failed first attempts trace back to one thing: a mistyped shared secret. It's long, it's case-sensitive, and typing it by hand instead of pasting it from the account area is the single most common way to lock yourself out of a connection that should otherwise just work.

The exact steps differ enough by platform that walking through all of them here wouldn't help much, so the site keeps a dedicated guide per device: router setup, iPhone, Windows, Android, and macOS. Routers or NAS boxes running a SoftEther-based client instead of the OS's native L2TP dialog need a different path — see connecting L2TP via SoftEther, and where that protocol fits into the picture generally. The full index of setup guides across every platform is at the information section.

How does L2TP compare to the alternatives?

None of the four protocols below is objectively "the best." Each trades off differently between compatibility, speed, and resistance to filtering — match the row to whatever you're optimizing for.

If your priority is getting something working on a device that can't run a client, and the network isn't actively hunting for VPN traffic, L2TP is a reasonable, honest choice — that's what it's for. It's the wrong tool if you're on a network that actively filters or throttles VPN connections: its IPsec signature is one of the easier ones to spot. It's also the wrong tool for 4K streaming or competitive gaming, full stop — the double encapsulation overhead is structural, not something a config tweak fixes. In either case, switching the same RocketVPN subscription to AmneziaWG or V2Ray (for filtering) or WireGuard (for raw speed) is the better move. For a broader walkthrough of which protocol fits which situation, see how to pick a protocol.

Frequently asked questions

Is L2TP still safe to use in 2026?

The encryption layer — IPsec, typically with AES — hasn't been broken and is still considered secure. The concerns with L2TP are speed and detectability, not the cryptography itself. On a network that isn't actively filtering VPN traffic, L2TP/IPsec is a legitimate option, just not the fastest one available.

Why don't major VPN apps offer L2TP anymore?

Most consumer VPN apps moved their default protocol to WireGuard or a proprietary variant years ago because it's faster and easier to market. Removing L2TP from the app was a side effect of that shift, not a security call — the protocol wasn't deprecated for being unsafe, it just fell out of the interface as attention moved elsewhere.

Do I need a shared secret to connect over L2TP?

Depends on the platform. Windows and many routers ask for a shared secret (also called a pre-shared key) in addition to your username and password. iOS and Android sometimes skip that field depending on the exact client screen. Whichever fields your device asks for, they all come from your account area — check the relevant per-platform guide if something doesn't match what you're seeing.

Can I use L2TP on a router without flashing custom firmware?

Usually, yes — that's the main reason L2TP is still worth having. Most stock router firmware includes a native VPN client that lists L2TP among the supported protocols, alongside PPTP and sometimes OpenVPN. WireGuard and AmneziaWG generally require replacing the firmware or running a separate client device, which isn't always practical.

Will L2TP work if my network blocks VPN traffic?

Not reliably. L2TP/IPsec has a recognizable signature — fixed ports and a standard handshake — that filtering systems identify more easily than obfuscated protocols. On a network known to interfere with VPN connections, switch to AmneziaWG or V2Ray within the same subscription instead of troubleshooting L2TP.

Does switching protocols cost extra?

No. All seven protocols, including L2TP/IPsec, are included in every plan, and you can switch between them freely depending on the device and network you're on.

What locations are available over L2TP specifically?

The same 54 locations available across the whole subscription, including Moscow and St. Petersburg. The protocol you choose doesn't limit which server locations you can reach — it only changes how the connection is made.

Quick checklist before you connect

1. Sign up and pick a plan at the registration page — see pricing for the current plans: Bronze at $19.99/month, Silver at $29.99 per 3 months, Gold at $39.99 per 6 months.
2. Log into the account area and note the server address, username, password, and shared secret (if your platform asks for one) for the location you want.
3. Open your device's built-in VPN settings — not a separate app — and choose L2TP/IPsec as the connection type.
4. Follow the platform-specific guide for your device: router, iPhone, Windows, Android, or macOS.
5. Slow or repeatedly dropped connections are usually a sign the network is filtering it — switch the same account to AmneziaWG or V2Ray instead of retrying L2TP over and over.
6. If a setup step doesn't match what's on screen, open a ticket in the account area or reach out via the support page at support@rocketvpn.net.