Configuring PIM on MikroTik

Here is an example of configuring PIM on two MikroTik routers:

Let us configure the first MikroTik.
Add a pim interface and check:

routing pim interface add
routing pim interface p

Add the IP address of RP (this MikroTik):

routing pim rp add address=IP-ADDRESS

Let’s specify from which IP multicast traffic is allowed:

routing pim interface set alternative-subnets=,

Let’s configure the second MikroTik.
Add a pim interface to the uplink WAN port, I have ether1:

routing pim interface add interface=ether1
routing pim interface p

Add the IP address of the RP (the first MikroTik):

routing pim rp add address=IP-АДРЕС

Let’s specify the route of the multicast source: (first MikroTik):

ip route add via IP-АДРЕС


Configuring Fasttrack on Mikrotik

FastTrack accelerates the processing of packets, started working on firmware from 6.29.

Setting example:

/ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related
/ip firewall filter add chain=forward action=accept connection-state=established,related

The added rules should be before the others.

Let’s see a list of rules:

/ip firewall filter print

We will move our two added to the top (I have them under ID 33 and 34):

/ip firewall filter move 33  destination=1
/ip firewall filter move 34  destination=2

How to restore the standard mac-addresses of MikroTik interfaces

Recently, I had to copy the settings of one MikroTik router to another one and after I saved the settings to a file and populated them on the second, I noticed that mac addresses were also copied.

Therefore, we had to reset them to standard ones.
First, let’s see what the interface numbers are (I have ether1 for 0, ether2 for 1, etc.):

interface ethernet print

And reset their mac-addresses:

interface ethernet reset-mac-address 0
interface ethernet reset-mac-address 1
interface ethernet reset-mac-address 2
interface ethernet reset-mac-address 3
interface ethernet reset-mac-address 4

If you need to reset the mac of the wireless interface, then save the wireless settings to the file:

interface wireless export file wifibackup

Look at the wireless interfaces (I have one at number 0):

interface wireless print

Reset all settings including the mac address:

interface wireless reset-configuration 0

Restore the settings from the previously saved file (mac-address in this case will remain standard):

import wifibackup.rsc


How to view the configuration of MikroTik

Recently I configured the next MikroTik and I had to share the configuration, so, to see it in the terminal, execute the command:

/export compact

To save the configuration to a file, execute the command:

/export compact file=config

After saving the file will be in the device’s memory, you can see it and download it from the Files menu via the web interface or winbox, ftp, smb, sftp.

Configuring the VPN IPSec / L2TP server on Mikrotik

Here is an example of setting up a VPN IPSec / L2TP server on Mikrotik so that you can connect to it from Windows, MacBook, iPhone, etc.

1) Add a range of IP addresses for DHCP by opening “IP” – “Pool” and indicating:
Name: vpn_pool
Next pool: none
From the terminal like this:

ip pool add name=vpn_pool ranges=

2) Add a profile to “PPP” – “Profiles
Name: l2tp_profile
Local address: vpn_pool (you can specify default
Remote address: vpn_pool
Change TCP MSS: yes
The rest is not touched and left in default
From the terminal like this:

ppp profile add change-tcp-mss=yes local-address=vpn_pool name=l2tp_profile remote-address=vpn_pool

3) Add a user to “PPP” – “Secrets
Password: PASSWORD
Service: l2tp
Profile: l2tp_profile
From the terminal like this:

ppp secret add name=LOGIN password=PASSWORD profile=l2tp_profile service=l2tp

4) Enable the server in “PPP” – “Interface” – “L2TP Server
Enabled: yes
MTU/MRU: 1450
Keepalive Timeout: 30
Default profile: l2tp_profile
Authentication: mschap2
Use IPSec: yes
IPSec Secret: ENCRYPTION_KEY (also indicated in the clients)
From the terminal like this:

interface l2tp-server server set authentication=mschap2 default-profile=l2tp_profile enabled=yes ipsec-secret=KEY use-ipsec=yes

5)IP” – “IPSec” – “Peers
Port: 500
Auth method: pre shared key
Exchange mode: main l2tp
Passive: yes (set)
Secret: ENCRYPTION_KEY (also indicated in the clients)
Policy template group: default
Send Initial Contact: yes
NAT Traversal: yes
My ID Type: auto
Generate policy: port override
Lifitime: 1d 00:00:00
DPD Interval: 120
DPD Maximum failures: 5
Proposal check: obey
Hash algorithm: sha1
Encryption Algorithm: 3des aes-128 aes-256
DH Group: modp 1024
From the terminal like this:

ip ipsec peer add address= enc-algorithm=aes-256,aes-128,3des exchange-mode=main-l2tp generate-policy=port-override passive=yes secret=KEY

6)IP” – “IPSec” – “Proposals”
Name: default
Auth algorithms: sha1
Enrc. algorithms: 3des, aes-256 cbc, aes-256 ctr
Life time: 00:30:00
PFS Group: mod 1024
From the terminal like this:

ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-256-ctr,3des

7)Firewall” – “Add New
Let’s add the first rule allowing incoming VPN connections:
Chain: Input
Protocol: udp
Any. Port: 1701,500,4500
Action: Accept
And the second:
Chain: Input
Protocol: ipsec-esp
Action: Accept
From the terminal like this:

ip firewall filter add chain=input action=accept protocol=udp port=1701,500,4500
ip firewall filter add chain=input action=accept protocol=ipsec-esp

The rules should be at the top of the list.

This completes the configuration, you can connect.

See also:
Configuring Remote Access in Mikrotik Router

Configuring Remote Access in Mikrotik Router

Open “IP”“Firewall” – the tab “Filter Rules”.
Click “Add new” to add a new rule.

Then set the following parameters:

Chain: input
Src. Address: here you can specify the IP address or network with which it is allowed to connect, if everyone is allowed, then we do not specify.
Protocol: tcp
Dst. Port: 80 (or 8291 for Winbox, 21 for ftp, 22 for ssh, 23 for telnet, udp 161 for snmp)
Action: accept

Click “OK” to add a rule.

After that, in the firewall, a rule will be created at the end of the list. Since it will be the last, and before it there is a rule prohibiting everything, then it must be dragged to the very top with the mouse, otherwise it will not be of use.

Through the command line, the rules will look like this:

/ip firewall filter add chain=input protocol=tcp dst-port=80 disabled=no action=accept

To pick up the list, you can do this (where 30 is the ID of the rule added):

/ip firewall filter print
/ip firewall filter move 30 destination=1

Or in the command itself, we indicate that you need to place the rule at the very beginning of the list:

/ip firewall filter add chain=input protocol=tcp dst-port=80 disabled=no action=accept place-before 0

Also in the menu “IP” – “Services” in the parameters of the desired service, you can add “Available From” the list of IP addresses from which you want to allow access. Access is restricted to both local and external addresses, so first of all you need to add the IP or subnet with which you are currently connected.

I’ll give an example of specifying IP through a terminal for example for telnet (similar to ftp, www, ssh, winbox):

/ip service set telnet address=,,

See also my article:
Configure Hairpin NAT on RouterOS (Mikrotik)