Category Archives: MikroTik

Configuring the VPN IPSec / L2TP server on Mikrotik

Here is an example of setting up a VPN IPSec / L2TP server on Mikrotik so that you can connect to it from Windows, MacBook, iPhone, etc.

1) Add a range of IP addresses for DHCP by opening “IP” – “Pool” and indicating:
Name: vpn_pool
Addresses: 192.168.5.1-192.168.5.15
Next pool: none
From the terminal like this:

ip pool add name=vpn_pool ranges=192.168.5.1-192.168.5.15

2) Add a profile to “PPP” – “Profiles”
Name: l2tp_profile
Local address: vpn_pool (you can specify default 192.168.88.1)
Remote address: vpn_pool
Change TCP MSS: yes
The rest is not touched and left in default
From the terminal like this:

ppp profile add change-tcp-mss=yes local-address=vpn_pool name=l2tp_profile remote-address=vpn_pool

3) Add a user to “PPP” – “Secrets”
Name: LOGIN
Password: PASSWORD
Service: l2tp
Profile: l2tp_profile
From the terminal like this:

ppp secret add name=LOGIN password=PASSWORD profile=l2tp_profile service=l2tp

4) Enable the server in “PPP” – “Interface” – “L2TP Server”
Enabled: yes
MTU/MRU: 1450
Keepalive Timeout: 30
Default profile: l2tp_profile
Authentication: mschap2
Use IPSec: yes
IPSec Secret: ENCRYPTION_KEY (also indicated in the clients)
From the terminal like this:

interface l2tp-server server set authentication=mschap2 default-profile=l2tp_profile enabled=yes ipsec-secret=KEY use-ipsec=yes

5) “IP” – “IPSec” – “Peers”
Address: 0.0.0.0/0
Port: 500
Auth method: pre shared key
Exchange mode: main l2tp
Passive: yes (set)
Secret: ENCRYPTION_KEY (also indicated in the clients)
Policy template group: default
Send Initial Contact: yes
NAT Traversal: yes
My ID Type: auto
Generate policy: port override
Lifitime: 1d 00:00:00
DPD Interval: 120
DPD Maximum failures: 5
Proposal check: obey
Hash algorithm: sha1
Encryption Algorithm: 3des aes-128 aes-256
DH Group: modp 1024
From the terminal like this:

ip ipsec peer add address=0.0.0.0/0 enc-algorithm=aes-256,aes-128,3des exchange-mode=main-l2tp generate-policy=port-override passive=yes secret=KEY

6) “IP” – “IPSec” – “Proposals”
Name: default
Auth algorithms: sha1
Enrc. algorithms: 3des, aes-256 cbc, aes-256 ctr
Life time: 00:30:00
PFS Group: mod 1024
From the terminal like this:

ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-256-ctr,3des

7) “Firewall” – “Add New”
Let’s add the first rule allowing incoming VPN connections:
Chain: Input
Protocol: udp
Any. Port: 1701,500,4500
Action: Accept
And the second:
Chain: Input
Protocol: ipsec-esp
Action: Accept
From the terminal like this:

ip firewall filter add chain=input action=accept protocol=udp port=1701,500,4500
ip firewall filter add chain=input action=accept protocol=ipsec-esp

The rules should be at the top of the list.

This completes the configuration, you can connect.

See also:
Configuring Remote Access in Mikrotik Router

Configuring Remote Access in Mikrotik Router

Open “IP” – “Firewall” – the tab “Filter Rules”.
Click “Add new” to add a new rule.

Then set the following parameters:

Chain: input
Src. Address: here you can specify the IP address or network with which it is allowed to connect, if everyone is allowed, then we do not specify.
Protocol: tcp
Dst. Port: 80 (or 8291 for Winbox, 21 for ftp, 22 for ssh, 23 for telnet, udp 161 for snmp)
Action: accept

Click “OK” to add a rule.

After that, in the firewall, a rule will be created at the end of the list. Since it will be the last, and before it there is a rule prohibiting everything, then it must be dragged to the very top with the mouse, otherwise it will not be of use.

Through the command line, the rules will look like this:

/ip firewall filter add chain=input protocol=tcp dst-port=80 disabled=no action=accept

To pick up the list, you can do this (where 30 is the ID of the rule added):

/ip firewall filter print
/ip firewall filter move 30 destination=1

Or in the command itself, we indicate that you need to place the rule at the very beginning of the list:

/ip firewall filter add chain=input protocol=tcp dst-port=80 disabled=no action=accept place-before 0

Also in the menu “IP” – “Services” in the parameters of the desired service, you can add “Available From” the list of IP addresses from which you want to allow access. Access is restricted to both local and external addresses, so first of all you need to add the IP or subnet with which you are currently connected.

I’ll give an example of specifying IP through a terminal for example for telnet (similar to ftp, www, ssh, winbox):

/ip service set telnet address=192.168.1.0/24,172.16.205.50/32,192.168.3.24/32

See also my article:
Configure Hairpin NAT on RouterOS (Mikrotik)