Setting up a VPN Server on RouterOS/Mikrotik

A new year, a new post πŸ™‚

This year I’m starting with something completely non-PowerShell related for a change.

For a while now I’ve wanted to set up a VPN server at home for various reasons such as

  • Access to home Hyper-V lab
  • Secure internet access when using insecure WiFi
  • Access to other home resources [Synology etc]

Now I finally had some time over the holidays to play around with it, but to be honest found out that it was quite the pain, as all information I found was simply not complete as turns out.
So I thought what better way to solve that problem and to document it for future reference by making a blog post on the subject πŸ™‚

Do note that I’m definitely not an expert on networking, so

What are we working with?

Well, my network isn’t all too fancy, but for the sake of clarity here’s an overview of my network layout

My network topology

The following hardware is used for this setup:

I’ve created bridges for my WAN, my LAN and my Guest so I can easily assign rules/access to each part as needed.

As for the VPN connection, while I first thought about using OpenVPN, I ended up going for L2TP/IPSEC instead, as OpenVPN is not yet fully supported and configuration requirements for L2TP/IPSEC are a bit easier [no certificate requirements etc].

Ok, let’s do this!

In order to set this up, we need to first create some pre-requisites and then put them all together.
For clarity sake I’ll list the required steps here:

  • L2TP
    • Create an address pool which can be used by your VPN clients
    • Create a VPN profile to be used by your L2TP server/users
    • Configure the L2TP server
    • Create a fixed Interface binding
    • Create a VPN User
  • IPsec
    • Modify the default IPsec Policy Proposal
    • Modify the default IPsec Peer Profile
    • Create an IPsec Policy
    • Create an IPsec Peer
  • Firewall
    • Input rules to allow L2TP traffic
    • Forward rules to provide LAN and Internet access
  • ARP
    • Set proxy-arp to make sure you can access your other LAN devices properly

L2TP

Create an address pool

Create an address pool

Create a VPN Profile

Create a VPN Profile

Configure L2TP Server

Configure the L2TP Server

of course be sure to replace InsetSecretKeyHere with your own key πŸ™‚

Create a static binding

Now this isn’t a requirement, but I think it helps with maintenance and the configuration of the firewall later on, so I thought I’d include it

Static Interface binding

if you want to you can add user=<username> to create static bindings per user

Create a VPN user

Create a VPN user

Of course you should again replace your username and password by whatever you want to have here, this is the information you also need to provide when setting up the connection on your client!

IPsec

Now there are quite a few steps to be done here, but they’re all easy and self explanatory. In this section I’ll simply provide the code required for each step, everything can be found under the IP -> IPsec tab on your Winbox application

Again, be sure to change the PreShared Key here, you will need this when configuring your VPN connection on your client.

Almost there! Firewall up ahead!

It’s very important to note that you should place all your newly created firewall rules ABOVE any drop rules for them to be used.
Firewall rules work top to bottom, meaning that the first rule that applies to the traffic gets applied, skipping any following rule.

Input rules

Input rules for UDP L2TP
Input rules for IPsec-ESP

Forward rules

Now depending on your needs you might want to lock this down more or just do one bit and not the other [either provide access to internet for safe remote browsing or just provide access to LAN for resources], but in my case I’ve configured both

Forward rule for VPN to LAN
Forward rule for LAN to VPN

Now for VPN to Internet you will have the exact same setup as before, only your interface will be the WAN facing interface, in my case bridge-ziggo.

Here’s the code for both entries just in case.

Are we there yet?

Now the final thing we should do is set proxy-arp in order to properly access all LAN devices. Thanks for the help Mateusz Czerniawski!

Proxy ARP

That’s all!!

Now I know it seems like a lot, but that’s because of the code and screenshots.
Now that I look at it myself, it’s not that bad… But perhaps it can be of help to someone else now too!

Happy Scripting! πŸ™‚

twitterredditlinkedinmail

Robert

It never hurts to Get-Help

2 thoughts to “Setting up a VPN Server on RouterOS/Mikrotik”

  1. A couple (hopefully simple) questions –

    I have an L2TP/IPSec vpn working on my Mikrotik, but there are a few oddities that seem like they’d e solvable with the proxy-arp… but I want to make sure I’m not missing something, because enabling proxy-arp seems to kill my VPN connections…

    1. The bridge-ziggo is just your WAN interface, no? Wondering why you have a bridge for that?

    2. You discuss enabling proxy-arp on bridge-ziggo, but the screenshot shows it enabled on bridge-lan? Can you clarify that? I’m breaking something when I enable the proxy-arp, but I’m not sure what πŸ™‚

    Best wishes – thank you for your time!
    John

    1. @Robert
      Awesome tutorial, couldn’t find fully working solution anywhere, thank you.

      @John Ray
      I have more simplified network. It have only 1xWAN and 1xLAN ports named “ether1 Outside” and “ether2 Local” respectively. My local network is 192.168.0.0/24. So I’ve made my notes. Maybe they will be useful for someone else too.

      Create an address pool
      ip pool add name=VPN-POOL ranges=192.168.0.220-192.168.0.249

      Create a VPN Profile (no “bridge=bridge-lan” argument)
      ppp profile add name=VPN-PROFILE local-address=192.168.0.253 remote-address=VPN-POOL dns-server=1.1.1.1 change-tcp-mss=yes use-encryption=yes

      Configure L2TP Server
      interface l2tp-server server set enabled=yes max-mtu=1450 max-mru=1450 keepalive-timeout=30 default-profile=VPN-PROFILE authentication=mschap2 use-ipsec=yes ipsec-secret=InsertSecretKeyHere

      Create a VPN user
      ppp secret add name=YourUserName password=YourSecretPassword service=l2tp profile=VPN-PROFILE

      Create a static binding (add VPN username for user: using WinBox GUI, otherwise firewall rules will be red and marked as not ready even when VPN user connects)
      interface l2tp-server add name=L2TP-VPN

      IPsec
      ip ipsec proposal set default auth-algorithms=sha1 enc-algorithms=3des,aes-256-cbc,aes-256-ctr lifetime=00:30:00 pfs-group=modp1024
      (Check command below with GUI for all arguments)
      ip ipsec peer profile set default hash-algorithm=sha1 enc-algorithm=aes-128,aes-256,3des dh-group=modp1024,modp2048 proposal-check=obey lifetime=1d nat-traversal=yes dpd-interval=120 dpd-maximum-failures=5
      ip ipsec policy add action=encrypt ipsec-protocols=esp sa-src-address=0.0.0.0 sa-dst-address=0.0.0.0 proposal=default protocol=all template=yes group=default
      (Check command below with GUI for all arguments)
      ip ipsec peer add address=0.0.0.0/0 profile=default auth-method=pre-shared-key exchange-mode=main-l2tp passive=yes secret=Autochemija-2020 policy-template-group=default send-initial-contact=yes my-id=auto generate-policy=port-override

      Firewall rules (bring them up in the list to the most possible top)
      ip firewall filter add chain=input action=accept protocol=udp port=500,1701,4500 in-interface=”ether1 Outside” log=yes log-prefix=”vpn-in” comment=”Allow L2TP VPN”
      ip firewall filter add chain=input action=accept protocol=ipsec-esp in-interface=”ether1 Outside” log=yes log-prefix=”vpn-in” comment=”Allow IPsec ESP”
      ip firewall filter add chain=forward in-interface=L2TP-VPN out-interface=”ether2 Local” action=accept log=yes log-prefix=”vpn-in” comment=”VPN to LAN”
      ip firewall filter add chain=forward in-interface=”ether2 Local” out-interface=”L2TP-VPN” action=accept log=yes log-prefix=”vpn-in” comment=”LAN to VPN”
      ip firewall filter add chain=forward in-interface=L2TP-VPN out-interface=”ether1 Outside” action=accept log=yes log-prefix=”vpn-in” comment=”VPN to Internet”
      ip firewall filter add chain=forward in-interface=”ether1 Outside” out-interface=L2TP-VPN action=accept log=yes log-prefix=”vpn-in” comment=”Internet to VPN”

      Set proxy-arp in order to properly access all LAN devices
      interface bridge set “ether2 Local” arp=proxy-arp

Leave a Reply

Your email address will not be published. Required fields are marked *