Skip to content

Language version

This article also has a Czech version.

TL;DR ✨

This is the simplest option for setting up a tunnel quickly. The protocol has already been compromised and, for example, Apple does not support it, but it is the fastest.

This protocol is reasonably easy to configure. Essentially, an IPsec pre-shared key is added; otherwise, it is analogous to PPTP.

Below is a quick configuration for a VPN concentrator on MikroTik RouterOS.

For VPNs and routing, there are two commonly used ways to connect remotely:

  1. Directly through a client running on the given PC
  2. Through a routerboard that is behind masquerade, which then allows all the other PCs to connect through it

VPN concentrator

The process of creating a VPN concentrator on RouterOS consists of the following steps:

🔍 1. Enable the chosen protocol (PPTP,L2TP,SSTP)

  1. Prepare an address list containing the clients' IP addresses
  2. Allow VPN ports from the WAN through the firewall
  3. Apply NAT to the traffic for these clients

✨ 5. Create the individual users

✨ PPTP concentrator

This is the simplest option for setting up a tunnel quickly. The protocol has already been compromised and, for example, Apple does not support it, but it is the fastest.

🔍 Enable the PPTP server and configure its authentication

/interface pptp-server server set authentication=pap,chap,mschap1,mschap2 enabled=yes

✨ Create an address list and add the addresses to it

/ip firewall address-listadd address=192.168.90.240 list=vpn_ip
/ip firewall filter
add action=accept chain=input dst-port=1723 in-interface-list=WAN protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN src-address-list=vpn_ip
/ppp secret
local-address=192.168.90.1 name=user1 password=Heslo2
profile=default-encryption remote-address=192.168.90.240

🌐 L2TP/IPSEC concentrator

This protocol is reasonably easy to configure. Essentially, an IPsec pre-shared key is added; otherwise, it is analogous to PPTP.

In this case, L2TP with IPsec will be configured. Set Heslo1 below as the IPsec password.

/interface l2tp-server server
set enabled=yes ipsec-secret=Heslo1 use-ipsec=yes
# Ve firewallu si nastavíme adresní list, kde budou adresace klientů.
/ip firewall address-list
add address=192.168.90.240 list=vpn_ip
# Na firewallu na inputu povolíme UDP traffic co jde z WAN na MikroTik
/ip firewall filter
add action=accept chain=WAN>INPUT dst-port=500,1701,4500 in-interface=wan2 \
protocol=udp
# V NATu si nastavíme maškaradů pro dané IP adresy v address listu.
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN src-address-list=vpn_ip
# Teď už jen přidáme do sekce ppp secret uživatele. Lokální adresa je stejná jako lokální IP adresa MikroTiku, remote adresa je ta, která příjde do vpn_ip address-listu.
/ppp secret
add local-address=192.168.90.1 name=user1 password=Heslo2 remote-address=192.168.90.240

✨ SSTP concentrator

In this case, a certificate must be generated; otherwise, the procedure is the same as for PPTP.

# Nejdřív povolíme SSTP server:
/interface sstp-server
add name=sstp-server-site user=site-nazev-vpn
# Nachystáme si ppp profily
/ppp profile
add change-tcp-mss=yes name=ppp-profile-default-encryption-only1 only-one=yes use-encryption=yes
add change-tcp-mss=yes name=ppp-profile-default-sstp remote-address=pool19-vpn use-encryption=yes
# Předgenerujeme certifikát v MikroTiku pro SSTP spojení, podepíšeme ho a pak ho naimportujeme ke klientům na závěr. # Postupojte 1:1 jak je uvedeno zde: https://wiki.mikrotik.com/wiki/SSTP_step-by-step
# A teď nastavíme samotný SSTP server.
/interface sstp-server server
set authentication=mschap2 certificate=PubIP-signed default-profile=\
ppp-profile-default-sstp enabled=yes force-aes=yes pfs=yes tls-version=only-1.2
# Přidáme si zase adress listy pro lepší orientaci
/ip firewall address-list
add address=192.168.90.240 list=vpn_ip
# Ve firewallu povolíme traffic na port 443 na MikroTik
/ip firewall filter
add action=accept chain=input dst-port=443 protocol=tcp
# Nastavíme maškarádu pro adresní rozsah VPN klientům
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN src-address-list=vpn_ip
# A přidáme jednotlivé klienty
/ppp secret
add local-address=172.22.19.1 name=user1 password=Heslo2 profile=ppp-profile-default-sstp remote-address=172.22.19.5 service=sstp

VPN clients

This is the simplest approach to use. Usually, it is enough to configure a VPN tunnel using one of various applications. These applications may be available directly in the operating system (for example, for the SSTP protocol), or they can be downloaded and then configured, such as the OpenVPN client.

The following shows a simple connection using the SSTP protocol from Windows 10 Professional. The procedure is very similar for the other VPNs. PPTP is the easiest to configure; for L2TP/IPsec, only the pre-shared key (Heslo1) needs to be supplied.

🌐 Option 1 – Connecting directly from a PC

!

🔍 Configuration on the VPN server side, specifically the SSTP server

Add a new user as shown above.

/ppp profile
add local-address=X.X.X.1 name=user2 password=Heslo3 profile=ppp-profile-default-sstp remote-address=X.X.X.X service=sstp

That is all. Nothing else needs to be configured. Masquerade and encryption have already been configured above.

🔍 Client-side configuration on Windows

First, import the certificate obtained from the VPN concentrator.

✨ Go to the system-certificates section

Select the certificate, right-click it, and click Export.

Select pkcs12 as the export type.

The certificate will be saved in the files section, from where it can be downloaded.

! Then import it into the local machine's trusted root certification authorities. Detailed instructions for Windows are available here: https://success.outsystems.com/Support/Enterprise_Customers/Installation/Install_a_trusted_root_CA__or_self-signed_certificate

For Windows 10 Professional/Home, simply add a new connection using the VPN configuration interface as follows:

!

🔍 Configure the VPN connection according to the diagram below

! - VPN provider - Leave it set to Windows - Connection name - Choose a name that keeps the connections organized - server name or address - The IP address signed by the certificate - VPN type - In this case, select SSTP - Username - user name - password - password

🌐 Once connected, the status is connected

! Sometimes the SSTP connection in Windows misbehaves. This may be because operating system updates are pending or because the network adapters need to be updated in Device Manager: https://wintip.cz/621-chyba-pri-pripojeni-k-vpn-ve-windows-10

The client is now connected to the network.

🔐 Option 2 - A client routerboard named R103 has other users behind it who need to access the network behind the VPN concentrator

The procedure is analogous to connecting a VPN client.

Before configuring the routerboard, remember to import the certificate from the concentrator. Importing the certificate is a two-step process. First, upload the certificate itself to files. Then, in the system-certificates section, click Import and select this certificate from files.

! Check that the ppp package is available in the system-packages section.

In the PPP section, add an SSTP client according to the diagram below.

! Keep the settings shown above and enter only a different login and password: the credentials generated for this client.

The tunnel is now connected.

A route must still be added manually to tell the client MikroTik named R103 where to send packets when communicating with the internal subnets.

/ip route
add distance=1 dst-address=IP.0/24 gateway=sstp-tunel

The route above provides access to the IP.0/24 subnet.

If the tunnel does not work for some reason, the most likely cause is that the traffic is not allowed through the firewall.

Check these two chains:

input - This can block the tunnel connection itself

forward - This blocks communication between different subnets

So far, the setup has covered connecting the home MikroTik through a VPN tunnel to the model company, as shown below:

! But what if several PCs behind the MikroTik named R103, which has a local-network IP address such as 192.168.90.98/24, also need to communicate with the company network?

! The principle is to hide behind masquerade on the R103 router. When masquerade is used, there is no need to add a route on the VPN concentrator for a subnet located elsewhere. This is quite practical.

Therefore, on R103:

/ip firewall nat
add action=masquerade chain=srcnat out-interface=sstp-out1

To complete the configuration, add a manual route on the local computer (PC01) that points to the R103 router. For clarity, the router marked R103 in the diagram has the LAN IP address 192.168.90.98.

🐧 Example on a Linux machine:

A separate route can be added for each subnet:

route add -net IP.0 netmask 255.255.255.0 gw 192.168.90.98 dev vmbr0

Alternatively, use a /16 mask instead of /24 and combine everything into a single command.

🐧 Example of adding a non-persistent route on a Windows machine in a terminal with elevated administrator privileges

route add IP.0 MASK 255.255.255.0 192.168.90.98

Persistence for routes on Windows machines is configured with the -p option.