RouterOS OpenVPN

RouterOS support OpenVPN server and client. OpenVPN is one mostly secure VPN tunnel protocol.

Server

This manual shows, how to configure Mikrotik OpenVPN Server.

Requirements / Recommendation =

• SSL Root Certificate (CA)
• SSL Server Certificate
• SSL Client Certificate

• Tested Mikrotik RB951G-2HnD and RouterOS 6.26

How to

1. Create SSL certificate first, example OpenSSL and move certificate to Mikrotik with Winbox.

Import Certificate key and certificate to RouterOS.

/certificates import file-name=ssl.key

/certificates import file-name=ssl.crt

2. Create DHCP Pool (if you want use bridge, you can skip this step)

  /ip pool add name=ovpn-pool ranges=10.15.32.34-10.15.32.38

• DHCP pool name is ovpn-pool
• Pool area is 10.15.32.34-10.15.32.38

3. Create routing OpenVPN network to local network (if you want use bridge mode, you can skip this step)

 /ip firewall nat add chain=srcnat  out-interface=ether2 action=masquerade

Create NAT to ether2 interface

4. Create OpenVPN Profile

 /ppp profile add name=openvpn local-address=10.15.32.33 remote-address=ovpn-pool 

• Profile name is openvpn
• Local IP-address is 10.15.32.33
• VPN customer get remote IP-address from ovpn - DHCP pool.

• Using bridge, please remove local-address and remote address. Add bridge, example bridge-local

 /ppp profile add name=openvpn_bridge bridge=bridge-local

5. Create VPN user

 /ppp secret add disabled=no   name="openvpn" password="Qwerty1" service=any

• Username: openvpn
• Password: Qwerty1
• Service what can use this user: Openvpn

6. OpenVPN server configuration

 /interface ovpn-server server set auth=sha1, certificate=ssl_cert cipher=aes128,aes256 default-profile=openvpn enabled=yes keepalive-timeout=60 max-mtu=1500 mode=ip netmask=29 port=1194 require client-certificate=no

• Authentication: SHA1
• SS Certificate: ssl-cert
• SSL Chipper: AES128, AES256
• Default Profile: openvpn
• Keepalive-timeout=60
• MAX-MTU (packet size): 1500
• mode=ip (if you use bridge mode, change this to ethernet)
• require client-certificate=no (if you use client certificate, change value to yes)

6. Enable access from firewall

 /ip firewall filter add action=accept chain=input comment="OpenVPN" disabled=no dst-port=1194 protocol=tcp

Create new firewall rule what accept protocol TCP port 1194

Asiakas

OpenVPN asiakkaalla voit yhdistää OpenVPN palvelimeen.

1. Luodaan OpenVPN asiakkaalle profiili:

 /ppp profile add name=openvpn-client

2. Luodaan uusi OpenVPN asiakas:

 /intertface ovpn-client name="openvpn-client" connect-to="server.openvpn.com" port="1194" mode="ip" user="openvpn" password="openvpn123" profile="openvpn-client" certificate="no" auth="sha1" cipher="aes128" add-default-route="no"

• name = yhteyden nimi
• connect-to = OpenVPN palvelimen verkko-osoite tai IP-osoite
• port = Portti, jota OpenVPN palvelin kuuntelee
• mode = ip (ethernet silloin jos haluat sillata kaksi Mikrotikkiä)
• user = OpenVPN käyttäjä
• password = OpenVPN käyttäjän salasana
• profile = OpenVPN profiili jota käytetään
• certificate = SSL asiakas sertifikaatti
• auth = Todennus
• cipher = salaus
• add-default-route = Käytetäänkö tätä yhteyttä oletusreittinä.

3. Kokeile yhdistää ja katso lokia jos tulee ongelmia.