I am wanting to create a VPN from my Note 8 to my Mikrotik router.
Current setup:
Router = RB951G
OS = 6.46.2
Phone = Samsung Note 8
OS = v9 “Pie”
I have been looking for months at various VPN examples and tutorials, and I am just confusing myself.
Here is what the PHONE has for setup:
Type:
- PPTP
- L2TP/IPSec PSK
- L2TP/IPSec RSA
- IPSec Hybrid RSA
- IPSec Xauth PSK
- IPSec Xauth RSA
- IPSec IKEv2 PSK
- IPSEC IKEv2 RSA
Server Address:
After that, depending on the Type selected, the options change. I have been able to use PPTP, however, that is not an “always on” option. I want one that will always remain on. From what I have read, that means the L2TP/IPSec type.
If I set the phone to L2TP/IPSec PSK, here are my options:
L2TP Secret
IPSec identifier
IPSec Pre-shared Key
Username
Password
Always On VPNAdvanced:
DNS Search Domains
DNS Servers
Forwarding Routes
In trying to read all the various examples and tutorials, I am coming across the fact that many of them were created with older versions of RouterOS, so I am finding that certain settings have been moved. Example:
***Original Posting 04 Dec 2012***
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des,aes-128,aes-192,aes-256 lifetime=1h
/ip ipsec peer
add address=0.0.0.0/0 exchange-mode=main-l2tp generate-policy=yes hash-algorithm=sha1 secret=vpnsecret send-initial-contact=no
However, in OS 6.46.2, these 2 lines now look like:
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc,3des lifetime=1h
/ip ipsec peer
add name=peer1 passive=yes profile=profile99 send-initial-contact=no
/ip ipsec profile
set [ find default=yes ] dh-group=modp1024 enc-algorithm=3des,aes-128,aes-192,aes-256 hash-algorithm=sha1
add dh-group=modp1024 enc-algorithm=aes-256,aes-192,aes-128,3des lifetime=1h name=profile99
So it has been a little fun trying to “translate” older settings into the new locations. But as I said, after reading who knows how many forum posts and tutorials and examples, I have just gotten myself completely confused and lost.
My end goal is to have the following devices setup to be an “always on” VPN back to my Mikrotik.
A Samsung Note 8
A Samsung Galaxy S7
A Samsung Galaxy S5
A Samsung Tab A
So, I type all that in the hopes someone can help me navigate this endeavor and find a solution. Thank you in advance for your help.
I do have one final question. Once I set this “always on” VPN on these devices, when the phones are away from my house, no big deal. They use the VPN either on VZW’s internet or the local “free” (yeah right) WiFi to get back to the house. But what will happen when these phones are at the house? If I step through the process correctly, they will get access on MY WiFi, go out on the internet to just turnaround and try and access the network they are already on via the VPN. Am I thinking this correctly? Will this affect their internet access when at home on the home WiFi/router?