OpenVPN between TP-Link and Mikrotik

RouterOS General
1

Server: ER605
Client: HEX-S

The problem:
The setup on the ER605 is quite simple and straightforward:
Screenshot 2024-02-23 220819.png
After that, it creates a certificate file for the clients. An example:

client
dev tun
proto tcp
float
nobind
cipher AES-128-CBC
comp-lzo no
resolv-retry infinite
remote-cert-tls server
persist-key
auth-user-pass
remote "wanip" 1194
<ca>
-----BEGIN CERTIFICATE-----
Redacted stuff
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
Redacted stuff
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
Redacted stuff
-----END PRIVATE KEY-----
</key>

So far simple. BUT, on the mikrotik client, after loading the file in the storage, loading the certificate, all good.
Screenshot 2024-02-23 221703.png
I believed that was it, since I am able to connect, BUT for some odd reason, the routing has issues.
When I connect, the following route shows unreachable.
Screenshot 2024-02-23 222323.png
From the TP-Link manual, the ER605 SHOULD be able to ping the Mikrotik, and viceversa. But, they can’t. And I cannot understand why. The firewall is pretty stock and do not have weird rules that can block traffic. I torch the interface and I see the traffic going but not being responded.
If I ping from the ER605, I get the same result, no response. Right now, I do not know WHO is at fault, is it the ER605 no routing correctly? or the HEX-S? And why? And how to correct the issue?
Screenshot 2024-02-23 222757.png

2

Better off doing wireguard IMHO.

3

^^ This.

Any particular reason you want to use OpenVPN when you have Wireguard available?

4

I really didn’t think about it. I was able to connect two ER605 togheter using openvpn and they worked flawlesly (users reporting that the vpn was now faster between sites). So I thought to myself: let’s try it. Although I’m on version 6.48.7 and do not see any wireguard options here. Is it an optional package?

5

Nope would need to update it to vers7,
Wireguard is well supported on MT, openvpn has never been completely supported.

6

OpenVPN in RouterOS v6 is also TCP only. So your user experience with OpenVPN may be sub-optimal anyway.

As @Mesquite says, upgrade to v7 and use Wireguard