OpenVPN Configuration

RouterOS General
1

After many years of suffering with bad routers aimed at non-techies, I made the switch to a Mikrotik. I’ve been trying to get OpenVPN set up so I can connect to my home network while on the road, but I’ve had no luck so far.

  1. I started with the documentation in the Wiki - specifically this page (http://wiki.mikrotik.com/wiki/OpenVPN_Configuration_Step_by_Step). It refers to a command that’s expecting a template in the latest version of RouterOS (certificate create-certificate-request). That’s fine, I’ll look at a different set of instructions.

  2. I then found this page (https://rbgeek.wordpress.com/2014/09/10/openvpn-server-setup-on-mikrotik-routeros/). I created a set of self-signed certificates in an Ubuntu Server virtual machine for the Mikrotik device, as well as for the client that I’ll be connecting from. I also found this page (http://forum.mikrotik.com/t/solved-cant-import-client-private-key-for-ovpn/48330/1) on the forums that mentions that .key files can’t be imported, so I converted the .key to .pem and uploaded them to the Mikrotik via the web UI.

  3. I then went to the Certificates page, and read them. I was able to read ca.crt without issue as well as the server certificate (home.crt). I then read the .key/.pem file to match home.crt. Should I be seeing the cert as showing KT (which would make sense based on the text below) or KR (as every blog that I read said it should be)? /certificate print output below:

Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority,
I - issued, R - revoked, E - expired, T - trusted
 #          NAME    CO.. SUBJECT-ALT-NAME                                  FI..
 0        T CA_CRT  st.. email:****@**********.***                         9a..
 1 K      T cert_2  ho.. DNS:home                                          07..
  1. When I go into PPP → OVPN Server, check the “Enabled” box, and set the certificate to cert index 1 (above), and click apply → OK, the server never shows up in the Interface tab. What are the correct steps to set up an OpenVPN server through the command line?

So, what am I doing wrong here? How can I get the proper certificates loaded so I can get VPN working?

2

I got it working once but ran into limitations with Mikrotik’s implementation:

  • UDP mode doesn’t work, must use TCP mode. Don’t forget to set this on the client.
  • Must use username and password, not just client certificate. In this case, you can opt out of client certificate which would then mean you don’t have to install the CA cert on Mikrotik.
  • Uses the Net30 topology, so a single client connection consumes 3 IPs
  • Compression is not supported, must turn it off on the client as well.

Then from there don’t forget to add an input firewall rule to allow TCP 1194. Set up your profiles (users and passwords)

Your modes must match (tap vs tun). I think Mikrotik calls these modes IP vs Ethernet. Ethernet=Tap, IP=Tun. IP/TUN is probably what you want as it means less broadcast traffic on the lan doesn’t go over the VPN to the client.

When importing certs, yes I find they must have the .pem extension as well and not have a password (the passphrase option when importing doesn’t work for me).

Mine shows KR signalling K-PrivateKey present and associated with cert. R-RSA (the type of key). For yours, it looks like R means revoked. Perhaps this is a change in the OS since you’re using a newer OS. I’d expect yours to say KT.

Then of course the common name of the cert must be what OpenVPN on the client uses to connect. And your client must trust the CA, there’s an entry in the OpenVPN client config for which certs to trust as a CA.

Enabling a VPN server does NOT create an interface in the interface list. When a client connects, one will appear. You can optionally go to the interface list and add an OVPN Server interface. You have to specify a user. All this does is allow you to reference the interface in firewall rules. So you can firewall a certain user.

with OpenVPN on your laptop you can specify more verbose logging, it’s usually quite helpful.

If you’re using a windows PC, I find SSTP to be simpler to setup.

3

I am using a PC. I’ll take a look at SSTP - I’m not married to OpenVPN, but I do want a solution.