Hi, new in this forum, hope this is the right place for this thread.
I have a router MicroTik RB951Ui-2HnD and behind it a laptop running Windows 10 Pro 22H2. On it I installed SoftEthernet VPN server, and I am trying to connect to it from another laptop with similar O.S. and OpenVPN Connect client.
I have been able to connect the laptop behind the Mikrotik router with Wake on Lan, Remote Desktop, Teamviewer, VNC, etc. but I cannot do it with VPN, neither the Windows included VPN one nor the SoftEther VPN server one.
I have opened and forwarded to the internal IP of my laptop port 1723 for the Windows VPN and UDP 1194 for the SoftEther. (I also tried with TCP and some other port as 443, 5555, etc.). I did it in a similar way I did for the RDP (Remote Desktop) access.
For SoftEther VPN server and OpenVNP Connect client I am using similar installation and definitions as I use in another situations where I have a Mitrastar router and it works perfectly, but I cannot do it in the Mikrotik location.
On the other hand, installing OpenVPN Connect in the laptop behind the Mikrotik, I am able to access SoftEther VPN server that is behind the Mitrastar router, but not the other way
Is there some specific or special thing I should do to have this VPN access working? I have a limited administrator access to the Mikrotik, for instance I can access to IP-Firewall rules/definitions, but not the full administration rights.
Hi, thanks for the answer, but this comes to me with a couple of questions:
1.- Why a waste of time? Is it the difference with SoftEther such big?
2.- I had a look to the wireguard web site and it looks (at least for me) much more complicated to install and use than SoftEther and OpenVPN was. I was able to install both of them in minutes, wireguard seems to be much more “unix-like command oriented”.
3.- I am not sure I will not find similar problems with wireguard than the ones I found just now, or even worst because I have some (not much, but some) experience with SoftEther and none with wireguard.
What I really cannot understand is why the other applications (RDP, Teamviewer, WOL, etc.) go thru the Mikrotik router smoothly and without problems and the OpenVNP to the internal SoftEther VPN server does not, even doing the corresponding NAT ports, and in another router (Mitrastar), it does without any problem or special configuration.
Hi there,
OPENVPN or OVPN etc has never been fully supported on MT devices.
Wireguard is pretty easy but there is a catch, you need at least one of your MT devices to have a public IP address or have an upstream router (yours or ISP) that can forward a port to the MT device.
If neither is possible, then there is still way for single devices (not MT device to MT device tunnel) to connect to your Mikrotik Device by Back to Home Wireguard, which makes use of an MT server in the cloud which facilitates the connection between the single device and the MT device.
Hi, thanks again for your answer, that, regarding OpenVPN, is probably the worst I was expecting, and it seem that the Windows VPN is not well supported in MK either, because I was not able to have it working.
On the other hand, I don’t see wireguard as “easy to install”, looking at their web site videos, too many command line to execute and too “unix like”, that I am not familiar with. At least I was not able to find a easy step-by-step guide to install and put in work it, something for “dummies in unix environment” and windows oriented.
It seem I will have to stay without VPN with this remote computer and use the other applications that work.
Fear not, provide the config on the MT router or device ( assuming it has a public IP or can be forwarded a port from an upstream router and will have you up and running in no time.)
I tried to install wireguard in Windows… no way, it came to a window asking for a tunnel installation or importing from a file… and stopped… As there is not (or I cannot find) an installation guide (or step-by-step), I gave up… uninstall.
Very sorry, too complex to install (first needed step to have it working and use it! ) for me.
Really, where did you get the install from?
If you can configure a Mikrotik Device, getting a wireguard tunnel setup on windows is a piece of cake.
Step1: Download window installer from wireguard website.
Step2: At the popup window Select the arrow next to add Add Tunnel at the bottom.
SELECT: Add Empty Tunnel
…
…
Step3: Give the tunnel a name.
Step4: Note and copy the public KEY under the name. This will be used on the MIkrotik to identify this PC peer.
Step5: Then copy and paste the block underneath existing INTERFACE and PRIVATE KEY. Adjust the numbers to reflect your setup.
Remove the notes as they are there for your understanding.
[Interface] Address = 194.128.2.2/32 { address you will give to the Windows Client. Lets assume address on router is 194.128.2.1/24. } DNS = 192.168.2.1 { Use the gateway IP of the wireguard }
[Peer] PublicKey = dZek49BWgVCLJRMsG6k6QK5mzHFrfy4uhOLjPyTe5WE= { this is the public key generated by the Mikrotik device } AllowedIPs = 0.0.0.0/0 Endpoint = 32.185.112.15:12345 { public IP address and endpoint port of the mikrotik wireguard }
…
…
Note1: For allowed IPs, if the PC requires internet access at the MT device, enter 0.0.0.0/0 as shown. If you only want users to connect to the LAN subnets (for example 192.168.0.0/24) on the Mikrotik router then select the following: AllowedIPs=194.128.2.0/24,192.168.0.0/24
Note2: Persistent keep alive is not usually used on PCs or Smartphones as its not a router to router connection that normally should be up ALL the time.
Step 6. SAVE
ENSURE The MIKROTIK Wireguard is setup, then:
Step 7. SELECT ACTIVATE BUTTON and wait for status to be ACTIVE.
DONE! No certificates, nothing tricky at all, just some cut and paste really.
It should be clear that its best to configure the WG on the Router first and copy the public key it provides so you can easily paste it into the windows install and vice versa copy the windows public key to install in the Mikrotik setup.
Hi, thanks again for your help. I downloaded the Windows installation .exe file from the wireguard web site.
Let me clarify some points. I cannot fully configure Mikrotik Router, I got it from my Internet provider, I asked them to allow me to change some things on it, particularly the NAT routing ports, and this is what I know how to do. That and some other things I don’t remember now, but I don’t know and I am not able to fully configure the Mikrotik device.
Looking at what you say, I feel I could do almost everything in the windows PC that is supposed I will connect to thru WG, but when we come to:
“ENSURE The MIKROTIK Wireguard is setup, then:” How can I setup Wireguard in the MK? “this is the public key generated by the Mikrotik device” How can I get it?
In order to have a clear idea of what I want to implement:
Windows PC at place 1 with VPN client – Mitrastar router – Internet – Mikrotik with public IP 90.xxx.xxx.6 – Windows PC at place 2 with local IP 192.yy.y.26 with VPN server
Today the VPN client is OpenVPN and the VPN Server is SoftEther (I also tried with the Windows included VPN, no success) ---- possible to migrate to → Wireguard?
To be clear you simply need one PC to talk to the other PC??
Without access to the MT config, not much more we can do at this point for any VPN.
Suggest you pick up a cheap MT device like HeX router and attache it to the ISP MT router and then we you can forward the MT port to the hex router and we can configure whatever we want on that.
No, this is the example, in the real final installation there will be several PC able to talk to one of two/three PCs.
Without access to the MT config, not much more we can do at this point for any VPN.
I have access to the MT config, but not FULL access, if I am told of the exact steps to do I probably would be able to do them using the User Interface of the RouterOS, as I do with the NAT and some other configuration parameters, assigning fixed local IP address to MAC of PCs in the DHCP Leases. What I never used was a command line in the router.
Hi, thanks for your offer, but we have a couple of problems. First one is time difference, I see you are in Canada… I am in Spain , several hours of difference, second one, the PC where I try to install the VPN server is remote at this moment for me. I am accessing to it thru RDP at this moment, so Teamviewer (what I am used to use, btw) would be somehow complicated at this moment, because you would be doing Teamviewer to my local PC, not to the remote one.
Maybe if you tell me what to change in the MK I could try by myself.
And… last, but not least, I would need to know what kind of changes we Will have to do in order to tell the “real” administrator of the network and the mikrotik, at least to heve him aware of the changes I have to go and reason for it.
Ok, thanks, but, as I told you, for connecting to the router I have to do it being at the remote PC, what I do just now using Remote Desktop from my local laptop, so, if we start a teamviewer session with my local, I am not sure you will be able to “see” the remote desktop and the MK configuration.
Additionally, I need to tell my internet provider administrator the changes that are needed to be done in the MK router before those changes are done, we have a friendly relation, but I feel I should tell him before doing the changes.
Thanks again and regards.
P.S.: This MK router is in a place south and not far from Valencia
In winbox use the NEW TERMINAL selection on the left hand side.
Type in
/export file=anynameyouwish
Then go to FILES on the left hand side, and open the files, find the file you just created and download it to the PC.
Then either copy and paste the file so you have access or open the file and copy the contents etc..
Before posting it, ensure the router serial number is removed and remove any public WANIP information (and any keys, or passwords although there shouldnt be any at this point.
which includes IP address and gateway IP. Replace with fake numbers or X.X.X.X
You see, this is one of the limitations my config userid in the router has. I was just looking for the FILES entry in order to do a backup before we changed any thing, and I couldn’t find it, same for your indication of looking for “new terminal”.
I am attaching you an example of the config screen I have access to. Hope this gives you an idea of what I am allowed to do in the router.
Regards
and stopped… As there is not (or I cannot find) an installation guide (or step-by-step), I gave up… uninstall.
