vpn basics-ipsec

RouterOS General
1

I am new to mikrotik os. I have never setup a vpn connection on any type router before. I have attempted to use various posts but I haven’t been successful. I need some suggestions on how to start the process. I also need some suggestions on how to troubleshoot/debug during the testing.

I have a mikrotik 2801 running 6.34.3. I didn’t set up this router/switch initially so I am not familiar on how that was done.

When I examine under NAT I don’t see the ISP ip address (its set up to receive ip via dhcp from ISP). The LAN is a private 192.168.x.x so I know it must be NATed somewhere, but in poke around in the config I can’t find it. I have been using the gui interface since learning the terminal will take more time.

I do see the NAT under firewall>nat. The setting is masquer. I know this is the active NAT since I see the interface that is connected to the ISP as the outgoing interface. But can’t see any listing of actually nating taking place, but I know it is.

So here are some questions.

  1. Do I need to create an ip pool for the vpn? I am assuming I do, am I correct in that I can use any private ip I want? 192.168.10.x for example.
  2. If I have the remote and local address in the ppp>secrets as 0.0.0.0 am I correct in that it will accept any address within the LAN and from outside the LAN?

Any other tips would be greatly appreciated…

2

Maybe this will help you out with your VPN-setup, if you want to use IPsec:

https://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Road_Warrior_setup_with_Mode_Conf

1.) Yes you can do that.
2.) If you want connection from everywhere you just leave this fields empty.

Depending on the setup you have, I would suggest to use OpenVPN. Setup is very easy and for “road-warriors” it’s my prefered solution.

3

Thank you for the reply and the great reference. Next time I am on site I will give that a try.
Just to verify, by referring to use OpenVPN, did you mean for client machines to access? Or did you mean it is a better choice for creating vpn connection to a remote site, for a server?

Thanks again for the help. I’ll let you know how it turns out.