Community discussions

MikroTik App
 
zorrua
newbie
Topic Author
Posts: 40
Joined: Sun Sep 17, 2017 4:32 pm

Site-to-site VPN with dynamic DNS

Wed Jan 13, 2021 11:04 am

Hello,

I have 2 Mikrotik routers in different locations, both with dinamic public IP address.

Which will be the best way to create a VPN between both networks?

Best regards.
 
sindy
Forum Guru
Forum Guru
Posts: 6660
Joined: Mon Dec 04, 2017 9:19 pm

Re: Site-to-site VPN with dynamic DNS

Wed Jan 13, 2021 11:45 am

If at least one of both devices has a public IP directly on itself, you can use any VPN you choose, and all of them will suffer an interruption when one of the addresses changes. Wireguard, which is only available in RouterOS 7, which in turn is still only available as beta, has the advantage that it accommodates to the change of the public IP on one site at a time autonomously, i.e. without waiting for the dynamic DNS to get updated, so the interruption will be the shortest one in this case. For this to work, both sites must have a public IP, and that condition is met in your case.

Mikrotik provides its own Dynamic DNS service, found under /ip cloud settings; the fqdn is generated from the serial number of the device and it is not possible to change that, so if the device dies, you have to reconfigure all the other ones with a new fqdn. Hence it is highly recommended to use a static DNS CNAME record, translating a freely chosen name to the one generated from the serial number, so it is then enough to manually update this CNAME record when you need to replace a router. Or you can use some public Dynamic DNS service which doesn't require to run an application on the dynamic host to update the record instead, or in addition to, the Mikrotik's own one.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
zorrua
newbie
Topic Author
Posts: 40
Joined: Sun Sep 17, 2017 4:32 pm

Re: Site-to-site VPN with dynamic DNS

Thu Jan 14, 2021 10:12 am

If at least one of both devices has a public IP directly on itself, you can use any VPN you choose, and all of them will suffer an interruption when one of the addresses changes. Wireguard, which is only available in RouterOS 7, which in turn is still only available as beta, has the advantage that it accommodates to the change of the public IP on one site at a time autonomously, i.e. without waiting for the dynamic DNS to get updated, so the interruption will be the shortest one in this case. For this to work, both sites must have a public IP, and that condition is met in your case.

Mikrotik provides its own Dynamic DNS service, found under /ip cloud settings; the fqdn is generated from the serial number of the device and it is not possible to change that, so if the device dies, you have to reconfigure all the other ones with a new fqdn. Hence it is highly recommended to use a static DNS CNAME record, translating a freely chosen name to the one generated from the serial number, so it is then enough to manually update this CNAME record when you need to replace a router. Or you can use some public Dynamic DNS service which doesn't require to run an application on the dynamic host to update the record instead, or in addition to, the Mikrotik's own one.
Thanks for the reply,

I have a dyndns service that resolve the public IP address of both routers. The big question is wich VPN software use: OpenVPN, IPSec...

I want to stay in stable version of RouterOS. Which software do you recommend? The routerboards are RB3011 and RB2011.

Kind regards.
 
erlinden
Long time Member
Long time Member
Posts: 654
Joined: Wed Jun 12, 2013 1:59 pm

Re: Site-to-site VPN with dynamic DNS

Thu Jan 14, 2021 10:20 am

I would use IPSEC, here is a great blogpost I found (and am using):
https://blog.pessoft.com/2016/05/29/mik ... s-and-nat/
First the problem, then the solution

Who is online

Users browsing this forum: Baidu [Spider], rodpp and 183 guests