MikroTik

I am fresh vpn user and basically I use pptp protocol for streaming. On last weekend with my friends, I was using Facebook from my smartphone. In a while my smartphone is going hacked and all data that already stored in my phone was too. At that time, I said “What the fuck is this” but one of my friend suggest me to don’t use PPTP because it has zero level security.

Now, I have 3 different protocols option like l2tp, ikev2 and openvpn. Can anyone guide me which one is best for all purposes.

Thank You

You can use l2tp / ipsec which is quite secure and works on all platforms.
If you have a hardware accelerator router then it is even better:
https://wiki.mikrotik.com/wiki/Manual:I ... celeration

But l2tp uses IPsec for data encryption. Recently I read some comparison guide on SSL and IPsec

So, what do you think l2tp/ipsec is much better than openvpn.

I did not say that ipsec / l2tp is generally better than openvpn but that, in the case of a mikrotik router, it is a better choice.
The implementation of openvpn on the routeros does not support udp and therefore it is not so fast.

Completely aside from the selection of a "best VPN", please note that your original problem has absolutely nothing to do with the security of your VPN.
It is highly unlikely that someone, even when they have cracked your VPN, would be able to attack your smartphone from the outside.
Much more likely is that you visited content that infected your phone because it was not updated recently and it has a security issue.
Instead of focussing on changing your VPN, it is more advisable to re-install the phone and update it to the most recent state, and when there are no recent updates replace the phone.

I agree with pe1chl.
Also yes do not use pptp, instead use L2TP/IPsec...

IPsec supports hardware acceleration in MikroTik devices and is very secure as well.

PPTP should not be used anymore. Even Microsoft (which designed the protocol) has advised against using it.
One protocol which has not been mentioned is 'OpenConnect', which is quite simple to set up (you just need to make the keys and to edit a simple .conf file), but after that just works and OpenConnect works fast.
OpenConnect works fine on all OS and mobile platforms. OpenConnect was initially set up by Cisco (the makers of high quality routers), called 'AnyConnect' in Cisco-speak.

https://en.wikipedia.org/wiki/OpenConnect

Openconnect is not supported by Mikrotik devices.

As your best options I would recommend OpenVPN, IKEv2/IPSec, and SoftEther.

Right now. OpenVPN is the most secure VPN protocol in the industry. It uses TCP and UDP for transmission.

Right now. OpenVPN is the most secure VPN protocol in the industry. It uses TCP and UDP for transmission.

How did you test that?

If I understand correctly, OpenVPN needs a third party client to work on Windows. L2TP/IPSec works fine on all my client types (Windows/Linux/Android/iPhone ++), so that is what I do use. There are also a nice view in my Splunk project that do show logs from the L2TP/IPSec logins. See my signature.

how about wireguard? viewtopic.php?f=1&t=165248

why no love for openconnect?

I lived in Dubai and here a lot of sites is a band and I don't find and good VPN and here is something have the uae vpn law which I don't have any clue if anyone has any information pls suggest me.

I do not understand why Mikrotik does not support openconnect. I think it is a hate Cisco thing. I wish vendors could keep politics out of their software.

Each VPN is needed for its own tasks, there are providers that break through ipsec and l2tp, then we give the client SSTP. You need a secure channel for mgmt traffic, then you can take openvpn, although slow, PPTP itself is outdated and its use is considered not secure, I personally use ipsec ike2 with certificates.

Its two flavours
.
Real (two way) VPN - where you control both endpoints or where both endpoints are trusted.
Work ( worksite to worksite, work laptop to worksite)
Home ( home to home, laptop to home etc.)
In which case Wireguard is friggin fast.

Fake (one way) VPN - where you only control one endpoint and put your trust into a THIRD PARTY provider, with no ability to 100% know if your data is being mined. If I was within agencies, I would be sure to have backdoors to all 3 party providers in my country (by law or by force) or own them outright. So think carefully where your third party provider is located. It doesnt have to be govt, it can be criminal enterprises owning these sites and selling your information.

Just a theory, I have no proof, but am naturally skeptical.

If you are subscribing to a vpn service then use ike2 or WireGuard.

If you are using a MikroTik router at home and running RoS v 6.4x then use ike2

HI Mozerd I set up a WG tunnel between two MT devices, an RB450Gx5 (server) behind my CCR1009 and at the other end a BELL HH3000 in front of an RB4011 (client).
Works amazingly well. Keep alive works as the tunnel keeps chugging away.
For simplicity its certainly worth considering.
My next task is to see if I can add my iphone as a wireguard clent as well.

I set up a WG tunnel between two MT devices, an RB450Gx5 (server) behind my CCR1009 and at the other end a BELL HH3000 in front of an RB4011 (client).
My next task is to see if I can add my iphone as a wireguard clent as well.

hi Anav

On Tik devices WireGuard only works if RoS v7.xbeta is used ….. so I assume that is what you are doing … Yes works really well and very easy to implement PLUS very secure. WG has iPhone driver [client] that you can use … also works very nicely.

OpenConnect would be a great addition to Mikrotik. Mikrotik should support all VPN protocols without regard to which network religion originally developed the VPN.

OpenConnect would be a great addition to Mikrotik. Mikrotik should support all VPN protocols without regard to which network religion originally developed the VPN.

First it was OpenVPN. Then it was Wireguard. Now it is OpenConnect. You people will NEVER be satisfied with ANY VPN technology!!!

OpenConnect would be a great addition to Mikrotik. Mikrotik should support all VPN protocols without regard to which network religion originally developed the VPN.

First it was OpenVPN. Then it was Wireguard. Now it is OpenConnect. You people will NEVER be satisfied with ANY VPN technology!!!

Belchi, there can only be one!!!!! (wireguard).

@mozerd, my iphone can now configure the RBG Server behind the CCR1009, AND the CCR1009. Wait for it................ AND the client side router an RB4011. So sweet.

Let me introduce IPSEC/IKE2 protocol to the VPN zoo... :D Let's see what VPN companies say about IPSEC/IKE2?

AES with 256-bit keys, which is recommended by the NSA for securing classified information, including the TOP SECRET level.

BOOM, clear winner.

NSA approval = they can can crack it you silly bird. SO YESTERDAY!!!

Been living here in Dubai for almost 2 years now and there are certain VPN laws in the UAE that might get one in trouble.

how about wireguard? viewtopic.php?f=1&t=165248

nice bro