Hi, new in this forum, hope this is the right place for this thread.

I have a router MicroTik RB951Ui-2HnD and behind it a laptop running Windows 10 Pro 22H2. On it I installed SoftEthernet VPN server, and I am trying to connect to it from another laptop with similar O.S. and OpenVPN Connect client.

I have been able to connect the laptop behind the Mikrotik router with Wake on Lan, Remote Desktop, Teamviewer, VNC, etc. but I cannot do it with VPN, neither the Windows included VPN one nor the SoftEther VPN server one.

I have opened and forwarded to the internal IP of my laptop port 1723 for the Windows VPN and UDP 1194 for the SoftEther. (I also tried with TCP and some other port as 443, 5555, etc.). I did it in a similar way I did for the RDP (Remote Desktop) access.

For SoftEther VPN server and OpenVNP Connect client I am using similar installation and definitions as I use in another situations where I have a Mitrastar router and it works perfectly, but I cannot do it in the Mikrotik location.

On the other hand, installing OpenVPN Connect in the laptop behind the Mikrotik, I am able to access SoftEther VPN server that is behind the Mitrastar router, but not the other way

Is there some specific or special thing I should do to have this VPN access working? I have a limited administrator access to the Mikrotik, for instance I can access to IP-Firewall rules/definitions, but not the full administration rights.

Thanks for any help.

Best regards.

Javier

Sounds like a waste of time, try using wireguard.

Hi, thanks for the answer, but this comes to me with a couple of questions:

1.- Why a waste of time? Is it the difference with SoftEther such big?
2.- I had a look to the wireguard web site and it looks (at least for me) much more complicated to install and use than SoftEther and OpenVPN was. I was able to install both of them in minutes, wireguard seems to be much more "unix-like command oriented".
3.- I am not sure I will not find similar problems with wireguard than the ones I found just now, or even worst because I have some (not much, but some) experience with SoftEther and none with wireguard.

What I really cannot understand is why the other applications (RDP, Teamviewer, WOL, etc.) go thru the Mikrotik router smoothly and without problems and the OpenVNP to the internal SoftEther VPN server does not, even doing the corresponding NAT ports, and in another router (Mitrastar), it does without any problem or special configuration.

Regards.

Javier

Hi there,
OPENVPN or OVPN etc has never been fully supported on MT devices.
Wireguard is pretty easy but there is a catch, you need at least one of your MT devices to have a public IP address or have an upstream router (yours or ISP) that can forward a port to the MT device.

If neither is possible, then there is still way for single devices (not MT device to MT device tunnel) to connect to your Mikrotik Device by Back to Home Wireguard, which makes use of an MT server in the cloud which facilitates the connection between the single device and the MT device.

Hi, thanks again for your answer, that, regarding OpenVPN, is probably the worst I was expecting, and it seem that the Windows VPN is not well supported in MK either, because I was not able to have it working.

On the other hand, I don't see wireguard as "easy to install", looking at their web site videos, too many command line to execute and too "unix like", that I am not familiar with. At least I was not able to find a easy step-by-step guide to install and put in work it, something for "dummies in unix environment" and windows oriented.

It seem I will have to stay without VPN with this remote computer and use the other applications that work.

Regards.

Fear not, provide the config on the MT router or device ( assuming it has a public IP or can be forwarded a port from an upstream router and will have you up and running in no time.)

I tried to install wireguard in Windows... no way, it came to a window asking for a tunnel installation or importing from a file.... and stopped... As there is not (or I cannot find) an installation guide (or step-by-step), I gave up... uninstall.

Very sorry, too complex to install (first needed step to have it working and use it! ) for me.

regards.

Really, where did you get the install from?
If you can configure a Mikrotik Device, getting a wireguard tunnel setup on windows is a piece of cake.

Step1: Download window installer from wireguard website.
Step2: At the popup window Select the arrow next to add Add Tunnel at the bottom.
SELECT: Add Empty Tunnel
... ....

Step3: Give the tunnel a name.
Step4: Note and copy the public KEY under the name. This will be used on the MIkrotik to identify this PC peer.
Step5: Then copy and paste the block underneath existing INTERFACE and PRIVATE KEY. Adjust the numbers to reflect your setup.
Remove the notes as they are there for your understanding.

[Interface]
Address = 194.128.2.2/32 { address you will give to the Windows Client. Lets assume address on router is 194.128.2.1/24. }
DNS = 192.168.2.1 { Use the gateway IP of the wireguard }

[Peer]
PublicKey = dZek49BWgVCLJRMsG6k6QK5mzHFrfy4uhOLjPyTe5WE= { this is the public key generated by the Mikrotik device }
AllowedIPs = 0.0.0.0/0
Endpoint = 32.185.112.15:12345 { public IP address and endpoint port of the mikrotik wireguard }
... .....


Note1: For allowed IPs, if the PC requires internet access at the MT device, enter 0.0.0.0/0 as shown. If you only want users to connect to the LAN subnets (for example 192.168.0.0/24) on the Mikrotik router then select the following:
AllowedIPs=194.128.2.0/24,192.168.0.0/24

Note2: Persistent keep alive is not usually used on PCs or Smartphones as its not a router to router connection that normally should be up ALL the time.

Step 6. SAVE

ENSURE The MIKROTIK Wireguard is setup, then:
Step 7. SELECT ACTIVATE BUTTON and wait for status to be ACTIVE.

DONE! No certificates, nothing tricky at all, just some cut and paste really.

It should be clear that its best to configure the WG on the Router first and copy the public key it provides so you can easily paste it into the windows install and vice versa copy the windows public key to install in the Mikrotik setup.

Hi, thanks again for your help. I downloaded the Windows installation .exe file from the wireguard web site.

Let me clarify some points. I cannot fully configure Mikrotik Router, I got it from my Internet provider, I asked them to allow me to change some things on it, particularly the NAT routing ports, and this is what I know how to do. That and some other things I don't remember now, but I don't know and I am not able to fully configure the Mikrotik device.

Looking at what you say, I feel I could do almost everything in the windows PC that is supposed I will connect to thru WG, but when we come to:

"ENSURE The MIKROTIK Wireguard is setup, then:" How can I setup Wireguard in the MK?
"this is the public key generated by the Mikrotik device" How can I get it?

In order to have a clear idea of what I want to implement:

Windows PC at place 1 with VPN client -- Mitrastar router -- Internet -- Mikrotik with public IP 90.xxx.xxx.6 -- Windows PC at place 2 with local IP 192.yy.y.26 with VPN server

Today the VPN client is OpenVPN and the VPN Server is SoftEther (I also tried with the Windows included VPN, no success) ---- possible to migrate to -> Wireguard?

Thanks again and best regards

To be clear you simply need one PC to talk to the other PC??

Without access to the MT config, not much more we can do at this point for any VPN.
Suggest you pick up a cheap MT device like HeX router and attache it to the ISP MT router and then we you can forward the MT port to the hex router and we can configure whatever we want on that.

To be clear you simply need one PC to talk to the other PC??

No, this is the example, in the real final installation there will be several PC able to talk to one of two/three PCs.

Without access to the MT config, not much more we can do at this point for any VPN.

I have access to the MT config, but not FULL access, if I am told of the exact steps to do I probably would be able to do them using the User Interface of the RouterOS, as I do with the NAT and some other configuration parameters, assigning fixed local IP address to MAC of PCs in the DHCP Leases. What I never used was a command line in the router.

Regards.

Oh as long as you have winbox access we are good to go then!!
If push comes to shove we could do a live session, via teamviewer etc......

Hi, thanks for your offer, but we have a couple of problems. First one is time difference, I see you are in Canada.... I am in Spain , several hours of difference, second one, the PC where I try to install the VPN server is remote at this moment for me. I am accessing to it thru RDP at this moment, so Teamviewer (what I am used to use, btw) would be somehow complicated at this moment, because you would be doing Teamviewer to my local PC, not to the remote one.

Maybe if you tell me what to change in the MK I could try by myself.

And... last, but not least, I would need to know what kind of changes we Will have to do in order to tell the "real" administrator of the network and the mikrotik, at least to heve him aware of the changes I have to go and reason for it.

Regards.

I meant for settings on the router. I have relatives in Cuenca and Valencia.

Ok, thanks, but, as I told you, for connecting to the router I have to do it being at the remote PC, what I do just now using Remote Desktop from my local laptop, so, if we start a teamviewer session with my local, I am not sure you will be able to "see" the remote desktop and the MK configuration.

Additionally, I need to tell my internet provider administrator the changes that are needed to be done in the MK router before those changes are done, we have a friendly relation, but I feel I should tell him before doing the changes.

Thanks again and regards.

P.S.: This MK router is in a place south and not far from Valencia

If you can pass me the config of that router, then I can adjust it for wireguard........

How can I export its configuration? and/or ... Which parameters in particular?

In winbox use the NEW TERMINAL selection on the left hand side.
Type in
/export file=anynameyouwish

Then go to FILES on the left hand side, and open the files, find the file you just created and download it to the PC.
Then either copy and paste the file so you have access or open the file and copy the contents etc..

Before posting it, ensure the router serial number is removed and remove any public WANIP information (and any keys, or passwords although there shouldnt be any at this point.
which includes IP address and gateway IP. Replace with fake numbers or X.X.X.X

Good morning for you (I feel)

You see, this is one of the limitations my config userid in the router has. I was just looking for the FILES entry in order to do a backup before we changed any thing, and I couldn't find it, same for your indication of looking for "new terminal".

I am attaching you an example of the config screen I have access to. Hope this gives you an idea of what I am allowed to do in the router.
Regards

My word, .................
The firmware version on that router is OUTDATED.
Suggest you upgrade the firmware to the latest version 7. For example, wireguard is not available on ver6 firmware.
Also I see you are not using winbox which is better for most non CLI inclined folks.

Just load winbox onto the remote PC and try that.
Or pay my air fare, and I will do it on site LOL

Hi, thanks.

I will tell to the network administrator when I will be there in several days. In the meantime, thanks a lot for your suggestions and help and, if he agree to update the router I will come back to you again..... it would be more affordable than a flight ticket

Thanks again and best regards.

Couldn't the OP simply run a WG server on his windows box behind the MT router and just port forward the WG port in the NAT of the router? Seems easier than trying to run WG on a router that is out of date and he doesn't have full admin rights on.

What? A hex router is like 60$, a windows computer is much more expensive.
Personally, if it was a business and I could deduct expenses or charge the customer, I would go with a $7 a month CHR cloud server and connect all my devices through that.

I will try jollyjogr proposal, installing the WG in one of the PCs I have in the remote location and see if it works.

It is not an additional expense because it is one of PCs already there and, as far as I understand, it has not to be dedicated to the WG, but to work also as a data server too for the other two/three PCs connected to it there.

Will keep this updated. The only problem is that WireGuard is absolutely unknown for me and I couldn't find a guide for an easy installation in Windows.

But I will try it, I will.

Thanks again and kind regards.

I found a couple of step-by-step guides to install/setup WireGuard in a Windows PC, I will try to follow them. Hope I will have success on it.

Regards

Finally, using those guides I found "googling" and also a couple of youtube videos, I was able to install wireguard server in one of the remote PCs and client in my local one, but the communication didn't work.

In order to test if it was a problem of my implementation I did a similar work using two PCs (local and remote) linked thru a Mitrastar router and, in this case, it worked without problem.

So, it seems that, as anav said some posts before, the version 6.42.7 I have in the Mikrotik Router doesn't support wireguard VPN (and I would say VPNs in general, because it didn't with OpenVPN and SoftEther either). I will talk to the network administrator for the possible upgrade a V7, but I am seriously afraid that I could lose some of the special and particular implementations I just have in that remote location and that where implemented some years ago by the administrator predecesor. I will try to stay with the TV and RDP I use just now.

Thanks anyway for your help and suggestions.

Javier

The version of Mikrotrik does not matter if you are NOT using it to communicate for wireguard.
The Windows Server behind the MT suffices just fine. Its all transparent to the MT.
As long as the server has access to the WAN side, it should be good to go.

More than likely its windows firewall or things on the PC getting in the way.
Once you fix those then you may need to adjust some MT parameters depending upon requirements.

Hi, thanks for your answer.

I feel there is something in the router that does not allow the communication via VPN to the PC. In fact the external IP is not reachable using PING or Traceroute commands. As far as I was told, in order to have a fixed external IP (I need it for doing a Wake on Lan of the remote PC), I was assigned some kind of internal/phantom IP in the router (I don't have a clear idea of how it was implemented). This way I am able to use WoL and some other things as RDP and Teamviewer for accessing the remote PC, but it seems that other protocols, as the VPN, the PING and the Traceroute doesn't arrive to my "external IP".

In fact, once I defined the NAT for both SoftEthernet and WireGuard, the counter in the NAT window stayed at "0", not the other ones.

I don't know if there is any parameter in the RouterOS of the router that is blocking that coming in traffic. By the way, if I try to communicate FROM the remote PC behind the Mikrotik using OpenVPN TO another PC in another location that has a SoftEther VPN and it is behind a Mitrastar router, it works, it is able to connect. So the VPN going outside works, the traffic coming in, doesn't.

Thanks again.