Configuring VPN servers and clients on Mikrotik routers

The easiest one is the L2TP protocol and the QuickSet mode which is available by default when you log in to the web interface. Quickset is a simple configuration wizard page that prepares your router in a few clicks.

This option gives you a domain name where to connect to, and enables PPTP and L2TP/IPsec (the second one is recommended). The username is 'vpn' and you can specify your own password. All you need to do is enable it here, and then provide the address, username and password in your laptop or phone, and when connected to the VPN, you will have a securely encrypted connection to your home network. Also useful when travelling - you will be able to browse the internet through a secure line, as if connecting from your home. This also helps to avoid geographical restrictions that are set up in some countries.

The openVPN is performing really slow on mikrotik devices, at least on my RB2011UiAS-RM it was at 50Mb speed max over vpn. OpenVPN is based on TLS/SSL technology, in which a server and clients can verify each other’s identities using certificates.

The only options which perfroms good on a mikrotik devices is wireguard server, i was able to achive all 100Mb speed over vpn. with the CPU load around 15-20%.

So first of all we need to do the folowing to setup wiregurad srver on a mikrotik:

Let's start by creating a WireGuard interface on your MikroTik router. I created one called 'wireguard1'. For this setup, I've chosen the IP range 192.168.98.0/24. When you create this interface, the router will automatically generate a private and public key pair. It's important to copy the public key here because we'll need this to set up the client.

In WireGuard menu click add new interface, keys will be generated automatically on save.

Then we should assign the ip adress pool for our wireguard interface, which will assign this to vpn users.

We should go tp IP->Adresses new

Next step is to setup peers for the wireguard interface, WE should paste the public key from your client into this configuration — we'll get this from our client device. I'm leaving the Port at its default value of 13231.

Navigate to Wireguard->Peers new

At this point we are done with mikrotik configuration, we will come back later to update pulic key for our client peer, once we will get it from client.

I'm using network manager tools available by default from Gnome the package is nmcli i'm assuming you have already installed it.

First of all let's create an vpn.conf file and generate private && public keys

install the wireguard-tools package
wg genkey | tee private.key | wg pubkey > public.key

Then copy the public key value and save into the Mikrotik server Peer configuration. On a Mikrotik go to Wireguard -> Peers client1 and paste the pulic key which we leaced empty in previous steps.

Then cerate the following vpn.conf file

[Interface]
PrivateKey = <contents-of-client-privatekey-generated in command above>
Address = 10.0.0.1/24
DNS = 8.8.8.8
[Peer]
PublicKey = <contents-of-server-publickey-generated-on-mikrotik-side>
AllowedIPs = 0.0.0.0/0
Endpoint = YOUR_PUBLIC_IP_ADDRESS_OF_MIKROTIK
PersistentKeepalive = 15

Import configuration file using nmcli command

nmcli connection import type wireguard file ~/vpn.conf

Then make sure that new connection is set up and running by:

nmcli connection up vpn

On A mikrotik side you should be able to see traffic comming in by Tx Rx rate in a Peers section of wireguard menu

On another Mikrotik router we can create a client to connect to the wireguard server on a Mikrotik server so it will be Mikrotik client -> to Mikrotik server.

Lets create the Wireguard interface which will be connected to our Wireguard server on another Mikrotik router. Private and public key for interface will be generated automatically.

[admin@MikroTik] >  /interface wireguard
add listen-port=13231 mtu=1420 name=wireguard-MikroTik-Client

Then we should create a new peer containing public key from the mikrotik server peer:

[admin@MikroTik] > /interface wireguard peers
    add allowed-address=0.0.0.0/0 endpoint-address=your_miktorik_wireguard_public_ip_address \
        endpoint-port=13231 \
        interface=wireguard-MikroTik-Client \
        persistent-keepalive=10s \
        public-key="public_key_from_wireguard_server_interface"

Create an ip address pool, for the wireguard interface:

[admin@MikroTik] >  /ip address
add address=192.168.86.2/24 \
    interface=wireguard-MikroTik-Client \
    network=192.168.86.0

At the last point we should add the route for the wireguard interface where the gateway is the internal wireguard address, and the dst-address is the subnetwork behind the wireguard on which we should get access.

[admin@MikroTik] > /ip route add \
                 disabled=no \
                 distance=1 \
                 dst-address=192.168.1.0/24 \
                 gateway=192.168.86.1 \
                 pref-src="" \
                 routing-table=main \
                 scope=30 \
                 suppress-hw-offload=no \
                 target-scope=10

After that we should see the traffic on the Wireguard interface Rx and Tx rate and Last Handshake should change their values, which indicates that traffic is going on them.