The Book

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
=== IPsec tunnel - Windows client to Mikrotik ===

Check the [[networking:misc:ipsec_facts|differences between IPsec tunnel and IPsec transport]].\\

== Assumptions: ==

We have a central location [HQ] connected to internet via Mikrotik router. Rourer has either a fixed IP or some dynamic DNS auto update script. Let's assume that we are using the ChangeIP service and our router can be found on internet by "myVPN.changeip.org" fqdn.

1. create VPN address pool [VPN pool]\\
{{networking:mikrotik:ipsec_tunnel:ip_pool.png?}}\\


  /ip pool
  add name="VPN Pool" ranges=172.16.0.1-172.16.0.253


2. create L2TP profile [L2TP-encryption]\\
{{networking:mikrotik:ipsec_tunnel:ppp_profile.png?}}\\

  /ppp profile
  add local-address=192.168.5.254 name=L2TP-encryption remote-address="VPN Pool" use-encryption=yes \
  change-tcp-mss=yes dns-server=4.2.2.2
  
..."local-address" is private IP address of your router...


3. enable L2TP server\\
{{networking:mikrotik:ipsec_tunnel:l2tp_server.png?}}\\

  /interface l2tp-server server
  set default-profile=L2TP-encryption enabled=yes max-mru=1460 max-mtu=1460
  
4. create secret\\
{{networking:mikrotik:ipsec_tunnel:ppp_secret.png?}}\\

  /ppp secret
  add name=user11 password=pass1 profile=L2TP-encryption service=l2tp

5. add IPsec proposal (or edit default)\\
{{networking:mikrotik:ipsec_tunnel:ipsec_proposal.png?}}\\

  /ip ipsec proposal
  set [ find default=yes ] pfs-group=none

6. add IPsec peer\\
{{networking:mikrotik:ipsec_tunnel:ipsec_peer.png?}}\\

  /ip ipsec peer
  add dpd-interval=15s exchange-mode=main-l2tp generate-policy=port-override hash-algorithm=sha1 lifetime=\
  1h nat-traversal=yes secret=my_secret_key

This is all you need to configure on router. You still have to configure windows client.....

{{networking:mikrotik:ipsec_tunnel:win_ipsec_1.png?}}\\
{{networking:mikrotik:ipsec_tunnel:win_ipsec_2.png?}}\\
{{networking:mikrotik:ipsec_tunnel:win_ipsec_3.png?}}\\