VPN for individual users

Not every device is allowed to install a WireGuard client, or able to. A managed laptop, a company phone, a guest who needs one file: for those the configurator offers the protocols phones and laptops already carry. If you can install an app, pick WireGuard; this chapter is about the rest.

Where it sits

The wizard's VPN step only offers WireGuard, IKEv2 and L2TP/IPsec. SSTP, OpenVPN and PPTP live in advanced, under VPN, in the same group as L2TP.

Which one to pick

IKEv2 — the best of this list. iOS, macOS, Windows and Android speak it without extra software, it survives a switch from Wi-Fi to mobile, and with certificates there is no password to guess.
L2TP/IPsec — works on older equipment and on networks that still allow it. The tool sets use-ipsec=required, so plain L2TP without encryption is refused.
SSTP — TCP on port 443. Useful on networks where only web traffic gets past the firewall. In practice a Windows protocol.
OpenVPN — when your client or your policy asks for it. You build the client profile yourself; see below.
PPTP — broken. MS-CHAPv2 and RC4 can be cracked, so anyone watching reads along. The configurator flags it as an error, not a warning. Only switch it on for equipment that truly speaks nothing else, and only for traffic that is not secret.

IKEv2

First pick the authentication:

Certificates — the router creates a CA (vpn-ca), a server certificate on the server name you fill in, and a certificate per client. Use the name you will connect to, because it ends up in the certificate and in its subject alternative name.
Pre-shared key — simpler, but everybody shares the same secret. The field has a button to generate one and wants at least 16 characters.

With certificates you add a name and a password for the .p12 export per client. The script creates and signs the certificates and exports them:

/certificate export-certificate vpn-phone1 type=pkcs12 export-passphrase=...

After the script has run, those files are in Files on the router. Fetch them there, move them to the device and import them; the CA is inside the file. Remove them from the router afterwards.

The address pool for clients (192.168.77.2-192.168.77.254 by default) decides which addresses dialled-in clients get. Pick a range you use nowhere else. The tool writes a mode-config with that pool and with the router's LAN address as the DNS server.

L2TP, SSTP, OpenVPN and PPTP

These four share one address pool, one router address and one list of users, because in RouterOS they sit on the same PPP layer:

Address pool for PPP clients — 192.168.89.2-192.168.89.254 by default.
Router address for PPP clients — 192.168.89.1 by default, the address the client sees at the other end of the link.
PPP users — a name, a password and which service that user may dial into: any, or only l2tp, sstp, ovpn or pptp. With several servers switched on, that last field is how you decide per user where they come in.

What comes out is one PPP profile named vpn, with the router address, the pool, your LAN DNS server, encryption on and MSS adjustment on, so large packets fit through the tunnel.

L2TP needs an IPsec pre-shared key (at least 12 characters, with a button to generate one). The firewall only accepts UDP 1701 when it arrives inside IPsec, so unencrypted L2TP is refused.

For SSTP and OpenVPN the script creates its own CA (ppp-ca) and a server certificate (ppp-server). That certificate is self-signed, so your client has to trust that CA. The tool does not fetch a certificate from a public issuer.

SSTP listens on TCP 443. If HTTPS management (www-ssl) also uses 443, the checks report it as an error; move one of the two. See Management access.

OpenVPN lets you choose the port (1194 by default) and UDP or TCP. The server asks for no client certificate, so you log in with a username and password from the PPP list. The configurator writes no .ovpn file: you build that client profile yourself, with the router's CA alongside. The script also contains the line for RouterOS older than 7.17, where this is written differently.

What else you need

A reachable address. Fill in the public address or hostname at the top. Without a fixed IP: switch on IP Cloud DDNS under Management access and use the sn.mynetname.net name.
Firewall rules are added for you: UDP 500 and 4500 plus ESP for IKEv2 and L2TP, TCP 443 for SSTP, your port for OpenVPN.
A correct clock. Certificates dated in the future or the past are refused. Switch on NTP; see System and time.

What goes wrong

The client connects but sees nothing. Check that the address pool does not overlap with the network you are sitting on, and that the user is allowed on that service.
The name does not match. With certificates, the name you connect to has to be the server name in the certificate.
Two services on one port. SSTP and HTTPS management both want 443; the checks say so.
Only need IKEv2? Switch the rest off. Every server you leave on is a door you have to keep an eye on.