Skip to content
This repository has been archived by the owner on May 30, 2020. It is now read-only.
/ l2tp-ipsec-tutorial Public archive

L2TP/IPsec on MikroTik RouterOS tutorial

Notifications You must be signed in to change notification settings

bomsi/l2tp-ipsec-tutorial

Repository files navigation

L2TP/IPsec on MikroTik RouterOS tutorial

This tutorial will guide you to quickly setup L2TP/IPSec VPN using WinBox.

Tools used:

  • WinBox v6.41
  • RB951G-2HnD

Clients which have been tested and are able to connect:

  • iOS v11.2.1
  • Windows 10 (1709)

L2TP setup

In the PPP menu, select Interface tab and click L2TP Server button.

L2TP Server

Profile used:

PPP Profile - General tab

Local Address is set to the internal IP address for MikroTik. Remote Address is taken from the pool and will be assigned to the connected client.

PPP Profile - Protocols tab

IP Pool example:

IP Pool

Make sure that the VPN client IP address range does not overlap with an existing range.

PPP Secret - Adding clients

Add client accounts.

IPSec setup

In the IP menu select IPSec. Create new peer as shown:

IPSec Peer - General tab

IPSec Peer - Advanced tab

IPSec Peer - Encryption tab

Set up IPSec proposal.

IPSec Proposal

Firewall

To allow outside connections accept UDP on ports 500, 1701 and 4500.

Firewall rules

If you would like to apply firewall rules per user, you can set up bindings.

L2TP Binding

Firewall rules - per binding

FAQ

Q1. Windows 10 client completes IPSec phase 1, but is stuck after that. What is needed to complete the L2TP circuit?

A1. On the client, start PowerShell as Administrator. Execute the following command and reboot the PC.

Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\PolicyAgent -Name AssumeUDPEncapsulationContextOnSendRule -Value 2 -Type DWord

About

L2TP/IPsec on MikroTik RouterOS tutorial

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published