Site to site l2tp vpn with ipsec between mikrotik routers

Step-by-Step Guide: To Setup Site-to-Site VPN with L2TP/IPsec between MikroTik Routers.

by

Introduction:

In today’s interconnected world, securing your network communication is paramount. One effective way to achieve this is by setting up a Site-to-Site VPN (Virtual Private Network) using MikroTik routers and the L2TP/IPsec protocol. This type of VPN ensures that data traffic between two remote locations is encrypted and secure. In this step-by-step guide, we’ll walk you through the process of configuring a MikroTik Site-to-Site VPN with L2TP/IPsec.

Prerequisites of L2tp with IPSec on Mikrotik:

Before you start the setup process, make sure you have the following:

  1. Two MikroTik routers with RouterOS version 6.44 or later.
  2. Access to both routers with administrator privileges.
  3. Basic knowledge of MikroTik RouterOS and networking concepts.
  4. Static IP on L2tp-server router.

Step 1: Accessing RouterOS Interface

  1. Connect your computer to the MikroTik router via an Ethernet cable or access it over the network through its IP address (default is usually 192.168.88.1).
  2. Open a web browser and enter the router’s IP address in the address bar.
  3. Log in with your admin credentials.

Step 2: Basic Configuration

  1. Click on “IP” in the left-hand menu and select “Addresses.” Add an IP address to the WAN interface of both routers as follows:
    • Router 1 WAN Interface: In our case 172.31.1.240/24 is WAN IP Address.
    • Router 2 WAN Interface: A In our case 172.31.1.242/24 is WAN IP Address.
  2. Now, let’s configure the LAN settings for both routers:
    • Router 1 LAN Interface: Go to “IP” -> “Addresses” and add an IP address for the LAN interface, such as 192.168.1.1/24.
    • Router 2 LAN Interface: Similarly, go to “IP” -> “Addresses” and configure the LAN interface with an IP address, e.g., 192.168.2.1/24.
  3. Next, create static routes on both routers to allow traffic to flow between LAN networks:
    • Router 1: Go to “IP” -> “Routes” and add a route for the remote LAN network (192.168.2.0/24) with the gateway set to the IP address of Router 2’s LAN interface (e.g., 192.168.1.2).
    • Router 2: Follow the same procedure, adding a route for the remote LAN network (192.168.1.0/24) with the gateway set to the IP address of Router 1’s LAN interface (e.g., 192.168.2.1).
  4. Now, let’s set up NAT (Network Address Translation) to allow LAN devices to access the internet:
    • Router 1: Navigate to “IP” -> “Firewall” -> “NAT,” and under the “Srcnat” tab, click on the “+” sign to add a new rule. Set the chain to “srcnat,” source address to your LAN network (e.g., 192.168.1.0/24), and action to “masquerade.” This rule allows devices on the Router 1 LAN to access the internet.
    • Router 2: Follow the same procedure on Router 2, but configure the source address as your LAN network (e.g., 192.168.2.0/24).
  5. Finally, ensure that both routers have DNS servers configured under “IP” -> “DNS.” You can use your ISP’s DNS servers or any preferred public DNS servers like Google’s (8.8.8.8 and 8.8.4.4).

For SDN tutorials you can explore our site https://skillset-bd.com/

Step 3: L2TP Server Configuration (Router 1)

  1. Go to “PPP” -> “INTERFACE.”
  2. Click on the “+” sign > L2TP Server Binding.
  3. Set a name for the server and Click on L2TP Server to Enable Service.
  4. Chose Authentication as Maschap2
  5. Enable “Use IPsec” yes and set secret which will use to connect Client Mikrotik Router(Router 2)

Step 4: User Configuration

  1. Go to “PPP” -> “Secrets tab.”
  2. Click on the “+” sign > New page will pop up.
  3. Set user name, password,service. It will use when we connect mirotik client router.
  4. Put local address and remote address which will be use when client try to connect mikrotik server it will form a virtual tunnel using this ips. no need to assign this ips on interface.

Step 5: L2TP Client Configuration (Router 2)

  1. On Router 2, navigate to “PPP” -> “L2TP Client.”
  2. Click on the “+” sign to add a new client.
  3. Sat the name, click Dial Out tab enter the public IP address of Router 1 in the “Connect To” field.
  4. Enter the username and password for authentication which we created on router 1.
  5. Configure the IPsec Secret to match the secret what set on Router 1 click apply and ok.

Step 7: Add Route on Both Routers

  1. On Router 1 & 2, navigate to “IP” -> “Routes”
  2. Click on the “+” sign to add a new route.
  3. On Router 1 add Local network of site 2 which you want to access from your network and add gateway ip as remote address which is created on secrets filed.
  4. On Router 2 add Local network of site 1 on dest.address field which you want to access from your network and add L2TP Client as gateway which is created on router 2.
  5. Now You are good to go for testing.

Step 8: Testing the VPN

  1. On Router 1, go to “PPP” -> “Active Connections” to ensure the L2TP connection is established.
  2. Verify the VPN status on Router 2 as well.
  3. Test the connection by pinging devices on the remote network.

For more details you can go for official documents https://mikrotik.com

Congratulations! You’ve successfully set up a Site-to-Site VPN with L2TP/IPsec using MikroTik routers. This secure connection allows you to transfer data between the two locations while ensuring the confidentiality and integrity of your data. Remember to regularly update your router’s firmware and review security settings to maintain a high level of network protection.

A network engineer specializing in routing, switching, and security in multi-vendor environments.He writes easy-to-understand articles about networking like switching, routing, network setup, protocols, and security. He shares his knowledge and experience through his blog and is a mentor to many in the field of network engineering.

...

Leave a Comment