routeros-vpn
Installation
SKILL.md
RouterOS VPN and tunnels
A tunnel needs four things: the tunnel interface (or PPP session), addresses on both ends, routes that send traffic into it,
and firewall rules that let the carrier traffic in and the inner traffic through. Most "the tunnel is up but nothing passes"
problems are a missing route, a firewall rule in the wrong place, or MTU. For IPsec policies and IKE see routeros-ipsec.
Choose the protocol
| Need | Use |
|---|---|
| Modern site-to-site or remote access between RouterOS, Linux, phones, laptops | WireGuard (UDP, key pairs, fast, no user database) |
| Native clients on Windows, macOS, iOS, Android without extra software | L2TP with IPsec (use-ipsec on the client; server side needs IPsec) |
| Must pass restrictive firewalls over TCP 443 | SSTP (TLS; certificate needed for Microsoft clients) or OpenVPN over TCP |
| Existing OpenVPN clients | OpenVPN (limited implementation, see below) |
| Extend a Layer 2 segment between sites | EoIP (RouterOS to RouterOS), L2TP-Ether, or a bridge over VXLAN (routeros-bridging-switching) |
| Plain IP-in-IP / GRE interop with other vendors | GRE, IPIP, protected with IPsec |
| Overlay network without opening ports | ZeroTier (zerotier package) |
| PPPoE to or from an ISP | PPPoE client or server |