In this post, I’ll describe the step by step procedure to setup Mikrotik RouterOS as OpenVPN server. I’ll use the Ubuntu Server in order to create CA, server and client(s) certificates.
Please remember a few things about Mikrotik OpenVPN server implementation:
– UDP mode is not supported, only supports TCP mode
– username/password is must even though client certificates are being used for authentication
Install the openvpn package on Ubuntu Server using the following command:
sudo apt-get install openvpn easy-rsa
Make an easy-rsa directory inside /etc/openvpn:
sudo mkdir easy-rsa
Use the following command to copy the default easy-rsa into /etc/openvpn/easy-rsa for setting up Certificate Authority (CA), certificates and keys generation for OpenVPN server and clients:
cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/
Edit these parameters according to your need:
export KEY_ORG="Example Company"
Run the clean-all command:
Now, generate the CA certificate:
Next, generate a server certificate and private key:
Move to the keys directory (/etc/openvpn/easy-rsa/keys):
Copy the ca certificate, server certificate and key to the mikrotik router:
ncftpput -u admin 10.10.10.1 / ca.crt mikrotik.crt mikrotik.key
VPN client also need a certificate to authenticate itself to the server. Move to the /etc/openvpn/easy-rsa/ directory and create the different certificate for each client:
Mikrotik OpenVPN Server Configuration:
1) Connect to the Mikrotik using Winbox. Goto the Files,there you will find all the files, that you have copied from Linux server:
2) Then goto the System —> Certificates:
Click on Import Button, then select the ca certificate file (in my case, it is ca.crt) and press Import:
Double click on the imported certificate and change its name (This step is optional):
Once again,click on Import Button, then select the server certificate file (in my case, it is mikrotik.crt) and press Import:
Next, import the server key using the above step:
Double click on the imported server certificate and change its name (This step is optional):
Once you have imported the private key, the server certificate will get the “KR” written in-front of it:
Next we need to create the pool for openvpn client, for this, goto the IP—->Pool:
Create each pool of /30 subnet:
(Reason to create the /30 subnet is that, I am getting the below mentioned error on Windows machine, and that trick work for me)
There is a problem in your selection of --ifconfig endpoints [local=172.25.10.2, remote=172.25.10.1].
The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet. This is a
limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets'
option for more info.
Create as many pool as you have openvpn clients:
Give in the name of the immediately next pool name in the “Next Pool” field:
Create the profile for openvpn client by selecting “Profiles” tab and click on + button:
Move over to the Secrets tab and click on the + button to create user for openvpn client:
Enable OpenVPN Service and Select Valid Certificate by moving to the Interface take and click on “OVPN Server“:
Windows as OpenVPN Client installation & Configuration:
Download free OpenVPN client for windows from here, and install it. Once it’s installed, move to the openvpn directory(C:\Program Files\OpenVPN\config):
Download the sample configuration file from here. Modify it as per your requirement:
Create the auth.cfg file inside the C:\Program Files\OpenVPN\config folder, with the openvpn username and password that you have created on mikrotik server:
Run the OpenVPN client with Administrator privileges:
Right click on the openvpn icon at System Tray and click on “Connect“:
Once, it will be connected, will show you the similar detail:
Check the Routing Table:
route PTINT -4
Ping to the internal host:
Hope this will help you!
Please Remember me in your prayers!