OpenVPN Server Setup on Mikrotik RouterOS

In this post, I’ll describe the step by step procedure to setup Mikrotik RouterOS as OpenVPN server. I’ll use the Ubuntu Server in order to create CA, server and client(s) certificates.

openvpn

Please remember a few things about Mikrotik OpenVPN server implementation:

– UDP mode is not supported, only supports TCP mode

– username/password is must even though client certificates are being used for authentication

Install the openvpn package on Ubuntu Server using the following command:

sudo apt-get install openvpn easy-rsa

Linux-1

Make an easy-rsa directory inside /etc/openvpn:

cd /etc/openvpn/ 
sudo mkdir easy-rsa

Linux-2

Use the following command to copy the default easy-rsa into /etc/openvpn/easy-rsa for setting up Certificate Authority (CA), certificates and keys generation for OpenVPN server and clients:

cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/

Linux-3

Edit /etc/openvpn/easy-rsa/vars:

cd /etc/openvpn/easy-rsa/
vi vars

Linux-4

Edit these parameters according to your need:

export KEY_COUNTRY="US"
export KEY_PROVINCE="NC"
export KEY_CITY="Winston-Salem"
export KEY_ORG="Example Company"
export KEY_EMAIL="me@example.com"

Linux-5

Run the clean-all command:

source vars
./clean-all

Linux-6

Now, generate the CA certificate:

./build-ca

Linux-7

Next, generate a server certificate and private key:

./build-key-server mikrotik

Linux-8

Move to the keys directory (/etc/openvpn/easy-rsa/keys):

cd /etc/openvpn/easy-rsa/keys/

Linux-9

Copy the ca certificate, server certificate and key to the mikrotik router:

ncftpput -u admin 10.10.10.1 / ca.crt mikrotik.crt mikrotik.key

Linux-10

VPN client also need a certificate to authenticate itself to the server. Move to the /etc/openvpn/easy-rsa/ directory and create the different certificate for each client:

cd /etc/openvpn/easy-rsa/
source vars
./build-key arbabpc

Linux-11

Mikrotik OpenVPN Server Configuration:

1) Connect to the Mikrotik using Winbox. Goto the Files,there you will find all the files, that you have copied from Linux server:

Server-1

2) Then goto the System —> Certificates:

Server-2

Click on Import Button, then select the ca certificate file (in my case, it is ca.crt) and press Import:

Server-3

Double click on the imported certificate and change its name (This step is optional):

Server-4

Once again,click on Import Button, then select the server certificate file (in my case, it is mikrotik.crt) and press Import:

Server-5

Next, import the server key using the above step:

Server-6

Double click on the imported server certificate and change its name (This step is optional):

Server-7

Once you have imported the private key, the server certificate will get the “KR” written in-front of it:

K: Decrypted-Private-Key 
R: RSA

Server-8

Next we need to create the pool for openvpn client, for this, goto the IP—->Pool:

Server-9

Create each pool of /30 subnet:

(Reason to create the /30 subnet is that, I am getting the below mentioned error on Windows machine, and that trick work for me)

There is a problem in your selection of --ifconfig endpoints [local=172.25.10.2, remote=172.25.10.1]. 
The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet. This is a 
limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets' 
option for more info.

Server-10

Create as many pool as you have openvpn clients:

Server-11

Give in the name of the immediately next pool name in the “Next Pool” field:

Server-12

Create the profile for openvpn client by selecting “Profiles” tab and click on + button:

Server-13

Move over to the Secrets tab and click on the + button to create user for openvpn client:

Server-14

Enable OpenVPN Service and Select Valid Certificate by moving to the Interface take and click on “OVPN Server“:

Server-15

Windows as OpenVPN Client installation & Configuration:

Download free OpenVPN client for windows from here, and install it. Once it’s installed, move to the openvpn directory(C:\Program Files\OpenVPN\config):

Windows-1

Download the sample configuration file from here. Modify it as per your requirement:

Windows-2

Create the auth.cfg file inside the C:\Program Files\OpenVPN\config folder, with the openvpn username and password that you have created on mikrotik server:

Windows-3

Run the OpenVPN client with Administrator privileges:

Windows-4

Right click on the openvpn icon at System Tray and click on “Connect“:

Windows-5

Once, it will be connected, will show you the similar detail:

Windows-6

Check the Routing Table:

route PTINT -4

Windows-7

Ping to the internal host:

Windows-8

Success 🙂

Hope this will help you!

Please Remember me in your prayers!

Enjoy :-)

Reference:

1) http://wiki.mikrotik.com/wiki/OpenVPN
2) http://lukas.dzunko.sk/index.php/MikrotTik:_OpenVPN
3) http://forum.mikrotik.com/viewtopic.php?f=9&t=36987
4) http://blog.nettraptor.net/?p=446
5) http://daffy.za.net/2010/02/openvpn-mini-guides-mikrotik-routeros-vpn-server/
6) http://daffy.za.net/2010/02/openvpn-mini-guides-certificates/
7) http://mybroadband.co.za/vb/showthread.php/375258-OpenVPN-Server-on-a-Routerboard-RB750-R-OS-5-7
8) http://itsavedmyass.cyprusmania.net/remote-access/mikrotik-openvpn-server-windows-7-client/
9) http://wiki.mikrotik.com/wiki/OpenVPN_Configuration_Step_by_Step
10) https://www.async.fi/2012/01/mikrotik-openvpn-server/
11) http://help.unotelly.com/support/solutions/articles/184300-openvpn-info-and-files-please-read
12) http://www.vpntutorials.com/tutorials/openvpn-client-setup-tutorial-for-windows-8/

2 responses to “OpenVPN Server Setup on Mikrotik RouterOS

  1. Matt February 16, 2016 at 6:25 pm

    Hello this was a great article. However something that appears to not quite work is the route in the config file. That is, yes it applies the windows route. However the Mikrotik will sometimes assign you the IP 172.25.10.1 instead of itself, in which case the route would need to specify 172.25.10.2 as the gateway since the Mikrotik assigns itself .2 periodically. Any way of getting around this problem?

    • Matt February 16, 2016 at 6:39 pm

      Ah yes the pool, looks like to avoid this happening on the latest OS you should create a local assigned pool just on the .1. Then the rest should work. In the graphic above it shows the same pool for local and remote.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: