MikroTik - OpenVPN Server Setup - ShellHacks
MikroTik - OpenVPN Server Setup - ShellHacks
MikroTik - OpenVPN Server Setup - ShellHacks
gov.ua/)
ShellHacks (https://www.shellhacks.com/)
Command-Line Tips and Tricks
BLOG (HTTPS://WWW.SHELLHACKS.COM/CAT/BLOG/)
(https://www.shellhacks.com/mikrotik-openvpn-server-setup/)
Configuring an OpenVPN server on a MikroTik router can be a complex task, especially for beginners with limited experience in
networking.
Below you will find how to setup the OpenVPN server on your MikroTik router from a command-line (terminal) quickly and easily, and
Cool Tip: Minimize risks by using a MikroTik’s safe mode feature! Read more → (https://www.shellhacks.com/mikrotik-safe-mode-
cli-winbox-webfig/)
OpenVPN is based on TLS/SSL technology, in which a server and clients can verify each other’s identities using certificates 📜.
To setup the MikroTik OpenVPN server you should generate the following certificates:
Certificate Authority (CA) – a master (root) certificate that will be used to sign server and client certificates. Clients receive a copy
of the public part of the CA certificate to verify the validity of the server certificate. The server in its turn verifies the validity of the
client certificates.
Server – provides the proof of identity for the server and what the OpenVPN daemon runs on. The private key and public key stay
on the server and the server sends the public key to clients for identity purposes.
Client – a private key and public key generated for each new user account. The client has a copy of its private key and the public
key that is in the connection profile. The public key is sent to the server for identity purposes.
(https://u24.
Certificate Template: To create a certificate in MikroTik, firstly it is required to create a certificate template that will be
gov.ua/)
automatically removed right after the certificate is signed.
⏳ It may take some time! The time of the key signing process depends on a certificate key-size and a CPU power of a MikroTik
router.
1️⃣.2️⃣ ─ Create the OpenVPN server key pair and sign it with the CA key:
Motorola Edge 40
Neo
1️⃣.3️⃣ ─ Create the OpenVPN client key pair and sign it with the CA key:
(https://u24.
[admin@MikroTik] > /certificate add name=client-template \
common-name=ovpn-client1 \
gov.ua/) days-valid=36500 \
key-size=2048 \
key-usage=tls-client
Individual Client Keys: For each OpenVPN client it is recommended to create an individual key pair to avoid an impact on the
Cool Tip: How to backup and restore a MikroTik router! Read more → (https://www.shellhacks.com/mikrotik-backup-restore-
system-configuration/)
dns-server=192.168.99.1 – Configures the Mikrotik router to be also a DNS server for the OpenVPN clients.
port=443 – Starts the OpenVPN server on the port 443 (by default: 1194 ) to avoid an Internet service provider (ISP) from
Cool Tip: How to setup DNS servers on a MikroTik router! Read more → (https://www.shellhacks.com/mikrotik-dns-servers-setup/)
2️⃣.3️⃣ ─ Enable a dynamic DNS (https://wiki.mikrotik.com/wiki/Manual:IP/Cloud) (DDNS) service to connect to the OpenVPN server by a
permanent domain name (very useful when your ISP provides a dynamic IP address that changes periodically):
(https://u24.
Akcija do -50% čak 24 meseca
gov.ua/)
If you get the “warning: Router is behind a NAT. Remote connection might not work.“, you should configure a port forwarding on an ISP’s
For this, login to the ISP’s router through a user interface (UI) and configure the port forwarding in the NAT settings, for example, as
follows:
If the ISP’s router issues a dynamic IP address to your MikroTik router, it is better to go to DHCP settings and make it static:
To get the IP and MAC addresses of the MikroTik’s interface connected to the ISP’s router (usually ether1 ), execute:
The firewall rules, that have to be created, should be moved above the DROP rules, otherwise you will get the “Connection reset,
3️⃣.1️⃣ ─ List the firewall rules and note a number of the “drop all not coming from LAN” rule (in the example below it is 5):
...
3️⃣.2️⃣ ─ Create firewall rules to allow incoming connections to the VPN server and to allow OpenVPN clients from the 192.168.99.0/24
network to access a LAN (by default, 192.168.88.0/24 ) and the MikroTik router itself (to use it as a DNS server and to be able to login to
it):
(https://u24.
[admin@MikroTik] > /ip firewall filter add chain=input \
action=accept \
gov.ua/) protocol=tcp \
dst-port=443 \
disabled=no \
comment="Allow incoming connections to OpenVPN" \
place-before=X
ℹ️ Replace X and X+1 according to the number of the “drop all not coming from LAN” rule, i.e. 5 and 6 respectively, in my case.
The resulting order of the firewall rules in my case looks like as follows:
Cool Tip: Configure an OpenVPN client as a systemd service in Linux! Read more → (https://www.shellhacks.com/openvpn-
connect-client-setup-install-config-linux/)
Export Passphrase: MikroTik doesn’t allow to export a private key without protecting it with a passphrase. Fortunately the
passphrase can be removed using the OpenSSL and i will show how to do this in the later steps.
4️⃣.2️⃣ ─ Copy the exported files from the MikroTik router to your computer:
Alternatively, you can download the files from the WinBox/WebFig interface by going to the “Files” menu:
4️⃣.3️⃣ ─ After copying the CA certificate and the client key pair to the computer, I prefer to rename them to ca.crt , client1.crt and
client1.key respectively:
4️⃣.4️⃣ ─ Remove the passphrase from the client’s private key using the OpenSSL:
As the OpenSSL is not installed on a Windows system by default, you may receive the following error:
‘openssl’ is not recognized as an internal or external command, operable program or batch file.
”
(https://u24.
Unfortunately there is no official version of the OpenSSL for Windows but it is easy and secure to use the one that comes with a Git for
gov.ua/)
Windows (https://git-scm.com/download/win) .
Once you have installed the Git for Windows (https://git-scm.com/download/win) , you can run the openssl command by providing the
4️⃣.5️⃣ ─ In the MikroTik router, create an OpenVPN user and set the password:
4️⃣.7️⃣ ─ Change the current directory to %USERPROFILE%\OpenVPN\config (create if doesn’t exist) and copy the ca.crt , client1.crt and
credentials) :
The final content of the %USERPROFILE%\OpenVPN\config folder should look like as follows:
(https://u24.
C:\> dir
- sample output -
gov.ua/)
Volume in drive C is Windows
Volume Serial Number is 9AFA-3990
Directory of %USERPROFILE%\OpenVPN\config
(https://www.facebook.com/sharer/sharer.php?
u=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Fwww.shellhacks.com%2Fmikrotik-openvpn-
server-setup%2F)
(http://twitter.com/
via=ShellHacks&text=MikroTik%3A%20OpenVPN%20Server%20Setup
openvpn-server-set
(https://u24.
gov.ua/)
(http://www.linkedin.com/shareArticle?
mini=true&url=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Fwww.shellhacks.com%2Fmikrotik-
openvpn-server-
setup%2F&title=MikroTik%3A%20OpenVPN%20Server%20Setup)
(http://reddit.com/submit?
url=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Fwww.shellhacks.com%2Fmikrotik-openvpn-
server-
setup%2F&title=MikroTik%3A%20OpenVPN%20Server%20Setup)
(https://api.whatsapp.com/se
text=MikroTik%3A%20OpenVPN%20Server%20Setup%20https%3A%2
openvpn-server-setup%2F)
(https://telegram.me/share/url?
url=https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Fwww.shellhacks.com%2Fmikrotik-openvpn-
server-
setup%2F&text=MikroTik%3A%20OpenVPN%20Server%20Setup)
(https://www.shellhacks.com/mikrotik-openvpn-server-setup/)
Primite Uplate Iz
Inostranstva
Payoneer
gov.ua/)
O N E R E P LY T O “ M I K R O T I K : O P E N V P N S E R V E R S E T U P ”
openssl pkcs12 -export -in client1.crt -inkey client1.key -certfile ca.crt -name certphone -out certphone.p12
client
dev tun
proto udp
comp-lzo
redirect-gateway
—–BEGIN CERTIFICATE—–
q0c4PYC3BB7pIOA2fH7Clkb8TduDcz0kzPqStD3mVjLXx1+KVxVeGMgbj0QLbPoG
—–END CERTIFICATE—–
nobind
persist-key
persist-tun
user nobody
group nogroup
resolv-retry infinite
L E A V E A R E P LY
Comment
Name
(https://u24.
Email
gov.ua/)
POST REPLY
SUBSCRIBE
(https://t.me/ShellHacks) (https://twitter.com/shellhacks)
(https://www.shellhacks.com/feed)
ONLINE TOOLS
TAGS
A C C E S S - C O NT R O L ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / A C C E S S - C O NT R O L / ) A N O NY M IT Y ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / A N O NY M IT Y / )
A N S I B L E ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / A N S I B L E / ) A PA C H E ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / A PA C H E / ) A R C H I V E ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / A R C H I V E / )
A R D U I N O ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / A R D U I N O / ) A R G O C D ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / A R G O C D / )
A RT I FA CTO RY ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / A RT I FA CTO RY / ) B A S H ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / B A S H / ) B O OT ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / B O OT / )
C M D ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / C M D / ) C O M M A N D - L I N E ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / C O M M A N D - L I N E / ) C U R L ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / C U R L / )
D N S ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / D N S / ) D O C K E R ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / D O C K E R / ) E N C RY P T I O N ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / E N C RY P T I O N / )
G IT ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / G IT / ) G IT L A B ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / G IT L A B / ) H E L M ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / H E L M / )
I P TA B L E S ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / I P TA B L E S / ) J E N K I N S ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / J E N K I N S / )
K U B E R N E T E S ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / K U B E R N E T E S / ) L I N U X ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / L I N U X / ) M A C O S ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / M A C O S / )
M A I L ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / M A I L / ) M I K R OT I K ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / M I K R OT I K / ) M O N G O D B ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / M O N G O D B / )
MY S Q L ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / MY S Q L / ) N E T W O R K ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / N E T W O R K / ) O P E N S S L ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / O P E N S S L / )
PA S S W O R D ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / PA S S W O R D / ) P D F ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / P D F / )
P O W E R S H E L L ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / P O W E R S H E L L / ) P Y T H O N ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / P Y T H O N / )
R A S P B E R RY P I ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / R A S P B E R RY- P I / ) S S H ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / S S H / )
S U B L I M E T E X T ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / S U B L I M E - T E X T / ) T E L E G R A M ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / T E L E G R A M / )
T E L N E T ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / T E L N E T / ) T E X T- P R O C E S S I N G ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / T E X T- P R O C E S S I N G / )
TO R ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / TO R / ) T S M ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / T S M / ) W I N D O W S ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / W I N D O W S / )
W O R D P R E S S ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / W O R D P R E S S / ) YU M ( HT T P S : // W W W. S H E L L H A C K S . C O M / TA G / YU M / )
(https://t.me/ShellHacks) (https://twitter.com/shellhacks)
(https://www.shellhacks.com/feed)
Privacy (https://www.shellhacks.com/privacy)