I got some questions about how to configure Mikrotik to act as L2TP Server with IPsec encryption for mobile clients. I know this is not exactly in the line of this blog oriented on enterprise networks, but it’s network technology in the end so I’ll try to cover it here.
Before we start, please make sure that your Mikrotik build-in firewall is configured in such way that it can accept packets on the WAN interface. You can check my article on IPsec VPN Mikrotik to Cisco for firewall configuration.
Another important part is that I’m using RouterOS v6.24 in the below scenario. In earlier versions some configurations are a bit different, but you’ll figure it out as I will explain where is really important.
1. Add a new IP Pool
It’s not mandatory if you already have a IP Pool, but I assume you don’t and we need to add one.
GUI
IP > Pool
Add a new pool
Name: L2TP-Pool Adresses: 172.31.86.1-172.31.86.14 Next Pool: None
CLI
/ip pool add name="L2TP-Pool" ranges=172.31.86.1-172.31.86.14
L2TP Configuration
1. Configure L2TP Profile
Before adding a new L2TP Server, we need to add a new L2TP Profile. We can use also the default one, but I don’t like to mix things.
GUI
PPP > Profiles
Name: l2tp-profile Local Address: L2TP-Pool Remote Address: L2TP-Pool DNS Server: 8.8.8.8 Change TCP MSS: yes Use Encryption: required
The rest of values can be left on default value.
CLI
/ppp profile add name=l2tp-profile local-address=L2TP-Pool remote-address=L2TP-Pool use-encryption=required change-tcp-mss=yes dns-server=8.8.8.8
2. Add a L2TP-Server
GUI
PPP > Interface > L2TP Server
Enabled: Checked Max MTU: 1460 Max MRU: 1460 Keepalive Timeout: 30 Default Profile: mschap2 Use IPsec: Checked IPsec Secret: MYKEY
CLI
/interface l2tp-server server set authentication=mschap2 default-profile=l2tp-profile enabled=yes ipsec-secret=MYKEY max-mru=1460 max-mtu=1460 use-ipsec=yes
3. Add PPP Secrets
GUI
PPP > Secrets
Enabled: Checked Name: MYUSER Password: MYPASSWORD Service: l2tp Profile: l2tp-profile
Let the rest as default.
CLI
/ppp secret add name=MYUSER password=MYPASSWORD service=l2tp profile=l2tp-profile
IPsec Configuration
On IPsec configuration, you can use the default configuration (like Proposals) but I would suggest to let those as default and add your new ones. In case that you already have some IPsec configuration which is already working and using the default configuration we don’t want to mess with that.
1. IPsec Proposals
GUI
IPsec > Proposals
Enabled: Checked Name: L2TP-Proposal Auth. Algorithm: sha1 Encr. Algorithm: 3des, aes-256 cbc PFS Group: none
CLI
/ip ipsec proposal add name=L2TP-Proposal auth-algorithms=sha1 enc-algorithms=3des,aes-256-cbc pfs-group=none
Something to mention here. In version previous than 6.xx, you can pick only one encryption algorithm, if I remember correctly. You cannot add multiple algorithms (like 3des and aes-256 above). If this is the case, be sure to stay with 3des. I know it offer less security, but for some reason I could not force Microsoft Windows to work on L2TP via aes-256.
2. IPsec Peers
GUI
IPsec > Peers
Enabled: Checked Address: 0.0.0.0 Auth. Method: pre shared key Secret: MYKEY Policy Template Group: default Exchange Mode: main l2tp Send Initial Contact: Checked NAT Traversal: Checked My ID: auto Proposal check: obey Hash Algorithm: sha1 Encryption Algorithm: 3des, aes-256 DH Group: modp1024 Generate policy: port override
CLI
/ip ipsec peer add address=0.0.0.0/0 port=500 auth-method=pre-shared-key secret="MYKEY" generate-policy=port-override exchange-mode=main-l2tp send-initial-contact=yes nat-traversal=yes hash-algorithm=sha1 enc-algorithm=3des,aes-256 dh-group=modp1024
IMPORTANT
The value of the Secret field above, MUST be the same as in L2TP Configuration, Step 2.
Also, if your RouterOS support only one encryption algorithm, then pick 3des.
3. IPsec Policies
GUI
Enabled: Checked Src. Address: ::/0 Dst. Address: ::/0 Protocol: 255(all) Template: Checked Group: default Action: encrypt Level: require IPsec Protocols: esp Tunnel: Not checked SA Src. Address: 0.0.0.0 SA Dsr. Address: 0.0.0.0 Proposal: L2TP-Proposal
CLI
/ip ipsec policy add src-address=::/0 dst-address=::/0 protocol=all template=yes group=default action=encrypt level=require ipsec-protocols=esp tunnel=no sa-src-address=0.0.0.0 sa-dst-address=0.0.0.0 proposal=L2TP-Proposal
Below, I’ll add two examples how to configure the iPhone and Microsoft Windows to work with the above configuration.
iPhone
Go to Settings, VPN section and Add VPN Configuration…
It will look like this:
The Server is the public IP address or FQDN of your Mikrotik. Account and Password are the one defined in L2TP Configuration Step 3. (MYUSER and MYPASSWORD in the example above). Secret , is the IPsec Secret Key defined in L2TP Configuration Step 2. and IPsec Configuration Step 2. (MYKEY in the example).
PC with Microsoft Windows
1. Add a new VPN connection
2. Pick the option Use my Internet connection
3. Add Mikrotik L2TP Server details
4. Add the user and password
Add this point Windows 7 force me to hit Connect. I will not work yet. Please follow the next steps.
You need to reach the Properties of your new VPN connection.
5. Configure the VPN Security settings.
Be sure to have the settings like in image below, to force encryption and use mschap2 protocol.
6. Set the IPsec Secret key
Hit the Advanced button and set the IPsec key
Hit Connect and it will work. If you have questions please be sure to add them to Comments.
This has been a huge help but, I’m still struggling. I can make the connection just fine. However, once on the target network and receiving an IP address from the dhcp server, I can’t connect to (or even ping) other devices on the subnet. Yes, I have enabled arp-proxy on my LAN interface and, no, I see no difference once enabled. Is there something (likely simple) else I may be missing?
MPLS missing. Configure that and other devices will be visible.
You need to add a static route point back to the VPN interface, for example my VPN pool I’musing 192.168.99.0/24
/ip route add distance=1 dst-address=192.168.99.0/24 gateway=[your l2tp interface]
Phase 1 negotiation failed due to time up 192.168.1.1[500]34.128.0.178[500]43f762354…:5674a8462g5….
“Invalid length of payload.”
Thanks so much for this! I was stuck dead in the water at “resent phase 1 packet” until I read this. I opened up UDP 4500, and that broke the dam. Just a couple more minor things to tweak, and I had my first L2TP/iPhone connection operational.
Muito obrigado deu certo essa configuração
need add net firewall rule to work
Chain: input
Protocol: 17 UDP
DST Port: 500
In Interface: ether1-gateway (or whatever your WAN interface name is. Choose it from the drop down list)
Connection state: new
action : accept
Hi!
This configuration isn`t working at android phone? Or need some other config?
Same question here….
Can’t connect using Nexus 5 Android 6.0
Log says: authtype mismatched error (http://forum.mikrotik.com/viewtopic.php?f=13&t=101415)
Thanks!
Same problem. Can’t connect using Android 6.0 on Nexus5
When using the above settings if you “accidentally” check the box in the Windows 7 client for using certificates instead of the secret passphrase, then the client will connect to the server regardless without even entering a passphrase. This is on an RB850Gx2. The protocol switches from normally sha1 + aes to MPPE128 stateless. Any idea why this happens. We expect the client to be required to use the secret passphrase and not connect with only the username and password. Thanks!
Joel
Working on Windows Phone 8.1, thanks! Finally a VPN I can use while waiting for WP10!
Is it possible to use this vpn without password? With SSL cert?
Sergey, as variant see http://bozza.ru/art-248.html, vrode rabotaet :)
idea (if right) to use “3des” only rather than “3des, aes-256”
On L2TP Configuration > 2, the GUI settings should be:
Default Profile=l2tp-profile
Authentication: mschap2
In addition to Green’s update, the firewall configuration requires port 1701 to be opened (for iPhone 6s, iOS9)
i also needed to open udp/1701 despite it “should” not be opened in theory.
[8/1/2016 9:31:27 PM] 21:26:24 firewall,info input: in:ether1-gateway out:(none), src-mac MM, proto UDP, AA:19569->BB:4500, len 92
[8/1/2016 9:31:27 PM] 21:26:24 firewall,info input: in:ether1-gateway out:(none), src-mac MM, proto UDP, AA:19569->BB:4500, len 160
[8/1/2016 9:31:27 PM] 21:26:24 firewall,info input: in:ether1-gateway out:(none), proto UDP, AA:58272->BB:1701, len 101
[8/1/2016 9:31:27 PM] 21:26:25 firewall,info input: in:ether1-gateway out:(none), src-mac MM, proto UDP, AA:19569->BB:4500, len 96
[8/1/2016 9:31:27 PM] 21:26:25 firewall,info input: in:ether1-gateway out:(none), proto UDP, AA:58272->BB:1701, len 48
AA is an external ip of vpn client
BB is an external ip of vpn server
Hello, it seems to me there is a bug with the Nexus 5 (my android is up to date). I have done everything in the tutorial and verified many times for errors but still My Nexus client doesn’t connect. Any help?
I only got the error “no configuration found for 87.129.xxx.xxx” (This is the public IPv4 from my iPhone at this time. It will not connect!
Any hints?
Here are the ports and protocols:
Protocol: UDP, port 500 (for IKE, to manage encryption keys)
Protocol: UDP, port 4500 (for IPSEC NAT-Traversal mode)
Protocol: ESP, value 50 (for IPSEC)
Protocol: AH, value 51 (for IPSEC)
Also, Port 1701 is used by the L2TP Server, but connections should not be allowed inbound to it from outside. There is a special firewall rule to allow only IPSEC secured traffic inbound on this port.
I found I don’t need ESP & AH as I’m not using IPSEC directly but IPSEC over L2TP with NAT. So I am able to get away with ports 500,4500,1701. Interesting comment about the special rule for 1701. I’ll have to try that as soon as I figure out how to configure it with Mikrotik. – Matt Sep 18 ’14 at 23:08
I feel that you should probably add a firewall section to this tutorial. As most installations are going to have a filter rules and nat rules.
I have followed tutorial and I am stuck, I get `Phase 1 negotiation failed due to time up` in the log of the Mikrotik “Server”.
I’ll try to add it, but lately I was really busy with some other projects.
Thank you for a great tutorial! – One question I would have though. Why is the ipsec secret entered twice (/interface l2tp-server server & /ip ipsec peer)? Especially as these have to be the same.
Hi,
I have set, all as here described but have this error:
The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator.
Please can you help me what I do wrong, or what i need to repair?
I have tested it with added firewall roles for all udp 500, 17001, 4500 and IP-ESP, IP-AH input ports.
I test it with macOS Sierra, iOS 10 and MikroTik 6.37.1
I have set it exactly as described but have still the same error.
Please is possible to help me and tell me what I done wrong?
Thanks.
What happens if you turn the firewall off completely for a few moments and try to test? Does it work?
There can be multiple issues for what you describe, but there is too less information to give you a definitive answer.
muchas graciass excelenteee tutoriallll!!
Finally a blog explaining how to do this and it actually works… thank you very much!
Thanks for your positive feedback :)
I followed it step-by-step and worked as charm, after I disabled a firewall’s rule blocking all incoming connexations.
Great work! work for me in win7 & samsung S7 at first try :-)
just 1 question (problem)
in the mikrotik I have 4 differant network
10.0.0.0/24
10.0.1.0/24
10.0.2.0 /24
10.0.3.0/24
when I connect I can only go to 10.0.2.0 /24
any reason for it?
what do I need to add?
(when I connect to the mikrotik by cable I get access to all networks….)
Thanks ,
Hello, my vpn with l’IPhone is ok, but this vpn with Windows, is not good..I have the same configuration as you under Windows
a idea ?
Hello, my vpn with l’IPhone is ok, but this vpn with Windows, is not good..I have the same configuration as you under Windows
a idea ?
VPN via L2TP is in connected status but can’t ping IP in LAN. I use 10.0.0.1-10.0.0.10 as VPN IP pool and LAN is 192.168.1.0/24. The VPN clients can get the IP Pool range in connect status but can’t ping to LAN IP range. What should i do?
Works ideally on ios 10! Big thanks!
If you have a strict firewall, like I do ( I drop every incoming pocket ), do not forget to bring up to the top these 2 rules:
/ip firewall filter add chain=input protocol=udp port=1701,500,4500
/ip firewall filter add chain=input protocol=ipsec-es
Zoltan, thanks for bringing this up! Good hint!
Thanks for the tutorial. I have followed the configuration that you have described step by step but I run into a problem. When I connect from Windows 10, this connection is made, it is connected and it works but only for a while (about 2 minutes). The solo is disconnected. To others the connection tells me that I do not have access to the network, but I ping the internal network and it responds to me but when it approaches the time it is disconnected the ping no longer responds and the connection drops off by itself. You can tell me what can happen, I can not know why it falls, instead it stays up (without network connection as it tells me in Windows) if I do a continuous ping, but cut it after a few minutes it falls again.
The most curious thing is that it only happens to me with a computer, because I have tried it in other locations of the client, but in them if it works without problems and does not fall even if there is no traffic.