MikroTik VPN Configuration Handbook

You followed three tutorials. The tunnel shows as established. You cannot ping across it.

This handbook is written for exactly that moment. Most guides stop once the tunnel comes up. This one carries on through the input chain, the route, the NAT bypass and the forward rule, because those are what decide whether traffic actually passes. Every configuration is a complete, copy-paste-ready RouterOS 7 block, built for one consistent scenario (a fictional logistics company with a head office and branches) and tested on RouterOS 7.24.

Who it’s for

• You can log in to a MikroTik router, assign an address and read a firewall rule.
• You know the difference between the input and forward chains.
• You don’t need a MikroTik certification, previous IPsec experience, or physical hardware. Chapter 5 builds the whole lab in virtual machines.

It does not cover wireless, CAPsMAN, MPLS/VPLS, or exam preparation.

What’s inside

Part One — Foundations

• How RouterOS thinks about VPNs: interface-based versus policy-based tunnels
• Choosing the right tunnel, by scenario
• The four things every tunnel needs, and the diagnostic sequence
• Building the lab, and certificates with the built-in CA (including ACME / Let’s Encrypt)

Part Two — The Protocols

• WireGuard site-to-site and remote access, including split vs full tunnel and DNS
• IPsec fundamentals, policy-based site-to-site, and route-based IPsec
• L2TP over IPsec, SSTP, and OpenVPN on RouterOS 7
• EoIP over IPsec for bridging layer 2; GRE, IPIP and when to use which
• PPTP: why not, and how to migrate an inherited deployment

Part Three — Real-World Scenarios

• Working behind CGNAT
• Hub and spoke, and scaling beyond a handful of peers
• Interoperating with strongSwan and other non-MikroTik peers
• Failover and redundancy with OSPF over WireGuard, with measured failover times
• Split tunnel, full tunnel and policy routing

Part Four — Troubleshooting

• The tunnel is up but no traffic passes: a decision tree and a five-minute triage
• Reading the logs, protocol by protocol
• Torch, sniffer and Wireshark streaming
• MTU, fragmentation and MSS clamping
• Performance and hardware offload

Appendices: RouterOS 6.49 to 7.x migration, a cryptographic proposal reference, nine ready-to-use configuration templates, and a verification log recording exactly what was tested.

From the book

Chapter 4 is the chapter the book calls the most important. Here is the NAT failure it exists to prevent. A standard MikroTik router has a masquerade rule:

/ip/firewall/nat
add chain=srcnat action=masquerade out-interface-list=WAN comment="defconf: masquerade"

Traffic heading into the tunnel can match it, get its source rewritten to your public IP, and arrive at the far side with no route back. The tunnel is up, the counters increment, and nothing works. The fix is an accept rule placed above the masquerade:

/ip/firewall/nat
add chain=srcnat action=accept \
    src-address=10.10.10.0/24 dst-address=10.10.20.0/24 \
    place-before=0 comment="Bypass NAT for tunnel traffic to Site B"

Watch out. Adding a WireGuard peer with allowed-address=0.0.0.0/0 on a router that already has a default route will silently blackhole all traffic the moment the peer handshakes. Chapter 7 shows why.

Tested on

RouterOS 7.24 (Stable channel), running as Cloud Hosted Router. Where behaviour differs between minor releases, the book says so, and Appendix D records exactly what was tested.