Mikrotik L2TP

Matěj Hloušek

Overview

Here we will be configuring a dial-in-vpn using L2TP with IPsec. 

In this example we will be using 10.0.1.0/24 for the L2TP clients and  for the LAN.

The configuration will detail the following:

  • Enable L2TP server
  • Create DHCP pool
  • Create L2TP profile
  • Create a sample user
  • Configure IPsec Peer and Proposal
  • Create firewall input rule to accept the L2TP connections
  • Configure connectivity between dial-in-clients and LAN

Configuration

Enable the L2TP server.

/interface l2tp-server server
set enabled=yes

DHCP Pool and L2TP profile

Next we will create a PPP profile which will be used when we create our users.

Here we select the IP used by the router as well as selecting a Pool which we will also configure to give out address to our dial-in-vpn users.  Be sure not to include the IP you the router (local IP) in the DHCP range which is created in the pool.

/ip pool
add name=LAN_Pool ranges=10.0.1.51-10.0.1.250

/ppp profile
add bridge=LAN local-address=10.0.1.254 name=L2TP remote-address="LAN_Pool"

Create user

Secrets is where we create our users. Here we will create the user and password as well as  selecting our profile created earlier.

/ppp secret
add name=johndoe password=Keepsafe profile=L2TP service=l2tp

IPsec peer and proposal

This is the IPsec part of the setup and the peer and proposal are configured here.

/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc,3des
/ip ipsec peer
add address=0.0.0.0/0 exchange-mode=main-l2tp generate-policy=port-override secret=L2TPPresharedKey

Firewall rules

Here we create the firewall rules to accept the L2P connection from our dial-in-vpn users. In our example these connections are coming in over the PPPoE interface.

/ip firewall filter
add action=accept chain=input comment="L2TP accept ISAKMP/IKE" dst-port=500 in-interface=pppoe-out1 protocol=udp
add action=accept chain=input comment="L2TP accept IPSec NAT Traversal" dst-port=4500 in-interface=pppoe-out1 protocol=udp
add action=accept chain=input comment="L2TP accept L2TP" dst-port=1701 in-interface=pppoe-out1 log=yes protocol=udp

connectivity between dial-in-clients and LAN

Connection between dial-in-vpn clients and the LAN can be done by either using proxy arp or by routing.

Routing
This does not require any configuration as the router will naturally route between connected subnets.
The only thing to remember here is to have a different subnet for the dial-in-vpn clients to the LAN

Proxy arp
Here we set proxy-arp on LAN Bridge.
The LAN and L2TP clients use the same subnet.

/interface bridge
add arp=proxy-arp name=LAN/ip address
add address=10.0.1.1/24 interface=LAN network=10.0.1.0