Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
languageros
/ip firewall nat
add action=accept chain=srcnat protocol=udp src-port=500,4500 place-before=0

Application examples

Site to Site IPsec (IKEv1) tunnel

Consider setup as illustrated below. Two remote office routers are connected to the internet and office workstations are behind NAT. Each office has its own local subnet, 10.1.202.0/24 for Office1 and 10.1.101.0/24 for Office2. Both remote offices need secure tunnels to local networks behind routers.

...

Currently, Windows 10 is compatible with the following Phase 1 ( profiles) and Phase 2 ( proposals) proposal sets:

Phase 1
Hash AlgorithmEncryption AlgorithmDH Group
SHA13DESmodp1024
SHA2563DESmodp1024
SHA1AES-128-CBCmodp1024
SHA256AES-128-CBCmodp1024
SHA1AES-192-CBCmodp1024
SHA256AES-192-CBCmodp1024
SHA1AES-256-CBCmodp1024
SHA256AES-256-CBCmodp1024
SHA1AES-128-GCMmodp1024
SHA256AES-128-GCMmodp1024
SHA1AES-256-GCMmodp1024
SHA256AES-256-GCMmodp1024


Phase 2
Hash AlgorithmEncryption AlgorithmPFS Group
SHA1AES-256-CBCnone
SHA1AES-128-CBCnone
SHA13DESnone
SHA1DESnone
SHA1nonenone

macOS client configuration

...

Currently, macOS is compatible with the following Phase 1 ( profiles) and Phase 2 ( proposals) proposal sets:

Phase 1
Hash AlgorithmEncryption AlgorithmDH Group
SHA256AES-256-CBCmodp2048
SHA256AES-256-CBCecp256
SHA256AES-256-CBCmodp1536
SHA1AES-128-CBCmodp1024
SHA13DESmodp1024


Phase 2
Hash AlgorithmEncryption AlgorithmPFS Group
SHA256AES-256-CBCnone
SHA1AES-128-CBCnone
SHA13DESnone

iOS client configuration

Typically PKCS12 bundle contains also a CA certificate, but iOS does not install this CA, so a self-signed CA certificate must be installed separately using PEM format. Open these files on the iOS device and install both certificates by following the instructions. It is necessary to mark the self-signed CA certificate as trusted on the iOS device. This can be done in Settings -> General -> About -> Certificate Trust Settings menu. When it is done, check whether both certificates are marked as "verified" under the Settings -> General -> Profiles menu.

...

Currently, iOS is compatible with the following Phase 1 ( profiles) and Phase 2 ( proposals) proposal sets:

Phase 1
Hash AlgorithmEncryption AlgorithmDH Group
SHA256AES-256-CBCmodp2048
SHA256AES-256-CBCecp256
SHA256AES-256-CBCmodp1536
SHA1AES-128-CBCmodp1024
SHA13DESmodp1024


Phase 2
Hash AlgorithmEncryption AlgorithmPFS Group
SHA256AES-256-CBCnone
SHA1AES-128-CBCnone
SHA13DESnone


Note

If you are connected to the VPN over WiFi, the iOS device can go into sleep mode and disconnect from the network.

...

It is possible to specify custom encryption settings in strongSwan by ticking the "Show advanced settings" checkbox. Currently, strongSwan by default is compatible with the following Phase 1 ( profiles) and Phase 2 ( proposals) proposal sets:

Phase 1
Hash AlgorithmEncryption AlgorithmDH Group
SHA*AES-*-CBCmodp2048
SHA*AES-*-CBCecp256
SHA*AES-*-CBCecp384
SHA*AES-*-CBCecp521
SHA*AES-*-CBCmodp3072
SHA*AES-*-CBCmodp4096
SHA*AES-*-CBCmodp6144
SHA*AES-*-CBCmodp8192
SHA*AES-*-GCMmodp2048
SHA*AES-*-GCMecp256
SHA*AES-*-GCMecp384
SHA*AES-*-GCMecp521
SHA*AES-*-GCMmodp3072
SHA*AES-*-GCMmodp4096
SHA*AES-*-GCMmodp6144
SHA*AES-*-GCMmodp8192


Phase 2
Hash AlgorithmEncryption AlgorithmPFS Group
noneAES-256-GCMnone
noneAES-128-GCMnone
SHA256AES-256-CBCnone
SHA512AES-256-CBCnone
SHA1AES-256-CBCnone
SHA256AES-192-CBCnone
SHA512AES-192-CBCnone
SHA1AES-192-CBCnone
SHA256AES-128-CBCnone
SHA512AES-128-CBCnone
SHA1AES-128-CBCnone

Linux (strongSwan) client configuration

...

Code Block
languagebash
$ ipsec restart
$ ipsec up ikev2

Basic L2TP/IPsec setup

This example demonstrates how to easily set up an L2TP/IPsec server on RouterOS for road warrior connections (works with Windows, Android, iOS, macOS, and other vendor L2TP/IPsec implementations).

RouterOS server configuration

The first step is to enable the L2TP server:

Code Block
languageros
/interface l2tp-server server
set enabled=yes use-ipsec=required ipsec-secret=mySecret default-profile=default

use-ipsec is set to required to make sure that only IPsec encapsulated L2TP connections are accepted.

Now what it does is enables an L2TP server and creates a dynamic IPsec peer with a specified secret.

Code Block
languageros
[admin@MikroTik] /ip ipsec peer> print 
0 D address=0.0.0.0/0 local-address=0.0.0.0 passive=yes port=500 
auth-method=pre-shared-key secret="123" generate-policy=port-strict 
exchange-mode=main-l2tp send-initial-contact=yes nat-traversal=yes 
hash-algorithm=sha1 enc-algorithm=3des,aes-128,aes-192,aes-256 
dh-group=modp1024 lifetime=1d dpd-interval=2m dpd-maximum-failures=5 

...

Now the router is ready to accept L2TP/IPsec client connections.

RouterOS client configuration

For RouterOS to work as L2TP/IPsec client, it is as simple as adding a new L2TP client.

...

It will automatically create dynamic IPsec peer and policy configurations.

Site to Site GRE tunnel over IPsec (IKEv2) using DNS

This example explains how it is possible to establish a secure and encrypted GRE tunnel between two RouterOS devices when one or both sites do not have a static IP address. Before making this configuration possible, it is necessary to have a DNS name assigned to one of the devices which will act as a responder (server). For simplicity, we will use RouterOS built-in DDNS service IP/Cloud.

Site 1 (server) configuration

This is the side that will listen to incoming connections and act as a responder. We will use mode config to provide an IP address for the second site, but first, create a loopback (blank) bridge and assign an IP address to it that will be used later for GRE tunnel establishment.

Code Block
languageros
/interface bridge 
add name=loopback
/ip address
add address=192.168.99.1 interface=loopback

...

Code Block
languageros
/ip ipsec identity
add generate-policy=port-strict mode-config=ike2-gre peer=ike2 policy-template-group=ike2-gre secret=test

The server side is now configured and listening to all IKEv2 requests. Please make sure the firewall is not blocking UDP/4500 port.

The last step is to create the GRE interface itself. This can also be done later when an IPsec connection is established from the client-side.

Code Block
languageros
/interface gre
add local-address=192.168.99.1 name=gre-tunnel1 remote-address=192.168.99.2

Site 2 (client) configuration

Similarly to server configuration, start off by creating a new Phase 1 profile and Phase 2 proposal configurations. Since this site will be the initiator, we can use a more specific profile configuration to control which exact encryption parameters are used, just make sure they overlap with what is configured on the server-side.

...

Code Block
languageros
/interface gre
add local-address=192.168.99.2 name=gre-tunnel1 remote-address=192.168.99.1

IKEv2 EAP between NordVPN and RouterOS

Example available here

Troubleshooting/FAQ

Phase 1 Failed to get a valid proposal

...