Getting a laptop or phone securely back into the office on RouterOS comes down to picking the right protocol for where the user is. IKEv2 for native mobile clients, SSTP for punching through hostile firewalls on port 443. This builds both, plus the road-warrior gotchas that make MikroTik remote access "work in the lab, fail at the airport." The twin of the Cisco IKEv2 post.
Unlike WireGuard (great, but needs an app) or site-to-site (fixed peers), remote access is about arbitrary clients from arbitrary networks. RouterOS gives you several road-warrior options, and the right choice is a firewall question: IKEv2 is built into iOS/macOS/Windows natively and is the modern default — until a guest or hotel network blocks UDP 500/4500. SSTP tunnels over TLS on 443, so it looks like HTTPS and gets through almost anywhere — the reliable fallback. L2TP/IPsec is the legacy option every device supports but nothing loves.
We'll build IKEv2 (native clients, mode-config to assign addresses) and SSTP (443, firewall-proof), both handing the client an address from a pool and routing it to the LAN. It mirrors Cisco IKEv2 remote access; the model is identical, the menus are RouterOS.
01
Start here, because it's the most robust and the simplest. SSTP rides TLS/443, so it traverses NAT and restrictive firewalls transparently. A server cert, a PPP profile, and a user.
# Address pool + a PPP profile that assigns the gateway and client range. /ip pool add name=ra-pool ranges=10.99.0.10-10.99.0.200 /ppp profile add name=ra local-address=10.99.0.1 remote-address=ra-pool \ dns-server=10.10.0.53 # Enable the SSTP server with your cert (443 = looks like HTTPS). /interface sstp-server server set enabled=yes certificate=ra-cert default-profile=ra \ authentication=mschap2 port=443 tls-version=only-1.2 # A user (or point authentication at RADIUS for scale). /ppp secret add name=road.warrior password="strong-pass" service=sstp profile=ra
Road-warrior VPNs fail most often not on crypto but on reachability — the client is on a captive café network that blocks everything except web ports. SSTP on 443 sails through because it's indistinguishable from HTTPS to a stateful firewall. The cost is that it's Windows-native but needs a client app on other platforms, and TLS adds a little overhead. For "it has to work from wherever the user is," SSTP is the answer; pair it with IKEv2 for the native-mobile experience.
02
IKEv2 is built into phones and laptops with no app, so it's the nicest experience — when the network allows it. On RouterOS it's IPsec with mode-config to hand the client an address and a policy generated per connection.
# mode-config assigns the client an address from the pool + DNS. /ip ipsec mode-config add name=ra-mc address-pool=ra-pool address-prefix-length=32 \ split-include=10.10.0.0/24 # split tunnel: only office subnet # Phase 1/2 + a passive peer that waits for clients (exchange-mode ike2). /ip ipsec profile add name=ra-p1 enc-algorithm=aes-256 hash-algorithm=sha256 dh-group=modp2048 /ip ipsec proposal add name=ra-p2 enc-algorithms=aes-256-cbc auth-algorithms=sha256 pfs-group=modp2048 /ip ipsec peer add name=ra passive=yes exchange-mode=ike2 profile=ra-p1 \ send-initial-contact=no # Identity: authenticate clients by EAP (username/password) + server cert, # and auto-generate policies per client, scoped to the mode-config. /ip ipsec identity add peer=ra auth-method=eap-radius certificate=ra-cert \ generate-policy=port-strict mode-config=ra-mc
Two road-warrior classics. First, generate-policy=port-strict is what lets a peer with an unknown source address (a client from anywhere) install a policy dynamically — without it, IKEv2 remote access simply won't build a tunnel for a client whose IP you didn't pre-configure. Second, exactly as on Cisco: the client validates the router's server certificate, so it must be CA-signed with a name matching what the client dials, or native clients refuse with a vague error. The crypto is rarely the problem; the policy-generation and the cert trust are.
03
Clients arrive on the WAN input chain and their traffic needs to reach — and be NATed toward — the LAN. Two rules people miss, and the tunnel comes up but nothing passes.
# Allow the VPN transports IN (443 for SSTP; 500/4500 + ESP for IKEv2). /ip firewall filter add chain=input protocol=tcp dst-port=443 action=accept comment="SSTP" add chain=input protocol=udp port=500,4500 action=accept comment="IKEv2" add chain=input protocol=ipsec-esp action=accept # Let clients reach the LAN, and DON'T masquerade VPN->LAN traffic. /ip firewall nat add chain=srcnat src-address=10.99.0.0/24 dst-address=10.10.0.0/24 action=accept place-before=0
04
Confirm the listeners are up and watch a client connect on each protocol.
/interface sstp-server print # server running on 443 /ppp active print # connected SSTP users + assigned IPs /ip ipsec active-peers print # IKEv2 clients, state=established /ip ipsec policy print where dynamic=yes # auto-generated per-client policies /log print where topics~"ipsec" # first stop when a client won't connect
Takeaways
generate-policy=port-strict is what lets clients from unknown addresses build a tunnel — without it, IKEv2 remote access doesn't work.NOCTIS builds road-warrior VPNs on MikroTik and Cisco across Crete — IKEv2 for native devices and SSTP for the networks that block everything else — with proper certs, per-user auth, and split tunnelling.
Book a Discovery Call →