Setting Up an OpenVPN Server on MikroTik RouterOS: A Complete Practical Guide

OpenVPN — is a reliable and time-tested VPN protocol that allows setting up secure remote access to a local network. MikroTik RouterOS supports OpenVPN in server mode starting from version 6.x (TCP), and from version 7+ — also UDP, but with a number of architectural limitations:

• the user is authenticated by PPP username and password even when using certificates;
• a limited list of ciphers and algorithms (of modern ones — AES-GCM);
• absence of some features of the “classic” OpenVPN.

Despite this, OpenVPN on MikroTik remains a popular solution — especially in scenarios where clients do not support WireGuard or compatibility with legacy systems is required.

This article covers the complete setup of an OpenVPN server on MikroTik RouterOS:

• using a private CA and client certificates;
• supporting UDP and TCP;
• isolating VPN clients from each other;
• access to the local network;
• examples of diagnostics and troubleshooting.

What OpenVPN is, the differences between its editions, and how PKI is organized in classic OpenVPN are covered in the series “OpenVPN” — PKI and basic setup, login via Keycloak.

⚠️ All IP addresses, usernames and passwords given below are test values. Never use them in production.

Assumed topology

• Local network (LAN): 192.168.11.0/24

• Address pool for VPN clients: 10.222.60.0/24

• OpenVPN server:

  • port 1199
  • protocols: UDP and TCP

Step 1: Creating certificates

OpenVPN uses TLS encryption, so a Certificate Authority (CA), a server certificate and client certificates are required.

/certificate
add name=ovpn-ca common-name=ovpn-ca key-size=4096 days-valid=3650 key-usage=key-cert-sign,crl-sign
sign ovpn-ca ca-crl-host=127.0.0.1

add name=ovpn-server common-name=ovpn-server key-size=4096 days-valid=1825 \
    key-usage=digital-signature,key-encipherment,tls-server
sign ovpn-server ca=ovpn-ca

# Клиентские сертификаты
add name=testuser1-cert common-name=testuser1 key-usage=tls-client days-valid=365
sign testuser1-cert ca=ovpn-ca

add name=testuser2-cert common-name=testuser2 key-usage=tls-client days-valid=365
sign testuser2-cert ca=ovpn-ca

Exporting certificates:

# Export CA
export-certificate ovpn-ca

# Export clients certificate with pass
export-certificate testuser1-cert export-passphrase="TestExportPass2025!"
export-certificate testuser2-cert export-passphrase="TestExportPass2025!"

Files will appear in /files. You can download them via Winbox → Files or by FTP.

Step 2: Creating an IP pool for VPN clients

/ip pool
add name=ovpn-pool ranges=10.222.60.10-10.222.60.200

Step 3: PPP profile for OpenVPN

/ppp profile
add name=ovpn-profile \
    local-address=10.222.60.1 \
    remote-address=ovpn-pool \
    use-encryption=required \
    only-one=yes

• local-address — MikroTik’s IP inside the VPN;
• remote-address — pool of client addresses;
• only-one=yes — one active session per user.

Step 4: Configuring the OpenVPN server (UDP and TCP)

In RouterOS v7+ OpenVPN is configured as an interface. Multiple servers on one router (as here — UDP and TCP concurrently) can be created starting from RouterOS 7.17; in earlier versions there is one server.

/interface ovpn-server server
add name=ovpn-udp \
    auth=sha256,sha512 \
    certificate=ovpn-server \
    cipher=aes256-gcm,aes128-gcm \
    tls-version=only-1.2 \
    default-profile=ovpn-profile \
    disabled=no \
    port=1199 \
    protocol=udp \
    require-client-certificate=yes \
    netmask=24 \
    mode=ip \
    keepalive-timeout=60 \
    max-mtu=1500 \
    push-routes=192.168.11.0/24

add name=ovpn-tcp \
    auth=sha256,sha512 \
    certificate=ovpn-server \
    cipher=aes256-gcm,aes128-gcm \
    tls-version=only-1.2 \
    default-profile=ovpn-profile \
    disabled=no \
    port=1199 \
    protocol=tcp \
    require-client-certificate=yes \
    netmask=24 \
    mode=ip \
    keepalive-timeout=60 \
    max-mtu=1500 \
    push-routes=192.168.11.0/24

• cipher=aes256-gcm,aes128-gcm — by default RouterOS offers aes128-cbc,blowfish128; Blowfish and CBC are deprecated, so we leave only AES-GCM;
• auth=sha256,sha512 — remove MD5 and SHA-1 from the default list (sha1,md5,sha256,sha512);
• tls-version=only-1.2 — prohibits obsolete TLS versions (default any);
• require-client-certificate=yes — server checks that the client certificate is signed by our CA (default no).

Step 5: Firewall configuration

Allowing incoming connections

/ip firewall filter
add chain=input protocol=udp dst-port=1199 action=accept comment="OpenVPN UDP"
add chain=input protocol=tcp dst-port=1199 action=accept comment="OpenVPN TCP"

Forward rules and client isolation

/ip firewall filter
add chain=forward connection-state=established,related action=accept comment="Established/Related"

add chain=forward src-address=10.222.60.0/24 dst-address=192.168.11.0/24 \
    action=accept comment="VPN -> LAN"

add chain=forward src-address=192.168.11.0/24 dst-address=10.222.60.0/24 \
    action=accept comment="LAN -> VPN"

add chain=forward src-address=10.222.60.0/24 dst-address=10.222.60.0/24 \
    action=drop comment="Изоляция VPN-клиентов"

Step 6: Creating users (PPP secrets)

⚠️ The OpenVPN server in RouterOS authenticates the user by PPP login and password (/ppp secret or RADIUS); the method of password transmission is set by the user-auth-method parameter (pap by default or mschap2). The client certificate when require-client-certificate=yes is an additional check, not a replacement for the password.

/ppp secret
add name=testuser1 password="TestPass#2025!" profile=ovpn-profile service=ovpn
add name=testuser2 password="TestPass#2025!" profile=ovpn-profile service=ovpn

Step 7: Revoking a certificate and removing a user

/certificate revoke testuser1-cert
/ppp secret remove [find name="testuser1"]

Client configuration (.ovpn)

client
dev tun
proto udp        # or tcp
remote YOUR_PUBLIC_IP 1199
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
data-ciphers AES-256-GCM:AES-128-GCM
auth SHA256
verb 3

<ca>
--- contents of ovpn-ca.crt ---
</ca>

<cert>
--- contents of testuser1-cert.crt ---
</cert>

<key>
--- contents of testuser1-cert.key ---
</key>

auth-user-pass

The data-ciphers parameter is understood by OpenVPN clients 2.5 and newer; for clients version 2.4 and older, use cipher AES-256-GCM instead.

Supported clients:

• OpenVPN Connect
• Viscosity
• Tunnelblick

Diagnostics and troubleshooting

Enabling logging

/system logging
add topics=ovpn action=memory
add topics=ovpn,debug action=memory

/log print where topics~"ovpn"

Checking connections

/interface ovpn-server print
/ppp active print

Network testing

/ping 10.222.60.XX
/tool traceroute 8.8.8.8 interface=ovpn-udp

From the client:

• ping 10.222.60.1
• ping 192.168.11.1

Common issues

• No connection — firewall, port, NAT, router time (NTP).
• Authentication error — certificate or password.
• No access to the LAN — push-routes and forward.
• Clients cannot see each other — the isolation rule is working as intended.

Conclusion

This configuration implements two-factor authentication (certificate + username/password), client segmentation and controlled access to the LAN. For maximum performance it is recommended to use UDP.

If more modern cryptography and lower CPU load are required, consider WireGuard as an alternative.