Skip to main content

IPSec/L2TP with Mikrotik

In this tutorial we'll configure the ISP side of the IPSec/L2TP VPN on a Mikrotik (RouterOS) router. Unlike WireGuard, here Mikrotik runs the L2TP server and Cpehub connects to it as a client, using a username, password, and the IPSec PSK.

How the two ends fit together

The credentials you create here (username, password, and ipsec-secret) are exactly what you enter on the Create the IPSec/L2TP VPN screen in Cpehub. They need to match on both sides.

Field map (Cpehub ↔ Mikrotik)​

Field in CpehubItem in MikrotikExample
Remote IP (ISP Equipment)Mikrotik's public IP203.0.113.10
Remote PortL2TP port1701 (UDP)
VPN Usernamename from /ppp secretcpehub-olts
VPN Passwordpassword from /ppp secret(your password)
IPSec PSKipsec-secret from the L2TP Server(your PSK)
Remote Networksinternal networks routed through the VPN192.168.100.0/24
Test Remote IPan internal IP that responds to ping192.168.100.1

Access Mikrotik through the terminal (Winbox → New Terminal, or SSH) and run the blocks below, replacing the passwords and PSK with your own values.

Change the secrets

The password and ipsec-secret values below are examples only. Use strong, unique passwords, and never reuse the ones from this tutorial.

1. VPN IP pool​

We'll create a range of IPs for VPN clients, starting at .10 to keep the initial IPs free for fixed/static use.

/ip pool add name=vpn-cpehub-pool ranges=172.31.255.10-172.31.255.200

2. PPP profile​

The Mikrotik's own IP on the VPN will be .1.

/ppp profile add name=vpn-cpehub-profile local-address=172.31.255.1 \
    remote-address=vpn-cpehub-pool dns-server=8.8.8.8,1.1.1.1

3. Users (PPP secrets)​

Create a user for each Cpehub connection. A fixed IP (outside the pool range) is recommended for the OLTs and ACS users:

# Usuários com IP FIXO (.2 e .3, fora do range do pool)
/ppp secret add name=cpehub-olts password=SENHA_OLTS_EXEMPLO profile=vpn-cpehub-profile remote-address=172.31.255.2
/ppp secret add name=cpehub-acs  password=SENHA_ACS_EXEMPLO  profile=vpn-cpehub-profile remote-address=172.31.255.3

# (Opcional) Usuário com IP DINÂMICO — pega um IP do pool (.10 a .200)
/ppp secret add name=cpehub-dev  password=SENHA_DEV_EXEMPLO  profile=vpn-cpehub-profile

The VPN Username and VPN Password on the Cpehub screen correspond to the name and password of one of these secrets. Use cpehub-olts for the Cpehub server VPN and cpehub-acs for the ACS server VPN.

4. L2TP + IPSec server​

Here we enable the L2TP server with IPSec. The ipsec-secret is the PSK you enter in Cpehub:

/interface l2tp-server server set enabled=yes default-profile=vpn-cpehub-profile \
    authentication=mschap2 use-ipsec=yes ipsec-secret=PSK_EXEMPLO_TROCAR

5. Firewall​

Open the IPSec/L2TP ports and forwarding for the VPN network:

/ip firewall filter
add chain=input protocol=udp dst-port=500,4500 action=accept place-before=0 comment="L2TP/IPSEC"
add chain=input protocol=50 action=accept place-before=0 comment="L2TP/IPSEC (ESP)"
add chain=input protocol=udp dst-port=1701 action=accept place-before=0 comment="L2TP/IPSEC"
add chain=forward src-address=172.31.255.0/24 action=accept place-before=0 comment="L2TP/IPSEC Forward"
add chain=forward dst-address=172.31.255.0/24 action=accept place-before=0 comment="L2TP/IPSEC Forward"
  • UDP 500 and 4500 — IPSec negotiation (IKE / NAT-T).
  • Protocol 50 (ESP) — encrypted IPSec packets.
  • UDP 1701 — L2TP.

6. NAT (masquerade)​

So the equipment reached through the VPN responds correctly:

/ip firewall nat add chain=srcnat src-address=172.31.255.0/24 action=masquerade

Configuration via Winbox (graphical alternative)​

If you prefer the graphical interface, the same steps are found at:

  • PPP → Profiles — create the profile (local-address, pool in remote-address, DNS).
  • PPP → Secrets — create the users (name/password/profile and, for a fixed IP, remote-address).
  • PPP → Interface → L2TP Server — check Enabled, Use IPsec = yes, and enter the IPsec Secret (the PSK).
  • IP → Firewall → Filter Rules and NAT — add the rules from steps 5 and 6.

Validation​

  1. In Cpehub, register (or check) the VPN in Create the IPSec/L2TP VPN with the same username, password, and PSK.

  2. In the VPNs listing, the status should show Connected.

  3. Run an ICMP (ping) test from Mikrotik to the VPN IP on the Cpehub side, and set an internal Test Remote IP that responds to ping.

Routing on other equipment

In some scenarios, you'll need to create routes on other network devices so they know the return path through the VPN.

Conclusion​

With the L2TP + IPSec server up and the VPN registered in Cpehub, the system can now reach your OLTs (or the ACS can reach the CPEs) through a secure tunnel.

If you run into any difficulty, feel free to contact support.