MikroTik VPN Setup: IKEv2/IPSec Guide

There are three misconceptions about VPNs: “I can just connect remotely over WinBox,” “I never want to set up L2TP/IPSec again,” and “certificates are too hard.” IKEv2 solves all three: native mobile support, modern encryption, and reasonable configuration complexity. This article walks step by step through setting up an IKEv2/IPSec server on RouterOS 7 and connecting clients.

VPN Protocol Comparison

Protocol	Speed	Security	Mobile	Ease	RouterOS
IKEv2/IPSec	✅ Good	✅ Strong	✅ Native iOS/Android	⚠️ Medium	✅ v6+
WireGuard	✅ Very good	✅ Strong	⚠️ App required	✅ Simple	✅ v7+
L2TP/IPSec	⚠️ Medium	⚠️ Weak	✅ Native	✅ Easy	✅ v6+
SSTP	⚠️ Medium	✅ Good	❌ Windows only	✅ Easy	✅ v6+
OpenVPN	⚠️ Slow	✅ Strong	⚠️ App	⚠️ Complex	✅ v6+

Why IKEv2?

• No extra app needed on iOS and macOS; it is set up from system settings
• MOBIKE support: the VPN connection does not drop when switching from WiFi to mobile
• Modern encryption: AES-256-GCM, SHA-256+, ECC
• Certificate-based authentication, resistant to password theft

---

Scenario

• MikroTik RB4011, static IP: 83.45.12.10
• Domain: vpn.company.com (A record pointing to 83.45.12.10)
• Users: Windows, macOS, iOS, Android
• Method: Certificate + username/password (EAP-MSCHAPv2)

---

Creating Certificates

Self-Signed (Quick Start)

# 1. Create the Root CA
/certificate
add name=ca-root common-name="Company VPN CA" \
    key-size=4096 days-valid=3650 \
    key-usage=crl-sign,key-cert-sign \
    trusted=yes

sign ca-root ca=ca-root name=ca-root

# 2. Server certificate
add name=vpn-server common-name=vpn.company.com \
    key-size=2048 days-valid=730 \
    key-usage=tls-server,digital-signature,key-encipherment

sign vpn-server ca=ca-root name=vpn-server

# 3. Check the certificate status
print detail where name=vpn-server
# should read "trusted: yes"

With Let’s Encrypt (Trusted Certificate)

# RouterOS 7.4+ required
/certificate acme-client
add name=acme-vpn url=https://acme-v02.api.letsencrypt.org/directory \
    domain=vpn.company.com key-size=2048

/certificate acme-client issue acme-vpn
# A DNS A record must exist and port 80 must be open

---

IPSec Configuration

IKE Policy (IKEv2)

/ip ipsec policy group
add name=ike2-clients

/ip ipsec profile
add name=ike2-profile \
    enc-algorithm=aes-256-gcm,aes-256-cbc \
    dh-group=ecp384,ecp256,modp2048 \
    hash-algorithm=sha256,sha1 \
    lifetime=24h \
    nat-traversal=yes \
    dpd-interval=30s dpd-maximum-failures=3 \
    comment="IKEv2 Profile"

/ip ipsec proposal
add name=ike2-proposal \
    enc-algorithms=aes-256-gcm,aes-256-cbc \
    auth-algorithms=sha256,sha1 \
    pfs-group=modp2048 \
    lifetime=8h \
    comment="IKEv2 ESP Proposal"

Mode Config (IP Pool)

Assign IP addresses to remote access clients:

/ip pool
add name=vpn-pool ranges=10.88.88.2-10.88.88.254 \
    comment="VPN client IP pool"

/ip ipsec mode-config
add name=ike2-mode-config \
    address-pool=vpn-pool \
    address-prefix-length=24 \
    split-include=10.0.0.0/8 \
    system-dns=yes static-dns=8.8.8.8,1.1.1.1 \
    comment="IKEv2 Mode Config"

split-include: on the client side, only the specified network is reached over the VPN (split tunnel). Leave it empty for a full tunnel.

IKEv2 Peer

/ip ipsec peer
add name=ike2-remote \
    address=0.0.0.0/0 \
    passive=yes \
    profile=ike2-profile \
    exchange-mode=ike2 \
    send-initial-contact=yes \
    comment="IKEv2 Remote Access"

EAP Authentication (Username/Password)

/ip ipsec identity
add auth-method=eap \
    certificate=vpn-server \
    eap-methods=eap-mschapv2 \
    generate-policy=port-override \
    mode-config=ike2-mode-config \
    my-id=fqdn:vpn.company.com \
    passive=yes \
    policy-template-group=ike2-clients \
    comment="IKEv2 EAP Identity"

PPP Users (for EAP)

/ppp secret
add name=james password=JamesPass2026 \
    service=any profile=default \
    comment="VPN user: James"

add name=emily password=EmilyPass2026 \
    service=any profile=default \
    comment="VPN user: Emily"

Firewall Rules

/ip firewall filter
add chain=input action=accept protocol=udp dst-port=500,4500 \
    comment="IKEv2: UDP 500 (IKE) + 4500 (NAT-T)"
add chain=input action=accept protocol=ipsec-esp \
    comment="IKEv2: ESP"

/ip firewall nat
add chain=srcnat action=accept \
    src-address=10.88.88.0/24 dst-address=10.0.0.0/8 \
    comment="Do not NAT VPN traffic going to the internal network"

add chain=srcnat action=masquerade \
    src-address=10.88.88.0/24 out-interface-list=WAN \
    comment="VPN internet egress"

---

Client Configuration

Windows 10/11

1. Network Settings → VPN → Add a VPN connection
2. VPN provider: Windows (built-in)
3. Connection name: Company VPN
4. Server name or address: vpn.company.com
5. VPN type: IKEv2
6. Type of sign-in info: User name and password

If you are using a self-signed certificate, import the CA into Windows:

# PowerShell (Admin)
Import-Certificate -FilePath "C:\ca-root.crt" -CertStoreLocation Cert:\LocalMachine\Root

macOS / iOS

1. Settings → VPN → Add VPN Configuration
2. Type: IKEv2
3. Server: vpn.company.com
4. Remote ID: vpn.company.com
5. Local ID: (leave empty)
6. Authentication: Username
7. User: james / password

For a self-signed CA on iOS: send the CA certificate (.pem or .der) to the device by email or AirDrop, install it with “Install Profile,” then go to Settings → About → Certificate Trust Settings and enable it.

Android

Native IKEv2 support arrived on Android with Android 11+. For older versions, use the strongSwan app:

1. StrongSwan → Add profile
2. Server: vpn.company.com
3. VPN type: IKEv2 EAP (Username/Password)
4. CA certificate: Select from file or “Get from server”
5. Username / Password: Enter

---

Site-to-Site VPN

Connect two offices with a permanent tunnel:

[Office A: 192.168.10.0/24] ←→ [Office B: 192.168.20.0/24]
Router A: 83.45.12.10        Router B: 176.89.21.100

Router A (Office A):

/ip ipsec profile
add name=s2s-profile enc-algorithm=aes-256-cbc hash-algorithm=sha256 \
    dh-group=modp2048 lifetime=24h

/ip ipsec peer
add name=office-b address=176.89.21.100 \
    profile=s2s-profile exchange-mode=ike2

/ip ipsec identity
add auth-method=pre-shared-key secret="SecurePass2026!" \
    peer=office-b

/ip ipsec policy
add src-address=192.168.10.0/24 dst-address=192.168.20.0/24 \
    action=encrypt tunnel=yes sa-src-address=83.45.12.10 \
    sa-dst-address=176.89.21.100 \
    proposal=ike2-proposal

/ip route
add dst-address=192.168.20.0/24 gateway=176.89.21.100 \
    comment="Route to Office B"

Mirror configuration for Router B (Office B):

/ip ipsec peer
add name=office-a address=83.45.12.10 profile=s2s-profile exchange-mode=ike2

/ip ipsec identity
add auth-method=pre-shared-key secret="SecurePass2026!" peer=office-a

/ip ipsec policy
add src-address=192.168.20.0/24 dst-address=192.168.10.0/24 \
    action=encrypt tunnel=yes sa-src-address=176.89.21.100 \
    sa-dst-address=83.45.12.10 proposal=ike2-proposal

---

Performance and MTU

A VPN tunnel adds overhead. If the MTU is not tuned, large packets fragment, causing slowdowns or connectivity issues.

# IPSec overhead: ~60 bytes
# Standard Ethernet MTU: 1500
# Recommended VPN MTU: 1400-1420

/ip ipsec
set [find] xauth=no

# MTU test on Windows
ping vpn.company.com -f -l 1400
# If the packet goes through, 1400 works
# If you get a "fragmented" message, reduce it

---

Troubleshooting

“The client cannot connect”

# Increase the IPSec log level
/system logging add action=memory topics=ipsec
/log print where topics~"ipsec"

# Check the SA status
/ip ipsec active-peers print
/ip ipsec installed-sa print

“The tunnel is up but no traffic passes”

# Is the policy matching?
/ip ipsec policy print
# active=yes is expected

# Is there a NAT bypass?
/ip firewall nat print
# VPN traffic must be accepted before masquerade

“The connection keeps dropping”

Check the DPD (Dead Peer Detection) setting. Overly aggressive values can end the session early on unstable connections:

/ip ipsec profile
set [find name=ike2-profile] dpd-interval=60s dpd-maximum-failures=5

---

WireGuard Alternative (Brief)

RouterOS 7 has native WireGuard support. It is simpler and faster:

/interface wireguard
add name=wg0 listen-port=51820

# The key pair is generated automatically
/interface wireguard print
# Copy the public-key value and give it to the client

/interface wireguard peers
add interface=wg0 \
    public-key="CLIENT_PUBLIC_KEY=" \
    allowed-address=10.88.0.2/32 \
    comment="James laptop"

/ip address
add address=10.88.0.1/24 interface=wg0

/ip firewall filter
add chain=input action=accept protocol=udp dst-port=51820 comment="WireGuard"

When to choose WireGuard over IKEv2?

• When you manage the client devices yourself (you can install the client app)
• When you need high performance (saving server CPU)
• When native iOS/macOS support is not a requirement

Practical tip: Before setting up IKEv2, check that the server certificate matches the domain name. The common-name must be identical to the hostname the client connects to. This mistake causes every client to get a “certificate could not be validated” error and forces you to regenerate the certificate.