Securing VPN Configurations on MikroTik

VPN Security Hardening on MikroTik

VPNs are only as secure as how they are configured. A poorly secured VPN endpoint can be exploited just as easily as any other exposed service. This post covers hardening for the VPN types most commonly used on MikroTik.

WireGuard Security Hardening

WireGuard is the most secure and modern VPN option in RouterOS v7.

Generate strong keys:

WireGuard keys are generated automatically when you create the interface — no configuration needed. Never share the private key.

Restrict the listening port:

TEXT

/interface wireguard
add name=wg-vpn listen-port=13231 private-key="<auto-generated>"

Choose a non-standard port (not 51820, the default, which scanners look for).

Bind peers to specific IPs:

TEXT

/interface wireguard peers
add interface=wg-vpn public-key="peer-pub-key" allowed-address=10.0.0.2/32 endpoint-address=0.0.0.0 endpoint-port=0

allowed-address=10.0.0.2/32 means only that specific VPN IP can authenticate with that key. Firewall rules for WireGuard:

TEXT

/ip firewall filter
add chain=input protocol=udp dst-port=13231 action=accept comment="WireGuard"
add chain=input in-interface=wg-vpn action=accept comment="Allow VPN traffic"

IPsec IKEv2 Security Hardening

Use strong proposal settings:

TEXT

/ip ipsec proposal
set default auth-algorithms=sha256 enc-algorithms=aes-256-cbc pfs-group=modp2048

/ip ipsec profile
set default dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha256 dpd-interval=30s dpd-maximum-failures=5

Avoid weak algorithms — disable these:

TEXT

/ip ipsec proposal
set default enc-algorithms=aes-256-cbc  # Remove 3des, aes-128, etc.

Use certificate-based auth instead of PSK (pre-shared key):

PSKs can be brute-forced if weak. Certificates provide stronger authentication:

TEXT

/ip ipsec peer
set [find] auth-method=rsa-signature

IP source filtering — only allow VPN from expected regions:

TEXT

/ip firewall filter
add chain=input protocol=udp dst-port=500,4500 src-address-list=allowed-vpn-sources action=accept
add chain=input protocol=udp dst-port=500,4500 action=drop

PPTP/L2TP Security Notes

PPTP is deprecated — avoid it:

PPTP uses MPPE which has known cryptographic weaknesses. MS-CHAPv2 (the authentication protocol) can be cracked offline. If you have PPTP, migrate to L2TP+IPsec or WireGuard.

If you must use L2TP, always require IPsec:

TEXT

/interface l2tp-server server
set enabled=yes use-ipsec=required ipsec-secret=VeryStr0ngSecret123!

use-ipsec=required rejects any L2TP connection that doesn't have IPsec encryption.

Firewall Rules for VPN Services

Only expose VPN ports — never management ports — to the internet:

TEXT

/ip firewall filter
# WireGuard
add chain=input protocol=udp dst-port=13231 action=accept

# IPsec IKE
add chain=input protocol=udp dst-port=500,4500 action=accept

# L2TP
add chain=input protocol=udp dst-port=1701 src-address-list=known-l2tp action=accept

# Block all other input from WAN
add chain=input in-interface=ether1-wan action=drop

VPN User Management

Create separate VPN users with minimal permissions:

TEXT

/ppp secret
add name=vpnuser1 password=Str0ng!VPN profile=vpn-profile service=any

Use profiles to restrict what VPN users can access:

TEXT

/ppp profile
add name=vpn-profile local-address=10.0.0.1 remote-address=vpn-pool dns-server=8.8.8.8

Monitoring VPN Activity

Check active VPN connections:

TEXT

/interface wireguard peers print         # WireGuard connected peers
/ip ipsec active-peers print             # IPsec active sessions
/ppp active print                        # PPTP/L2TP active sessions

Log VPN events:

TEXT

/system logging
add topics=pppoe,pptp,l2tp,ipsec action=remote-syslog

Summary Checklist

[ ] WireGuard: non-default port, peers bound to specific IPs
[ ] IPsec: strong proposals (AES-256, SHA-256, DH group 14+)
[ ] No PPTP in production
[ ] L2TP requires IPsec
[ ] VPN ports firewalled — no other WAN exposure
[ ] VPN user accounts with strong passwords
[ ] VPN events logged to syslog