Monday, May 07, 2018

How To Setup OpenVPN Tunnel Between Offices On MikroTik Routers


When we talk of MikroTik OpenVPN Server, We are probably referring to a secure and encrypted tunnel which goes across very large public network transporting IP traffic using PPP. OpenVPN Server uses SSL Certificates. So, OpenVPN Tunnel is a trusted tunnel to send and receive data across public network. MikroTik OpenVPN Server can be applied in two methods.



Connecting remote workstation/client with OpenVPN: In this method, OpenVPN client software, installed any operating system such as Windows, can communicate with MikroTik OpenVPN server through OpenVPN tunnel whenever required and can access remote private network as if it was directly connected to the remote private network.



Site to Site OpenVPN: Here we will have to establish the VPN connection between two routers. In this method, an OpenVPN client supported router always establishes an OpenVPN tunnel with MikroTik OpenVPN Server. By doing this, private networks of these routers will then be able to communicate with each other as though they were directly connected to the same router.



In this simple tutorial, will be configuring OpenVPN Tunnel between two MikroTik RouterOS so that local networks of these routers can communicate with each other as if they were directly connected to the same router. if this configuration is followed and proper done you will end up setting what I called OpenVPN Tunnel.
In this tutorial, we will be looking at the network diagram Above.

you will notice that in the diagram above, Office 1 Router is connected to internet through ether1 interface with IP address 192.168.70.2/30., Office1 Router’s ether2 interface is connected to local network having IP network 10.10.11.0/24. We are going to do our configure our  OpenVPN Server in this router and after OpenVPN configuration the router will create a virtual interface (OVPN Tunnel) across public network whose IP address will be 172.22.22.1.

Office2 Router is a remote router and can access Office1 Router’s WAN IP. Office2 Router’s ether1 interface is connected to internet having IP address 192.168.40.2/30 and ether2 has a local IP network 10.10.12.0/24. We will configure OpenVPN client in this router and after OpenVPN client configuration the router will have a virtual interface (OVPN Tunnel) across public network whose IP address will be 172.22.22.2.



To configure a site to site OpenVPN between two Routers, I am using two MikroTik RouterOS v6.38.1. IP information that I am using for this network configuration are given below.
Office 1 Router WAN IP: 192.168.70.2/30, LAN IP Block 10.10.11.0/24 and Tunnel interface IP 172.22.22.1/30
Office 2 Router WAN IP: 192.168.80.2/30, LAN IP Block 10.10.12.0/24 and Tunnel interface IP 172.22.22.2/30

Site to Site OpenVPN Configuration

Step 1: MikroTik RouterOS Basic Configuration

In MikroTik RouterOS basic configuration, we will assign WAN, LAN and DNS IP and perform NAT and Route configuration. The following steps will show how to do these topics in your RouterOS.
Login to MikroTik RouterOS using winbox and go to IP > Addresses. In Address List window, click on PLUS SIGN (+). In New Address window, put WAN IP address (192.168.70.2/30) in Address input field and choose WAN interface (ether1) from Interface dropdown menu and click on Apply and OK button. Click on PLUS SIGN again and put LAN IP (10.10.11.1/24) in Address input field and choose LAN interface (ether2) from Interface dropdown menu and click on Apply and OK button.
Go to IP > DNS and put DNS servers IP (8.8.8.8 or 8.8.4.4) in Servers input field and click on Apply and OK button.
Go to IP > Firewall and click on NAT tab and then click on PLUS SIGN (+). Under General tab, choose srcnat from Chain dropdown menu and click on Action tab and then choose masquerade from Action dropdown menu. Click on Apply and OK button.
Go to IP > Routes and click on PLUS SIGN (+). In New Route window, click on Gateway input field and put WAN Gateway address (192.168.70.1) in Gateway input field and click on Apply and OK button.



Step 2: Creating SSL certificate for OpenVPN Server
OpenVPN Server configuration requires SSL certificate because OpenVPN uses SSL certificate for secure communication. MikroTik RouterOS version 6 gives ability to create, store and manage certificates in certificate store. So, we will create required OpenVPN certificate from our RouterOS. OpenVPN Server requires the following certificates:
CA (Certification Authority) certificate and
Server certificate.

Creating CA certificate
The following steps will show how to create CA certificate in MikroTik RouterOS.
Go to System > Certificates menu item from winbox and click on Certificates tab and then click on PLUS SIGN (+). New Certificate window will appear.
Put your CA certificate name (for example: ca) in Name input field. Also put a certificate common name (for example: ca) in Common Name input field.
You will find some optional fields in General tab. You can fill if you wish. All fields are self-defined.
Click on Key Usage tab and uncheck all checkboxes except crl sign and key cert. sign
Click on Apply button and then click on Sign button. Sign window will appear now.
Your newly created certificate template will appear in certificate dropdown menu. Select your newly created certificate template if it is not selected.
Put MikroTik Router’s WAN IP address (192.168.70.2) in CA CRL Host input field.
Click on Sign button. Your Sign certificate will be created within few seconds.
Click on OK button to close New Certificate window.
If newly created CA certificate does not show T flag or Trusted property shows no value, double click on your CA certificate and click on Trusted checkbox located at the bottom of General tab and then click on Apply and OK button.

Creating Server Certificate



The following steps will show how to create server certificate in MikroTik RouterOS.
Click on PLUS SIGN (+) again. New Certificate window will appear.
Put your server certificate name (for example: server) in Name input field. Also put a certificate common name (for example: server) in Common Name input field.
If you have put any optional field for CA certificate, put them here also.
Click on Key Usage tab and uncheck all checkboxes.
Click on Apply button and then click on Sign button. Sign window will appear now.
Your newly server created certificate template will appear in certificate dropdown menu. Select your newly created certificate template if it is not selected.
Also select CA certificate from CA dropdown menu.
Click on Sign button. Your Sign certificate will be created within few seconds.
Click on OK button to close New Certificate window.
If newly created server certificate does not show T flag or Trusted property shows no value, double click on your server certificate and click on Trusted checkbox located at the bottom of General tab and then click on Apply and OK button.

Server certificate has been created successfully. Now we will enable and configure OpenVPN Server in MikroTik RouterOS.
Step 3: OpenVPN Server Configuration in MikroTik Router
After creating SSL certificate, we are now eligible to enable OpenVPN Server in MikroTik Router. The following steps will show how to enable OpenVPN Server in your MikroTik Router with proper configuration.Click on PPP menu item from winbox and then click on Secrets tab.
Click on PLUS SIGN (+). New PPP Secret window will appear.
Put username (For example: sayeed) in Name input and password in Password input field. This username and password will be required at the time of OpenVPN client configuration.
Choose ovpn from Service dropdown menu.
Put Office 1 Router’s virtual interface IP (172.22.22.1) in Local Address input field and put Office 2 Router’s virtual interface IP (172.22.22.2) in Remote Address input field.
Put static routes to reach Office2 Router’s local network in Routes input filed. This route will be added in Office1 Router’s routing table when OpenVPN user will be connected from Office2 Router. The route format is: dst-address gateway metric (example for this configuration: 10.10.12.0/24 172.22.22.2 1). Several routes may be specified separated with commas.
Click on Apply and OK button.

PPP user who will be connected from remote client machine has been created. Whenever your created user will be connected from OpenVPN client router (Office2 Router), the Remote Address IP will be assigned for its virtual interface and the routes will be created in Office1 Router’s routing table so that Office1 Router’s local network can reach remote router’s (Office2 Router) local network.
Office1 Router configuration for OpenVPN Server has been completed.



Office2 Router Configuration for OpenVPN Client


According to our network diagram, Office2 Router is working as an OpenVPN client router. So, we will configure OpenVPN client in Office2 Router. Complete RouterOS configuration can be divided into three steps.

Basic RouterOS Configuration

OpenVPN client configuration

Static route configuration


Step 1: Basic RouterOS Configuration

Basic RouterOS configuration includes assigning WAN, LAN and DNS IP as well as NAT and Route configuration. The following steps will guide you about basic RouterOS configuration
Login to Office2 RouterOS using winbox and go to IP > Addresses. In Address List window, click on PLUS SIGN (+). In New Address window, put WAN IP address (192.168.80.2/30) in Address input field and choose WAN interface (ether1) from Interface dropdown menu and click on Apply and OK button. Click on PLUS SIGN again and put LAN IP (10.10.12.1/24) in Address input field and choose LAN interface (ether2) from Interface dropdown menu and click on Apply and OK button.
Go to IP > DNS and put DNS servers IP (8.8.8.8 or 8.8.4.4) in Servers input field and click on Apply and OK button.
Go to IP > Firewall and click on NAT tab and then click on PLUS SIGN (+). Under General tab, choose srcnat from Chain dropdown menu and click on Action tab and then choose masquerade from Action dropdown menu. Click on Apply and OK button.
Go to IP > Routes and click on PLUS SIGN (+). In New Route window, click on Gateway input field and put WAN Gateway address (192.168.80.1) in Gateway input field and click on Apply and OK button.

Basic RouterOS configuration in Office2 Router has been completed. Now it is time to create OpenVPN Client in our MikroTik Router.
Step 2: OpenVPN Client Configuration
After completing RouterOS basic configuration, we will now configure OpenVPN client in Office2 Router. The following steps will show you how to create OVPN client in your MikroTik Router.Click on Interfaces menu item from winbox and then click on Interface tab. Click on PLUS SIGN (+) dropdown menu and then choose OVPN Client option. New Interface window will appear.
Click on General tab and put OpenVPN interface name (openvpn-server) in Name input field.
Click on Dial Out tab and put Office1 Router’s WAN IP (192.168.70.2) in Connect To input field. This IP must be reachable from Office2 Router.
Put username (sayeed) and password that you have provided in Office1 Router’s PPP user configuration, in User and Password input field respectively.
From dropdown menu, choose sha1 encryption method.
From Cipher dropdown menu, choose aes 256Click on Apply and OK button. As soon as you provide the above information, an OVPN Tunnel will be created between Office1 and Office2 Router and provided local and remote IP address will be assigned in office1 and Office2 Router’s virtual interface respectively. At this stage, Office1 Router as well as its local network will be able to reach Office2 Router and its local network but Office2 Router and its local network will only be able to reach Office1 Router but not its local network. To reach Office1 Router’s local network, a static route must be added in Office2 Router’s routing table. Step 3: Static Route Configuration After configuring OVPN Client in Office2 Router, Office 2 Router can only access Office 1 Router but not its local network. To solve this issue, a route is required in Office2 Router’s routing table. The following steps will show how to add a route in Office2 Router’s routing table statically. Go to IP > Routes and then click on PLUS SIGN (+). In New Route window, provide Office1 Router’s local network (10.10.11.0/24) where you want to reach, in Dst. Address input field. Click on Gateway input field and then choose OpenVPN client interface (openvpn-server) that you have created at the of OVPN client configuration, from Gateway dropdown menu. Click on Apply and OK button. Now Office 2 Router and its local network will be able to access Office 1 Router’s local network. Office1 Router and Office2 Router Configuration for establishing an OVPN Tunnel between them has been completed. Now both router’s local networks are eligible to access each other. To check your configuration, do a ping request from any local network machine to other local network machine. If everything is OK, your ping request will be success. MikroTik VPN Configuration with Site to Site OpenVPN Service has been explained in this article. I hope you will be able to configure your Site to Site VPN with MikroTik OpenVPN service if you follow the above explanation carefully. However, if you face any confusion to do above steps properly, feel free to discuss in comment or contact with me from Contact page. I will try my best to stay with you.

No comments:

Post a Comment