How to set up SSTP / PPTP / L2TP VPN on Mikrotik Routers

In this tutorial we will show you how to set up SSTP, PPTP or L2TP VPN on Mikrotik Routers but first let’s see what are our requirements and recommendations.

Requirements

In order to set up the VPN you will need:

A CactusVPN account. If you don’t have one you can try our services for free.
Your VPN username, password and VPN server address. You can find them in your account on our website, by going to Settings.

If you still want to set up VPN manually, go step-by-step through following instructions:

VPN Setup instructions

To start set up VPN on Mikrotik routers you first have to connect to it. For that you have to put in your browser the following address: http://192.168.1.1 (If this doesn’t work, please consult your router’s manual to find what is the Default Gateway Address). Also you have to set your network connection to obtain IP address automatically if you connect to your router via Ethernet.
Click on “PPP” (1) from the left-side menu and click on “+” (2).
Choose “SSTP Client” / “PPTP Client” / “L2TP Client” (3).
Enter the name of your connection in the “Name” field (5) of the “General” tab (4). For example you can name it “l2tp_Cactus_US1”.
Select the “Dial Out” tab (6).
Enter the IP address of the VPN server you want to connect to in the “Connect to” box (7). You can find all the available servers in your account on our website, by going to Settings.

Enter your VPN username and password in the “User” and “Password” boxes (8). You can find them in your account on our website, by going to Settings. Make sure you use your VPN username and password and NOT the website account credentials (What is the difference?).

If you selected “L2TP Client” at step 3, check the “Use IPsec” checkbox and enter “cactusvpn” in the “IPsec Secret” field.

Click the “Enable” button (9).
Click on the “Status” tab (10).
Check “Last Link Up Time” (11) and “Uptime” (12) to ensure your VPN connection is UP.

Press “OK” (13) to close the window.
You should see the created “l2tp_Cactus-US1” L2TP connection (14) in the PPP window. “R” (15) means the VPN connection is ready.
Select IP (16) then “Firewall” from the left-side menu, click on the “NAT” tab (17) and click on the “+” icon (18).
In the “General” tab (19), choose “srcnat” for “Chain” (20) and “l2tp_Cactus_US1” for “Out. Interface” (21).
Click on the “Action” tab, choose “masquerade” for “Action” (22).
Click on “Apply” (23) to apply the changes and click on “OK” (24) to close this window.
In the “Firewall” window, click on the “Mangle” tab (25) and click on the “+” icon (26).
In the “Mangle Rule” window, in the “General” Tab (27) select “prerouting” for “Chain” (28).

Enter the range of IP addresses in your LAN which you want to connect to VPN through this router in the “Src. Address” field (29).
Click on the “Action” tab (30), choose “mark routing” for “Action” (31), enter a new routing mark in “New Routing Mark” (32) and check the “Passthrough” checkbox (33).
Click on “Apply” (34) to apply the changes and click on “OK” (35) to close this window.
Click on “IP” (36) and choose “Routes” from the left-side menu.
Click on the “+” icon (37).
In the “General” tab (38), enter “0.0.0.0/0” in the “Dest. Address” field (39).
Choose “l2tp_Cactus_US1” from the “Gateway” menu (40).

Choose “unicast” from the “Type” menu (41).

From the “Routing Mark” menu (42) choose the routing mark “l2tp_Cactus” created at step 10 in “IP->Firewall->Mangle”.

Click on “Apply” (43) to apply the changes and click on “OK” (44) to close this window.
Select “IP” (45) and “DNS” from the left-side menu.
Enter the Google DNS addresses (or other open DNS you want) in the “Servers” field (46) and check the “Allow Remote Requests” checkbox (47).

Click on “Apply” (48) to apply the changes and “OK” (49) to close this window.
To see if VPN is accessible for your local network, click on “New Terminal” (50) from the left-side menu and enter “ping 8.8.8.8 (or whatever is up) interface={PPP connection interface} src-address={local gateway}”.
For example in our case it will be:
ping 8.8.8.8 interface= l2tp_Cactus_US1 src-address=192.168.88.1