Implementing IKEv2 VPN on MikroTik routers is an excellent choice for businesses and developers seeking a fast, robust, and standards-based VPN. This guide walks you through a practical, secure, and performance-conscious setup using RouterOS. It includes certificate management, IPsec policies and proposals, firewall and NAT considerations, client configuration hints, and troubleshooting commands. The instructions favor reproducibility via CLI but note equivalent Winbox steps where appropriate.
Why IKEv2 on MikroTik?
IKEv2 offers several advantages for site-to-site and remote-access VPNs: faster connection establishment, native MOBIKE support for roaming clients, better resilience to network changes, and modern cryptographic algorithms. MikroTik’s RouterOS supports IKEv2 with flexible policy and proposal configuration, making it suitable for enterprise deployments on cost-effective hardware.
High-level plan
- Prepare certificates (preferred) or use pre-shared keys (PSK) for testing.
- Create IPsec proposals and policies tuned for performance and security.
- Define peers and identities for IKEv2.
- Configure firewall and NAT exemptions.
- Test and optimize: MTU/MSS, PFS, lifetimes, and monitoring.
Prerequisites
Assume RouterOS v6.41+ or RouterOS v7.x. You should have administrative access (Winbox, WebFig, or SSH) and know the public IP of the router. For production, use certificate-based authentication (ECDSA or RSA) issued by your internal CA or a self-signed CA. PSK is acceptable only for lab/testing.
Certificate Generation (recommended)
Two methods: create certificates on RouterOS or generate externally with OpenSSL and import. External generation provides more control and is preferred.
OpenSSL example (CA + server cert)
Run these on a workstation with OpenSSL installed. Adjust subject CN and SANs to match your public hostname/IP.
1. Create CA key and cert:
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -subj "/CN=Example-CA"
2. Create router/server key and CSR:
openssl genrsa -out router.key 4096
openssl req -new -key router.key -subj "/CN=vpn.example.com" -out router.csr
3. Sign server cert:
openssl x509 -req -in router.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out router.crt -days 1825 -sha256
Import ca.crt and router.crt + router.key into RouterOS (Files → drag-and-drop) or use CLI:
/certificate import file-name=ca.crt
/certificate import file-name=router.crt
/certificate import file-name=router.key
Mark the CA as trusted and ensure the server certificate is valid. For IKEv2, ECDSA certificates are smaller and faster; if you generate ECDSA keys, use appropriate OpenSSL commands.
IPsec: Basic Concepts on RouterOS
RouterOS splits configuration into these pieces:
- proposals — crypto algorithms and lifetimes for phase 1 (IKE) and phase 2 (IPsec)
- policies — traffic selectors and SA modes (tun/transport)
- peers — remote endpoints, auth method, DH groups
- identities — match certificates/IDs to peers
Sample CLI Configuration (IKEv2 Server Mode, Certificate Auth)
Below is a concise, production-minded configuration. Replace values with your environment specifics.
1. Proposals (phase2):
/ip ipsec proposal add name=strong-proposal auth-algorithms=sha256 enc-algorithms=aes-256-gcm,p=yes pfs-group=modp2048 lifetime=1h
2. Peer (IKEv2 responder mode):
/ip ipsec peer add address=0.0.0.0/0 auth-policy=certificate exchange-mode=ike2 port=500,4500 generate-policy=port-override hash-algorithm=sha256 enc-algorithm=aes-256 dh-group=modp2048 certificate=vpn.example.com passive=yes nat-traversal=yes dpd-interval=10s dpd-maximum-failures=5
Notes: set address to 0.0.0.0/0 for remote access or restrict to known peer IP for site-to-site. generate-policy=port-override lets RouterOS create appropriate policies dynamically for IKEv2 clients. Use passive=yes for server behavior.
3. Identity (match incoming certs):
/ip ipsec identity add auth-method=digital-signature certificate=vpn.example.com generate-policy=port-override match-by=cert subject="CN=client" remote-id=
For client certificates, you can use match-by=cert or match by subject when you issue client certs. Omit remote-id for flexible matching; for stricter security, match the exact subject.
4. Policies (if not generating dynamically):
For static site-to-site policies:
/ip ipsec policy add src-address=10.0.0.0/24 dst-address=172.16.0.0/24 protocol=all action=encrypt level=require proposal=strong-proposal sa-src-address=YOUR_PUBLIC_IP
5. Firewall/NAT exemptions:
Allow UDP 500/4500 and IP protocol 50 (ESP) if you use transport of ESP. If NAT is present, ESP might be encapsulated in UDP 4500.
/ip firewall filter add chain=input protocol=udp dst-port=500,4500 action=accept comment="Allow IKE/IPsec"/ip firewall filter add chain=input protocol=ipsec-esp action=accept comment="Allow ESP"
When masquerading, add an exemption for internal VPN traffic:
/ip firewall nat add chain=srcnat src-address=10.0.0.0/24 dst-address=0.0.0.0/0 action=accept comment="Don't NAT VPN clients"
Client Configuration Hints
Clients commonly include Windows (built-in IKEv2), macOS/iOS (native), and Android (strongSwan or vendor). For certificate-based auth, install the CA cert and client certificate on the device. Set the server address to your router public IP or FQDN.
Windows
- Create a new VPN connection → IKEv2.
- Use machine or user certificate in the authentication settings.
- Advanced settings: uncheck “Use default gateway on remote network” for split-tunneling if desired (or control with static routes).
iOS/macOS
- Use native IKEv2 profile with certificate authentication.
- Install CA and client cert in the keychain and mark them as trusted.
Android (strongSwan)
- Import CA and client certs, choose IKEv2-EAP or IKEv2 certificate.
- Enable MOBIKE and set up remote-id if needed.
Performance and Security Tuning
For high throughput, choose algorithms and settings carefully:
- Encryption: AES-GCM (e.g., AES-256-GCM) is both authenticated encryption and fast when hardware AES-NI is available on CPU.
- Hash: SHA-256 or SHA-384. For AES-GCM, a separate hash is less relevant for data plane but used in IKE.
- DH groups: modp2048 (group 14) is common; consider ECP groups (ecp256/384) for better performance and security.
- Lifetimes: IKE SA lifetime ~1h-8h, Child SA 1h; shorter lifetimes create rekey overhead but limit cryptoperiod.
- PFS: enable if security policy requires; note PFS adds CPU cost.
Monitor CPU during throughput tests. RouterBOARD devices with hardware crypto offload will perform better. If you see high CPU, reduce encryption strength or move to dedicated hardware.
MTU, MSS and Fragmentation
IPsec adds overhead (ESP or UDP encapsulation). Typical issues are MTU-related packet fragmentation or slow TCP performance. Two remedies:
- Set lower MTU on client virtual adapter (e.g., 1400).
- Use MSS clamping on router:
/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1360
Adjust values based on observed fragmentation.
Verification and Troubleshooting
Useful RouterOS commands for diagnostics:
/ip ipsec active-peers print— active IKE peers./ip ipsec installed-sa print— installed SAs (child SAs/ESP)./log print where topics~"ipsec"— filter IPsec logs./tool sniffer quick ipsec— packet capture focused on IPsec flows (useful to confirm NAT-T is working).
Common issues:
- Authentication failures: check certificate subjects and trusted CAs; ensure clock/time is synchronized (X.509 validity is time-dependent).
- NAT/Firewall blocking UDP 500/4500: verify NAT traversal and allow these ports.
- Policy mismatch: check traffic selectors (src/dst networks) and whether RouterOS is generating policies or you need static policies.
Advanced: Site-to-Site with Certificate Authentication
For site-to-site, create a peer with specific remote address and a policy defining the networks. Example snippet:
/ip ipsec peer add address=203.0.113.2/32 exchange-mode=ike2 certificate=sitea.example.com secret=
/ip ipsec policy add src-address=10.1.0.0/16 dst-address=10.2.0.0/16 sa-src-address=198.51.100.1 sa-dst-address=203.0.113.2 tunnel=yes proposal=strong-proposal
Use tunnel=yes for encapsulating entire L3 networks. Test with mutual ping of endpoints behind each router.
Maintenance and Logging
Keep RouterOS updated for security patches. Rotate certificates and monitor logs for repeated authentication attempts. Configure syslog export to a central server for long-term analysis and compliance.
Wrap-up and key takeaways
IKEv2 on MikroTik provides a modern, performant, and interoperable VPN solution. For production, use certificate-based authentication, choose AES-GCM/ECP algorithms for performance and security, and account for MTU/NAT considerations. Monitor active peers and SAs and test client configurations across platforms.
For further reference and downloadable guides, visit Dedicated-IP-VPN at https://dedicated-ip-vpn.com/. Dedicated-IP-VPN provides additional tutorials and configuration examples tailored to enterprise deployments.