OpenVPN Site-to-Site

Configure a secure OpenVPN site-to-site tunnel on RouterOS 7.

OpenVPN Site-to-Site

Explain It Simply

OpenVPN is one of the most widely used VPN protocols in the world. It uses standard SSL/TLS for key exchange and encryption, making it very secure and capable of traversing strict firewalls (especially when run over TCP port 443). While it has a slightly higher CPU overhead than WireGuard, it remains a heavily requested feature in enterprise environments.

RouterOS 7 Configuration (Server Side)

In this example, we configure the central router (e.g., a CCR2116 at HQ) as the OpenVPN Server. OpenVPN requires a certificate authority (CA) and certificates for both the server and the client.

1. Generate Certificates

# Create the CA
/certificate
add name=ca-template common-name=my-ca key-usage=key-cert-sign,crl-sign
sign ca-template name=my-ca

# Create the Server Certificate
add name=server-template common-name=server key-usage=tls-server
sign server-template ca=my-ca name=server-cert

# Create the Client Certificate
add name=client-template common-name=client1 key-usage=tls-client
sign client-template ca=my-ca name=client1-cert

Go to System → Certificates.
Click [+]. Name it ca-template, set Common Name to my-ca. Go to Key Usage and check crl sign and key cert. sign. Click OK.
Right-click ca-template and select Sign. Select my-ca as the CA. Click Start.
Click [+] again. Name it server-template, Common Name server. In Key Usage, check tls server. Click OK.
Right-click server-template and Sign it using the my-ca CA.
Click [+] again. Name it client-template, Common Name client1. In Key Usage, check tls client. Click OK.
Right-click client-template and Sign it using the my-ca CA.

2. Create the PPP Profile and Secret

# Create an IP pool for VPN clients
/ip pool add name=ovpn-pool ranges=172.16.99.10-172.16.99.50

# Create the PPP Profile
/ppp profile add name=ovpn-profile local-address=172.16.99.1 remote-address=ovpn-pool

# Add the Client Secret (Username/Password)
/ppp secret add name=client1 password=SecurePassword123 profile=ovpn-profile service=ovpn

Go to IP → Pool. Click [+]. Name it ovpn-pool, set addresses to 172.16.99.10-172.16.99.50. Click OK.
Go to PPP → Profiles. Click [+]. Name it ovpn-profile. Set Local Address to 172.16.99.1 and Remote Address to ovpn-pool. Click OK.
Go to PPP → Secrets. Click [+]. Name client1, Password SecurePassword123, Service ovpn, Profile ovpn-profile. Click OK.

3. Enable the OpenVPN Server

/interface ovpn-server server
set certificate=server-cert default-profile=ovpn-profile enabled=yes require-client-certificate=yes

Go to PPP → Interface. Click the OVPN Server button.
Check Enabled.
Set Default Profile to ovpn-profile.
Select server-cert from the Certificate dropdown.
Check Require Client Certificate. Click OK.