|
How to set up USAIP.EU SSTP VPN on Mikrotik routeros (RouterOS 5.x is required)
Although Mikrotik RouterOS is a commercial linux based router operating system, it is not only available on RouterBoard routers, but also as a PC installable ISO. If you don't have a RouterBoard router, just download their ISO distribution from their website and install it on any old PC or as a virtualised OS in VmWare, Xen, KVM or VirtualBox. Installing RouterOS is free for the purposes of the VPN. Just sign up on mikrotik.com and request a free level 1 license.
This tutorial already assumes that you have a working RouterOS that has internet access as either your primary broadband router or as a wifi hotspot, or as a secondary router connected to your internal LAN.
Your router's WAN interface already has an IP address and the LAN interface or bridge also with an IP serves as a DHCP server for all devices connected to it.
For the purposes of the tutorial below, your internal IP range is 192.168.88.0/24 and your USAIP username is usaipusername and your USAIP password is usaippassword. The vpn server name is vpn.usaip.eu
STEP 1: Set up your VPN client connection as
/interface sstp-client add name="vpn" max-mtu=1500 max-mru=1500 mrru=disabled connect-to=vpn.usaip.eu:443 certificate=none verify-server-certificate=no verify-server-address-from-certificate=no user="usaipusername" password="usaippassword" profile=default-encryption keepalive-timeout=60 add-default-route=no dial-on-demand=no authentication=pap,chap,mschap1,mschap2
/interface sstp-client enable [/interface sstp-client find name ="vpn"]
STEP 2: Define an internal IP range that will be routed toward the VPN by default (192.168.88.0/24 in this example)
/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark=vpn passthrough=yes src-address=192.168.88.0/24 dst-address=!192.168.88.0/24
STEP 3: Set up the route to the VPN and define masqueranding for the subnet
/ip route add dst-address=0.0.0.0/0 gateway=vpn gateway-status=vpn distance=1 scope=30 target-scope=10 routing-mark=vpn
/ip firewall nat add chain=srcnat action=masquerade out-interface=vpn
This will connect you to the VPN automatically and keep the VPN connection open. It will also reconnect automatically and quickly, when needed.
|
