MikroTik Site-to-Site IPsec Tunnel

Easy Guide on how to setup MikroTik Site-to-Site IPsec Tunnel

If one of MikroTik’s WAN IP address is dynamic, set up that router as the initiator (i.e. dial-out)

If you are working from WAN, don’t forget to enable Safe Mode.

Let’s go to Winbox -> IP -> IPsec -> Proposals, and this is the IPsec proposal I usually use:

It compatible with DrayTek Routers as well, see the picture below:

IPsec Policy

Let’s go to IP -> IPsec -> on Policies, click on + and on the Action tab, fill in the following:

<tick> Tunnel if it’s not ticked.

SA Src. Address: <WAN IP Address of this MikroTik> (this can be blanked, if this MikroTik has dynamic WAN IP address)
SA Dst. Address: <WAN IP Address of the other MikroTik>
Proposal: Select the proposal we created before (i.e. proposal-younameit)

Then click on General tab, and fill with the following:

Src. Address: <Internal LAN IP of this MikroTik
Dst. Address: <Internal LAN IP of the other side>
<untick> Template if it’s ticked.

IPsec Peers

Now let’s go to peers tab to setup the other phase:


If the initiator has dynamic WAN IP, set Generate Policy = port strict on the responder side. Port strict will generate policies and use ports from peer’s proposal, which should match peer’s policy. This is also useful when remote peer’s IP address is unknown at the configuration time, basically allowing the peer to establish SA for non-existing policies.

Setup the same (just reverse the SRC/DST) on the other side of tunnel, if your tunnel works, you will see on IPsec -> Installed SAs.

Last but not least, we need to setup a Firewall NAT rule that allows LAN IP in our MikroTik goes through the tunnel:

On the Action tab, set Action: accept.

Click Apply then OK and put this rule above the masquerade srcnat rule.

I hope this guide works for you, but if you have any question or comment please don’t hesitate to write down below, and I would happy to respond.