VPN and VLANs · Topic 3 of 7

Site to Site Tunnels with PPTP, SSTP, L2TP and PPPoE

Learn how PPP based tunnels work in RouterOS: server and client setup, secrets, addressing and routing for PPTP, L2TP, SSTP and PPPoE site links.

5 min

In a nutshell

PPP tunnels use a server, a client and a PPP secret.
The secret sets name, password, service and the link addresses.
Routes to the remote LANs must still be added.

What it is

PPTP, L2TP, SSTP and PPPoE are tunnels built on the Point to Point Protocol, with a server and a client.

PPP gives these tunnels authentication and automatic addressing. The client connects to the server, proves who it is, and both ends receive an address for the link.

They are used for remote access and also for site to site links, where one router is the client and the other is the server.

How it works

The server holds a user entry, and the client dials in using that user.

The server side

The user entry is called a PPP secret. It holds the name, the password, the service and the two link addresses.

/ppp secret add name=branch1 password=StrongSecret service=pptp local-address=10.255.1.1 remote-address=10.255.1.2
/interface pptp-server server set enabled=yes

The local-address is the server end of the link, and remote-address is given to the client. The pair behaves like the point to point addresses from the earlier chapter.

Each tunnel type has its own server menu. For PPTP it is /interface pptp-server server, and the other types follow the same pattern with their own names.

The client side

The client needs the server address and the same user and password.

/interface pptp-client add name=pptp-to-hq connect-to=203.0.113.1 user=branch1 password=StrongSecret disabled=no

When the connection succeeds, the client creates the interface and a point to point address. The dynamic address uses the address pair from the secret.

Routing across the tunnel

The tunnel only connects the two link addresses. Each router still needs a route to the LAN behind the other end.

/ip route add dst-address=192.168.2.0/24 gateway=10.255.1.2

This route on the server sends the branch LAN to the client end. The client adds a similar route to the head office LAN. Dynamic protocols can also run over the tunnel.

The four types compared

Type	Transport	Security	Notes
PPTP	TCP port 1723 and GRE	MPPE, weak	Old, simple, needs GRE allowed
L2TP	UDP port 1701	None alone, IPsec optional	Often paired with IPsec
SSTP	TCP, port 443 by default	TLS, normally with a certificate	Passes most firewalls
PPPoE	Ethernet frames	None	Layer 2 only

L2TP with IPsec

L2TP does not encrypt by itself. The client can ask for IPsec protection with use-ipsec=yes and a shared secret.

/interface l2tp-client add name=l2tp-to-hq connect-to=203.0.113.1 user=branch1 password=StrongSecret use-ipsec=yes ipsec-secret=SharedKey

SSTP

SSTP wraps PPP in a TLS session on TCP, port 443 by default. The server normally uses a certificate, and the client may check it.

Because it looks like ordinary HTTPS traffic, it often passes firewalls that block other tunnels.

PPPoE

PPPoE runs PPP directly over Ethernet. The client binds to an interface and finds a server on that Ethernet segment.

/interface pppoe-client add name=pppoe-out1 interface=ether1 user=customer1 password=StrongSecret add-default-route=yes
/interface pppoe-server server add service-name=isp interface=ether2 default-profile=default

The server and client must be in the same Layer 2 segment, because PPPoE has no IP layer of its own. Internet providers use it to authenticate customers and assign addresses.

Verifying

/interface print
/ppp active print
/ip address print

The active list on the server shows who is connected, which service they used and the address they received.

Exam tip

On the server, the user needs a matching service in the secret. A secret for pptp does not let a client connect through l2tp.

What to remember for the exam

Seven facts cover most questions on this topic.

PPP tunnels use a server, a client and a PPP secret.
The secret sets name, password, service and the link addresses.
Routes to the remote LANs must still be added.
PPTP uses TCP port 1723 with GRE, and its encryption is weak.
L2TP uses UDP port 1701 and can be protected with IPsec.
SSTP uses TLS on TCP port 443 by default and normally uses a server certificate.
PPPoE works on one Ethernet segment, and it is not routed.

Watch out

PPTP needs GRE as well as TCP port 1723. A firewall that opens only the port blocks the data.

Common mistakes

These four errors appear often.

Forgetting to enable the server. The server menu is disabled until you turn it on, and the client then cannot connect.

Using the wrong service in the secret. If the secret names one service, it must be the tunnel type the client uses.

Missing routes to the remote LAN. The tunnel is up and the ping to the peer works, but site traffic fails.

Trying to run PPPoE across routers. It does not cross routed networks, so client and server must share the Ethernet segment.

Check yourself

Work through these three questions.

What does a PPP secret define on the server?
It defines the user name, the password, the service and the link addresses. The remote address is given to the client.
Which tunnel type uses TLS and passes most firewalls?
SSTP, which uses TLS on TCP port 443 by default. It normally uses a certificate on the server.
Why can PPPoE not connect two sites across the internet?
PPPoE runs directly over Ethernet and has no IP layer. The client and server must be on the same Layer 2 segment.

Topic 3 of 7 in VPN and VLANs

Test yourself on VPN and VLANs

The full MikroTik MTCRE question bank has 417 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.