VPN and VLANs · Topic 1 of 7
What a VPN Is and the Types of VPN
Learn what a VPN is, how tunnels encapsulate traffic, and how the main VPN types differ in layer, transport, encryption and typical use in RouterOS.
- 5 min
- A VPN uses tunnels to connect private networks over a shared network.
- A tunnel encapsulates the original packet inside another packet.
- Encapsulation reduces the usable packet size.
What it is
A VPN is a private network that runs across a shared or public network, using tunnels.
The goal is to connect sites or users as if they were on one network. The traffic crosses the internet, but the endpoints treat the tunnel like a private cable.
A tunnel works by encapsulation. The router wraps the original packet inside another packet, sends it to the far end, and the far end removes the wrapper.
How it works
A tunnel has two end addresses, an inner network and an optional layer of security.
Outer and inner packets
The outer packet uses the public addresses of the two routers. The inner packet keeps the private addresses of the sites. Routers on the internet only see the outer header.
Encapsulation adds extra header bytes. The usable size of the inner packet is therefore smaller than on a normal link. If the size is not adjusted, large packets can be dropped or fragmented.
Two kinds of connection
| Kind | Connects | Example |
|---|---|---|
| Site to site | Two networks, with routers at both ends | Head office and branch |
| Remote access | One user device to a network | A laptop connecting to the office |
In a site to site tunnel, both ends are routers that stay connected. In a remote access tunnel, a client dials in to a server, and it usually authenticates with a username and password.
Layer 2 and Layer 3 tunnels
Tunnels differ by what they carry inside.
- A Layer 3 tunnel carries IP packets. The two ends have IP addresses on the tunnel, and you route between them.
- A Layer 2 tunnel carries Ethernet frames. The two ends can be placed in one bridge, so both sites share one broadcast domain.
Comparing the types
| Type | Carries | Transport | Built in security |
|---|---|---|---|
| IPIP | IP | IP protocol 4 | None |
| EoIP | Ethernet | GRE, IP protocol 47 | None |
| PPTP | PPP | TCP port 1723 and GRE | MPPE, weak |
| L2TP | PPP | UDP port 1701 | None by itself, IPsec optional |
| SSTP | PPP | TCP, port 443 by default | TLS |
| PPPoE | PPP | Ethernet frames | None |
| IPsec | IP | ESP or AH, with IKE on UDP port 500 | Strong |
IPIP and EoIP are simple and fast, but they do not encrypt. They are often combined with IPsec when the path is not trusted.
PPTP, L2TP, SSTP and PPPoE are PPP based. PPP provides authentication and assigns addresses to the two ends. Their differences are the transport underneath and the protection around it.
PPPoE is different from the other PPP types. It runs directly over Ethernet, not over IP, so it is mostly used between a customer and a provider on the same Layer 2 segment.
OpenVPN is also supported. RouterOS v7 adds WireGuard.
Choosing a type
The choice depends on four questions.
- Is the traffic Layer 2 or Layer 3?
- Is encryption required, or does another layer provide it?
- Can the firewall in between pass the transport? SSTP uses TCP port 443, which usually passes.
- Do both ends need to stay connected as routers, or is it a dial in user?
PPTP is old and its encryption is weak, so it is a poor choice when security matters. IPsec or a TLS based tunnel such as SSTP is safer.
Verifying the idea
On any tunnel, check these three things in order. The tunnel interface is running, the two ends can ping each other's tunnel address, and routes for the remote LAN point at the tunnel.
/interface print
/ip address print
/ip route printRemember the carried layer first. IPIP carries IP, EoIP carries Ethernet, and PPP types carry PPP.
What to remember for the exam
Eight facts cover most questions on this topic.
- A VPN uses tunnels to connect private networks over a shared network.
- A tunnel encapsulates the original packet inside another packet.
- Encapsulation reduces the usable packet size.
- Site to site links join networks, and remote access links join one client to a network.
- IPIP is Layer 3, EoIP is Layer 2, and neither encrypts.
- PPTP uses TCP port 1723 with GRE, L2TP uses UDP port 1701, and SSTP uses TCP port 443 by default.
- PPPoE runs over Ethernet, not over IP.
- IPsec provides strong encryption and often protects the simpler tunnels.
A working tunnel is not a secure tunnel. IPIP and EoIP carry everything in clear unless something else encrypts them.
Common mistakes
These four errors appear often.
Calling every tunnel encrypted. IPIP, EoIP and plain L2TP do not encrypt by themselves.
Treating PPPoE as an internet tunnel. It works between devices on one Ethernet segment, because it does not use IP.
Ignoring the packet size. Encapsulation takes bytes from every packet, so large packets may need a smaller tunnel size.
Choosing PPTP for security. Its encryption is weak, and IPsec or SSTP is the better answer when security is the requirement.
Check yourself
Work through these three questions.
What is encapsulation in a tunnel?
The router wraps the original packet inside an outer packet, and the far end removes the outer packet. This is how private traffic crosses a shared network.
Which tunnel types carry Ethernet and which carry IP?
EoIP carries Ethernet frames, so it is a Layer 2 tunnel. IPIP carries IP packets, so it is a Layer 3 tunnel.
Which transport do PPTP, L2TP and SSTP use?
PPTP uses TCP port 1723 with GRE, L2TP uses UDP port 1701, and SSTP uses TCP port 443 by default.
Topic 1 of 7 in VPN and VLANs
Test yourself on VPN and VLANs
The full MikroTik MTCRE question bank has 417 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.