Chapter 6 of 6 · MikroTik MTCSE
Secure Tunnels
IPsec fundamentals, L2TP over IPsec for remote access, and SSTP with certificates on MikroTik RouterOS.
- 3topics
- 16 minfast track
- 2diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Introduction to IPsecLearn what IPsec is, how AH, ESP and IKE work, tunnel mode versus transport mode, and how a MikroTik site to site IPsec tunnel is…Diagram6 min
- 2L2TP with IPsecLearn how L2TP over IPsec builds a remote access VPN on RouterOS, how the server, PPP secrets and client are set up, and which…Diagram5 min
- 3SSTP with CertificatesLearn how SSTP carries PPP over TLS, why it passes through firewalls on TCP 443, and how to set up an SSTP server and client with…5 min
About this chapter
What this chapter covers
Secure tunnels carry private traffic safely across an untrusted network such as the internet.
This chapter introduces IPsec, the main protocol suite for this job. It then shows two remote access designs. One is L2TP combined with IPsec, and the other is SSTP, which relies on TLS and certificates.
The chapter pulls together earlier work. The algorithms, keys and certificates from the Cryptography chapter and the firewall rules from the Firewall chapter are all needed to make a tunnel work.
How the topics fit together
IPsec is the base, and the two remote access options use it or replace it.
The IPsec page explains how two peers negotiate keys and protect packets with ESP. It also builds a site to site link between two routers.
The L2TP page adds a PPP tunnel on top of IPsec. This gives a user login and an assigned address.
The SSTP page takes a different path. It puts PPP inside TLS, so IPsec is not needed, but certificates are.
When a tunnel fails, check in this order. First the ports in the firewall, then the secrets or certificates, and then the algorithms.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and console examples.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read the pages in order. The IPsec page gives the vocabulary that the L2TP page uses, and the SSTP page uses the certificate commands from the previous chapter.
Make a table of the ports for each tunnel type, and practise it until you know it. Port questions are easy marks, and wrong firewall rules are the most common reason for a tunnel that does not come up.
Ready for more practice?
The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.