Skip to content

Instantly share code, notes, and snippets.

Last active May 13, 2024 12:12
Show Gist options
  • Save SmartFinn/8324a55a2020c56b267b to your computer and use it in GitHub Desktop.
Save SmartFinn/8324a55a2020c56b267b to your computer and use it in GitHub Desktop.
MikroTik (RouterOS) script for setup OpenVPN server and generate certificates

OpenVPN Server and certificate management on MikroTik


Setup OpenVPN server and generate certificates

# Setup OpenVPN Server and generate certs
# Change variables below if needed then copy the whole script
# and paste into MikroTik terminal window.

:global CN [/system identity get name]
:global PORT 1194

## generate a CA certificate
add name=ca-template common-name="$CN" days-valid=3650 \
sign ca-template ca-crl-host= name="$CN"
:delay 10

## generate a server certificate
add name=server-template common-name="server@$CN" days-valid=3650 \
sign server-template ca="$CN" name="server@$CN"
:delay 10

## create a client template
add name=client-template common-name="client" days-valid=3650 \

## create IP pool
/ip pool
add name=VPN-POOL ranges=

## add VPN profile
/ppp profile
add dns-server= local-address= name=VPN-PROFILE \
  remote-address=VPN-POOL use-encryption=yes

## setup OpenVPN server
/interface ovpn-server server
set auth=sha1 certificate="server@$CN" cipher=aes128,aes192,aes256 \
  default-profile=VPN-PROFILE mode=ip netmask=24 port="$PORT" \
  enabled=yes require-client-certificate=yes

## add a firewall rule
/ip firewall filter
add chain=input action=accept dst-port="$PORT" protocol=tcp \
  comment="Allow OpenVPN"
add chain=input action=accept dst-port=53 protocol=udp \
  src-address= \
  comment="Accept DNS requests from VPN clients"
move [find comment="Allow OpenVPN"] 0
move [find comment="Accept DNS requests from VPN clients"] 1

## Setup completed. Do not forget to create a user.

NOTE: To allow clients to surf the Internet, make sure that there are permissive rules, such as:

/ip firewall filter
add chain=forward action=accept src-address= \
  out-interface-list=WAN place-before=0
add chain=forward action=accept in-interface-list=WAN \
  dst-address= place-before=1
/ip firewall nat
add chain=srcnat src-address= out-interface-list=WAN \

Add a new user

# Add a new user and generate/export certs
# Change variables below if needed then copy the whole script
# and paste into MikroTik terminal window.

:global CN [/system identity get name]
:global USERNAME "user"
:global PASSWORD "password"

## add a user
/ppp secret
add name=$USERNAME password=$PASSWORD profile=VPN-PROFILE service=ovpn

## generate a client certificate
add name=client-template-to-issue copy-from=client-template \
sign client-template-to-issue ca="$CN" name="$USERNAME@$CN"
:delay 10

## export the CA, client certificate, and private key
export-certificate "$CN" export-passphrase=""
export-certificate "$USERNAME@$CN" export-passphrase="$PASSWORD"

## Done. You will find the created certificates in Files.

Setup OpenVPN client

  1. Copy the exported certificates from the MikroTik

    sftp admin@MikroTik_IP:cert_export_\*

    Also, you can download the certificates from the web interface or Winbox. Open Winbox/WebFig → Files for this.

  2. Create user.auth file

    The file auth.auth holds your username/password combination. On the first line must be the username and on the second line your password.

  3. Create OpenVPN config that named like USERNAME.ovpn:

    dev tun
    proto tcp-client
    remote MikroTik_IP 1194
    cipher AES-128-CBC
    auth SHA1
    verb 2
    mute 3
    # Create a file 'user.auth' with a username and a password
    # cat << EOF > user.auth
    # user
    # password
    # EOF
    auth-user-pass user.auth
    # Copy the certificates from MikroTik and change
    # the filenames below if needed
    ca cert_export_MikroTik.crt
    cert cert_export_user@MikroTik.crt
    key cert_export_user@MikroTik.key
    # Uncomment the following line if Internet access is needed
    #redirect-gateway def1
    # Add routes to networks behind MikroTik
  4. Try to connect

    sudo openvpn USERNAME.ovpn

Decrypt private key to avoid password asking (optional)

openssl rsa -passin pass:password -in cert_export_user@MikroTik.key -out cert_export_user@MikroTik.key

Delete a user and revoke his certificate

# Delete a user and revoke his certificate
# Change variables below and paste the script
# into MikroTik terminal window.

:global CN [/system identity get name]
:global USERNAME "user"

## delete a user
/ppp secret
remove [find name=$USERNAME profile=VPN-PROFILE]

## revoke a client certificate
issued-revoke [find name="$USERNAME@$CN"]

## Done.

Revert OpenVPN server configuration on MikroTik

## Revert OpenVPN configuration

/interface ovpn-server server
set enabled=no default-profile=default port=1194

/ip pool
remove [find name=VPN-POOL]

/ppp secret
remove [find profile=VPN-PROFILE]

/ppp profile
remove [find name=VPN-PROFILE]

/ip firewall filter
remove [find comment="Allow OpenVPN"]
remove [find comment="Accept DNS requests from VPN clients"]

## delete the certificates manually
Copy link

nlavri commented Feb 2, 2024

Thanks a lot for the script. I got VPN connection between Android 13 and Mikrotik working, but there was no access to LAN and no firewall filter rules helped.
I have addresses assigned to VPN clients and LAN (so route was added to client open vpn profile just like in the script above).
However adding firewal nat masquerade helped.
/ip firewall nat add action=masquerade
comment="Allow OpenVPN clients to access LAN"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment