Jan 062017

Few posts ago, I have gone over the procedure needed to get OpenVPN going. However, what about SSTP-based VPN?

This guide is going to assume you are to enter commands into the New Terminal window from WinBox. That way I will simply repeat commands needed instead of going through the screens. Commands are actually quite descriptive and easy to “translate” into GUI actions if that is your preference.

Prerequisite for any VPN server is to get certificates sorted. Procedure is exactly the same as for OpenVPN server setup with the slight difference being that common-name really matters. It must match either external IP or external host name – no exceptions.

For completeness sake, I will repeat the certificate creation steps here:

add name=ca-template common-name=example.com days-valid=3650 key-size=2048 key-usage=crl-sign,key-cert-sign
add name=server-template common-name=*.example.com days-valid=3650 key-size=2048 key-usage=digital-signature,key-encipherment,tls-server
add name=client-template common-name=client.example.com days-valid=3650 key-size=2048 key-usage=tls-client

sign ca-template name=ca-certificate
sign server-template name=server-certificate ca=ca-certificate
sign client-template name=client-certificate ca=ca-certificate

Depending on your router’s speed, that sign command might time-out – nothing to worry about – just wait for CPU to drop below 100%. Or alternatively check the name of certificate – template part will disappear once signing is completed.

For later shenaningans, we will need root certificate export (just move it somewhere on your computer afterward):

export-certificate ca-certificate export-passphrase=""

Next we need a IP address pool for clients. I will assume you have your clients in some other network (e.g. 192.168.1.x) and this new network is just for VPN (notice that it can be the same pool as one used for OpenVPN):

pool add name="vpn-pool" ranges=

Instead of editing the default encrypted profile, we can create a new one. Assumption is your Mikrotik will also be a DNS server. And while at it, you can create a bit more imaginative user/password (again, if you did this for OpenVPN server, you can just reuse the same profile and user):

profile add name="vpn-profile" use-encryption=yes local-address= dns-server= remote-address=vpn-pool
secret add name=user profile=vpn-profile password=password

Finally, we get to enable SSTP VPN server interface – first step that is actually needed if you already have OpenVPN server running:

/interface sstp-server server
set enabled=yes default-profile=vpn-profile authentication=mschap2 certificate=server-certificate force-aes=yes pfs=yes

One curiosity is force-aes flag that is officially listed as not working with Windows clients. I’ve tested it on Windows 7 and 10 without any issues. You can clear it if you play with something older.

With this, our SSTP VPN server is up and running – onto the client setup!

For client we first need to import our certificate authority and we need to do it a bit roundabout way. First we start MMC (Microsoft Management Console) using mmc.exe and to it add Certificates (File->Add/Remove Snap-in). When asked select Computer account for Local Computer and find Trusted Root Certification Authorities. Right-click on it will show Import to which we give certificate we’ve exported a few steps ago.

In the Network and Sharing Center now we can go and Set up a new connection. When asked we just select Connect to a workplace and write destination host name (or IP). Remember that it must match certificate common-name (or a matching wildcard) you gave to your server certificate.

If all steps went fine, you should be presented with user name / password prompt and off you go.

PS: Do not forget to adjust firewall if necessary (TCP port 443).

/ip firewall filter
add chain=input protocol=tcp dst-port=443 action=accept place-before=0 comment="Allow SSTP"

[2017-01-26: Adjusted certificate creation to work on RouterOS 6.38 and later]
[2017-01-26: Changed key size to 2048 (instead of 4096) so it doesn’t take ages to generate certificates. :)]

  14 Responses to “Simple SSTP VPN Server on Mikrotik”

Comments (14)
  1. Thank you for this. Saved us from some frustration as the mikrotik wiki was not explicit about what key-usages ought to be included when creating certificates. I’ve posted our experience here: http://forum.mikrotik.com/viewtopic.php?f=2&t=118405

  2. Certificates no working on windows 10 error: CN name does no match transmited value
    “example.com” was replaced by my dyndns name.
    router RB750Gr3 firmware 6.38.3

    • Are you using your DynDNS name to connect? Your CA needs to have domain only (dyndns.org I guess in your case) while server certificate should be either exact DynDNS name or (my preference) wildcard.

  3. Hi Josip,
    After I’d installed the ca.crt on Trusted Root Certification Authorities and try to connect, I get the error:

    “A certificate chain processed but terminated in a root certificate which is not trusted by the trust provider”.

    I repeated 3 times your procedure but never works. Tried on a different RB but same problem. Version 6.37.4 of RouterOS. Have any idea what could be ?

    Note: I did your OpenVPN tutorial and it is working fine in the same RB.


    • Did you install certificate under Local Machine or Local User? Try exporting server certificate and check how it looks on Windows. If it is ok you should see that certification path is green.

  4. thanks boss

  5. i can ping the MT and connecting it works. I cannot ping other IPs in the same net as the MT is. Do i need any firewall or routing?
    Tried it, without success… ;-)

  6. hi,
    why did you create client certificate if you don’t use it?


    • Because this post was intended to be alternative to OpenVPN one and there you do need client certificate. I tried to keep those two posts very close so one can either use the same certificates for both or switch back-and-forth between them without needing to repeat certificate creation.

  7. I am having trouble resolving host names. I can ping IP addresses for devices on the MikroTik’s network, but not their hostnames. Any idea on what I may need to do?

  8. i setup L2TP Server,
    computer can connecting to Mikrotik ,
    but cellphone can not connect.

  9. You’re awsome.

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>