PPTP and L2TP VPN Server in MikroTik: Remote Access

Setting Up PPTP and L2TP VPN Servers on MikroTik

RouterOS supports several VPN protocols for remote access. This guide covers PPTP and L2TP — two older but still commonly used protocols. Understanding both helps you choose the right one and configure it correctly.

Important Security Note

PPTP is considered insecure and should not be used for sensitive data. Its encryption has known vulnerabilities and it is easily blocked by firewalls and ISPs. L2TP/IPsec is the recommended choice — L2TP alone provides no encryption, but when combined with IPsec (which RouterOS does automatically), it becomes a reasonably secure protocol.

Use these protocols when:

Connecting legacy clients that do not support IKEv2
Quick remote access for non-critical access
Compatibility is more important than maximum security

For maximum security, use IKEv2 (see the IPsec IKEv2 guide).

Part 1: Setting Up the PPTP Server

Enable the PPTP Server

TEXT

/interface pptp-server server set enabled=yes authentication=mschap2   default-profile=default-encryption

Parameters:

authentication=mschap2 — use MS-CHAPv2 (most compatible)
default-profile — the profile controlling IP, DNS, compression settings

Create a User Account

VPN users are managed under /ppp secret:

TEXT

/ppp secret add name=vpnuser1 password=SecurePass123   service=pptp   local-address=192.168.100.1   remote-address=192.168.100.10   comment="Remote user 1"

Parameters:

service=pptp — this account is for PPTP only
local-address — the IP assigned to the router's end of the tunnel
remote-address — the IP assigned to the client

Alternative: Use an IP Pool for Multiple Users

TEXT

/ip pool add name=pptp-pool ranges=192.168.100.10-192.168.100.50

/ppp profile add name=pptp-profile   local-address=192.168.100.1   remote-address=pptp-pool   dns-server=8.8.8.8

/ppp secret add name=vpnuser1 password=Pass1 service=pptp profile=pptp-profile
/ppp secret add name=vpnuser2 password=Pass2 service=pptp profile=pptp-profile

Firewall Rule for PPTP

Allow incoming PPTP connections on the WAN:

TEXT

/ip firewall filter add chain=input protocol=tcp dst-port=1723 action=accept   comment="Allow PPTP"
/ip firewall filter add chain=input protocol=gre action=accept   comment="Allow GRE for PPTP"

PPTP uses TCP port 1723 and GRE protocol (IP protocol 47).

View Connected PPTP Clients

TEXT

/interface pptp-server print

Or see active connections:

TEXT

/ppp active print

Part 2: Setting Up the L2TP/IPsec Server

L2TP combined with IPsec is more secure than PPTP. RouterOS handles the IPsec part automatically when you enable the ipsec-secret.

Enable the L2TP Server

TEXT

/interface l2tp-server server set enabled=yes   authentication=mschap2   default-profile=default-encryption   ipsec-secret=IPsecSharedKey123   use-ipsec=required

Parameters:

ipsec-secret — the pre-shared key for IPsec. All clients use this same key (in addition to their username/password)
use-ipsec=required — require IPsec encryption (reject plain L2TP without IPsec)

Create User Accounts for L2TP

TEXT

/ip pool add name=l2tp-pool ranges=192.168.200.10-192.168.200.50

/ppp profile add name=l2tp-profile   local-address=192.168.200.1   remote-address=l2tp-pool   dns-server=8.8.8.8   use-compression=no

/ppp secret add name=vpnuser1 password=SecurePass123   service=l2tp   profile=l2tp-profile

/ppp secret add name=vpnuser2 password=AnotherPass456   service=l2tp   profile=l2tp-profile

Firewall Rules for L2TP/IPsec

TEXT

/ip firewall filter add chain=input protocol=udp dst-port=1701 action=accept   comment="L2TP"
/ip firewall filter add chain=input protocol=udp dst-port=500 action=accept   comment="IKE for IPsec"
/ip firewall filter add chain=input protocol=udp dst-port=4500 action=accept   comment="IPsec NAT-T"
/ip firewall filter add chain=input protocol=ipsec-esp action=accept   comment="IPsec ESP"

View Connected L2TP Clients

TEXT

/interface l2tp-server print
/ppp active print

Connecting from a Client

Windows — L2TP/IPsec

Go to Settings → Network & Internet → VPN → Add a VPN connection
VPN provider: Windows (built-in)
VPN type: L2TP/IPsec with pre-shared key
Pre-shared key: IPsecSharedKey123 (your ipsec-secret)
Username/password: the credentials from /ppp secret

Windows — PPTP

Same path, VPN type: PPTP
Enter the router's WAN IP as the server address
Enter username and password

macOS and iOS

Both support L2TP/IPsec natively in the VPN settings.

Android

Android supports L2TP/IPsec in Settings → Network → VPN.

Using the Same Account for Both Protocols

If you set service=any, the account works for both PPTP and L2TP:

TEXT

/ppp secret add name=vpnuser1 password=SecurePass123   service=any   profile=l2tp-profile

Monitoring VPN Usage

See all active VPN sessions:

TEXT

/ppp active print detail

Output includes username, interface, uptime, and bytes transferred.

See VPN usage in the log:

TEXT

/log print where topics~"ppp"

Assigning a Specific IP to a User

If you always want the same IP for a user:

TEXT

/ppp secret set [find name=vpnuser1] remote-address=192.168.200.25

This overrides the pool and always gives this user 192.168.200.25.

Summary

PPTP: easy to set up but insecure — use only for legacy compatibility
L2TP/IPsec: more secure, recommended for remote access
Users are managed under /ppp secret
Enable PPTP with /interface pptp-server server set enabled=yes
Enable L2TP with /interface l2tp-server server set enabled=yes ipsec-secret=...
Always open required firewall ports on the WAN interface
Monitor connections with /ppp active print