DEV Community

loading...

OpenVPN Server and certificate management on MikroTik

garyker profile image Ihor ・3 min read

Setup OpenVPN Server and generate certs

Change variables below and paste the script

into MikroTik terminal window.

:global CN [/system identity get name]
:global COUNTRY "UA"
:global STATE "KV"
:global LOC "Kyiv"
:global ORG "My organization"
:global OU ""
:global KEYSIZE "2048"

functions

:global waitSec do={:return ($KEYSIZE * 10 / 1024)}

generate a CA certificate

/certificate
add name=ca-template country="$COUNTRY" state="$STATE" locality="$LOC" \
organization="$ORG" unit="$OU" common-name="$CN" key-size="$KEYSIZE" \
days-valid=3650 key-usage=crl-sign,key-cert-sign
sign ca-template ca-crl-host=127.0.0.1 name="$CN"
:delay [$waitSec]

generate a server certificate

/certificate
add name=server-template country="$COUNTRY" state="$STATE" locality="$LOC" \
organization="$ORG" unit="$OU" common-name="server@$CN" key-size="$KEYSIZE" \
days-valid=3650 key-usage=digital-signature,key-encipherment,tls-server
sign server-template ca="$CN" name="server@$CN"
:delay [$waitSec]

create a client template

/certificate
add name=client-template country="$COUNTRY" state="$STATE" locality="$LOC" \
organization="$ORG" unit="$OU" common-name="client" \
key-size="$KEYSIZE" days-valid=3650 key-usage=tls-client

create IP pool

/ip pool
add name=VPN-POOL ranges=192.168.252.128-192.168.252.224

add VPN profile

/ppp profile
add dns-server=192.168.252.1 local-address=192.168.252.1 name=VPN-PROFILE \
remote-address=VPN-POOL use-encryption=yes

setup OpenVPN server

/interface ovpn-server server
set auth=sha1 certificate="server@$CN" cipher=aes128,aes192,aes256 \
default-profile=VPN-PROFILE enabled=yes require-client-certificate=yes

add a firewall rule

/ip firewall filter
add chain=input dst-port=1194 protocol=tcp comment="Allow OpenVPN"

Add a new user

Add a new user and generate/export certs

Change variables below and paste the script

into MikroTik terminal window.

:global CN [/system identity get name]
:global USERNAME "user"
:global PASSWORD "password"

add a user

/ppp secret
add name=$USERNAME password=$PASSWORD profile=VPN-PROFILE service=ovpn

generate a client certificate

/certificate
add name=client-template-to-issue copy-from="client-template" \
common-name="$USERNAME@$CN"
sign client-template-to-issue ca="$CN" name="$USERNAME@$CN"
:delay 20

export the CA, client certificate, and private key

/certificate
export-certificate "$CN" export-passphrase=""
export-certificate "$USERNAME@$CN" export-passphrase="$PASSWORD"

Setup OpenVPN client

Copy the exported certificates from the MikroTik

sftp admin@MikroTik_IP:cert_export_*

Also, you can download the certificates from the web interface. Go to WebFig → Files for this.

Create user.auth file

The file auth.cfg holds your username/password combination. On the first line must be the username and on the second line your password.
user
password

Create OpenVPN config that named like USERNAME.ovpn:
client
dev tun
proto tcp-client
remote MikroTik_IP 1194
nobind
persist-key
persist-tun
cipher AES-256-CBC
auth SHA1
pull
verb 2
mute 3

Create a file 'user.auth' with a username and a password

cat << EOF > user.auth

user

password

EOF

auth-user-pass user.auth

Copy the certificates from MikroTik and change

the filenames below if needed

ca cert_export_MikroTik.crt
cert cert_export_user@MikroTik.crt
key cert_export_user@MikroTik.key

Add routes to networks behind MikroTik

route 192.168.10.0 255.255.255.0

Try to connect
sudo openvpn USERNAME.ovpn

Decrypt private key to avoid password asking
openssl rsa -passin pass:password -in cert_export_user@MikroTik.key -out cert_export_user@MikroTik.key

Delete a user and revoke his certificate

Delete a user and revoke his certificate

Change variables below and paste the script

into MikroTik terminal window.

:global CN [/system identity get name]
:global USERNAME "user"

delete a user

/ppp secret
remove [find name=$USERNAME profile=VPN-PROFILE]

revoke a client certificate

/certificate
issued-revoke [find name="$USERNAME@$CN"]

Revert OpenVPN server configuration on MikroTik

Revert OpenVPN configuration

/ip pool
remove [find name=VPN-POOL]

/ppp profile
remove [find name=VPN-PROFILE]

/ip firewall filter
remove [find comment="Allow OpenVPN"]

/ppp secret
remove [find profile=VPN-PROFILE]

/certificate

delete the certificates manually

Discussion (0)

Forem Open with the Forem app