Setting up a secure site-to-site tunnel between two MikroTik routers shouldn't require guessing command syntax or fighting silent packet drops. Whether you're connecting a branch office to headquarters or linking two data centers, building an IPsec connection using RouterOS relies on a precise sequence: defining profiles, establishing peers, configuring proposals, matching policies, and bypassing local NAT.
Most tutorials skip the subtle details that cause tunnels to hang on initialization or fail silently during rekeying. This guide walks through a production-ready IKEv2 configuration using modern cryptographic standards, clear CLI commands, and the vital firewall exceptions that keep traffic flowing.
Understanding the Architecture
An IPsec site-to-site tunnel wraps traffic originating from a local private subnet and delivers it securely across the public internet to a remote private subnet. The remote router strips the encapsulation and forwards the clear packets to the destination LAN.
RouterOS handles this through five distinct components: As discussed in recent reports by Reuters, the effects are notable.
- Profiles (Phase 1 Security): Define the encryption, hashing, and Diffie-Hellman group used to secure the management channel between the two routers.
- Peers: Define the remote router's public endpoint and tie it to your Phase 1 profile.
- Identities: Handle authentication using pre-shared keys (PSK) or certificates.
- Proposals (Phase 2 Security): Specify the parameters used to encrypt the actual data payload traversing the tunnel.
- Policies: Tell the router which subnets trigger the IPsec engine and dictate that matching traffic must be encrypted.
For this setup, assume Site A (Headquarters) uses local subnet 192.168.10.0/24 with public IP 203.0.113.1, and Site B (Branch) uses local subnet 192.168.20.0/24 with public IP 198.51.100.2.
Step 1: Configure Phase 1 Profiles and Peers
Phase 1 establishes a secure, authenticated channel between the two gateway routers. We use IKEv2 because it handles rekeying more efficiently and recovers faster from network drops than legacy IKEv1.
On Site A, configure the profile and peer pointing to Site B:
/ip ipsec profile
add name=to-site-b hash-algorithm=sha256 enc-algorithm=aes-256 dh-group=modp2048 lifetime=1d
/ip ipsec peer
add name=peer-site-b address=198.51.100.2 profile=to-site-b exchange-mode=ike2
On Site B, mirror the configuration pointing back to Site A:
/ip ipsec profile
add name=to-site-a hash-algorithm=sha256 enc-algorithm=aes-256 dh-group=modp2048 lifetime=1d
/ip ipsec peer
add name=peer-site-a address=203.0.113.1 profile=to-site-a exchange-mode=ike2
Note: Both routers must use identical hash algorithms, encryption algorithms, and Diffie-Hellman groups, or the initial handshake will fail.
Step 2: Add Authentication Identities
Next, assign a secure pre-shared key (PSK) to authenticate the peer identity. Choose a long, randomized string rather than a simple dictionary word.
On Site A:
/ip ipsec identity
add peer=peer-site-b auth-method=pre-shared-key secret="YourSuperSecureSharedKeyHere99!"
On Site B:
/ip ipsec identity
add peer=peer-site-a auth-method=pre-shared-key secret="YourSuperSecureSharedKeyHere99!"
Step 3: Define Phase 2 Proposals and Policies
Phase 2 governs how the actual data payload is encrypted. Perfect Forward Secrecy (PFS) ensures that even if a session key is compromised in the future, past recorded traffic remains secure.
On Site A, create the proposal and the traffic policy:
/ip ipsec proposal
add name=prop-site-b auth-algorithms=sha256 enc-algorithms=aes-256-cbc pfs-group=modp2048
/ip ipsec policy
add peer=peer-site-b tunnel=yes src-address=192.168.10.0/24 dst-address=192.168.20.0/24 proposal=prop-site-b action=encrypt
On Site B, reverse the source and destination subnets for the policy:
/ip ipsec proposal
add name=prop-site-a auth-algorithms=sha256 enc-algorithms=aes-256-cbc pfs-group=modp2048
/ip ipsec policy
add peer=peer-site-a tunnel=yes src-address=192.168.20.0/24 dst-address=192.168.10.0/24 proposal=prop-site-a action=encrypt
Setting tunnel=yes tells RouterOS to encapsulate the entire inner packet so that remote subnets communicate transparently.
Step 4: The Critical NAT Bypass Rule
This is the step administrators most frequently miss, resulting in connections that show up as established in the IPsec menu while traffic drops silently into a black hole.
Most routers feature a source NAT (masquerade) rule that rewrites outbound internet traffic. If a packet destined for the remote office hits your standard masquerade rule first, its source IP gets changed to your router's public address. When it reaches the IPsec policy matcher, the source no longer matches 192.168.10.0/24, and the kernel drops the packet.
You must insert an explicit accept rule at the top of your srcnat chain to intercept tunnel-bound traffic before masquerading occurs.
On Site A:
/ip firewall nat
add chain=srcnat action=accept place-before=0 src-address=192.168.10.0/24 dst-address=192.168.20.0/24
On Site B:
/ip firewall nat
add chain=srcnat action=accept place-before=0 src-address=192.168.20.0/24 dst-address=192.168.10.0/24
Using place-before=0 ensures the rule sits above your generic internet masquerade rule.
Step 5: Firewall Filter Adjustments
If your input and forward filter chains feature strict drop rules, you must explicitly permit IPsec control protocols and encapsulated traffic. IPsec uses UDP ports 500 (ISAKMP) and 4500 (NAT-T), alongside the ESP protocol (IP protocol 50).
Add these rules to the top of your input filter chain on both routers:
/ip firewall filter
add chain=input action=accept protocol=udp dst-port=500,4500 comment="Allow IPsec ISAKMP and NAT-T"
add chain=input action=ipsec-policy ipsec-policy=in,ipsec comment="Allow incoming IPsec policy traffic"
Additionally, ensure your forward chain allows traffic moving between your local subnet and the remote subnet:
/ip firewall filter
add chain=forward action=accept src-address=192.168.10.0/24 dst-address=192.168.20.0/24 comment="Allow traffic into VPN tunnel"
add chain=forward action=accept src-address=192.168.20.0/24 dst-address=192.168.10.0/24 comment="Allow traffic from VPN tunnel"
For official documentation on packet flow and advanced parameter optimization, consult the MikroTik RouterOS Documentation.
Troubleshooting Common Failures
When a tunnel refuses to come up, systematic checks will isolate the misconfiguration quickly.
- Check Active Peers: Navigate to
IP > IPsec > Active Peersin Winbox or run/ip ipsec active-peers printin the terminal. If this list is empty, Phase 1 has failed. Verify that public IP addresses are reachable and that shared keys match character-for-character. - Check Installed SAs: Run
/ip ipsec installed-sas print. If Phase 1 is active but this list is empty, Phase 2 parameters (proposals or policies) are mismatched between routers. Ensure encryption algorithms and subnets mirror each other correctly. - Verify NAT Bypass: If the tunnel is up but you cannot ping across it, check packet counters on your NAT accept rule. If packet counters remain at zero, your traffic isn't hitting the bypass rule or is being captured by a broader masquerade rule positioned higher in the chain.
- ISP and Port Blocking: Some consumer ISPs block or throttle UDP ports 500 and 4500. Ensure your upstream device or ONT is placed in bridge mode if you are double-NATted.
Frequently Asked Questions
Can I set up this tunnel if one site has a dynamic public IP address?
Yes. On the router with the dynamic IP address, leave the peer address field blank or set it to 0.0.0.0/0, and configure the static peer router to accept connections passively. Alternatively, use Dynamic DNS (DDNS) to track IP changes.
Why should I choose IKEv2 over IKEv1?
IKEv2 offers faster connection establishment, better handling of mobile or changing endpoints, built-in NAT traversal support, and superior cryptographic resilience compared to aging IKEv1 standards.
What do I do if my routers are behind carrier-grade NAT (CGNAT)?
IPsec site-to-site tunnels require at least one side to have a reachable public IP address or a static port-forwarded public endpoint. If both ends sit behind CGNAT without public exposure, consider alternative overlay solutions like WireGuard or ZeroTier.
How do I verify packet flow across the established tunnel?
Use the MikroTik built-in tool via /tool torch interface=ether1 filtering for remote traffic, or run a diagnostic ping from a local workstation specifying the source interface or address to confirm that packets enter the security association.
