Creating proxy or open VPN in mikrotik

OpenVPN on MikroTik: quick primer

• OpenVPN in RouterOS is supported, but its feature set differs from mainstream OpenVPN implementations.
• You can run OpenVPN as a server or a client, depending on your topology (site-to-site or remote access).
• Proxy capabilities: OpenVPN can be configured to route through a proxy in some configurations, but this is not universal across all RouterOS versions. Expect some experimentation or a workaround if your network requires a proxy path.

Why you might want a proxy with OpenVPN

• Bypassing firewalls that block standard VPN ports.
• Reducing exposure by confining VPN traffic to a proxy gateway.
• Path customization for multi-hop or split-tunnel scenarios.

Setting up OpenVPN on MikroTik: a practical workflow

Note: Always back up your configuration before making major changes.

1. Check RouterOS version and feature support
   • Navigate to Winbox or WebFig → System → Packages to confirm OpenVPN-related capabilities.
   • If you plan to proxy OpenVPN traffic, verify if the version you run supports TLS, LZO, and proxy-related routing tricks.
   • If your device uses an ARM or x86 architecture, ensure the hardware can handle the load.
2. Prepare certificates and keys (for OpenVPN SSL/TLS)
   • OpenVPN relies on certificates to authenticate peers.
   • Generate a CA, server certificate, and client certificates. You can do this on a trusted machine or with a PKI tool.
   • Copy the public keys and certificates to the MikroTik router, placing them in a location where RouterOS can reference them (typically under the /cert or /system certificate sections).
3. Configure the OpenVPN server
   • Create a server instance and specify the protocol (UDP is common for OpenVPN) and port.
   • Enable TLS authentication if you want an additional security layer.
   • Define the IP pool for clients (the VPN address space).
   • Assign server certificates and keys to the VPN interface.
4. Create VPN clients (or configure a site-to-site)
   • If you’re implementing a remote access VPN, create user accounts with proper credentials.
   • If you’re building a site-to-site VPN, configure the opposing gateway as a peer with matching parameters.
5. Route through a proxy (proxy-enabled OpenVPN)
   • In some RouterOS builds, you can instruct OpenVPN to utilize a proxy for outbound connections. This is not universally supported, so you may need to configure a proxy-bridge or use a separate proxy device in the path.
   • A typical approach is to point the OpenVPN server or client to a proxy endpoint, or to create a firewall/nat policy that routes VPN traffic through a proxy gateway.
   • Common proxy options include SOCKS or HTTP proxies. Ensure the proxy supports the VPN port and TLS if used.
6. Client configuration and testing
   • On the client device, import the OpenVPN profile, including CA cert and client certificates.
   • Test connectivity by establishing the VPN tunnel, then checking routing tables (ip route) and the MTU to avoid fragmentation.
7. Troubleshooting tips
   • If the VPN tunnel fails to connect, verify certificates and hostnames, ensure that the remote peer can be reached on the chosen port, and check firewall rules on MikroTik.
   • If proxy routing doesn’t take effect, review the proxy server’s reachability, authentication, and the routing table to ensure traffic actually passes through the proxy.

Proxy options inside MikroTik: what works and what to expect

To understand what you can implement on MikroTik when you want VPN traffic to use a proxy, consider these patterns:

• Direct OpenVPN with proxy support: Some RouterOS versions allow OpenVPN to be proxied directly. This typically involves configuring proxy settings at the OpenVPN interface level. Availability depends on the RouterOS version and platform.
• Proxy bridge or NAT-based workaround: If the VPN software cannot talk to a proxy directly, you can place a proxy gateway on the path and route the VPN traffic through that gateway using static routes or policy-based routing.
• Separate proxy for web traffic vs VPN traffic: If your goal is to proxy only certain traffic, you can set up routing rules so that only specific subnets or destinations pass through the proxy, while VPN control traffic runs normally.

Table: typical approach comparison

Using ZoogVPN with MikroTik: a recommended flow

ZoogVPN is a consumer VPN that many users like for ease of use and reliable coverage. If you want a straightforward way to secure remote access or site-to-site connectivity without delving deeply into MikroTik VPN nuances, ZoogVPN can be a practical option. Here’s how you can leverage ZoogVPN in a MikroTik-friendly setup:

1. Decide your topology
   • Client mode: Each remote user connects to ZoogVPN directly from their device, and MikroTik routes traffic according to local policies.
   • Gateway mode: MikroTik acts as a VPN gateway to ZoogVPN, so all user traffic traverses the ZoogVPN tunnel.
2. Obtain ZoogVPN configuration details
   • Get standard OpenVPN or WireGuard configuration files from ZoogVPN (depending on what their service supports for client devices).
   • If you want MikroTik to handle VPN termination, you’ll typically use OpenVPN in gateway mode or a similar approach.
3. Configure OpenVPN on MikroTik for ZoogVPN
   • Use the OpenVPN server/client setup steps, but point to ZoogVPN’s server and credentials. If ZoogVPN provides a config file, you can translate it into MikroTik’s interface.
   • Import certificates, define the virtual interface, and ensure routing rules direct traffic through the VPN tunnel as desired.
4. Proxy considerations with ZoogVPN
   • If you specifically require a proxy path for ZoogVPN traffic, assess whether you need a separate proxy gateway or prefer to route the VPN tunnel directly.
   • ZoogVPN primarily provides VPN servers. If you need a proxy for bandwidth, you can place a proxy in front of the MikroTik path or use a proxy for certain applications.
5. Security and maintenance
   • Regularly update RouterOS and ZoogVPN client configs to maintain compatibility.
   • Monitor VPN health with RouterOS logging, interface statistics, and pinger checks to keep VPN uptime high.

Practical tips and best practices

• Start small: Test a single OpenVPN client connection before attempting a full mesh or site-to-site deployment.
• Follow certificate hygiene: Keep your CA and keys secure. Rotate certificates periodically.
• Separate management traffic: Use separate interfaces or VLANs for VPN control and data traffic to minimize cross-effects during failures.
• Document your topology: Write down the VPN server IPs, client credentials, and routing rules so you can recover quickly after a reboot or reset.
• Plan for scalability: If you anticipate many remote users, consider a scalable topology that minimizes host-based configuration sprawl.

Final section: recommendation

If your goal is reliable, straightforward VPN access with solid performance, and you want to minimize the complexity of MikroTik OpenVPN proxy setups, ZoogVPN is a solid option to complement MikroTik deployments. Use ZoogVPN as the primary VPN service for client devices or as a gateway for all traffic, and then layer MikroTik’s routing and firewall rules to direct traffic as needed. For more advanced use cases, such as proxy-through-VPN routing, you can experiment with OpenVPN on MikroTik and implement a proxy gateway when direct proxy support isn’t available in your RouterOS version. Always test in a controlled environment before deploying to production, and keep your VPN and device firmware up to date. Best browser VPN extension free