This means that any general masquerade or 1:1 NAT rules will take place before the VPN is reached, and the now NAT’d addresses will not be directed across the VPN. In RouterOS, NAT is performed before IPsec takes place. Juniper’s documentation explains that it stands for “Dead Peer Detection”. DPD – Mikrotik do not offer any explanation for this, other than that experiments on the official forums seem to confirm that it only appears works with other RouterOS devices.

Lifebytes – Session will be reconnected after X bytes have been encrypted.Generate Policy – Appears to dynamically generate the policies depending on what details have been supplied by the remote side.It results in a proposal mis-match error. Note: I was not able to get group 2 to work. The table below shows the mapping between these: DH Group – Mikrotik use the actual algorithm names as opposed to the normal “DH1” or “DH2”.Setting this to “Obey” is the most flexible as it will make RouterOS conform to whatever the remote site proposes. Proposal Check – Determines how proposed lifetimes are handled.There’s a few confusing extras here that don’t appear on the ZyXEL. Next, switch to the “Peers” tab and create a new peer, using the public address of the ZyXEL as the address: Open the IP->IPsec window in WinBox, and create a new policy as follows: This is the equivelent of the first page of the ZyXEL configuration.

Now, on RouterOS we start by configuring the policy for this VPN. Create the VPN as you normally would on the ZyXEL, ensuring to use subnet’s for your local and remote networks, as well the IP addressess of the ZyXEL and Mikrotik for the Peer IDs: It’s an older ZyXEL 652H, but the same settings apply to almost all of the VPN enabled ZyXEL devices. We’ll configure the ZyXEL’s “public” address as 10.0.0.1 and the RB’s as 10.0.0.2.įirst, the ZyXEL. Just imagine that the 10.0.0.0/24 network in the middle is in fact the internet. Recently I had to setup several Mikrotik RouterOS to ZyXEL VPNs and through I would document how it’s done.įirst, a quick diagram to explain the setup we’re going to cover. It’s unfortunate that the Mikrotik RouterOS manual on IPsec is not great – it’s sorely lacking in details and good examples, and what examples it does have are not well explained.

Mac vpn setup for mikrotik