In this post I will help you setup a VPN connection from a MAC or IOS device to a Mikrotik router which according to all posts on the Internet should be fairly easy, but in real life will waste about 2 hours of your life if you are anyone like me.
So here is the topology I am using
So here are some of the details that apply to my setup
Ether1 is connected to the Internet and uses DHCP
The Ip number of the Mikrotik is 172.26.0.1/24
So first things first, we need to create the configuration, I use telnet cos that is how you are suppose to manage networking stuff
First we need to enable the l2tp server
/interface l2tp-server server set enabled=yes
Then we have to update the proposal
/ip ipsec proposal set default enc-algorithms=3des auth-algorithms=sha1 disabled=no lifetime=30m pfs-group=modp1024
Then we add a peer entry
/ip ipsec peer add address=0.0.0.0/0 \ auth-method=pre-shared-key dh-group=modp1024 \ disabled=no dpd-interval=2 dpd-maximum-failures=5 \ enc-algorithm=3des exchange-mode=main-l2tp \ generate-policy=port-override hash-algorithm=sha1 \ lifetime=1d nat-traversal=yes port=500 \ secret=XXXXX send-initial-contact=yes
Make sure you update the secret key, but that should be logical
Then we need to add the PPP client (end user)
/ppp secret add name=user password=12345 \ profile=default-encryption local-address=[local address] \ remote-address=[remote address] service=l2tp
So for a local address choose an address in your range for me that would be 172.26.0.200 and for the remote 172.26.0.201.
Now all you have to do is setup your Client, and connect.
So this is basically straight forward so why did I start off by saying it took me hours, we as soon as you connect you notice that you cannot reach anything on your local network! thing defeats the point of having a VPN. The solution to this problem is to enable proxy arp.
Now if you have a Mirkrotik router that a connection to an external switch then you need to do the following:
/interface ethernet set 0 arp=proxy-arp
Replacing 0 with what ever port number you have connected to your external switch
if you have a Mikrotik with an embedded switch like the RB2011UiAS-2HnD-IN then you need to update your bridge as follows:
/interface bridge set 0 arp=proxy-arp
This should take care of everything, Enjoy!