VPN Server

Turn the router into a VPN endpoint so you can reach your home network from outside.

Last updated Aug 14, 2026View as Markdown

Overview

This sub-step is the mirror image of VPN Client: instead of the router dialling out, it accepts connections in. The in-app help describes it as “Configure VPN servers for remote access including WireGuard, OpenVPN, L2TP/IPSec, PPTP, SSTP, and IKEv2. Set up user authentication and access policies for secure remote connectivity.”

It only appears if your WAN Link Type includes a domestic link. That is deliberate: a VPN server has to be reachable, and the domestic link is the one addressable from inside the country.

Each protocol has an Easy and an Advanced form. In Advanced Mode the flow breaks into sub-steps for choosing protocols, generating a certificate, adding users and reviewing the configuration; several protocols also let you pick which of your networks the incoming clients land on.

Before you start

  • SSTP, OpenVPN and IKEv2 need an SSL certificate. If you enable any of them, the wizard warns you and you must configure a certificate under Useful Services. The certificate passphrase must be at least 10 characters.
  • Decide which users need access and what their credentials will be.
  • Each enabled server gets its own subnet, as covered in Network Subnets.

Steps

  1. Pick the protocols you want to run from the protocol list.
  2. Configure each one by setting the port, addressing, and any protocol-specific settings.
  3. Add users and their credentials.
  4. Generate or select a certificate if a protocol you chose requires one.
  5. Review and save.

Reference

Protocol Description in the app
WireGuard Modern, efficient, and secure VPN protocol with excellent performance
OpenVPN Versatile and widely-supported VPN protocol with robust security features
L2TP/IPsec Improved security over PPTP with wide device compatibility
SSTP Microsoft-developed protocol that works well through firewalls
IKEv2 Fast, secure, and stable protocol with excellent reconnection capabilities
PPTP Legacy protocol with broad compatibility but weaker security
SOCKS5 Versatile proxy protocol for routing traffic through a secure tunnel
SSH Secure Shell protocol for encrypted remote access and tunneling
HTTP Proxy HTTP/HTTPS proxy server for web traffic routing and filtering
BackToHome Secure remote access solution for connecting to your home network
ZeroTier Software-defined networking for creating secure virtual networks

Troubleshooting

“Certificate required.” You enabled SSTP, OpenVPN or IKEv2, all of which need an SSL certificate. Configure one under Useful Services → Certificate.

The SSH service is locked on. Enabling certain VPN servers forces the RouterOS SSH service to stay available; the Services screen marks it “Required by VPN Server”.