Guides
MikRouter Guides
Step-by-step guides for configuring VPN clients and remote access on your MikroTik router. Pick a guide below to get started.
VPN Client Setup
MikroTik VPN Remote — Overview
Your MikroTik dials out to a MikRouter server and stays connected, so you get one public address you can reach it on from anywhere — no public IP and no port forwarding, even behind CGNAT. Start here to see how it fits together.
OVPN Client Setup
OpenVPN (OVPN) provides flexible encrypted tunneling. MikroTik supports OVPN in TCP mode.
SSTP Client Setup
SSTP (Secure Socket Tunneling Protocol) uses SSL/TLS encryption over port 443. It works well in networks that block other VPN protocols.
L2TP Client Setup
L2TP (Layer 2 Tunneling Protocol) is the most commonly used protocol for MikroTik remote access. It provides a reliable encrypted tunnel.
PPTP Client Setup
PPTP (Point-to-Point Tunneling Protocol) is the simplest protocol to configure. It has lower encryption but provides the fastest connection speeds.
Connecting via Winbox
Once your VPN tunnel is connected, access your MikroTik router remotely using Winbox with the server address and your assigned port.
Remote Access
Access an OLT through MikroTik
Reach the web interface of an OLT sitting behind your MikroTik router — from anywhere — by pairing a remote with one NAT rule. No public IP and no CGNAT headaches.
Access a router behind your MikroTik
Reach the admin page of another router — typically the internet modem your MikroTik connects through — from anywhere, with a remote plus one NAT rule. Same trick as the OLT guide, aimed at a router.
Agent Tunnel
Agent Tunnel — Overview
One agent reaches TCP services across every routable part of your site network — from the local LAN to permitted VLANs and subnets — through a cheap board, a Linux box, a Windows PC or Mac you already have, or the site's own router when it runs OpenWrt, dialling out to MikRouter. No MikroTik and no port forwarding required. Start here to see how it fits together.
Flash an ESP32
Put the MikRouter agent firmware onto a supported ESP32 board over USB — with the desktop flasher or the guided macOS Terminal script.
Connect ESP32 agent
The step after flashing: join the board's setup Wi-Fi, give it your Wi-Fi network and your agent token, and watch the tunnel come up — until this is done the agent stays offline in the dashboard.
Set up an agent on Linux (Debian/Ubuntu/etc)
Already have a Debian or Ubuntu machine, mini-PC, or VM on the target LAN? The one-line installer turns it into an agent in under a minute.
Set up an agent on a Windows PC
Already have a Windows PC that stays on at the site? One download turns it into an agent — no extra hardware, and nothing else to install.
Set up an agent on a Mac
A Mac mini, or any Mac that stays on at the site, can be the agent. Download the app and click through it, or paste one line into Terminal — both end up at the same place.
Set up an agent on an OpenWrt router
Already running OpenWrt? Put the agent on the router itself — no extra box to buy or power, and everything on your network becomes reachable.
Set up an agent on a small-flash OpenWrt router
Router too small for the agent? The loader takes a few kilobytes and loads the agent into memory at every boot.
Which ESP32 works with MikRouter?
Not every board with "ESP32" on the box runs the agent firmware. Here's what to buy, what to avoid, and how to tell which one you already have.
Put a local dev server or API online
Give the app running on your own laptop a public HTTPS address, the way a tunnelling tool like ngrok does — for webhooks that have to call you back, for showing work in progress, and for testing on a real phone. The address belongs to your account, so it is the same every time.
Help
Install Debian/Ubuntu on a Raspberry Pi
Prepare a Raspberry Pi for MikRouter by writing Raspberry Pi OS (Debian-based) or Ubuntu to a microSD card, enabling remote access, and completing the first boot.
Install Debian/Ubuntu on an Orange Pi
Prepare an Orange Pi for MikRouter — download the exact board-specific Debian or Ubuntu image, write it to a microSD card with Rufus or balenaEtcher, and finish the first boot over SSH.