L2TP (Layer 2 Tunneling Protocol) is the most commonly used protocol for MikroTik remote access. It provides a reliable encrypted tunnel.
Before You Start
You need a MikRouter remote account with an active subscription.
Open Winbox and connect to your MikroTik router via MAC or IP address.
Have the remote's Connect To, PPP Username and PPP Password ready — all three are on its page under your remotes in the dashboard.
The quickest way: paste one command
Open your remote in Remotes, press Copy on its Quick Setup section, then paste it into New Terminal in Winbox and press Enter. That is the whole setup.
MikroTik Terminal
:do {
/interface l2tp-client remove [find name="mikrouter-l2tp"]
/interface l2tp-client add name=mikrouter-l2tp connect-to=test.mikrouter.com user=user-l2tp password=pass-l2tp disabled=no
:if ([:len [/interface l2tp-client find name="mikrouter-l2tp"]] > 0) do={
:put "MikRouter: L2TP client mikrouter-l2tp added successfully."
} else={
:put "MikRouter: ERROR - L2TP client mikrouter-l2tp was not added."
}
} on-error={
:put "MikRouter: ERROR - could not add the L2TP client mikrouter-l2tp. Check that this RouterOS supports L2TP and try again."
}
This script is only a sample — copy the real one from your Quick Setup section.
The terminal confirms it:
admin@192.168.88.1 (hEX) hEX WinBox
Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙
Terminal□✕
MMM MMM KKK TTTTTTTTTTT KKK
MMMM MMMM KKK TTTTTTTTTTT KKK
MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK
MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK
MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK
MMM MMM III KKK KKK RRR RRR OOOOOO TTT III KKK KKK
MikroTik RouterOS 7.23.3 (c) 1999-2026 https://www.mikrotik.com/
Press F1 for help
[admin@hEX] >
MikRouter: L2TP client mikrouter-l2tp added successfully.
[admin@hEX] >
Prefer to set it up by hand? The steps below do the same thing in Winbox — three tabs and Apply. The values in the pictures are examples; use the Connect To, User and Password from your own remote's page.
1
Open PPP and press New
In Winbox, click PPP in the left menu. On the Interface tab press New and choose L2TP Client.
PPP ServerPPP ClientPPTP Server BindingPPTP ClientSSTP Server BindingSSTP ClientL2TP Server BindingL2TP ClientOVPN Server BindingOVPN ClientPPPoE Server BindingPPPoE Client
The new L2TP client window opens on the General tab. Give it any Name you like — it is only a label for this tunnel. Leave Enabled ticked and Max MTU and Max MRU at 1450; Type, Actual MTU and VRF are filled in for you.
Switch to Dial Out. Only three fields are yours to fill in — Connect To, User and Password. Every other field is a default and is already correct; if your Winbox shows something different, set it to match the picture below.
L2TP has no Port field here — it uses its own fixed ports. Enter the server address on its own, with no :port after it.
4
Check the Advanced tab
L2TP keeps its authentication settings on a third tab. Open Advanced and confirm all four Allow methods are ticked and L2TP Protocol Version is l2tpv2. Both are the defaults, so usually there is nothing to change — but an unticked method is a common cause of an authentication failure later.
Click Apply. Within a few seconds the window answers for itself: the title takes the name you gave the interface, a green RUNNING badge appears in the bottom-left corner, the footer reads Status: connected, and Apply greys out because there is nothing left unsaved. Then click OK to close the window.
You can also confirm the address the server handed your router under IP›Addresses, on the interface you just named.
7
Confirm it in your dashboard
Open the remote in Remotes. Within a few seconds the badge turns Online and a Live Connection section appears with the caller IP your router dialled in from — it only appears while the tunnel is up, so it is the confirmation that counts.
https://mikrouter.com/user/remotes/665…
MikroTik hEX
Online
4m22s
Remote is available
Expires on one week from today.
Live Connection
Caller IP
203.0.113.45
Location
🇵🇭 Manila, Philippines
ISP
Example Telecom
Organization
Example Telecom Inc.
VPN Credentials
Username
user-l2tp
Password
•••••
Connect To
test.mikrouter.com
Assigned Port
12345
Password shared or exposed? Issue a new one for free. You will need to update the VPN client on your MikroTik afterwards.
Rotate Password
Remote URL
test.mikrouter.com:12345
Use this address to connect via Winbox, SSH, HTTP, or API.
Need a fresh port? Rotate to a new one for 2 credits. The current port stops working and is retired permanently.
Rotate Port
If it will not connect
Stuck on connecting — some ISPs block L2TP outright. If it never leaves that state on one connection but works on another, try SSTP, which runs on port 443 and is the hardest to block. Authentication failure — retype the user and password, then check the four Allow methods on the Advanced tab.