All guides
OVPN

OVPN Client Setup

OpenVPN (OVPN) provides flexible encrypted tunneling. MikroTik supports OVPN in TCP mode.

Before You Start

  • You need a MikRouter remote account with an active subscription.
  • Open Winbox and connect to your MikroTik router via MAC or IP address.
  • Have the remote's Connect To, PPP Username and PPP Password ready — all three are on its page under your remotes in the dashboard.

The quickest way: paste one command

Open your remote in Remotes, press Copy on its Quick Setup section, then paste it into New Terminal in Winbox and press Enter. That is the whole setup.
MikroTik Terminal
:do {
  /interface ovpn-client remove [find name="mikrouter-ovpn"]
  /interface ovpn-client add name=mikrouter-ovpn connect-to=test.mikrouter.com port=1194 mode=ip protocol=tcp user=user-ovpn password=pass-ovpn disabled=no
  :if ([:len [/interface ovpn-client find name="mikrouter-ovpn"]] > 0) do={
    :put "MikRouter: OVPN client mikrouter-ovpn added successfully."
  } else={
    :put "MikRouter: ERROR - OVPN client mikrouter-ovpn was not added."
  }
} on-error={
  :put "MikRouter: ERROR - could not add the OVPN client mikrouter-ovpn. Check that this RouterOS supports OVPN and try again."
}

This script is only a sample — copy the real one from your Quick Setup section.

The terminal confirms it:

admin@192.168.88.1 (hEX) hEX WinBox
Workspace:<own> ▾
Terminal✕
  MMM      MMM       KKK                            TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                            TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO        TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO       TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO       TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO        TTT     III  KKK  KKK

  MikroTik RouterOS 7.23.3 (c) 1999-2026       https://www.mikrotik.com/

Press F1 for help

[admin@hEX] >
MikRouter: OVPN client mikrouter-ovpn added successfully.

[admin@hEX] >
hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)

Prefer to set it up by hand? The steps below do the same thing in Winbox — two tabs and Apply. The values in the pictures are examples; use the Connect To, User and Password from your own remote's page.

1

Open PPP and press New

In Winbox, click PPP in the left menu. On the Interface tab press New and choose OVPN Client.
admin@192.168.88.1 (hEX) hEX WinBox
Workspace:<own> ▾
PPP▾InterfacePPPoE ServersOVPN ServersSecretsProfilesActive ConnectionsL2TP EthernetL2TP Secrets✕
+New▶ Enable✗ Disable✕ Remove
Name ▴Type
PPP ServerPPP ClientPPTP Server BindingPPTP ClientSSTP Server BindingSSTP ClientL2TP Server BindingL2TP ClientOVPN Server BindingOVPN ClientPPPoE Server BindingPPPoE Client
0▶ Live
hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)
2

Name it on the General tab

The new OVPN client window opens on the General tab. Give it any Name you like — it is only a label for this tunnel. Leave Enabled ticked and Max MTU at 1500; Type, Actual MTU and VRF are filled in for you.
admin@192.168.88.1 (hEX) hEX WinBox
Workspace:<own> ▾
Interface › New…✕
GeneralDial OutStatusTraffic
Enabled✓
Comment
Namemikrouter-ovpn
TypeOVPN Client
Actual MTU
VRFmain⋮▾
MAC Address00:00:00:00:00:00
Max MTU1500
Status: CancelApplyOK
hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)
FieldValue
Namemikrouter-ovpn
3

Fill in the Dial Out tab

Switch to Dial Out. Only three fields are yours to fill in — Connect To, User and Password. Every other field is a default and is already correct; if your Winbox shows something different, set it to match the picture below.
admin@192.168.88.1 (hEX) hEX WinBox
Workspace:<own> ▾
Interface › New…✕
GeneralDial OutStatusTraffic
Connect Totest.mikrouter.com+VRF
Port1194
Modeip▾
Protocoltcp▾
Useruser-ovpn
Passwordpass-ovpn−
Profiledefault⋮▾
Certificatenone⋮▾
Verify Server Certificate
TLS Versionany▾
Auth.sha1▾
Cipherblowfish 128▾
Use Peer DNSyes▾
Add Default Route
Don't Add Pushed Routes (route-nopull)
Status: CancelApplyOK
hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)
FieldValue
Connect Totest.mikrouter.com
Useruser-ovpn
Passwordpass-ovpn
4

Press Apply and watch it connect

Click Apply. Within a few seconds the window answers for itself: the title takes the name you gave the interface, a green RUNNING badge appears in the bottom-left corner, the footer reads Status: connected, and Apply greys out because there is nothing left unsaved. Then click OK to close the dialog.
admin@192.168.88.1 (hEX) hEX WinBox
Workspace:<own> ▾
Interface › mikrouter-ovpn✕
GeneralDial OutStatusTraffic
Connect Totest.mikrouter.com+VRF
Port1194
Modeip▾
Protocoltcp▾
Useruser-ovpn
Passwordpass-ovpn−
Profiledefault⋮▾
Certificatenone⋮▾
Verify Server Certificate
TLS Versionany▾
Auth.sha1▾
Cipherblowfish 128▾
Use Peer DNSyes▾
Add Default Route
Don't Add Pushed Routes (route-nopull)
RUNNINGStatus: connectedCancelApplyOK
hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)

If the footer keeps cycling through connecting or shows an error instead, the settings are saved but the tunnel is not up — see the troubleshooting note at the end. OVPN takes a little longer than the other protocols because it negotiates over TCP.

5

Verify it in the interface list

Back in PPP›Interface the client is now listed with an R (Running) flag in the first column and a status of connected. That flag is the same fact as the RUNNING badge, seen from the other window — if it is missing, the tunnel is down whatever the dialog said a moment ago.
admin@192.168.88.1 (hEX) hEX WinBox
Workspace:<own> ▾
PPP▾InterfacePPPoE ServersOVPN ServersSecretsProfilesActive ConnectionsL2TP EthernetL2TP Secrets✕
+New▶ Enable✗ Disable✕ Remove
Name ▴TypeActual MTUL2 MTUStatus
Rmikrouter-ovpnOVPN Client1500connected
1 item (1 selected)▶ Live
hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)

You can also confirm the address the server handed your router under IP›Addresses, on the interface you just named.

6

Confirm it in your dashboard

Open the remote in Remotes. Within a few seconds the badge turns Online and a Live Connection section appears with the caller IP your router dialled in from — it only appears while the tunnel is up, so it is the confirmation that counts. The Remote URL underneath is the address you use from now on, in Winbox, SSH, a browser or the API.
https://mikrouter.com/user/remotes/665…

MikroTik hEX

Online

4m22s

Remote is available

Expires on one week from today.

Live Connection

Caller IP

203.0.113.45

Location

🇵🇭 Manila, Philippines

ISP

Example Telecom

Organization

Example Telecom Inc.

VPN Credentials

Username

user-ovpn

Password

•••••

Connect To

test.mikrouter.com

Assigned Port

12345

Password shared or exposed? Issue a new one for free. You will need to update the VPN client on your MikroTik afterwards.

Rotate Password
Remote URL

test.mikrouter.com:12345

Use this address to connect via Winbox, SSH, HTTP, or API.

Need a fresh port? Rotate to a new one for 2 credits. The current port stops working and is retired permanently.

Rotate Port

If it will not connect

Stuck on connecting — the port is wrong or your ISP is blocking it. Check the port on your remote's detail page and try again. Authentication failure — retype the user and password; they are the PPP credentials from the dashboard, not your MikRouter login. It connects then drops repeatedly — confirm Protocol is tcp and Mode is ip; MikroTik does not support OVPN over UDP, and ethernet mode will not work against this server.