OLT

Access an OLT through MikroTik

Reach the web interface of an OLT sitting behind your MikroTik router — from anywhere — by pairing a remote with one NAT rule. No public IP and no CGNAT headaches.

Your OLT has no direct path from the internet. MikRouter solves this with a VPN tunnel: your MikroTik dials out to a MikRouter server, and the server forwards a public address + port down that tunnel. You add one NAT rule on the MikroTik that hands the traffic to the OLT on your LAN. The result: opening https://test.mikrouter.com:12345 in your browser lands you on the OLT's login page.

The remote reaches the MikroTik. The NAT rule is what carries it the last hop, to the OLT.

The example used throughout: a VSOL V1600D Mini

Every screen and command below is filled in for one real setup, so you can see what a finished configuration looks like. Swap these five values for your own as you go:

The device — a VSOL V1600D Mini OLT, plugged into the MikroTik's LAN. Anything with a web interface works the same way; only the address and port change.
Its address — 192.168.88.100, on the OLT's AUX (management) port. That is the port you administer it on; its other port carries the internet and is not involved here.
Its web port — 443, because this OLT serves its interface over HTTPS. That is why the NAT rule below ends in to-ports=443 and why you open it with https://. An OLT that serves plain HTTP uses 80 in both places instead.
The Service Port — 8443, a free port you pick yourself. It is the port that comes out of the tunnel on the MikroTik, and it has nothing to do with the OLT's own port.
The public address — test.mikrouter.com:12345, which MikRouter assigns when you buy the remote. Yours will differ.

Before you start, make sure you have

A MikRouter account with enough credits or a payment method.
Winbox open and connected to the MikroTik that the OLT sits behind.
The OLT's AUX / management IP address and web port — e.g. 192.168.88.100 on port 443 — the VSOL V1600D Mini serves HTTPS. Check this under IP›DHCP Server›Leases in the MikroTik, or from the OLT itself. It is the management port you want, not whichever port carries the OLT's internet.

Can I use the uplink port instead, so I can unplug AUX?

It depends on the OLT. Newer VSOL GPON platforms can be managed over the uplink (in-band management — a VLAN, tagged on the uplink port, carrying an IP address). Older VSOL EPON platforms cannot: the management IP is tied to the AUX interface, so the AUX cable has to stay connected and this guide is how you reach it.

If your OLT does support it, put management on its own tagged VLAN — the uplink also carries subscriber traffic, and an untagged management address there is reachable by your customers.

Create a remote for the OLT

In the dashboard go to Remotes, click + New Remote, and fill in the purchase form. Pick the server, set a Duration, and choose a VPN Service — the key field for an OLT is Service Port:

https://mikrouter.com/user/remotes/new

1. Remote Server

test

🇵🇭 PH

L2TP, SSTP, OVPN, PPTP

2. Service Configuration

Duration1

UnitWeek(s)

VPN ServiceOVPN

Service PortOther ▾

Port8443

ProtocolTCP

3. Details

Remote NameVSOL V1600D Mini

Purchase Summary

Server: test (PH)
Duration: 1 Week(s)
VPN Service: OVPN
Service Port: 8443 (TCP)
Total: PHP 10

Purchase — PHP 10

Field	Value	Note
Remote Server	`test (PH)`	The server your MikroTik will dial
VPN Service	`OVPN`	Any of the four works
Service Port	`Other`	Not Winbox/HTTPS — those point at the router
Port	`8443`	Any free port on the tunnel
Protocol	`TCP`	OLT web UI is TCP
Remote Name	`VSOL V1600D Mini`	Anything you like

Why “Other” for the Service Port?

The Service Port is the port that arrives on your MikroTik through the tunnel. The built-in choices (Winbox 8291, HTTPS 443, HTTP 80, SSH 22) point at the router itself. Because the OLT is a separate device, pick Other with a free port like 8443— you'll aim it at the OLT in step 5.

Pay and confirm

Choose a Payment Method, click Purchase, then Confirm. With Credits the remote activates instantly; with an e-wallet it activates once payment clears.

Copy your connection details

Open the new remote under Remotes. The detail page gives you everything below — use the copy buttons rather than retyping.

https://mikrouter.com/user/remotes/665…

VSOL V1600D Mini

Offline

VPN Credentials

Username

user-ovpn

Password

pass-ovpn

Connect To

test.mikrouter.com

Assigned Port

12345

Remote URL

test.mikrouter.com:12345

Use this address to connect via Winbox, SSH, HTTP, or API.

Service Port

8443 (TCP)

Arrives on your MikroTik through the tunnel — the port your NAT rule matches.

It reads Offline, which is correct — nothing has dialled in yet. That changes in step 4.

Field	Value	Note
Connect To	`test.mikrouter.com`	VPN server address
Username	`user-ovpn`	PPP username
Password	`pass-ovpn`	PPP password
Remote URL	`test.mikrouter.com:12345`	Server : your assigned port
Service Port	`8443`	The port you chose in step 1

Build the VPN tunnel on the MikroTik

This part is the same for every remote, whatever sits behind the router, so it has its own guide per protocol rather than a shortened copy here. Open the one for the VPN Serviceyou chose in step 1 and follow it to the end, then come back:

OVPN Client Setup →mikrouter.com/guides/ovpn-client-setup SSTP Client Setup →mikrouter.com/guides/sstp-client-setup L2TP Client Setup →mikrouter.com/guides/l2tp-client-setup PPTP Client Setup →mikrouter.com/guides/pptp-client-setup

You are done with this step when the client shows an R (running) flag in PPP and the remote's badge has turned Online:

https://mikrouter.com/user/remotes

Accounts

Remote Accounts

Manage your remote access accounts. Drag to rearrange.

▦☰+ New Remote

Search remotes…

NameRemote accessVPNExpiresStatus

⠿🇵🇭MikroTik RB5009test.mikrouter.com:54321sstp7d 0hOffline

⠿🇵🇭VSOL V1600D Minitest.mikrouter.com:12345ovpn7d 0hOnline

Note down the nameyou gave the VPN client — step 5 uses it to keep the NAT rule limited to tunnel traffic. This guide's example is mikrouter-ovpn, the name the Quick Setup command uses.

Point the port at the OLT

The tunnel now reaches your MikroTik on port 8443. One NAT rule forwards it to the OLT — again, two ways to add it.

Open IP›Firewall, go to the NAT tab and click New:

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

Firewall▾Filter RulesNATMangleRawService PortsConnectionsAddress ListsLayer7 Protocols⇗✕

+New▶ Enable✗ Disable✕ Remove💬 Comment⚲ Find▼ Filter

# ▴⚑ActionChainSrc. AddressDst. AddressProtocol

0↗masqueradesrcnat

1 item▶ Live

Actions

Reset Counters

Reset All Counters

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

On the General tab set the chain, then the two things the rule has to match — the protocol and the port the tunnel delivers on. In. Interface is optional; the mockup fills it in because it is worth setting:

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

NAT Rule › New…□✕

GeneralAdvancedExtraActionStatistics

Enabled✓

Comment

Chaindstnat▾

Src. Address+

Dst. Address+

Src. Address List+

Dst. Address List+

Protocol6 (tcp)▾−

Src. Port+

Dst. Port8443−

Any. Port+

In. Interfacemikrouter-ovpn⋮▾−

Out. Interface+

In. Interface List+

Out. Interface List+

Packet Mark+

Connection Mark+

Routing Mark+

Connection Type+

Copy

Actions

Reset Counters

Reset All Counters

Status: CancelApplyOK

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

In. Interface is optional — leaving it empty still works

The rule forwards either way, because it matches the port wherever the traffic came from. That is also the reason to set it: with the field empty, anything that reaches this router on port 8443 is sent to the OLT, including a machine on your own LAN. Naming the VPN interface narrows the rule to traffic that actually came down your tunnel. Set it unless you have a reason not to.

Then switch to the Action tab and say where it goes. To Addresses and To Ports only appear once Action is dst-nat:

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

NAT Rule › New…□✕

GeneralAdvancedExtraActionStatistics

Actiondst-nat▾

Log

Log Prefix+

To Addresses192.168.88.100−

To Ports443−

Copy

Actions

Reset Counters

Reset All Counters

Status: CancelApplyOK

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

Click Apply, then OK. The rule appears in the NAT list.

Open New Terminal and paste. The four highlighted values are the ones to change; everything else is the same on every router:

MikroTik Terminal

/ip firewall nat add chain=dstnat protocol=tcp \
    in-interface=mikrouter-ovpn dst-port=8443 \
    action=dst-nat to-addresses=192.168.88.100 to-ports=443 \
    comment="mikrouter OLT"

mikrouter-ovpn is your VPN client's name from step 4, 8443 the Service Port you chose in step 1, and 192.168.88.100 / 443 your OLT's own address and web port. The chain, protocol and action are the same for everyone.

in-interface is optional — drop that one setting and the rule still forwards, it just stops being limited to traffic that arrived through the tunnel. Everything else is required.

Field	Value	Note
chain	`dstnat`	General tab — catches traffic addressed to this router, before it is routed
protocol	`tcp (6)`	General tab — a web interface is TCP
dst-port	`8443`	General tab — the Service Port you chose in step 1
in-interface	`mikrouter-ovpn`	General tab, optional — the VPN client from step 4; limits the rule to tunnel traffic
action	`dst-nat`	Action tab — rewrite the destination, i.e. send it on to another device
to-addresses	`192.168.88.100`	Action tab — your OLT's AUX / management IP
to-ports	`443`	Action tab — the V1600D Mini serves HTTPS; use 80 for a plain-HTTP OLT
comment	`mikrouter OLT`	Optional — a label so you can find this rule again later

If the page still won't load

The OLT's default gateway must be this MikroTik so its replies find their way back. If it points elsewhere, add a source-NAT so traffic appears to come from the router:

MikroTik Terminal

/ip firewall nat add chain=srcnat dst-address=192.168.88.100 action=masquerade comment="mikrouter OLT return"

Only the highlighted address changes — the same OLT address as the rule above. The chain, action and comment stay as they are.

Open the OLT from anywhere

That's it. From any device, open a browser and go to your Remote URL:

Field	Value	Note
Address	`https://test.mikrouter.com:12345`	https, because the OLT serves HTTPS on 443

Not Securehttps://test.mikrouter.com:12345

OLT Management

EPON / GPON Controller

admin

••••••

“Not Secure” in the address bar is expected here

The browser strikes out https and flags the page because the OLT presents its own self-signed certificate, which cannot match the MikRouter hostname you typed. Nothing is wrong with the tunnel — the traffic still crossed it encrypted. Continue past the warning and sign in.

You'll see the OLT's own login page. Sign in with the OLT's username and password — not your MikroTik or MikRouter login. Need a second device too? Buy another remote, pick a different Service Port (say 8444), and add another NAT rule pointing at it.

Troubleshooting

Remote shows “Offline” in the dashboard

The VPN client isn't connected — recheck step 4 (username, password, server address).
Make sure your ISP isn't blocking the protocol; try SSTP (port 443) if OVPN won't connect.
Confirm the subscription hasn't expired.

Online, but the browser page times out

Check the NAT rule from step 5 — dst-port must equal your Service Port (8443), and to-addresses/to-ports must match the OLT.
From New Terminal run /ping 192.168.88.100 to confirm the MikroTik can reach the OLT.
If ping works but the page doesn't load, add the srcnat masquerade rule from step 5.

Page loads but looks broken / won't log in

Some OLTs serve plain HTTP instead — try http:// and set the NAT to-ports=80.
Your browser warns that the connection is not private: expected. The OLT presents its own self-signed certificate, which cannot match the MikRouter hostname you typed. Continue past the warning.
Use the OLT's own admin credentials, not your router or MikRouter login.

Quick recap

Buy a remote on the test (PH) server — set Service Port = Other (8443, TCP).
Copy the credentials & Remote URL from the detail page.
Create the VPN client on the MikroTik (paste the Quick Setup command).
Add one NAT rule forwarding port 8443 → the OLT's AUX address 192.168.88.100:443.
Browse to https://test.mikrouter.com:12345 — you're on the OLT.

Another way to do this

No MikroTik? Use an agent instead

Everything above needs a MikroTik, a remote per device and one NAT rule each. A MikRouter agent reaches the same OLT from the inside instead: a cheap board — or a Windows PC or Mac already on that network — dials out on its own, and you add a mapping in the dashboard for each service you want to open. No firewall rule to write, no port forwarding, and one agent covers every device the network can route to — the OLT, a router, a DVR, a camera, a NAS.

Agent Overview →what an agent is, and the three setup steps Use a PC you already have →Windows or Mac on that network — nothing to buy Buy a cheap board →an ESP32 that does nothing else

Which is right for you: if your MikroTik is already dialled in and you only want this one OLT, the guide above is the shorter path. An agent wins when there is no MikroTik, when you would rather not touch firewall rules, or when you want several devices at the site. ⚠️ An ESP32 agent holds only a handful of connections at once, so a heavy admin page can load slowly through one — a Linux, Windows or Mac agent has far more headroom.