MikroTik VPN Remote — Overview
Your MikroTik dials out to a MikRouter server and stays connected, so you get one public address you can reach it on from anywhere — no public IP and no port forwarding, even behind CGNAT. Start here to see how it fits together.
What is a remote?
A remote is a VPN account on a MikRouter server. Your MikroTik dials out to that server and holds the line open, and in return the server gives you a public address and port that reaches your router — from any network, at any time.
Because your router does the dialling, nothing has to reach in. That is what makes it work behind CGNAT, a dynamic IP, or an ISP router you do not control — the cases where port forwarding is not an option at all.
This is the MikroTik product. If you have no MikroTik, or you want to reach several devices at a site through one connection, see the Agent Tunnel overview instead.
What you need to start
Two things — a MikroTik with a working internet connection, and a remote in your dashboard.
- 1
A MikroTik you can reach right now
Any RouterOS device with internet access. You set it up once over your own network — Winbox by MAC or IP — and after that you reach it from anywhere. Its internet does not need a public address.
- 2
A remote in your dashboard
Created under your remotes. It carries the credentials your router dials with, and the public address you will use afterwards.
How it works
1. Buy a remote and open it
Pick a server and a protocol, and it is active immediately. Every remote you own is listed with its address, its protocol and how long it has left.
Accounts
Remote Accounts
Manage your remote access accounts. Drag to rearrange.
2. Build the tunnel on your MikroTik
Copy the ready-made command from the remote's Quick Setup section and paste it into your router's terminal — or click through the same settings by hand with the guide for your protocol. Once it dials in, the remote turns Online.
MikroTik hEX
4m22s
Remote is available
Expires on one week from today.
Live Connection
Caller IP
203.0.113.45
Location
🇵🇭 Manila, Philippines
ISP
Example Telecom
Organization
Example Telecom Inc.
VPN Credentials
Username
user-ovpn
Password
•••••
Connect To
test.mikrouter.com
Assigned Port
12345
Password shared or exposed? Issue a new one for free. You will need to update the VPN client on your MikroTik afterwards.
Rotate PasswordRemote URL
test.mikrouter.com:12345
Use this address to connect via Winbox, SSH, HTTP, or API.
Need a fresh port? Rotate to a new one for 2 credits. The current port stops working and is retired permanently.
Rotate Port3. Connect from anywhere
Use the Remote URL in Winbox, a browser, SSH or the RouterOS API. The port forwarding on the server side is handled for you.
Remote URL
test.mikrouter.com:12345
Use this address to connect via Winbox, SSH, HTTP, or API.
Need a fresh port? Rotate to a new one for 2 credits. The current port stops working and is retired permanently.
Rotate PortWhich protocol should I pick?
All four carry the same traffic and give you the same address. They differ in how likely your ISP is to let them through — which is the only thing most people need to decide on.
SSL/TLS on port 443, so it looks like ordinary web traffic and is the hardest for an ISP to block. Start here if another protocol will not connect.
OpenVPN over TCP. Widely allowed and well understood. MikroTik supports TCP only, never UDP.
The usual choice for MikroTik remote access and a reliable encrypted tunnel — but some mobile and home ISPs block it.
The simplest and fastest to set up, and the weakest. It needs GRE, which many carriers drop outright. Use it only when nothing else connects.
You are not locked in
Reaching other devices on the LAN
A remote points at the MikroTik itself. To reach something behind it — an OLT, a second router, a camera — buy the remote with a free service port and add one NAT rule that forwards that port to the device.
The step-by-step guides
1.OVPN Client Setup → — one paste, or two tabs in Winbox.
2.SSTP Client Setup → — the one to use when others are blocked.
3.L2TP Client Setup → — the usual choice, with an extra Advanced tab.
4.PPTP Client Setup → — quickest to set up, least secure.
5.Connecting via Winbox → — once the tunnel is up, this is how you get in.