SSTP

SSTP Client Setup

SSTP (Secure Socket Tunneling Protocol) uses SSL/TLS encryption over port 443. It works well in networks that block other VPN protocols.

Before You Start

You need a MikRouter remote account with an active subscription.
Open Winbox and connect to your MikroTik router via MAC or IP address.
Have the remote's Connect To, PPP Username and PPP Password ready — all three are on its page under your remotes in the dashboard.

The quickest way: paste one command

Open your remote in Remotes, press Copy on its Quick Setup section, then paste it into New Terminal in Winbox and press Enter. That is the whole setup.

MikroTik Terminal

:do {
  /interface sstp-client remove [find name="mikrouter-sstp"]
  /interface sstp-client add name=mikrouter-sstp connect-to=test.mikrouter.com port=443 user=user-sstp password=pass-sstp disabled=no
  :if ([:len [/interface sstp-client find name="mikrouter-sstp"]] > 0) do={
    :put "MikRouter: SSTP client mikrouter-sstp added successfully."
  } else={
    :put "MikRouter: ERROR - SSTP client mikrouter-sstp was not added."
  }
} on-error={
  :put "MikRouter: ERROR - could not add the SSTP client mikrouter-sstp. Check that this RouterOS supports SSTP and try again."
}

This script is only a sample — copy the real one from your Quick Setup section.

The terminal confirms it:

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

Terminal□✕

  MMM      MMM       KKK                            TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                            TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO        TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO       TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO       TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO        TTT     III  KKK  KKK

  MikroTik RouterOS 7.23.3 (c) 1999-2026       https://www.mikrotik.com/

Press F1 for help

[admin@hEX] >
MikRouter: SSTP client mikrouter-sstp added successfully.

[admin@hEX] >

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

Prefer to set it up by hand? The steps below do the same thing in Winbox — two tabs and Apply. The values in the pictures are examples; use the Connect To, User and Password from your own remote's page.

Open PPP and press New

In Winbox, click PPP in the left menu. On the Interface tab press New and choose SSTP Client.

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

PPP▾InterfacePPPoE ServersOVPN ServersSecretsProfilesActive ConnectionsL2TP EthernetL2TP Secrets⇗✕

+New▶ Enable✗ Disable✕ Remove💬 Comment⚲ Find▼ Filter

Name ▴TypeActual MTU

PPP ServerPPP ClientPPTP Server BindingPPTP ClientSSTP Server BindingSSTP ClientL2TP Server BindingL2TP ClientOVPN Server BindingOVPN ClientPPPoE Server BindingPPPoE Client

0▶ Live

Actions

PPP Scanner

Import .ovpn

PPPoE Scan

Configuration

PPTP Server

SSTP Server

L2TP Server

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

Name it on the General tab

The new SSTP client window opens on the General tab. Give it any Name you like — it is only a label for this tunnel. Leave Enabled ticked and Max MTU at 1500; Type, Actual MTU and VRF are filled in for you.

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

Interface › New…□✕

GeneralDial OutStatusTraffic

Enabled✓

Comment

Namemikrouter-sstp

TypeSSTP Client

Actual MTU

VRFmain⋮▾

Max MTU1500

MRRU+

Copy

Actions

Torch

Reset Traffic Counters

Status: CancelApplyOK

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

Field	Value	Note
Name	`mikrouter-sstp`	Any name you prefer

Fill in the Dial Out tab

Switch to Dial Out. Four fields are yours — Connect To, Port, User and Password. Every other field is a default and is already correct; if your Winbox shows something different, set it to match the picture below.

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

Interface › New…□✕

GeneralDial OutStatusTraffic

Connect Totest.mikrouter.com+VRF

Port443

Proxy+

Proxy Port443

Certificatenone⋮▾

TLS Versionany▾

Verify Server Certificate

Verify Server Address From Certificate

Add SNI

PFSno▾

Ciphers AES256-SHA AES256-GCM-SHA384

Useruser-sstp

Passwordpass-sstp−

Profiledefault-encryption⋮▾

Keepalive Timeout60−

Dial On Demand

Add Default Route

Default Route Distance1

Allow✓ mschap2✓ mschap1✓ chap✓ pap

Copy

Actions

Torch

Reset Traffic Counters

Status: CancelApplyOK

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

Field	Value	Note
Connect To	`test.mikrouter.com`	Server address from your remote details
Port	`443`	Always 443 — see the note below
User	`user-sstp`	Your PPP username
Password	`pass-sstp`	Your PPP password

Port is 443, not 7744

The old MikRouter servers used port 7744 for SSTP. If you set one up before, or you are copying an older note, change it: SSTP now runs on 443, and 7744 will simply never connect.

Press Apply and watch it connect

Click Apply. Within a few seconds the window answers for itself: the title takes the name you gave the interface, a green RUNNING badge appears in the bottom-left corner, the footer reads Status: connected, and Apply greys out because there is nothing left unsaved. Then click OK to close the window.

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

Interface › mikrouter-sstp□✕

GeneralDial OutStatusTraffic

Connect Totest.mikrouter.com+VRF

Port443

Proxy+

Proxy Port443

Certificatenone⋮▾

TLS Versionany▾

Verify Server Certificate

Verify Server Address From Certificate

Add SNI

PFSno▾

Ciphers AES256-SHA AES256-GCM-SHA384

Useruser-sstp

Passwordpass-sstp−

Profiledefault-encryption⋮▾

Keepalive Timeout60−

Dial On Demand

Add Default Route

Default Route Distance1

Allow✓ mschap2✓ mschap1✓ chap✓ pap

Copy

✕ Remove

Actions

Torch

Reset Traffic Counters

RUNNINGStatus: connectedCancelApplyOK

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

SSTP takes a few seconds longer than the other protocols because it negotiates an SSL handshake first.

Verify it in the interface list

Back in PPP›Interface the client is now listed with an R (Running) flag in the first column and a status of connected.

admin@192.168.88.1 (hEX) hEX WinBox

Workspace:<own> ▾▣ 1⚲↶↷Safe Mode⚙

PPP▾InterfacePPPoE ServersOVPN ServersSecretsProfilesActive ConnectionsL2TP EthernetL2TP Secrets⇗✕

+New▶ Enable✗ Disable✕ Remove💬 Comment⚲ Find▼ Filter

Name ▴TypeActual MTUL2 MTUStatus

Rmikrouter-sstpSSTP Client1500connected

1 item (1 selected)▶ Live

Actions

PPP Scanner

Import .ovpn

PPPoE Scan

Configuration

PPTP Server

SSTP Server

L2TP Server

hEX 192.168.88.1 / mmips / hEX / 7.23.3 (stable)0 %196.9 MiB / 59.1 MiB / 256.0 MiB01:16:00

You can also confirm the address the server handed your router under IP›Addresses, on the interface you just named.

Confirm it in your dashboard

Open the remote in Remotes. Within a few seconds the badge turns Online and a Live Connection section appears with the caller IP your router dialled in from — it only appears while the tunnel is up, so it is the confirmation that counts.

https://mikrouter.com/user/remotes/665…

MikroTik hEX

Online

4m22s

Remote is available

Expires on one week from today.

Live Connection

Caller IP

203.0.113.45

Location

🇵🇭 Manila, Philippines

ISP

Example Telecom

Organization

Example Telecom Inc.

VPN Credentials

Username

user-sstp

Password

•••••

Connect To

test.mikrouter.com

Assigned Port

12345

Password shared or exposed? Issue a new one for free. You will need to update the VPN client on your MikroTik afterwards.

Rotate Password

Remote URL

test.mikrouter.com:12345

Use this address to connect via Winbox, SSH, HTTP, or API.

Need a fresh port? Rotate to a new one for 2 credits. The current port stops working and is retired permanently.

Rotate Port

If it will not connect

Stuck on connecting — check Port is 443, not 7744. Authentication failure — retype the user and password; they are the PPP credentials from the dashboard, not your MikRouter login. It connects then drops — confirm Profile is default-encryption and all four Allow methods are ticked.