Skip to main content
Dualbuy VPN
Get started

SSTP, L2TP/IPsec, OpenVPN or WireGuard on MikroTik: which should you use?

· · 4 min read

A practical comparison of the four VPN protocols RouterOS supports: ports, firewall friendliness, RouterOS version requirements, and when to pick each one.

RouterOS can connect to a VPN server using several protocols. They all protect your traffic, but they differ in which networks they get through, which RouterOS versions support them, and how much work they ask of the router's CPU. Here is how to choose.

SSTP

SSTP wraps the tunnel in TLS over TCP, usually on port 443, so to a firewall it looks like ordinary HTTPS. That makes it the best choice on restrictive networks such as offices, hotels and mobile carriers that block or throttle UDP. The trade-off is some overhead, because TCP ends up carrying traffic that may itself be TCP. It is available in every RouterOS version.

L2TP/IPsec

L2TP with IPsec uses UDP ports 500 and 4500. It is built into every RouterOS version and into Windows, macOS, iOS and Android, so it needs no extra software. It can be fussy behind some NAT devices, and a network that blocks UDP will block it. On models with IPsec hardware acceleration it is also light on the CPU.

OpenVPN

OpenVPN is widely known and TLS-based. On RouterOS 6 it only runs over TCP; RouterOS 7 added UDP. RouterOS supports fewer OpenVPN options than the standard OpenVPN software, so it suits you best if you already use OpenVPN elsewhere and want one familiar setup.

WireGuard

WireGuard is modern, small and fast, and runs over UDP. It needs RouterOS 7 or newer. It is the right pick for speed and low overhead when UDP is allowed. One limit on Dualbuy: WireGuard gives your device a VPN connection, but remote admin access through ports (Winbox, Webfig, SSH, API) is not available over it.

Quick recommendations

  • The network blocks UDP, or you don't know what it blocks: SSTP.
  • An older router on RouterOS 6, or you want something built in everywhere: L2TP/IPsec or SSTP.
  • RouterOS 7, UDP allowed, and speed matters most: WireGuard.
  • You already run OpenVPN and want the same setup everywhere: OpenVPN.
  • You need Winbox, Webfig, SSH or the API from outside: SSTP, L2TP/IPsec or OpenVPN.

Check your RouterOS version

Run this in the router's terminal and read the version line:

/system resource print

Whichever you choose, throughput depends on the router's CPU as much as on the protocol, because encryption is done in software on most models. If remote access is your goal, read how to reach a MikroTik without a public IP. One subscription includes all four protocols: see the plans.

Keep reading