VPN site-to-site Technical Details

🔒 VPN Details for MikroTik SD-WAN #

The MikroTik SD-WAN platform provides centralized VPN orchestration, allowing you to securely connect headquarters, branch offices, cloud environments, and remote users without complex manual configurations.

🌐 Supported VPN Protocols #

• WireGuard – Fully supported for both Site-to-Site and Client-to-Site VPN deployments.
• SSTP – SSL/TLS VPN ideal for restrictive networks where HTTPS traffic is allowed.
• L2TP + IPsec – Secure and widely compatible VPN solution.
• OpenVPN – Flexible VPN protocol for secure encrypted communications.

🚀 WireGuard Features #

• Automatic WireGuard key generation.
• Centralized peer management.
• Automatic configuration generation.
• QR Code provisioning for Android and iOS devices.
• Download ready-to-use client configuration files.
• Site-to-Site VPN between Hub and Branches.
• Client-to-Site VPN for remote users.
• Dynamic route advertisement through OSPF.

🔐 Security & Authentication #

• VPN credentials and secrets are automatically generated.
• WireGuard keys and VPN secrets are regenerated whenever the Hub is replaced.
• Clients reconnect automatically after Hub replacement or VPN updates.
• Encrypted communication between headquarters, branches, and remote users.

⚙️ Activation Requirements #

• Assign a Hub with a public IP address or a valid Dynamic DNS (DDNS) hostname.
• Configure local subnets on both Hub and Client devices.
• Each connected site must use a unique subnet to prevent routing conflicts.

📡 Network Configuration Notes #

• WireGuard supports both Branch-to-Hub and Remote User VPN deployments.
• OSPF integration enables automatic route propagation between connected sites.
• VPN configuration changes may take up to 5 minutes to fully propagate across the SD-WAN environment.
• All VPN services are managed from a centralized web interface.