Deep coredeployed deep

VPN & Tunnels

Nikita Tarikin deploys MikroTik RouterOS VPN and tunnelling in production across WireGuard, SSTP (Secure Socket Tunneling Protocol), EoIP (Ethernet over IP), IPsec, and PPP (Point-to-Point Protocol) — a tunnel stack that spans five MikroTik certifications; only the MPLS-backed VPLS (Virtual Private LAN Service) tunnel remains concept-known rather than deployed — the one tunnel still on the study side of the line.

Deployed across the whole tunnel stack; the one tunnel still on the study side of the line — VPLS over MPLS — is marked here, and it hands off to the carrier frontier where it belongs.

5.0
Knowledge K̄: 4.7
Deployment Ē: 50
leaves mapped: 7
know ≠ run splits

Verified by MTCNA 100%MTCSE 98%MTCRE 94%MTCUME 94%MTCIPv6E 92%

The map

Every VPN and tunnelling leaf in the official MikroTik curriculum, placed by what is known against what is run in production. Here almost every mark gathers in the upper-right mastery corner — studied and deployed to the same depth — because the tunnel stack is operated end to end. A short comb of drop-lines falls below it: the thin sliver of leaves studied ahead of where they run.

Read left-to-right as knowledge, bottom-to-top as deployment. The dense mass in the upper-right corner is the deployed tunnel stack — WireGuard, IPsec, SSTP, EoIP, and the PPP family with its profile and secret model — run in production. The few drop-lines below it are the studied-ahead sliver: the legacy dial-up tunnels kept current but superseded, the link-bonding tunnels held in theory, and the one leaf that drops furthest — multipoint VPLS — which has never been deployed at all.

The topography

The full leaf-level ledger, grouped by topic — the PPP profile and secret model, the point-to-point tunnels, SSTP, EoIP, IPsec, and WireGuard. Each row carries its own two verdicts — what is known and what is deployed — and the field note that earned them, quoted verbatim from the assessment.

Leaf	Knowledge	Deployment	Field note
PPP Profiles & Secrets		K̄ 5.0 · Ē 5.0 · 11 leaves
Profiles	5Teach	5Teach	Framed-IP-Address pins the per-session client IP and overrides the profile's pool-based remote-address; profile local-address still sets the gateway side; B2B static-IP delivery over SSTP
Secrets	5Teach	5Teach	PPP only-one / UM shared-users=1 / RADIUS Simultaneous-Use enforces one active session; single-NAS is local, but across multiple NASes only the server sees all sessions (count via accounting) and a stale un-stopped session falsely blocks re-login
Address Pools	5Teach	5Teach	Exhausted pool => clients authenticate but get no IP and drop (PPP pools don't chain). follow-up clean; the 'auto-extends from DHCP' was a MIS-CLICK (owner-confirmed).
In/Out Filters	5Teach	5Teach	incoming/outgoing-filter = per-user firewall chain for the client's traffic.
Address Lists (PPP)	5Teach	5Teach	Profile address-list adds each client's IP to a named list dynamically.
TCP-MSS Clamping	5Teach	5Teach	change-tcp-mss=yes clamps MSS to the link MTU (avoids blackhole).
Encryption (PPP)	5Teach	5Teach	Over L2TP/IPsec, PPP MPPE is redundant + weak (IPsec already encrypts).
Session Timeout	5Teach	5Teach	session-timeout caps total time; idle-timeout disconnects on inactivity.
Rate-Limiting (PPP)	5Teach	5Teach	RADIUS Mikrotik-Rate-Limit wins -> RouterOS creates a DYNAMIC simple queue; PPP profile rate-limit = fallback when RADIUS sends none; a manual queue for the same target double-queues/conflicts. CORRECT by reasoning but 'never formalized the precedence' -- the one fine corner, reasoned-not-lived (NOT an edge)
Routes via PPP	5Teach	5Teach	'routes' field auto-adds the client's subnet routes on connect, removed on disconnect.
Limit Bytes	5Teach	5Teach	limit-bytes-in/out = total data quota per session, disconnect on reach.
PPTP		K̄ 5.0 · Ē 4.7 · 6 leaves · 2 splits
PPTP Theory & Comparison	5Teach	5Teach	VPN positioning: SSTP (TLS/443) for restrictive-firewall traversal vs PPTP/L2TP.
PPTP Clientstudied ahead	5Teach	4Fluent	MS-CHAPv2+MPPE broken and the precise crypto reason — MS-CHAPv2 reduces to a single DES op, brute-forceable in 2^56 = knowledge Teach (security lens). Legacy, deployment superseded -> experience Fluent.
PPTP Serverstudied ahead	5Teach	4Fluent	Portless-GRE NAT-demux-needs-helper limitation nailed = knowledge Teach. Legacy protocol, knowledge current, deployment largely superseded by SSTP/L2TP -> experience Fluent-historical.
Dial-on-Demand	5Teach	5Teach	Won't redial if nothing routes via the tunnel to trigger a packet.
Static Interfaces	5Teach	5Teach	Static bound interface = persistent firewall/queue/route reference per client.
Default Routes via PPTP	5Teach	5Teach	Backup tunnel = add-default-route=yes + higher default-route-distance.
L2TP		K̄ 5.0 · Ē 4.4 · 9 leaves · 2 splits
L2TP Theory & Comparison	5Teach	5Teach	L2TP alone is unencrypted (UDP 1701); IPsec provides confidentiality.
L2TP Client	5Teach	5Teach	use-ipsec=yes auto-generates dynamic IPsec peer+policy; the masquerade-before-IPsec-policy NAT trap confirmed his self-declared RouterOS IPsec expertise — a real production scar.
L2TP Server	5Teach	5Teach	L2TP/IPsec-behind-NAT Windows fix (AssumeUDPEncapsulation registry) nailed — road-warrior deployment scar. Deploys L2TP/IPsec.
Dial-on-Demand	5Teach	5Teach	Tunnel up only when traffic needs it, idle-disconnect capable.
Static Interfaces	5Teach	5Teach	Static bound interface = stable firewall/route/queue reference per client.
Default Routes via L2TP	5Teach	5Teach	Split tunnel = add-default-route=no + specific route to office subnet.
L2TP + IPsec	5Teach	5Teach	L2TP/IPsec = transport-mode ESP encrypting the L2TP UDP-1701 traffic.
L2TP with VPLSstudied ahead	5Teach	2Aware	Knows VPLS = multipoint-L2 (virtual switch) usually over MPLS. EXPERIENCE flagged: VPLS/MPLS is his one v1 deep blind spot — concept-known, NEVER deployed.
L2TP with BCPstudied ahead	5Teach	3Confident	BCP bridges Ethernet L2 across the L2TP tunnel. Experience inferred (EoIP-style bridging is his, BCP-over-L2TP less so)
SSTP		K̄ 5.0 · Ē 5.0 · 3 leaves
SSTP Client	5Teach	5Teach	http-proxy traversal (SSTP through HTTP CONNECT proxy) nailed. SSTP delivery core, both ends Teach.
SSTP Server	5Teach	5Teach	TCP-over-TCP meltdown on lossy links — SSTP deployment reality lived. vISP B2B SSTP core.
SSTP with Certificates	5Teach	5Teach	verify-client-certificate=yes -> mutual TLS, client must present a CA-signed cert.
EoIP		K̄ 5.0 · Ē 5.0 · 1 leaf
EoIP Tunnel Setup	5Teach	5Teach	tunnel-id keying (duplicates leak frames across tunnels) nailed; confirms the topic-level K4/X4 at leaf. Runs EoIP bridges.
IPIP		K̄ 5.0 · Ē 3.0 · 1 leaf · 1 split
IPIP Tunnel Setupstudied ahead	5Teach	3Confident	IPIP carries only unicast IP (no multicast/non-IP, so no native OSPF) nailed = knowledge Teach. Known cold but not his primary tunnel (SSTP/EoIP/PPPoE are) — experience INFERRED Confident, FLAGGED.
PPPoE		K̄ 4.8 · Ē 4.8 · 4 leaves
PPPoE Client	5Teach	5Teach	PPPoE MTU 1492 -> TCP MSS clamping (change-tcp-mss/mangle) nailed. PPPoE is daily reality.
PPPoE Server	4Fluent	4Fluent	service-name pins the BNG among multiple concentrators
PPPoE Encryption	5Teach	5Teach	PPPoE data is cleartext; layer IPsec/SSTP for confidentiality.
PPPoE Interface ECMP	5Teach	5Teach	Dual-PPPoE ECMP = per-connection balancing; one flow per link; needs check-gateway.
MLPPP Multilink		K̄ 5.0 · Ē 3.0 · 1 leaf · 1 split
MLPPP Multilinkstudied ahead	5Teach	3Confident	MLPPP bonds several PPP links into one logical pipe; both ends must support. Experience inferred (link-bonding uncommon in his stack)
Basic Tunnel Configuration		K̄ 5.0 · Ē 5.0 · 1 leaf
Basic Tunnel Configuration	5Teach	5Teach	Tunnel = encapsulation of private traffic over public (+ optional encryption).
IPsec		K̄ 5.0 · Ē 4.8 · 12 leaves · 1 split
IPsec Theory	5Teach	5Teach	no edge found; protocol-level AH-vs-NAT correct
Peer Configuration	5Teach	5Teach	Road-warrior peer = 0.0.0.0/0 passive=yes.
Authentication Methods	5Teach	5Teach	Shared-PSK blast radius vs per-client cert/EAP revocation.
Exchange Modes	5Teach	5Teach	MOBIKE keeps the SA across client IP changes
Encryption & Hash Algorithms	5Teach	5Teach	AES-GCM AEAD => no separate SHA/HMAC. Re-confirms AEAD.
NAT-Traversal	5Teach	5Teach	NAT-T wraps ESP in UDP 4500 (raw ESP portless).
Dead Peer Detection (DPD)	5Teach	5Teach	DPD detects dead peer + clears stale SAs to re-establish.
Policies	5Teach	5Teach	action=none higher-priority policy exempts traffic from encryption.
Proposals	5Teach	5Teach	'no proposal chosen' = no common phase-2 transform.
Dynamic Policy Generation	5Teach	5Teach	generate-policy=port-strict locks to peer's exact proposal.
Perfect Forward Secrecy (PFS)	5Teach	5Teach	PFS = fresh DH per rekey, past sessions safe from future key compromise.
AH / ESP / AH+ESPstudied ahead	5Teach	3Confident	Cross-cert IPsec primitive (MTCSE Teach). WireGuard preferred in deployment.
WireGuard		K̄ 5.0 · Ē 5.0 · 1 leaf
WireGuard	5Teach	5Teach	persistent-keepalive holds the NAT pinhole; silent-by-design -- production tool

The edges

The sliver of daylight here is narrow, and it runs in one direction. The legacy dial-up tunnels are held current — down to the precise reason their old authentication is broken — but production has moved past them to stronger transports, so deployment sits a notch below knowledge. Beside them are the link-bonding and IP-in-IP tunnels, reasoned cold but uncommon in this stack, and a cross-certified security primitive where WireGuard is the deployed default. The one leaf that drops furthest is multipoint VPLS — the concept is held, a virtual Ethernet switch carried over MPLS, but it has never been deployed, and it belongs to the carrier frontier rather than to this page. Each gap is quoted below exactly as the assessment recorded it.

Knowledge ahead of deployment

Known deeper than it currently runs — named, not rounded over.

L2TP with VPLSknow 5 Teach→run 2 Aware
Knows VPLS = multipoint-L2 (virtual switch) usually over MPLS. EXPERIENCE flagged: VPLS/MPLS is his one v1 deep blind spot — concept-known, NEVER deployed.
L2TP with BCPknow 5 Teach→run 3 Confident
BCP bridges Ethernet L2 across the L2TP tunnel. Experience inferred (EoIP-style bridging is his, BCP-over-L2TP less so)
IPIP Tunnel Setupknow 5 Teach→run 3 Confident
IPIP carries only unicast IP (no multicast/non-IP, so no native OSPF) nailed = knowledge Teach. Known cold but not his primary tunnel (SSTP/EoIP/PPPoE are) — experience INFERRED Confident, FLAGGED.
MLPPP Multilinkknow 5 Teach→run 3 Confident
MLPPP bonds several PPP links into one logical pipe; both ends must support. Experience inferred (link-bonding uncommon in his stack)
AH / ESP / AH+ESPknow 5 Teach→run 3 Confident
Cross-cert IPsec primitive (MTCSE Teach). WireGuard preferred in deployment.
PPTP Clientknow 5 Teach→run 4 Fluent
MS-CHAPv2+MPPE broken and the precise crypto reason — MS-CHAPv2 reduces to a single DES op, brute-forceable in 2^56 = knowledge Teach (security lens). Legacy, deployment superseded -> experience Fluent.
PPTP Serverknow 5 Teach→run 4 Fluent
Portless-GRE NAT-demux-needs-helper limitation nailed = knowledge Teach. Legacy protocol, knowledge current, deployment largely superseded by SSTP/L2TP -> experience Fluent-historical.

The warrant

Third-party verification of the depth above — the widest certification footprint on this map stands behind this tunnel stack, each exam a link in support of the work, never a substitute for it.

MTCIPv6EVerified — 92%, IPv6 Engineer
MTCNAVerified — 100%, Network Associate
MTCREVerified — 94%, Routing Engineer
MTCSEVerified — 98%, Security Engineer
MTCUMEVerified — 94%, User Management Engineer

A tunnel is terminated, secured, and — at its frontier — handed onward. Where the VPN stack connects:

The questions

What VPN and tunnel work is genuinely production-proven?

Most of it. The deployed tunnel stack here is WireGuard, IPsec (Internet Protocol Security), SSTP (Secure Socket Tunneling Protocol, over TLS), EoIP (Ethernet over IP), and the PPP family — PPP, PPPoE, L2TP/IPsec — run in production across a virtual-ISP delivery network. The one tunnel I do not deploy is the MPLS-backed VPLS pseudowire; that is the named edge below, and it belongs to the carrier frontier. Two public, verifiable mechanics from what I run: WireGuard on RouterOS 7 is /interface/wireguard — the interface auto-generates its key pair and listens on UDP 13231 by default, while each /interface/wireguard/peers entry pins a remote by its public-key and an allowed-address CIDR, with persistent-keepalive sending a small authenticated packet (the canonical 25-second interval) to hold a NAT pinhole open for a peer behind NAT. EoIP is a GRE tunnel (IP protocol 47) that carries full Ethernet frames, so its interface drops straight into an /interface bridge for transparent Layer-2 between two sites — its tunnel-id must be unique and match on both ends, because a duplicated id leaks frames between tunnels.

WireGuard, IPsec, or the legacy tunnels — which do you reach for?

The working hierarchy: WireGuard is my default for new peer-to-peer and road-warrior links, IPsec where I need standards-based interop or L2TP/IPsec for native operating-system clients, and SSTP where a restrictive firewall will only trust TLS on port 443. The legacy dial-up tunnels — PPTP especially — I keep current but no longer deploy: PPTP’s MS-CHAPv2 with MPPE is cryptographically broken (the MS-CHAPv2 handshake reduces to the strength of a single 56-bit DES operation, brute-forceable in a fixed key space), which is exactly why it sits in the studied-ahead sliver rather than the deployed column. One public IPsec mechanic I rely on: NAT traversal (nat-traversal=yes, the default) encapsulates ESP inside UDP so IPsec survives a NAT device in the path — and it works only with ESP, never AH, because AH signs the entire packet including the IP header that NAT rewrites, which invalidates the signature. The peer must be reachable on UDP 500 and UDP 4500; in a road-warrior setup the client is the initiator, so on the responder I set send-initial-contact=no.

Can you deliver a VPN through a restrictive firewall, or hand a business a static tunnel IP?

Yes — this is the virtual-ISP delivery core, run daily. SSTP is the firewall-traversal workhorse: it carries a PPP session inside a TLS channel on TCP 443, so to a middlebox it looks like ordinary HTTPS and passes through almost any firewall or proxy — and where the only way out is an HTTP proxy, the SSTP client’s http-proxy setting tunnels through a CONNECT. For trust it can go mutual: verify-client-certificate=yes on the server forces every client to present a CA-signed certificate. The one deployment scar worth naming is that SSTP is TCP-over-TCP, so on a lossy link the inner and outer retransmit timers fight and throughput collapses — I account for that before I put a customer on it. Static per-client addresses come from the PPP layer: a profile’s local-address sets the gateway side, and a per-user Framed-IP-Address (a local secret or a RADIUS attribute) pins the client’s address and overrides the profile pool — which is how a B2B site gets the same tunnel IP every session.

Can you build VPLS or MPLS-backed Layer-2 tunnels?

No — this is the one tunnel on the page I have not deployed. I hold the concept: VPLS (Virtual Private LAN Service) is a multipoint virtual Ethernet switch carried across an MPLS backbone — conceptually an EoIP-style Layer-2 bridge, but label-switched and signalled rather than GRE-encapsulated — and in my own assessment it is recorded as my one tunnelling blind spot: concept-known, never run. The public mechanics show why it is a frontier and not a quick add: on RouterOS a VPLS pseudowire is negotiated by LDP (Label Distribution Protocol) or MP-BGP, and it cannot stand on its own — a label-distribution protocol (LDP, RSVP-TE, or static bindings) must already be running on the backbone before a single VPLS label is exchanged, which means an MPLS and IGP underlay I do not operate in production. That whole label layer is the carrier frontier, and I point you there honestly: see the carrier inter-networking page, where BGP, MPLS and VPLS are owned as the edge of the map. I would lab it before I bill it.

Bring the tunnel problem.

If it is WireGuard, IPsec, SSTP, EoIP, or a PPP-based delivery tunnel on RouterOS, that is ground I run in production. If it reaches into MPLS-backed VPLS, I will tell you it sits past my deployed edge — and point you to the carrier frontier — before the work starts, not after.

Start the conversation