Great comparision! Thak you! In my opinion you missed to mention one important thing about L2TP/IPsec. In Mikrotik environment is old issue that clients reaching the server via NAT do work but only one at a time per each public address.
I Just deployed a wireguard mesh vpn network between 7 sites and many road warriors clients. Performance speed touches 98% of line bandwidth and latency is awesome .
My man, my pro it teacher , I hail you and greetings from Greece! I have a fast internet connection but no access to public IP in my first WAN . My second WAN has slow internet connection and I have it as a backup. So Zerotier was a lifesaver ! I really admire you and I deeply appreciate what you do. Keep up the good work. Thumbs up!
Mikrotik for life. ZeroTier is awesome but It managed to bork itself on 2 of my production systems already (1 windows and 1 linux box). Rock solid of MT though. Wiregaurd is my go-to nowadays if I have a public IP accessible somewhere. Super fast, super simple, and using a modern stream cipher.
Love Wireguard that I'm using in pfsense. I've always wondered how reliable and stable ZeroTier is since you're relying on their infrastructure. I rather run Wireguard myself on my own network so I wouldn't have to worry about cloud services going down.
Was using L2TP + IPsec because of native Mac and Windows support for a while until Wireguard came along. Now I primarily use Wireguard on MT and OpenVPN on another server as backup.
Thank you for the awesome video. Really appreciate the effort with the comparisons. Perhaps do show things like the IPIP, EoIP tunnels as well as the dynamic routing protocols. Really love the content and keep it going!!!!
Hello, Johnny! Appreciate your work and talent of presentation. May I kindly ask you to specify few things? 1. L2TP was tested with ipsec, right? 2. You wrote “Unable to test” for IKEv2 in a table. Do you mean - tests failed in browser? Did “speedtest”/”fast” webpages load with no errors? 3. I’ve noticed poor results for PPTP. Maybe you have some thoughts about it (despite of low CPU/memory requirements pptp loses to others)? Have you ever tried to establish PPTP tunnels from some other locations? Thank you so much in advance.
Your video right on time for me. I was wondering what to use and because you have the experience I can tell that you know what you are talking about. Thanks you and keep up the good work !!!
Zerotier is excellent if you have two endpoints (routers) that do not have publicly accessible IPs. Limits, yes ARM devices but also dependency on third party servers. It can handle complex scenarios and wide variety of needs. Wireguard is maybe a bit faster but its strength is relatively easy to setup and it is truly independent. Never used OPENVPN and will never see myself needing to use it and not completely implemented in MT OS anyway. Where things get interesting which no one addresses head on is the issue of MTU which manifests in no browsing, slow browsing or some website not reachable. For example in wirguard, ensure ICMP is not blocked first and foremost. One method to address this is to try putting the MTU from default 1420 to 1500 on both client and server ends, or mangle/MSS clamping on the client side, OR............ MRRU finessing by using an unencrypted L2TP tunnel within an encrypted wireguard tunnel to send ones data. L2TP settings allow MRRU through MLPPP. One uses the very basic L2TP settings and ensures MRRU is set at 1504 at both ends of the L2TP connection. Dont use pptp................. no reason to.
I want to connect two locations with VPN, but both lack the static IP address. However DDNS is working for both places and clients can connect to both routers easily. Can I use IPSEC with two DDNS enabled routers? If not, which protocol do you recommend for permament connection? Thanks for your answer.
Nice video!! Any VPN using TCP will suffer what is called TCP meltdown (TCP inside from the app in another TCP like the VPN tunnel creates) that impacts badly the throughput so stay away of TCP VPNs such as SSTP or OVPN over TCP
Bcs I have CHR as main location I'm stuck with wireguard and cant complain. Works very well, but we will see how it hold hundreads off peers. For older V6 routers we still use l2tp but with ipsec.
Thanks for this. Makes me feel better about waiting for an ARM based MikroTik device for my primary usege. I have a MikroTik mAP (both lite and non lite versions actually) to play with while I wait on the Arm based AX models being available in my region. I'd like to setup a VPN that my friends in other countries can use to avoid region restrictions, but NOT give them any access to my home network. mAP would have to be behind an ISP modem. Is this possible? Is there an ELI5 guide for this anywhere? It seems that all VPN guides are for the (etirely normal) setup: secure access to the network. I just want it for geolocation avoidance - not local network access. Any pointers on how one could accomplish this?
I had ZT fully working across 5 sites and it was amazing just like you said. Then I disabled the ZT interface in WinBox in one of the site configs and the whole thing suddenly tanked, and I've never been able to get it working again and been using SSTP in its place for now. I'm genuinely baffled.
@The Network Berg Hi there i've issue with L2TP+IPSEC latency +3-5ms compared to direct ping side to client plus little fluctuating +2-3ms. Is there any advices where to dig to?
Hi there ! I was wondering if you were in a position to do a video, or comment on, the ability to do 2FA/MFA with Mikrotik VPN's. Websites like rublon and miniOrange seem to provide the services.
Definitely an interesting topic, unfortunately I have never needed to deploy MFA to MikroTik VPN users in my own production network. But I would like to see if this can be done on MikroTik, perhaps with the aid of some scripting on it, it may be doable. If I do figure it out I will definitely make a video on the subject.
@@TheNetworkBerg I need it for a client project coming up in January.. I'll do my best to keep you posted as well.. you have been of so much help to me !
Yes, you can. I have on my RB5009 2 instances of Zerotier (one for RoadWarriors and 1 as HUB-Spokes VPN) plus Wireguard as site-to-site VPN for older Mikrotik router.
I honestly do not have any idea, I would have thought that at the very least that virtual devices like x86 or CHR would support it, maybe one day it will but only MikroTik can really answer it and on their forums they just state that there are no plans for Zerotier on any other architecture
SSTP was my preferred method for connecting multiple locations. Usually single digit pings end to end, might be because we were within the same ISP on each end. Now I quite like Zerotier (simplicity) and Wireguard (speed). However Zerotier can get more complex if you create flow rules and setup capability matrix in the web admin console
idk why mikrotik made ROS V7 not compatible with V6 ...that sux big time , some stuff do not play well between versions , i have friends who have big setups runing on V6 cause it is a PiTA to start over changing all net config if they upgrade to V7
