Build a policy-based IKEv2 IPsec tunnel from a MikroTik RouterOS 7 device to a VPNGeek gateway — peer, identity, proposals, policy, and the NAT-bypass rule that makes traffic flow.
This guide connects a LAN behind a MikroTik RouterOS 7 router to a VPNGeek gateway with a policy-based IKEv2 tunnel. RouterOS builds IPsec from small, composable objects — a peer, an identity, proposals, and a policy — so the order matters. The steps use the CLI because it is unambiguous, but each command maps to a tab under IP > IPsec in WinBox.
Before you start
Collect these before you begin. A single mismatched parameter will hold the tunnel in negotiation.
- A VPNGeek plan that includes IPsec Gateways, and admin access to the dashboard.
- Admin access to a MikroTik device running RouterOS 7.
- A static public IP or resolvable DDNS hostname on the WAN.
- Non-overlapping subnets — for example 10.20.0.0/16 on the VPNGeek side and 192.168.20.0/24 behind the MikroTik.
1. Create the tunnel in VPNGeek
In the dashboard open Gateways > Tunnels and add a new site-to-site tunnel. Enter the MikroTik WAN address as the peer and the local/remote subnets. The dashboard returns the values to mirror on RouterOS:
gateway_address: 198.51.100.60 # VPNGeek gateway
local_subnet: 10.20.0.0/16 # VPNGeek side
remote_subnet: 192.168.20.0/24 # MikroTik LAN
ike_version: 2
enc_algorithm: aes-256
hash_algorithm: sha256
dh_group: modp2048 # group 14
psk: (shown once)
2. Create the profile and proposal
The profile holds phase 1 (IKE) parameters; the proposal holds phase 2 (ESP) parameters. Create both first so the peer and policy can reference them.
/ip ipsec profile
add name=vpngeek-p1 hash-algorithm=sha256 \
enc-algorithm=aes-256 dh-group=modp2048 lifetime=8h
# Phase 2 proposal
/ip ipsec proposal
add name=vpngeek-p2 auth-algorithms=sha256 \
enc-algorithms=aes-256-cbc pfs-group=modp2048 lifetime=1h
3. Configure the peer and identity
The peer points at the VPNGeek gateway and uses the profile from step 2. The identity carries the authentication — here a pre-shared key.
/ip ipsec peer
add name=vpngeek address=198.51.100.60 profile=vpngeek-p1 \
exchange-mode=ike2
# Identity — PSK authentication for that peer
/ip ipsec identity
add peer=vpngeek auth-method=pre-shared-key \
secret="<your-psk>"
4. Add the policy
The policy is the phase 2 selector — it decides which traffic is encrypted and sends it to the peer. The src/dst addresses must mirror the VPNGeek subnets exactly.
add peer=vpngeek tunnel=yes \
src-address=192.168.20.0/24 \
dst-address=10.20.0.0/16 \
proposal=vpngeek-p2 \
action=encrypt
5. Add the NAT-bypass rule
RouterOS masquerades LAN traffic out the WAN by default, which would rewrite the source before the policy can match. Add an accept rule in the NAT chain, placed above the masquerade rule, so VPN traffic is excluded.
/ip firewall nat
add chain=srcnat action=accept place-before=0 \
src-address=192.168.20.0/24 \
dst-address=10.20.0.0/16
6. Verify the tunnel
From the VPNGeek dashboard the tunnel should reach ESTABLISHED within about 30 seconds. Confirm from the MikroTik side:
/ip ipsec active-peers print
# Phase 2 — installed SAs and byte counters
/ip ipsec installed-sa print
# Policy state — ph2-state should be "established"
/ip ipsec policy print
# prove traffic flows from the LAN side
/ping 10.20.0.1 src-address=192.168.20.1
Troubleshooting
Stuck negotiating / no active peer
Check the log with /log print where topics~"ipsec". A stuck phase 1 is almost always a PSK, enc-algorithm, hash, or dh-group mismatch, or UDP 500/4500 blocked on the WAN. Confirm the profile and proposal match the VPNGeek side.
Peer up but no traffic
Usually the NAT-bypass rule is missing or below the masquerade rule, or the policy src/dst do not mirror the remote side. Check the policy's ph2-state and confirm the accept rule sits above masquerade.
Tunnel drops after the lifetime expires
Set matching lifetimes on both peers and enable DPD on the profile (dpd-interval) so a dead tunnel is detected and re-keyed cleanly.