Windows 8, 10 and 11 users can automatically import IKEv2 configuration:
.p12 file to your computer..p12 file.
To connect to the VPN: Click on the wireless/network icon in your system tray, select the new VPN entry, and
click Connect. Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say
"Your public IP address is Your VPN Server IP".
If you get an error when trying to connect, see Troubleshooting.
Using the following steps, you can remove the VPN connection and optionally restore the computer to the status before IKEv2 configuration import.
Remove the added VPN connection in Windows Settings - Network - VPN. Windows 7 users can remove the VPN connection in Network and Sharing Center - Change adapter settings.
(Optional) Remove IKEv2 certificates.
Press Win+R, or search for mmc in the Start Menu. Open Microsoft Management
Console.
Open File - Add/Remove Snap-In. Select to add Certificates and in the
window that opens, select Computer account -> Local Computer. Click on Finish
-> OK to save the settings.
Go to Certificates - Personal - Certificates and delete the IKEv2 client
certificate. The name of the certificate is the same as the IKEv2 client name you specified
(default: vpnclient). The certificate was issued by IKEv2 VPN CA.
Go to Certificates - Trusted Root Certification Authorities - Certificates and
delete the IKEv2 VPN CA certificate. The certificate was issued to IKEv2 VPN CA by
IKEv2 VPN CA. Before deleting, make sure that there are no other certificate(s)
issued by IKEv2 VPN CA in Certificates - Personal - Certificates.
(Optional. For users who manually created the VPN connection) Restore registry settings. Note that you should backup the registry before editing.
Press Win+R, or search for regedit in the Start Menu. Open Registry Editor.
Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters and
delete the item with name NegotiateDH2048_AES256, if it exists.
First, securely transfer the generated .mobileconfig file to your Mac, then double-click and follow
the prompts to import as a macOS profile. If your Mac runs macOS Big Sur or newer, open System Preferences and
go to the Profiles section to finish importing. For macOS Ventura and newer, open System Settings and search for
Profiles. When finished, check to make sure “IKEv2 VPN” is listed under System Preferences -> Profiles.
To connect to the VPN:
Your VPN Server IP (or DNS name).(Optional feature) Enable VPN On Demand to automatically start a VPN connection when your Mac is on Wi-Fi. To enable, check the Connect on demand checkbox for the VPN connection, and click Apply. To find this setting on macOS Ventura and newer, click on the “i” icon on the right of the VPN connection.
You can customize VPN On Demand rules to exclude certain Wi-Fi networks (such as your home network).
Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your
public IP address is Your VPN Server IP".
If you get an error when trying to connect, see Troubleshooting.
Note: macOS 14 (Sonoma) has a minor issue that may cause IKEv2 VPN to disconnect and reconnect once every 24-48 minutes. Other macOS versions are not affected. For more details and a workaround, see macOS Sonoma clients reconnect.
To remove the IKEv2 VPN connection, open System Preferences -> Profiles and remove the IKEv2 VPN profile you added.
First, securely transfer the generated .mobileconfig file to your iOS device, then import it as an
iOS profile. To transfer the file, you may use:
When finished, check to make sure “IKEv2 VPN” is listed under Settings -> General -> VPN & Device Management or Profile(s).
To connect to the VPN:
Your VPN Server IP (or DNS name).(Optional feature) Enable VPN On Demand to automatically start a VPN connection when your iOS device is on Wi-Fi. To enable, tap the “i” icon on the right of the VPN connection, and enable Connect On Demand.
You can customize VPN On Demand rules to exclude certain Wi-Fi networks (such as your home network).
Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your
public IP address is Your VPN Server IP".
If you get an error when trying to connect, see Troubleshooting.
To remove the IKEv2 VPN connection, open Settings -> General -> VPN & Device Management or Profile(s) and remove the IKEv2 VPN profile you added.
Android users can connect using strongSwan VPN client (recommended).
.sswan file to your Android device..sswan file you transferred from the VPN server..sswan file, tap the three-line menu button, then browse to
the location you saved the file.
(Optional feature) You can choose to enable the “Always-on VPN” feature on Android. Launch the Settings app, go to Network & internet -> Advanced -> VPN, click the gear icon on the right of “strongSwan VPN Client”, then enable the Always-on VPN and Block connections without VPN options.
.p12 file to your Android device..p12 file you transferred from the VPN server, and follow the prompts..p12 file, tap the three-line menu button, then browse to
the location you saved the file.
Your VPN Server IP (or DNS name) in the Server field.Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your
public IP address is Your VPN Server IP".
If you get an error when trying to connect, see Troubleshooting.
.p12 file to your Android device..p12 file you transferred from the VPN server..p12 file, tap the three-line menu button, then browse to
the location you saved the file.
Your VPN Server IP (or DNS name) in the Server address field.empty) in the IPSec identifier field.Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your
public IP address is Your VPN Server IP".
If you get an error when trying to connect, see Troubleshooting.
Before configuring Linux VPN clients, you must make the following change on the VPN server: Edit /etc/ipsec.d/ikev2.conf
on the server. Append authby=rsa-sha1 to the end of the conn ikev2-cp section,
indented by two spaces. Save the file and run service ipsec restart.
To configure your Linux computer to connect to IKEv2 as a VPN client, first install the strongSwan plugin for NetworkManager:
# Ubuntu and Debian
sudo apt-get update
sudo apt-get install network-manager-strongswan
# Arch Linux
sudo pacman -Syu # upgrade all packages
sudo pacman -S networkmanager-strongswan
# Fedora
sudo yum install NetworkManager-strongswan-gnome
# CentOS
sudo yum install epel-release
sudo yum --enablerepo=epel install NetworkManager-strongswan-gnome
Next, securely transfer the generated .p12 file from the VPN server to your Linux computer. After
that, extract the CA certificate, client certificate and private key. Replace vpnclient.p12 in the
example below with the name of your .p12 file.
# Example: Extract CA certificate, client certificate and private key.
# You may delete the .p12 file when finished.
# Note: You may need to enter the import password, which can be found
# in the output of the IKEv2 helper script. If the output does not
# contain an import password, press Enter to continue.
# Note: If using OpenSSL 3.x (run "openssl version" to check),
# append "-legacy" to the 3 commands below.
openssl pkcs12 -in vpnclient.p12 -cacerts -nokeys -out ca.cer
openssl pkcs12 -in vpnclient.p12 -clcerts -nokeys -out client.cer
openssl pkcs12 -in vpnclient.p12 -nocerts -nodes -out client.key
rm vpnclient.p12
# (Important) Protect certificate and private key files
# Note: This step is optional, but strongly recommended.
sudo chown root:root ca.cer client.cer client.key
sudo chmod 600 ca.cer client.cer client.key
You can then set up and enable the VPN connection:
Your VPN Server IP (or DNS name) for
the Address.
ca.cer file for the Certificate.client.cer file for the Certificate (file).client.key file for the Private key.aes128gcm16 in the ESP field.Alternatively, you may connect using the command line. See #1399 and #1007 for example steps. If you encounter
error Could not find source connection, edit /etc/netplan/01-netcfg.yaml and replace
renderer: networkd with renderer: NetworkManager, then run sudo netplan
apply. To connect to the VPN, run sudo nmcli c up VPN. To disconnect: sudo nmcli c
down VPN.
Once connected, you can verify that your traffic is being routed properly by looking up your IP address on Google. It should say "Your
public IP address is Your VPN Server IP".
If you get an error when trying to connect, see Troubleshooting.
Note: These steps were contributed by @Unix-User. It is recommended to run terminal commands via an SSH connection, e.g. via Putty.
Securely transfer the generated .p12 file to your computer.
In WinBox, go to System > certificates > import. Import the .p12 certificate file
twice (yes, import the same file two times!). Verify in your certificates panel. You will see 2 files,
the one that is marked KT is the key.
Or you can use terminal instead (empty passphrase):
[admin@MikroTik] > /certificate/import file-name=mikrotik.p12
passphrase:
certificates-imported: 2
private-keys-imported: 0
files-imported: 1
decryption-failures: 0
keys-with-no-certificate: 0
[admin@MikroTik] > /certificate/import file-name=mikrotik.p12
passphrase:
certificates-imported: 0
private-keys-imported: 1
files-imported: 1
decryption-failures: 0
keys-with-no-certificate: 0
Run these commands in terminal. Replace the following with your own values.
YOUR_VPN_SERVER_IP_OR_DNS_NAME is your VPN server IP or DNS name.
IMPORTED_CERTIFICATE is the name of the certificate from step 2 above, e.g. vpnclient.p12_0
(the one flagged with KT - Priv. Key Trusted - if not flagged as KT, import certificate again).
THESE_ADDRESSES_GO_THROUGH_VPN are the local network addresses that you want to browse
through the VPN.
Assuming that your local network behind RouterOS is 192.168.0.0/24, you can use 192.168.0.0/24
for the entire network, or use 192.168.0.10 for just one device, and so on.
/ip firewall address-list add address=THESE_ADDRESSES_GO_THROUGH_VPN list=local
/ip ipsec mode-config add name=ike2-rw responder=no src-address-list=local
/ip ipsec policy group add name=ike2-rw
/ip ipsec profile add name=ike2-rw
/ip ipsec peer add address=YOUR_VPN_SERVER_IP_OR_DNS_NAME exchange-mode=ike2 \
name=ike2-rw-client profile=ike2-rw
/ip ipsec proposal add name=ike2-rw pfs-group=none
/ip ipsec identity add auth-method=digital-signature certificate=IMPORTED_CERTIFICATE \
generate-policy=port-strict mode-config=ike2-rw \
peer=ike2-rw-client policy-template-group=ike2-rw
/ip ipsec policy add group=ike2-rw proposal=ike2-rw template=yes
For more information, see #1112.
tested on
mar/02/2022 12:52:57 by RouterOS 6.48
RouterBOARD 941-2nD
See also: Check logs and VPN status, IKEv1 troubleshooting and Advanced usage.
First, make sure that the VPN server address specified on your VPN client device exactly matches the server address in the output of the IKEv2 helper script. For example, you cannot use a DNS name to connect if it was not specified when setting up IKEv2. To change the IKEv2 server address, read this section.
For servers with an external firewall (e.g. EC2/GCE), open UDP ports 500 and 4500 for the VPN. Aliyun users, see #433.
Check logs and VPN status for errors. If you encounter retransmission related errors and are unable to connect, there may be network issues between the VPN client and server. If you are connecting from mainland China, consider switching to alternative solutions other than IPsec VPN.
If you installed the IPsec VPN before 2024-04-10, and your VPN server runs Ubuntu Linux version 20.04, you may
have encountered an issue where newly generated client configuration files (.mobileconfig) fail to
import on iOS or macOS device(s) with errors like “incorrect password”. This could be caused by updates to
libnss3 related packages on Ubuntu 20.04, which required some changes (25670f3) in the IKEv2 script.
To fix this issue, first update the IKEv2 script on your server to the latest version using these instructions. After that, run sudo ikev2.sh and
select “export” to re-create the client configuration files.
macOS 14 (Sonoma) has a minor issue that may cause IKEv2 VPN to disconnect and reconnect once every 24-48 minutes. Other macOS versions are not affected. First check your macOS version. To work around this issue, follow the steps below.
Note: If you installed IPsec VPN after December 10, 2023, no action is required because the following fixes are already included.
/etc/ipsec.d/ikev2.conf on the VPN server. Find the line:
ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1
ike=aes_gcm_c_256-hmac_sha2_256-ecp_256,aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1
service ipsec restart. Docker users: After step 4 below,
exit the container and run docker restart ipsec-vpn-server.
/opt/src/ikev2.sh on the VPN server. Find and replace the following sections with these
new values:
<key>ChildSecurityAssociationParameters</key>
<dict>
<key>DiffieHellmanGroup</key>
<integer>19</integer>
<key>EncryptionAlgorithm</key>
<string>AES-256-GCM</string>
<key>LifeTimeInMinutes</key>
<integer>1410</integer>
</dict>
<key>IKESecurityAssociationParameters</key>
<dict>
<key>DiffieHellmanGroup</key>
<integer>19</integer>
<key>EncryptionAlgorithm</key>
<string>AES-256-GCM</string>
<key>IntegrityAlgorithm</key>
<string>SHA2-256</string>
<key>LifeTimeInMinutes</key>
<integer>1410</integer>
</dict>
sudo ikev2.sh to export (or add) updated client config files for each macOS device you
have.
.mobileconfig file(s). See Configure IKEv2 VPN
clients. Docker users, see Configure
and use IKEv2 VPN.
To connect multiple IKEv2 clients from behind the same NAT (e.g. home router) at the same time, you will need to generate a unique certificate for each client. Otherwise, you could encounter the issue where a later connected client affects the VPN connection of an existing client, which may lose Internet access.
To generate certificates for additional IKEv2 clients, run the helper script with the --addclient
option. To customize client options, run the script without arguments.
sudo ikev2.sh --addclient [client name]
If you encounter this error, make sure that the VPN server address specified on your VPN client device exactly matches the server address in the output of the IKEv2 helper script. For example, you cannot use a DNS name to connect if it was not specified when setting up IKEv2. To change the IKEv2 server address, read this section.
To fix this error, you will need to enable stronger ciphers for IKEv2 with a one-time registry change. Download
and import the .reg file below, or run the following from an elevated command prompt.
REG ADD HKLM\SYSTEM\CurrentControlSet\Services\RasMan\Parameters /v NegotiateDH2048_AES256 /t REG_DWORD /d 0x1 /f
If you encounter “Error 87: The parameter is incorrect” when trying to connect using IKEv2 mode, try the solutions in this issue, more specifically, step 2 “reset device manager adapters”.
If your VPN client device cannot open websites after successfully connecting to IKEv2, try the following fixes:
Some cloud providers, such as Google Cloud, set a lower MTU by default. This could cause network issues with IKEv2 VPN clients. To fix, try setting the MTU to 1500 on the VPN server:
# Replace ens4 with the network interface name on your server
sudo ifconfig ens4 mtu 1500
This setting does not persist after a reboot. To change the MTU size permanently, refer to relevant articles on the web.
If your Android or Linux VPN client can connect using IKEv2 mode, but cannot open websites, try the fix in Android/Linux MTU/MSS issues.
Windows VPN clients may not use the DNS servers specified by IKEv2 after connecting, if the client’s configured DNS servers on the Internet adapter are from the local network segment. This can be fixed by manually entering DNS servers such as Google Public DNS (8.8.8.8, 8.8.4.4) in network interface properties -> TCP/IPv4. For more information, see Windows DNS leaks and IPv6.
If using Windows 10 and the VPN is stuck on “connecting” for more than a few minutes, try these steps:
The built-in VPN client in Windows may not support IKEv2 fragmentation (this feature requires Windows 10 v1803 or newer). On some networks, this can cause the connection to fail or have other issues. You may instead try the IPsec/L2TP or IPsec/XAuth mode.