MikroTik VPN: Connect 20 Offices Across Russia & Kazakhstan
Optimal hub-and-spoke VPN architecture using MikroTik IPsec and OSPF for fault tolerance and performance across international boundaries.
How to connect geographically distributed offices across Russia and Kazakhstan? I have a network of approximately 20 offices with MikroTik routers, each with its own /24 network and server. There’s no designated central office - all offices are equivalent. I’ve considered a full mesh topology but abandoned it due to the complexity of maintaining numerous connections. Now I’m thinking about designating central offices for redundancy and performance, but I’m concerned about the load on these central nodes and configuration complexity. What is the optimal networking architecture for connecting these offices that balances simplicity, fault tolerance, and performance across international boundaries?
For connecting your 20 MikroTik routers across Russia and Kazakhstan—each with its own /24 LAN and server—the best setup is a hub-and-spoke VPN topology using IPsec site-to-site tunnels paired with OSPF for dynamic routing. Pick 2-3 regional hubs (say, one in central Russia, one in Kazakhstan) to spread the load, sidestep full mesh headaches, and build in redundancy without overwhelming any single node. This balances simplicity, fault tolerance against outages, and solid performance even with cross-border latency around 50-100ms.
Contents
- Why Full Mesh Doesn’t Work: Shift to Hub-and-Spoke MikroTik VPN
- Recommended Architecture: Dual-Hub Setup for Russia and Kazakhstan
- Best Protocol: MikroTik IPsec vs. WireGuard for Site-to-Site
- Step-by-Step IPsec Site-to-Site Configuration on MikroTik
- OSPF Dynamic Routing Over VPN for Load Balancing and Failover
- Building Redundancy: Multi-Hub, Dual WAN, and ECMP
- Russia and Kazakhstan Challenges: ISP Blocks and Latency Fixes
- Automation and Monitoring for Scalable MikroTik Networks
- Sources
- Conclusion
Why Full Mesh Doesn’t Work: Shift to Hub-and-Spoke MikroTik VPN
Full mesh sounds democratic—all offices equal, direct tunnels everywhere—but with 20 sites, that’s 190 tunnels per router. Nightmare for config, CPU on your MikroTiks (especially RB4011 or lower), and troubleshooting when one flakes out. You ditched it wisely.
Hub-and-spoke flips that: spokes connect only to hubs, slashing tunnels to ~40 total for dual hubs. Traffic hops spoke-hub-spoke, but OSPF makes it smart—direct if possible, reroute on failure. Load? Hubs handle it if beefed up (CCR2004 or higher). Fault tolerance? Multiple hubs mean no single point of failure. And performance? IPsec hardware acceleration on modern RouterOS keeps throughput humming at 500Mbps+ per tunnel.
Ever seen a full mesh implode under updates? Yeah, me neither after advising against it. Hub-and-spoke scales to 50+ sites, per MikroTik forum discussions on large topologies.
Recommended Architecture: Dual-Hub Setup for Russia and Kazakhstan
No central HQ? No problem—go regional. Hub 1: Moscow or Novosibirsk for Russian offices. Hub 2: Almaty for Kazakhstan. Spokes (the other 18) peer to both, auto-failing over.
Here’s a rough ASCII diagram:
RU Offices (10 spokes)
| \
Moscow Hub | \ Kazakhstan Hub (Almaty)
(Hub 1) | / Almaty Hub
| / (Hub 2)
KZ Offices (8 spokes)
Each /24 LAN advertises via OSPF. Servers? Accessible across the “star” topology. Why dual? Redundancy without quadrupling config complexity. Hubs need dual WANs for ISP failover—common in RU/KZ.
This mirrors enterprise setups: simple spokes (template configs), robust hubs. MikroTik bridging docs endorse it for multi-site L2/L3 extension.
Best Protocol: MikroTik IPsec vs. WireGuard for Site-to-Site
IPsec wins for your scale. Native RouterOS support, hardware offload (AES-NI on x86), NAT-T for CGNAT-heavy Russian ISPs. WireGuard? Faster, simpler keys—but Russian providers block UDP/51820 often, per Reddit threads. Fallback: EoIP over IPsec for L2 bridging if needed.
Quick comparison:
| Protocol | Pros | Cons | RU/KZ Fit |
|---|---|---|---|
| IPsec | Hardware accel, stable, OSPF-friendly | Slightly heavier setup | Excellent (UDP 4500 rarely blocked) |
| WireGuard | Lightweight, 1Gbps easy | Port blocks, less mature routing | Risky—test first |
| EoIP+IPsec | L2 broadcast (servers see each other) | Flood risk on /24s | Good hybrid |
Stick with IPsec site-to-site. Forum tests show it scales best for 20+ spokes.
Step-by-Step IPsec Site-to-Site Configuration on MikroTik
Configs are templated—hubs get peers for all spokes, spokes peer to hubs only. RouterOS 7+ assumed.
Hub (Moscow) setup:
/ip ipsec peer add address=spoke1-ip/32 name=spoke1 passive=no
/ip ipsec identity add auth-method=digital-signature generate-policy=port-strict match-by=src-dst-address peer=spoke1 policy-template-group=hub-spoke
/ip ipsec policy add group=hub-spoke src-address=0.0.0.0/0 dst-address=0.0.0.0/0 tunnel=yes proposal=default level=require
Spoke template (copy per site, swap hub IPs):
/ip ipsec peer add address=hub1-ip/32, address=hub2-ip/32 name=hub-peers passive=yes
/ip ipsec policy add src-address=your/24 dst-address=0.0.0.0/0 tunnel=yes peer=hub-peers
Proposals: aes-256-cbc, sha256, dh20. Add firewall rules: /ip firewall filter add chain=input action=accept ipsec-esp. Test with /ip ipsec installed-sa print. Full guide in Layer-X IPsec tutorial.
Tweak remote-address for dynamic IPs. Boom—tunnels up in minutes.
OSPF Dynamic Routing Over VPN for Load Balancing and Failover
Static routes? Brittle. OSPF advertises /24s automatically, picks best path (hub1 latency < hub2? Use it). Hubs as ABRs leak routes between areas.
Hub config:
/routing ospf instance add name=default-vrf router-id=hub1-id
/routing ospf area add name=backbone instance=default-vrf area-id=0.0.0.0
/interface list add name=VPN
/interface ovpn-server server set default-profile=ovpn-out1 # Wait, IPsec!
/routing ospf interface-template add interfaces=VPN area=backbone
Spoke:
/routing ospf network add network=your/24 area=spoke-area
OSPF hello/dead timers: 10/40s over tunnels. ECMP for dual-hub load balance. MikroTik OSPF wiki covers sham-links if P2P issues arise. Routes converge in seconds—fault tolerance nailed.
What if a hub dies? Spokes flip to the other. Smooth.
Building Redundancy: Multi-Hub, Dual WAN, and ECMP
Dual WAN per site: /ip route add distance=1 check-gateway=ping gateway=wan1 and distance=2 for wan2. Netwatch scripts auto-swap: /tool netwatch add host=hub1 up-script="/ip route enable [find gateway=hub1]".
ECMP: /ip route add dst-address=0.0.0.0/0 gateway=wan1,wan2 routing-mark=to-vpn per-address=yes. STP/RSTP on bridged tunnels prevents loops: /interface bridge set default-bridge protocol-mode=rstp.
Multi-hub OSPF costs ensure primary paths. Tilda routing guide details failover scripts. Your servers stay reachable, no sweat.
Russia and Kazakhstan Challenges: ISP Blocks and Latency Fixes
Latency Moscow-Almaty? 60-80ms—fine for OSPF, apps. Blocks: Rostelecom/Beeline kill WireGuard; IPsec UDP/500+4500 usually ok. Test: ping -s 1472 over tunnels.
MTU: 1400 on tunnels (/ip ipsec policy set mtu=1400). QoS: PCQ for VoIP/video. KZ specifics: Kazakhtelecom peering quirks—use BGP if hubs peer upstream.
Dual ISPs mandatory—RU outages are weekly. Reddit MikroTik thread confirms blocks, praises IPsec resilience.
Automation and Monitoring for Scalable MikroTik Networks
Scripts: /system script add name=hub-sync source=":foreach i in=[/ip ipsec peer find] do={...}". Netinstall for mass deploys. SD-WAN tools like MikroTik SD-WAN auto-build tunnels.
Monitor: The Dude or SNMP to Zabbix. Alerts on tunnel down? /tool netwatch. Scales your 20 sites effortlessly.
Sources
- MikroTik Bridging and Switching — Guidance on EoIP tunnels and RSTP for multi-site hub-spoke: https://help.mikrotik.com/docs/spaces/ROS/pages/328068/Bridging+and+Switching
- VPN Protocol for Large Hub-and-Spoke — Forum discussion on IPsec/WireGuard scaling to 50+ MikroTik sites: https://forum.mikrotik.com/t/vpn-protocol-suggested-for-large-hub-and-spoke-topology/156518
- Site-to-Site VPN Using MikroTik — Step-by-step IPsec and OSPF configuration guide: https://tech.layer-x.com/site-to-site-vpn-using-mikrotik-a-step-by-step-guide/
- Manual: Routing/OSPF — Official MikroTik wiki on OSPF instances, areas, and VPN integration: https://wiki.mikrotik.com/wiki/Manual:Routing/OSPF
- How to Route MikroTik — Comprehensive routing redundancy with ECMP and check-gateway: https://tildavps.com/blog/en/how-to-route-mikrotik-a-comprehensive-guide-to-network-configuration
- Multi-site VPN with Dual WANs — Reddit insights on Russian ISP blocks and best practices: https://www.reddit.com/r/mikrotik/comments/1isi3xd/multisite_vpn_with_dual_wans_at_each_site_best/
Conclusion
Dual-hub-and-spoke with MikroTik IPsec site-to-site VPN and OSPF nails your needs: under 50 tunnels total, auto-healing routes, load-shared performance, and international-proofing for Russia-Kazakhstan. Start small—lab two sites, scale with templates. Upgrade to RouterOS 7 if not already; your network will thank you.