You need a VPN tunnel that survives restrictive networks — hotel Wi-Fi, corporate firewalls, some mobile carriers — where IPsec and OpenVPN over UDP are often blocked outright. SSTP (Secure Socket Tunneling Protocol) solves this by tunneling PPP over an HTTPS connection on TCP port 443, the one port almost nothing blocks.
Get a certificate for the server
SSTP requires a certificate on the server side. Use one issued by a real CA if the router has a public hostname, or generate a self-signed one on the router itself for testing:
/certificate add name=sstp-cert common-name=vpn.example.com key-usage=tls-server
/certificate sign sstp-certEnable the SSTP server
Point it at the certificate you just created:
/interface sstp-server server set enabled=yes certificate=sstp-certCreate a VPN user
SSTP clients authenticate with a PPP username and password:
/ppp secret add name=client1 password=xxx service=sstp local-address=10.20.20.1 remote-address=10.20.20.2Configure the client
On another MikroTik, or a Windows/Linux client with SSTP support, connect to the server's hostname with the credentials from the previous step:
/interface sstp-client add connect-to=vpn.example.com user=client1 password=xxx certificate=sstp-certWhy do it this way
SSTP's whole reason to exist is that it rides on TCP 443, the same port HTTPS uses — so it passes through the restrictive firewalls and corporate proxies where IPsec and OpenVPN over UDP usually get blocked, at the cost of a bit more overhead than a lighter protocol like WireGuard. It's not the right default for every VPN — if both ends are on open networks, WireGuard is faster and simpler — but for a tunnel that specifically has to survive a network you don't control, SSTP's use of a nearly-unblockable port is the actual reason to choose it, not habit.
How MoniTik helps
This is exactly the mechanism MoniTik's own tunnel to each satellite router runs on — SSTP is why the connection keeps working on restrictive residential and mobile networks where a UDP-based VPN would get silently dropped by the carrier. If you're building your own SSTP tunnel just to reach a router in one of those environments, that's the same problem MoniTik's remote WinBox already solves without you having to issue certificates or manage PPP secrets by hand.
Valentina has spent the last decade deploying and troubleshooting MikroTik networks for ISPs across Latin America.