Integrations · MikroTik
MikroTik 2FA: phone approval for VPN and router logins
For teams running a MikroTik router as their VPN gateway or network edge. Every VPN connection and every admin login gets approved with a tap in Notakey Authenticator, and the router you already have is all it takes.
How it connects
Two ways in, one app on the phone
For the VPN, a RouterOS script does the work. The user dials in with username and password as usual, but the firewall blocks their traffic until the PPP profile’s up script asks the Notakey server for an approval and the user taps Approve on the phone. Deny or ignore, and the script drops the session. There is no RADIUS server and no auth-proxy in this setup; the scripts come from the notakey/mikrotik-2fa-vpn repository and run on RouterOS 6.46.4 or newer, including 7.x.
For logins to the router itself (WinBox, WebFig, SSH and the API), the router sends its login service to RADIUS, and the Notakey auth-proxy sits transparently in that RADIUS path. The proxy forwards the password check to your RADIUS server (FreeRADIUS, Microsoft NPS, MikroTik’s own User Manager or the Notakey RADIUS plugin), pushes an approval to the admin’s phone and answers Access-Accept only when both succeed.
Either way, the VPN users, their passwords and the router configuration you rely on stay as they are. The only thing that changes is that a password alone is no longer a login.
What to know before you start
- The script-based VPN setup covers PPP-based VPNs (L2TP/IPsec, PPTP, SSTP). The approval timeout in the script is 60 seconds.
- MikroTik’s default RADIUS timeout is 300 milliseconds. For router login over RADIUS, set timeout=30s or every login fails before the phone buzzes.
- Keep a local admin account. RouterOS checks the local user database first and only asks RADIUS for unknown usernames, so that account is your way back in if the proxy, RADIUS or the Notakey service is unreachable.
- RADIUS-authenticated admins get the privileges of the default-group you choose unless your RADIUS server returns a Mikrotik-Group attribute per user. Pick the least privilege that works.
- If the phone approving the request is also the VPN client, add an accept rule so pending clients can reach the Notakey server while everything else is still blocked.
- The script’s JSON parser cannot handle parentheses and possibly other special punctuation in the approval message. Keep the message text plain.
- The script approach is the fastest route for a single router. Many routers, other VPN vendors or central policy call for the RADIUS-based setup instead.
From zero to the first approval
- 01
Create the application in Notakey
In the Notakey dashboard, create an application for the VPN or router, copy its Access ID, and onboard the users’ phones with Notakey Authenticator. The username in Notakey must match the router’s username exactly, because the request is addressed by username.
- 02
Install the scripts or add the proxy as a RADIUS server
For the VPN, paste the JParseFunctions and NotakeyFunctions libraries into System → Scripts, attach the up script to a PPP profile that places new sessions in the vpn_pending address list, and add the firewall drop rule for that list. For router login, add the auth-proxy under /radius with service=login and timeout=30s, then enable use-radius under /user aaa.
- 03
Test on one user, then roll out
Point one PPP secret at the 2FA profile, or open a second WinBox session with a RADIUS username, and approve the push. Once it works, set the 2FA profile as the PPP server’s default profile so every user is covered without editing each secret.
Frequently asked questions
- Does MikroTik VPN 2FA need a RADIUS server?
- No. For PPP-based VPNs (L2TP/IPsec, PPTP, SSTP) a RouterOS script asks the Notakey server for the approval and the firewall holds the session until the user taps Approve. RADIUS is only needed for router logins (WinBox, WebFig, SSH), or when many routers or other vendors should share one policy.
- Which RouterOS versions are supported?
- The scripts from the notakey/mikrotik-2fa-vpn repository run on RouterOS 6.46.4 or newer, including 7.x.
- Why do RADIUS logins fail before the phone buzzes?
- MikroTik’s default RADIUS timeout is 300 milliseconds. Set timeout=30s on the /radius entry so the router waits for the approval instead of giving up immediately.