View source for Mikrotik Ubuntu L2TPv3 one server six mikrotik two ubuntu

== L2TPv3 Tunnel: One Linux Server to 6 MikroTik Routers and 2 Ubuntu Servers (Template) ==

=== IP Address Plan ===

{| class="wikitable"
|-
! # !! Peer type !! Peer public IP !! Server tunnel IP !! Client tunnel IP !! tid !! ptid !! sid !! psid !! Hub interface
|-
| 1 || MikroTik || MIKROTIK_1_IP || 10.0.1.1/30 || 10.0.1.2/30 || 101 || 201 || 1001 || 2001 || l2tpeth1
|-
| 2 || MikroTik || MIKROTIK_2_IP || 10.0.2.1/30 || 10.0.2.2/30 || 102 || 202 || 1002 || 2002 || l2tpeth2
|-
| 3 || MikroTik || MIKROTIK_3_IP || 10.0.3.1/30 || 10.0.3.2/30 || 103 || 203 || 1003 || 2003 || l2tpeth3
|-
| 4 || MikroTik || MIKROTIK_4_IP || 10.0.4.1/30 || 10.0.4.2/30 || 104 || 204 || 1004 || 2004 || l2tpeth4
|-
| 5 || MikroTik || MIKROTIK_5_IP || 10.0.5.1/30 || 10.0.5.2/30 || 105 || 205 || 1005 || 2005 || l2tpeth5
|-
| 6 || MikroTik || MIKROTIK_6_IP || 10.0.6.1/30 || 10.0.6.2/30 || 106 || 206 || 1006 || 2006 || l2tpeth6
|-
| 7 || Ubuntu || UBUNTU_1_IP || 10.0.7.1/30 || 10.0.7.2/30 || 107 || 207 || 1007 || 2007 || l2tpeth7
|-
| 8 || Ubuntu || UBUNTU_2_IP || 10.0.8.1/30 || 10.0.8.2/30 || 108 || 208 || 1008 || 2008 || l2tpeth8
|}

----

=== Linux Hub Server Setup ===

Run all steps below on the central Ubuntu server (hub) with public IP <code>SERVER_IP</code>.

==== Step 1 — Install packages ====

 apt install -y linux-modules-extra-$(uname -r) go-l2tp

==== Step 2 — Load kernel modules ====

 modprobe l2tp_eth l2tp_ip l2tp_netlink
 echo -e "l2tp_eth\nl2tp_ip\nl2tp_netlink" > /etc/modules-load.d/l2tp.conf

==== Step 3 — Verify modules loaded ====

 lsmod | grep l2tp

Expected output:

 l2tp_eth
 l2tp_ip
 l2tp_netlink
 l2tp_core

==== Step 4 — Create ql2tpd configuration ====

 mkdir -p /etc/ql2tpd
 cat > /etc/ql2tpd/ql2tpd.toml << 'EOF'
 [tunnel.t1]
   version = "l2tpv3"
   encap = "ip"
   local = "SERVER_IP:0"
   peer = "MIKROTIK_1_IP:0"
   tid = 101
   ptid = 201
   [tunnel.t1.session.s1]
     pseudowire = "eth"
     sid = 1001
     psid = 2001
     interface_name = "l2tpeth1"

 [tunnel.t2]
   version = "l2tpv3"
   encap = "ip"
   local = "SERVER_IP:0"
   peer = "MIKROTIK_2_IP:0"
   tid = 102
   ptid = 202
   [tunnel.t2.session.s1]
     pseudowire = "eth"
     sid = 1002
     psid = 2002
     interface_name = "l2tpeth2"

 [tunnel.t3]
   version = "l2tpv3"
   encap = "ip"
   local = "SERVER_IP:0"
   peer = "MIKROTIK_3_IP:0"
   tid = 103
   ptid = 203
   [tunnel.t3.session.s1]
     pseudowire = "eth"
     sid = 1003
     psid = 2003
     interface_name = "l2tpeth3"

 [tunnel.t4]
   version = "l2tpv3"
   encap = "ip"
   local = "SERVER_IP:0"
   peer = "MIKROTIK_4_IP:0"
   tid = 104
   ptid = 204
   [tunnel.t4.session.s1]
     pseudowire = "eth"
     sid = 1004
     psid = 2004
     interface_name = "l2tpeth4"

 [tunnel.t5]
   version = "l2tpv3"
   encap = "ip"
   local = "SERVER_IP:0"
   peer = "MIKROTIK_5_IP:0"
   tid = 105
   ptid = 205
   [tunnel.t5.session.s1]
     pseudowire = "eth"
     sid = 1005
     psid = 2005
     interface_name = "l2tpeth5"

 [tunnel.t6]
   version = "l2tpv3"
   encap = "ip"
   local = "SERVER_IP:0"
   peer = "MIKROTIK_6_IP:0"
   tid = 106
   ptid = 206
   [tunnel.t6.session.s1]
     pseudowire = "eth"
     sid = 1006
     psid = 2006
     interface_name = "l2tpeth6"

 [tunnel.t7]
   version = "l2tpv3"
   encap = "ip"
   local = "SERVER_IP:0"
   peer = "UBUNTU_1_IP:0"
   tid = 107
   ptid = 207
   [tunnel.t7.session.s1]
     pseudowire = "eth"
     sid = 1007
     psid = 2007
     interface_name = "l2tpeth7"

 [tunnel.t8]
   version = "l2tpv3"
   encap = "ip"
   local = "SERVER_IP:0"
   peer = "UBUNTU_2_IP:0"
   tid = 108
   ptid = 208
   [tunnel.t8.session.s1]
     pseudowire = "eth"
     sid = 1008
     psid = 2008
     interface_name = "l2tpeth8"
 EOF

==== Step 5 — Create systemd service ====

 cat > /etc/systemd/system/ql2tpd.service << 'EOF'
 [Unit]
 Description=L2TPv3 Static Tunnel
 After=network.target

 [Service]
 ExecStart=/usr/sbin/ql2tpd -config /etc/ql2tpd/ql2tpd.toml
 Restart=always

 [Install]
 WantedBy=multi-user.target
 EOF

 systemctl daemon-reload
 systemctl enable --now ql2tpd

==== Step 6 — Assign tunnel IPs ====

 sleep 2
 ip addr add 10.0.1.1/30 dev l2tpeth1 && ip link set l2tpeth1 up
 ip addr add 10.0.2.1/30 dev l2tpeth2 && ip link set l2tpeth2 up
 ip addr add 10.0.3.1/30 dev l2tpeth3 && ip link set l2tpeth3 up
 ip addr add 10.0.4.1/30 dev l2tpeth4 && ip link set l2tpeth4 up
 ip addr add 10.0.5.1/30 dev l2tpeth5 && ip link set l2tpeth5 up
 ip addr add 10.0.6.1/30 dev l2tpeth6 && ip link set l2tpeth6 up
 ip addr add 10.0.7.1/30 dev l2tpeth7 && ip link set l2tpeth7 up
 ip addr add 10.0.8.1/30 dev l2tpeth8 && ip link set l2tpeth8 up

==== Step 7 — Persist IPs after reboot ====

 cat > /etc/networkd-dispatcher/routable.d/l2tp-ip.sh << 'EOF'
 #!/bin/bash
 sleep 3
 ip addr add 10.0.1.1/30 dev l2tpeth1 2>/dev/null && ip link set l2tpeth1 up 2>/dev/null
 ip addr add 10.0.2.1/30 dev l2tpeth2 2>/dev/null && ip link set l2tpeth2 up 2>/dev/null
 ip addr add 10.0.3.1/30 dev l2tpeth3 2>/dev/null && ip link set l2tpeth3 up 2>/dev/null
 ip addr add 10.0.4.1/30 dev l2tpeth4 2>/dev/null && ip link set l2tpeth4 up 2>/dev/null
 ip addr add 10.0.5.1/30 dev l2tpeth5 2>/dev/null && ip link set l2tpeth5 up 2>/dev/null
 ip addr add 10.0.6.1/30 dev l2tpeth6 2>/dev/null && ip link set l2tpeth6 up 2>/dev/null
 ip addr add 10.0.7.1/30 dev l2tpeth7 2>/dev/null && ip link set l2tpeth7 up 2>/dev/null
 ip addr add 10.0.8.1/30 dev l2tpeth8 2>/dev/null && ip link set l2tpeth8 up 2>/dev/null
 EOF
 chmod +x /etc/networkd-dispatcher/routable.d/l2tp-ip.sh

==== Step 8 — Verify interfaces ====

 ip addr show | grep l2tpeth

----

=== MikroTik Setup (Run on each router) ===

Replace the placeholder values from the table above for each MikroTik.

==== MikroTik 1 — <code>MIKROTIK_1_IP</code> ====

 /interface l2tp-ether add name=l2tpv3 connect-to=SERVER_IP local-address=MIKROTIK_1_IP local-tunnel-id=201 remote-tunnel-id=101 local-session-id=2001 remote-session-id=1001 l2tp-proto-version=l2tpv3-ip unmanaged-mode=yes disabled=no
 /ip address add address=10.0.1.2/30 interface=l2tpv3

==== MikroTik 2 — <code>MIKROTIK_2_IP</code> ====

 /interface l2tp-ether add name=l2tpv3 connect-to=SERVER_IP local-address=MIKROTIK_2_IP local-tunnel-id=202 remote-tunnel-id=102 local-session-id=2002 remote-session-id=1002 l2tp-proto-version=l2tpv3-ip unmanaged-mode=yes disabled=no
 /ip address add address=10.0.2.2/30 interface=l2tpv3

==== MikroTik 3 — <code>MIKROTIK_3_IP</code> ====

 /interface l2tp-ether add name=l2tpv3 connect-to=SERVER_IP local-address=MIKROTIK_3_IP local-tunnel-id=203 remote-tunnel-id=103 local-session-id=2003 remote-session-id=1003 l2tp-proto-version=l2tpv3-ip unmanaged-mode=yes disabled=no
 /ip address add address=10.0.3.2/30 interface=l2tpv3

==== MikroTik 4 — <code>MIKROTIK_4_IP</code> ====

 /interface l2tp-ether add name=l2tpv3 connect-to=SERVER_IP local-address=MIKROTIK_4_IP local-tunnel-id=204 remote-tunnel-id=104 local-session-id=2004 remote-session-id=1004 l2tp-proto-version=l2tpv3-ip unmanaged-mode=yes disabled=no
 /ip address add address=10.0.4.2/30 interface=l2tpv3

==== MikroTik 5 — <code>MIKROTIK_5_IP</code> ====

 /interface l2tp-ether add name=l2tpv3 connect-to=SERVER_IP local-address=MIKROTIK_5_IP local-tunnel-id=205 remote-tunnel-id=105 local-session-id=2005 remote-session-id=1005 l2tp-proto-version=l2tpv3-ip unmanaged-mode=yes disabled=no
 /ip address add address=10.0.5.2/30 interface=l2tpv3

==== MikroTik 6 — <code>MIKROTIK_6_IP</code> ====

 /interface l2tp-ether add name=l2tpv3 connect-to=SERVER_IP local-address=MIKROTIK_6_IP local-tunnel-id=206 remote-tunnel-id=106 local-session-id=2006 remote-session-id=1006 l2tp-proto-version=l2tpv3-ip unmanaged-mode=yes disabled=no
 /ip address add address=10.0.6.2/30 interface=l2tpv3

----

=== Ubuntu Remote Server Setup (Run on each Ubuntu peer) ===

Each remote Ubuntu server runs its own <code>ql2tpd</code> instance with a single static tunnel back to the hub. IDs on the remote side are the mirror of the hub tunnel row in the IP Address Plan table.

Prerequisites on each remote Ubuntu server:

* Ubuntu 24.04 (kernel 6.8+)
* Root access
* IP protocol 115 allowed in firewall toward <code>SERVER_IP</code>

==== Ubuntu Remote 1 — <code>UBUNTU_1_IP</code> ====

'''1. Install packages'''

 apt install -y linux-modules-extra-$(uname -r) go-l2tp

'''2. Load kernel modules'''

 modprobe l2tp_eth l2tp_ip l2tp_netlink
 echo -e "l2tp_eth\nl2tp_ip\nl2tp_netlink" > /etc/modules-load.d/l2tp.conf

'''3. Create ql2tpd configuration'''

 mkdir -p /etc/ql2tpd
 cat > /etc/ql2tpd/ql2tpd.toml << 'EOF'
 [tunnel.t1]
   version = "l2tpv3"
   encap = "ip"
   local = "UBUNTU_1_IP:0"
   peer = "SERVER_IP:0"
   tid = 207
   ptid = 107
   [tunnel.t1.session.s1]
     pseudowire = "eth"
     sid = 2007
     psid = 1007
     interface_name = "l2tpeth0"
 EOF

'''4. Create systemd service'''

 cat > /etc/systemd/system/ql2tpd.service << 'EOF'
 [Unit]
 Description=L2TPv3 Static Tunnel
 After=network.target

 [Service]
 ExecStart=/usr/sbin/ql2tpd -config /etc/ql2tpd/ql2tpd.toml
 Restart=always

 [Install]
 WantedBy=multi-user.target
 EOF

 systemctl daemon-reload
 systemctl enable --now ql2tpd

'''5. Assign tunnel IP'''

 sleep 2
 ip addr add 10.0.7.2/30 dev l2tpeth0
 ip link set l2tpeth0 up

'''6. Persist IP after reboot'''

 cat > /etc/networkd-dispatcher/routable.d/l2tp-ip.sh << 'EOF'
 #!/bin/bash
 sleep 3
 ip addr add 10.0.7.2/30 dev l2tpeth0 2>/dev/null
 ip link set l2tpeth0 up 2>/dev/null
 EOF
 chmod +x /etc/networkd-dispatcher/routable.d/l2tp-ip.sh

==== Ubuntu Remote 2 — <code>UBUNTU_2_IP</code> ====

'''1. Install packages'''

 apt install -y linux-modules-extra-$(uname -r) go-l2tp

'''2. Load kernel modules'''

 modprobe l2tp_eth l2tp_ip l2tp_netlink
 echo -e "l2tp_eth\nl2tp_ip\nl2tp_netlink" > /etc/modules-load.d/l2tp.conf

'''3. Create ql2tpd configuration'''

 mkdir -p /etc/ql2tpd
 cat > /etc/ql2tpd/ql2tpd.toml << 'EOF'
 [tunnel.t1]
   version = "l2tpv3"
   encap = "ip"
   local = "UBUNTU_2_IP:0"
   peer = "SERVER_IP:0"
   tid = 208
   ptid = 108
   [tunnel.t1.session.s1]
     pseudowire = "eth"
     sid = 2008
     psid = 1008
     interface_name = "l2tpeth0"
 EOF

'''4. Create systemd service'''

 cat > /etc/systemd/system/ql2tpd.service << 'EOF'
 [Unit]
 Description=L2TPv3 Static Tunnel
 After=network.target

 [Service]
 ExecStart=/usr/sbin/ql2tpd -config /etc/ql2tpd/ql2tpd.toml
 Restart=always

 [Install]
 WantedBy=multi-user.target
 EOF

 systemctl daemon-reload
 systemctl enable --now ql2tpd

'''5. Assign tunnel IP'''

 sleep 2
 ip addr add 10.0.8.2/30 dev l2tpeth0
 ip link set l2tpeth0 up

'''6. Persist IP after reboot'''

 cat > /etc/networkd-dispatcher/routable.d/l2tp-ip.sh << 'EOF'
 #!/bin/bash
 sleep 3
 ip addr add 10.0.8.2/30 dev l2tpeth0 2>/dev/null
 ip link set l2tpeth0 up 2>/dev/null
 EOF
 chmod +x /etc/networkd-dispatcher/routable.d/l2tp-ip.sh

{{Note|On remote Ubuntu peers, <code>tid</code>/<code>ptid</code> and <code>sid</code>/<code>psid</code> are swapped relative to the hub — same rule as MikroTik <code>local-tunnel-id</code>/<code>remote-tunnel-id</code>.}}

----

=== Verification ===

'''From Linux hub server — ping all peers:'''

 ping 10.0.1.2 -c 2
 ping 10.0.2.2 -c 2
 ping 10.0.3.2 -c 2
 ping 10.0.4.2 -c 2
 ping 10.0.5.2 -c 2
 ping 10.0.6.2 -c 2
 ping 10.0.7.2 -c 2
 ping 10.0.8.2 -c 2

'''From each MikroTik — ping hub tunnel IP:'''

 /ping 10.0.X.1 count=4

Replace <code>X</code> with the MikroTik number (1–6).

'''From each Ubuntu remote — ping hub tunnel IP:'''

 ping 10.0.7.1 -c 4    # Ubuntu Remote 1
 ping 10.0.8.1 -c 4    # Ubuntu Remote 2

----

=== Cleanup ===

'''Linux hub server:'''

 systemctl stop ql2tpd
 systemctl disable ql2tpd
 rm /etc/systemd/system/ql2tpd.service
 rm -rf /etc/ql2tpd
 rm -f /etc/networkd-dispatcher/routable.d/l2tp-ip.sh
 rm -f /etc/modules-load.d/l2tp.conf
 systemctl daemon-reload
 for i in 1 2 3 4 5 6 7 8; do ip link del l2tpeth$i 2>/dev/null; done
 modprobe -r l2tp_eth l2tp_ip l2tp_netlink 2>/dev/null
 apt remove -y go-l2tp

'''Each MikroTik:'''

 /ip address remove [find interface=l2tpv3]
 /interface l2tp-ether remove l2tpv3

'''Each Ubuntu remote server:'''

 systemctl stop ql2tpd
 systemctl disable ql2tpd
 rm /etc/systemd/system/ql2tpd.service
 rm -rf /etc/ql2tpd
 rm -f /etc/networkd-dispatcher/routable.d/l2tp-ip.sh
 rm -f /etc/modules-load.d/l2tp.conf
 systemctl daemon-reload
 ip link del l2tpeth0 2>/dev/null
 modprobe -r l2tp_eth l2tp_ip l2tp_netlink 2>/dev/null
 apt remove -y go-l2tp

----

=== Troubleshooting ===

{| class="wikitable"
|-
! Symptom !! Cause !! Fix
|-
| Module l2tp_eth not found || Missing extra modules || apt install linux-modules-extra-$(uname -r)
|-
| Interface not created || ql2tpd not running || systemctl restart ql2tpd && sleep 2
|-
| Link stays DOWN (MikroTik) || MikroTik sending control messages || Verify unmanaged-mode=yes is set
|-
| Link stays DOWN (Ubuntu remote) || Swapped or duplicate tunnel/session IDs || Verify tid/ptid/sid/psid mirror the hub row
|-
| No packets arriving || Firewall blocking proto 115 || Allow IP protocol 115 on hub, each MikroTik, and each Ubuntu remote
|-
| IP lost after reboot || Persistence script missing || Re-run hub Step 7 or remote Step 6
|-
| Wrong tunnel match || Duplicate or swapped IDs || Verify tid/ptid/sid/psid per IP Address Plan table
|-
| Hub pings MikroTik OK but not Ubuntu || Remote ql2tpd not started or wrong peer IP || systemctl status ql2tpd on remote; verify SERVER_IP and UBUNTU_X_IP in both configs
|}

----

=== Notes ===

* Replace all <code>SERVER_IP</code>, <code>MIKROTIK_X_IP</code>, and <code>UBUNTU_X_IP</code> placeholders with real public IP addresses before running.
* The hub runs one <code>ql2tpd</code> with eight tunnels; each remote Ubuntu runs its own single-tunnel <code>ql2tpd</code>.
* Each tunnel must have unique <code>tid</code>, <code>ptid</code>, <code>sid</code>, and <code>psid</code> values across the entire deployment.
* MikroTik <code>local-tunnel-id</code> = hub <code>ptid</code> and <code>remote-tunnel-id</code> = hub <code>tid</code>.
* Ubuntu remote <code>tid</code> = hub <code>ptid</code> and <code>ptid</code> = hub <code>tid</code> (same mirroring rule).
* MikroTik <code>unmanaged-mode=yes</code> is mandatory — without it the control protocol runs and the tunnel will not connect to <code>ql2tpd</code>.
* Ubuntu-to-Ubuntu legs also use static <code>ql2tpd</code>; neither side runs the L2TPv3 control protocol.
* The tunnel carries raw Ethernet frames (pseudowire type: <code>eth</code>), suitable for Layer 2 bridging between sites.
* Tested on Ubuntu 24.04 (kernel 6.8) and RouterOS 7.20.
* No encryption by default — wrap with IPsec for production use.

----

=== References ===

* [https://github.com/go-l2tp/go-l2tp go-l2tp GitHub]
* [https://manpages.ubuntu.com/manpages/noble/man8/ql2tpd.8.html ql2tpd.toml man page]
* [https://datatracker.ietf.org/doc/html/rfc3931 RFC 3931 — L2TPv3]
* [https://datatracker.ietf.org/doc/html/rfc4719 RFC 4719 — L2TPv3 Ethernet Pseudowire]
* [[Mikrotik Ubuntu L2TPv3]]
* [[Mikrotik Ubuntu L2TPv3 one server six mikrotik]]