This guide assumes that the Mikrotik WAN interface has a public IP address and that your ISP does not block ipsec ports. With this out of the way, let's get started. The first step is to create a PPP profile on Mikrotik. We will use 192.168.102.1 for the local address (VPN gateway), assuming that it is not yet in use. We also need to add a DNS server.
/ppp profile add name=ipsec_vpn local-address=192.168.102.1 dns-server=188.8.131.52
Then we add the server interface of the l2tp server and set the authentication methods allowed, mschap1 and mschap2.
/interface l2tp-server server set enabled=yes default-profile=ipsec_vpn authentication=mschap1,mschap2
Next, we need to define IPSec peering, as well as the default IPsec policy. We will also establish the secret of the pre-key in the process./ip ipsec policy set [ find default=yes ] src-address=0.0.0.0/0 dst-address=0.0.0.0/0 protocol=all proposal=default template=yes
For Router OS 6.39 and lower use
/ip ipsec peer add address=0.0.0.0/0 port=500 auth-method=pre-shared-key secret=STRONG_SECRET_HERE exchange-mode=main-l2tp send-initial-contact=no generate-policy=port-override
For Router OS 6.44 and higher use :
/ip ipsec peer add exchange-mode=main passive=yes name=l2tpserver /ip ipsec identity add generate-policy=port-override auth-method=pre-shared-key secret=STRONG_SECRET_HERE peer=l2tpserver
Next we set the default encryption algorithms
/ip ipsec proposal set default auth-algorithms=sha1 enc-algorithms=3des pfs-group=modp1024
Now we add the user and assign an IP address
/ppp secret add name=USERNAME password=STRONG PASSWORD service=l2tp profile=ipsec_vpn remote-address=192.168.102.2
Finally we need to open the IPSec ports from the WAN
/ip firewall filter add chain=input action=accept protocol=udp port=1701,500,4500 /ip firewall filter add chain=input action=accept protocol=ipsec-esp
Note that these two rules must be added at the top of the list before any other rules to allow connections from the WAN interface. Either use the move command using the CLI to move them to the top of the list, or use the GUI.