In general, to configure tunnels in MikroTik (such as VPNs, GRE tunnels, or any other type of point-to-point tunnel), it is very useful that at least one of the endpoints has a fixed public IP address.

However, it is not always absolutely necessary, and there are ways to handle situations where endpoints have dynamic or private IPs.

We explain how:

When one or both ends have a fixed public IP

• Ideal situation: When one of the ends has a fixed public IP, configuration and maintenance of the tunnel is easier, since this end can act as a stable anchor for the tunnel, to which the other end (with dynamic or private IP) can connect .

When both ends have dynamic IPs

• Use of DDNS services: If both endpoints have dynamic IP addresses, you can use Dynamic DNS (DDNS) services to maintain a consistent address despite changes in IPs. MikroTik supports several DDNS services, allowing each endpoint to automatically update its DNS record when its IP changes, thus maintaining tunnel reachability.
• VPN peering with dynamic initiation: Some VPN protocols, such as OpenVPN or IPsec, allow the tunnel to be initiated from either end and can handle changes to IP addresses without requiring a fixed address. This is usually done by configuring routers to periodically attempt to establish or reestablish the tunnel or upon detecting that the connection has been lost.

When both ends are behind NAT

• Using NAT Traversal: For situations where one or both ends are behind a NAT, technologies such as NAT Traversal (NAT-T) for IPsec or port forwarding configuration can help establish and maintain the tunnel. NAT-T allows IPsec to traffic through NAT devices by encapsulating IPSec packets within UDP packets.
• Port forwarding configuration: If you use tunnels that do not natively support NAT-T, such as some types of GRE tunnels, you will need to configure port forwarding in NAT to allow incoming traffic to the internal MikroTik device.

Considerations

• Security and stability: Having at least one endpoint with a fixed IP improves the security and stability of the tunnel, as it reduces configuration complexity and the risk of interruptions due to changes in the IP address.
• Monitoring and maintenance: Configurations with dynamic IP require greater monitoring and possibly more maintenance to ensure the tunnel remains operational and secure.

In summary, although it is beneficial and less complicated to have a fixed public IP at one end of the tunnel in MikroTik, there are various technical solutions to configure and maintain tunnels when this is not possible.