Free SmartOLT

Connect an OLT through OpenVPN and a MikroTik router

Most OLTs sit on a private address such as 192.168.100.2 and cannot be reached from the internet. You do not need a public IP. A MikroTik router on the same network as the OLT connects out to the panel by OpenVPN, and the panel reaches the OLT through that tunnel.

How the tunnel works

  • The panel's OpenVPN server is vpn.freesmartolt.com on TCP port 1194.
  • Your MikroTik is the OpenVPN client. It dials out to the server. You do not open any port on your side.
  • Each OLT gets its own VPN login and its own fixed tunnel IP. The panel makes them for you when you save the OLT.
  • A dst-nat rule on the router forwards TCP port 2323 on the tunnel IP to the OLT's Telnet port on your LAN.
  • If SNMP is enabled for the OLT, a second rule forwards UDP port 2161 on the tunnel IP to the OLT's SNMP port.
  • Firewall rules made by the script allow only these forwards from the panel. Everything else that arrives through the tunnel is dropped, so the panel can reach the OLT and nothing else in your network.
  • The tunnel does not become your default route and does not change your DNS. Customer traffic is not affected.

What you need

  • A MikroTik router with RouterOS 6 or RouterOS 7. The script stops with SmartOLT requires RouterOS 6 or 7 on anything else.
  • The router must have an address in the same network as the OLT and must be able to ping the OLT.
  • The router must reach the internet on TCP port 1194.
  • Telnet must be on at the OLT. Choose the correct manufacturer and check the model compatibility list.

1. Add the OLT with the VPN connection

  1. In the panel open Settings, then OLTs, then press Add OLT.
  2. In Connection choose Through the SmartOLT VPN (no public IP needed).
  3. In OLT IP enter the OLT's own address as your MikroTik sees it, for example 192.168.100.2.
  4. Leave Telnet TCP port at 23 unless your OLT uses another port.
  5. Enter the OLT telnet username and password, then press Save.

You are taken to the OLT page with the message OLT saved. Now connect your MikroTik to the SmartOLT VPN with the commands below. All fields are explained in Add an OLT.

2. Find the ready made script

The script is on the OLT page, on the OLT details tab, in the panel named SmartOLT VPN. Until the router connects, that panel shows the orange badge Waiting for your MikroTik.

You can come back to it at any time in two ways:

  • Settings, then OLTs, then View on the OLT.
  • Settings, then VPN & TR069. In the table OLTs on the VPN, press Router commands.

The three lines and the full script both carry the VPN login of this OLT. The lines work for 24 hours; reload the OLT page for fresh ones. Do not post them in a chat group or a forum. Each OLT has its own script. Do not reuse the script of one OLT for another.

3. Paste it into the MikroTik

  1. Press Copy under the three lines in the SmartOLT VPN panel. They tell the router to download its setup script from your panel, run it and delete the file.
  2. Open Winbox, connect to the MikroTik the OLT is connected to, and open New Terminal.
  3. Paste the three lines and press Enter. The router needs internet access for this. If it cannot download, open The router cannot download from the internet? Paste the full script instead in the same panel, copy that script and paste all of it. It is one block that starts with { and ends with }.
  4. Wait for the line SmartOLT configured. Check that smartolt-olt1 becomes running under Interfaces, then refresh the OLT in SmartOLT. The number at the end of the interface name is the ID of your OLT.

The script does these things on the router:

  • It adds an OVPN client interface named smartolt-olt followed by the OLT ID.
  • It adds the NAT, filter, mangle and route entries for the forward. Every entry has the interface name as its comment, so you can find them later.

Pasting the script again is safe. It first removes what an earlier paste made, then adds it again. Several OLTs can use the same MikroTik. Paste the script of each OLT once.

4. Check that the tunnel is up

On the router:

  • Open Interfaces. The interface smartolt-olt1 (with your OLT ID) must show as running.

In the panel:

  1. On the OLT page press Check again. The SmartOLT VPN panel should now show the green badge Connected, with the public address your router connected from and the time since it connected.
  2. The Connection row of the details table shows VPN connected.
  3. Press Refresh to make the first read. You should see a message such as Main OLT read: 240 ONUs, 231 online.

You can also see all tunnels at once under Settings, then VPN & TR069. The Router column shows Connected or Not connected for each OLT. In the OLT list, the VPN column shows a green tick or a red cross with the word Tunnel.

A connected tunnel only proves that the router reached the panel. The OLT login is tested separately when you press Refresh.

RouterOS 6 and RouterOS 7 notes

  • The same script works on both versions. It reads the RouterOS version and runs the right commands for it.
  • The tunnel uses OpenVPN over TCP with AES 256 CBC and SHA1, which both versions support.
  • On RouterOS 7 the script creates a routing table named after the interface. On RouterOS 6 it uses a routing mark with the same name. This sends the OLT's answers back through the right tunnel.
  • The router logs in to the VPN with the username and password of this OLT. No certificate is installed on the router.

When to paste the script again

The script is made from the OLT's settings. Copy it again from the OLT page and paste it into the router after you:

  • change the OLT IP or the Telnet TCP port,
  • enable SNMP monitoring or change the SNMP UDP port,
  • replace the MikroTik with another one.

If something goes wrong

  • The badge stays on "Waiting for your MikroTik". Check that the router can reach the internet on TCP port 1194. Check under Interfaces that the smartolt-olt interface exists and is enabled. Paste the script again and read the terminal output for an error.
  • "Your MikroTik is not connected to the SmartOLT VPN yet." The panel tried to read the OLT while the tunnel was down. Bring the tunnel up, then press Refresh.
  • The tunnel is connected but the OLT does not answer. The panel says that nothing answered at the OLT's address. Check the OLT IP and the Telnet port, check that the MikroTik has an address in the same network as the OLT and can ping it, then paste the router commands again.
  • "...no device at 192.168.100.2 on its network." The OLT IP is wrong, or the OLT's management port is not plugged into this MikroTik's network.
  • The connection was refused. Paste the router commands again. If that changes nothing, turn Telnet on at the OLT or enter the port it really uses.

All messages are explained in When an OLT will not connect.

Still stuck? Write to us and include your site name. No panel yet? Create one for free.