As I have covered creating both OpenVPN and SSTP server on Mikrotik, one might rightfully wonder - which one is better?

Security-wise, on Mikrotik, they are pretty much even. Both use certificates, both can use AES, and both allow for the perfect forward secrecy. If you decide to stick with Windows 10 or you are willing to tweak Windows 7 a bit, SSTP can even be forced to use only TLS 1.2.

When it comes to connectivity, by default SSTP has a slight advantage as it defaults to port 443 which traverses pretty much any firewall. But it is not a big advantage as OpenVPN can offer exactly the same success rate if configured accordingly. Unfortunately both also support only TCP as the base protocol, by design in the case of SSTP and by Mikrotik’s choice in the case of OpenVPN. If you are on a lossy or even just slow link, TCP-over-TCP tunneling is going to make bad situation worse.

OpenVPN does have a bit of advantage when it comes to support across various platforms as you cannot find an OS without it. If you are dealing with Linux platforms (including Android), OpenVPN is probably the best route. While there are open source versions of SSTP for various platforms, it roots are on Windows and there it works flawlessly and out of the box. It is the VPN of choice if you need to get Windows machine on VPN without installing any additional software.

Guess what, performance of both protocols, if configured similarly, is also close. OpenVPN might seem a bit slower at the time but usually this is when different ciphers are selected. If you keep both at AES-128 (SSTP’s default in force-aes mode), you will see both as being equal. Mind you, neither is “cheap” as far as CPU usage goes. It is just that neither has advantage over the other.

Frankly, based on all things I cared about, either protocol will do a good job but neither is perfect nor supported on all devices. I personally keep both turned on with a common security profile so I can use the same user name and password for both. If I am connecting from Windows computer I go SSTP route just because it is so frictionless. For all non-Windows devices, including mobile phones, I go OpenVPN.