Už som si poradil, ak by to niekomu náhodou pomohlo...
/ip pool
add comment=VPN name=l2tp-pool ranges=172.19.190.200-172.19.190.250
/ip dhcp-server
add address-pool=l2tp-pool interface=bridge name=defconf
/ppp profile
add change-tcp-mss=yes dns-server=172.19.187.10 interface-list=LAN \
local-address=172.19.190.1 name=l2tp-ipsec remote-address=l2tp-pool \
use-encryption=required
/ip firewall filter
add action=accept chain=input comment="L2TP VPN" dst-port=500,1701,4500 \
in-interface=ether1-wan protocol=udp src-port=""
add action=accept chain=input in-interface=ether1-wan protocol=ipsec-esp
add action=accept chain=input in-interface=ether1-wan protocol=ipsec-ah
add action=accept chain=forward dst-address=172.19.190.0/24 src-address=\
172.19.187.0/24
add action=accept chain=forward dst-address=172.19.187.0/24 src-address=\
172.19.190.0/24
# Blokovanie internetu cez VPN
add action=drop chain=forward comment="VPN drop outside bridge" in-interface=\
all-ppp out-interface=!bridge
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat dst-address=172.19.190.0/24 src-address=\
172.19.187.0/24
add action=masquerade chain=srcnat dst-address=172.19.187.0/24 src-address=\
172.19.190.0/24
