Postni sem za 1, Konfiguraci mikrotiku
2, máš ve Win tu VPN dobře nastavenou ? tzn. MS-CHAP V2 (pokud používáš nebo jiné protokoly), předsdílený klíč (pokud máš) atd?
pači sa
/ip pool
add name=dhcp_pool1 ranges=10.0.0.2-10.0.0.254
add name=dhcp_pool2 ranges=192.168.1.2-192.168.1.14
add name=L2TP-pool ranges=10.0.1.2-10.0.1.254
/ppp profile
add local-address=L2TP-pool name=L2TP remote-address=L2TP-pool
/ppp secret
add name=test password=test2 profile=L2TP service=l2tp
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1 src-address=\
10.0.1.0/24
add action=masquerade chain=srcnat out-interface=ether1 src-address=\
10.0.0.0/24
add action=masquerade chain=srcnat out-interface=ether1 src-address=\
192.168.1.0/28
/ip firewall filter
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input port=1701,500,4500 protocol=udp
# wlan2 not ready
add action=drop chain=forward in-interface=bridge out-interface=wlan2
# wlan2 not ready
add action=drop chain=forward in-interface=wlan2 out-interface=bridge
add action=jump chain=forward jump-target=GUEST-WLAN src-address-list=GUEST
add action=jump chain=forward dst-address-list=GUEST jump-target=GUEST-WLAN
add action=drop chain=input protocol=!icmp src-address-list=GUEST
add action=drop chain=input protocol=!icmp src-address-list=BAR-ANTENA
add action=accept chain=input comment="ACCEPT -- Povoli\9D moje IP" dst-port=\
8291 in-interface-list=WAN protocol=tcp src-address-list=POVOLENE
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=accept chain=GUEST-WLAN comment=GUEST-WLAN protocol=icmp \
src-address-list=GUEST
add action=accept chain=GUEST-WLAN comment=GUEST-WLAN dst-port=\
20,21,25,80,110,143,443,465,587,993,995 protocol=tcp src-address-list=\
GUEST
add action=accept chain=GUEST-WLAN comment=GUEST-WLAN dst-port=53,80,123,587 \
protocol=udp src-address-list=GUEST
add action=drop chain=GUEST-WLAN comment=GUEST-WLAN src-address-list=GUEST
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S 0.0.0.0/0 192.168.20.65 1
1 ADC 10.0.0.0/24 10.0.0.1 bridge 0
2 ADC 192.168.20.64/27 192.168.20.71 ether1 0
