Na Mikrotiku mám zprovozněn OpenVPN server podle toho návodu: https://itles.cz/blog-openvpn-na-mikrotiku.
OpenVPN server funguje a lze se na něj připojit.
Rozsah pro LAN je 172.16.1.0/24 a pro VPN 172.16.2.0/24
Problém je, že se VPN client nemůže připojit na IP adresy v LAN.
Konfigurace Mikrotiku na kterém běží OpenVPN server:
/ip address
add address=a.a.a.a/26 interface=ether1 network=a.a.a.192
add address=172.16.1.1/24 interface=LAN network=172.16.1.0
add address=172.16.2.1/24 interface=LAN network=172.16.2.0
/interface ovpn-server server
set auth=sha1 certificate=OPENVPN-SERVER cipher=aes256 default-profile=ovpn-profile enabled=yes port=443
/interface bridge
add name=LAN
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] disable-running-check=no
/interface bridge port
add bridge=LAN interface=ether2
/ppp profile
add bridge=LAN local-address=172.16.2.1 name=ovpn-profile only-one=yes remote-address=ovpn-pool-1 use-compression=yes \
use-encryption=required
/ppp secret
add name=vpnclient password=pass profile=ovpn-profile remote-address=172.16.2.254 service=ovpn
/ip firewall filter
add action=accept chain=input comment="INPUT START" connection-state=established
add action=accept chain=input connection-state=related
add action=drop chain=input connection-state=invalid
add action=accept chain=input dst-address=a.a.a.a protocol=icmp
add action=accept chain=input dst-address=a.a.a.a dst-port=443 protocol=tcp
add action=accept chain=input src-address-list=local
add action=drop chain=input comment="INPUT END"
add action=accept chain=forward comment="FORWARD START" connection-state=established
add action=accept chain=forward connection-state=related
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward src-address-list=local
add action=drop chain=forward comment="FORWARD STOP"
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip firewall address-list
add address=172.16.1.0/24 list=local
add address=172.16.2.0/24 list=local
/ip route
add distance=1 gateway=a.a.a.193
Konfigurace VPN clienta
client
tls-client
verb 3
remote-cert-tls server
remote a.a.a.a 443
cipher AES-256-CBC
dev tun
nobind
auth-nocache
script-security 2
persist-key
persist-tun
#comp-lzo no
proto tcp
tun-mtu 1500
mssfix 1400
route 172.16.0.0 255.240.0.0
dhcp-option DNS 172.16.1.1
<cert>
</cert>
<ca>
</ca>
<key>
</key>
Nějaký nápad jak komunikaci VPN -> LAN zprovoznit?
Díky.
