3
« kdy: 18. 02. 2022, 13:37:04 »
Ospravedlňujem sa stále sa učím.
Typ VPN je OpenVPN
client
dev tun
proto tcp-client
remote <verejná IP>
port 1190
nobind
persist-key
persist-tun
tls-client
remote-cert-tls server
ca cert_export_CA.crt
cert cert_export_client.crt
key cert_export_client.key
verb 4
mute 10
cipher AES-256-CBC
auth SHA1
auth-user-pass secret
auth-nocache
redirect-gateway def1
Mikrotik konfigurácia
/interface bridge
add admin-mac=E4:8D:8C:CA:30:04 arp=proxy-arp auto-mac=no fast-forward=no \
name=bridge-local
/interface ethernet
set [ find default-name=ether1 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full name=\
ether1-gateway
set [ find default-name=ether2 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full name=\
ether2-master-local
set [ find default-name=ether3 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full name=\
ether3-slave-local
set [ find default-name=ether4 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full arp=proxy-arp \
name=ether4-slave-local
/interface wireless
set [ find default-name=wlan1 ] antenna-gain=2 band=2ghz-b/g/n channel-width=\
20/40mhz-Ce country=slovakia default-ap-tx-limit=15000000 \
default-authentication=no distance=indoors frequency=2427 frequency-mode=\
regulatory-domain mode=ap-bridge ssid="AP " wireless-protocol=802.11 \
wps-mode=disabled
/interface list
add name=mac-winbox
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=\
dynamic-keys supplicant-identity=MikroTik wpa2-pre-shared-key=12345678
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=dhcp ranges=192.168.88.30-192.168.88.199
/ip dhcp-server
add address-pool=dhcp authoritative=after-2sec-delay disabled=no interface=\
bridge-local lease-time=3d10m name=default
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/interface bridge port
add bridge=bridge-local interface=ether2-master-local
add bridge=bridge-local interface=wlan1
add bridge=bridge-local interface=ether3-slave-local
add bridge=bridge-local interface=ether4-slave-local
/interface l2tp-server server
set ipsec-secret=tl6271 one-session-per-host=yes use-ipsec=required
/interface list member
add interface=ether2-master-local list=mac-winbox
add interface=ether3-slave-local list=mac-winbox
add interface=ether4-slave-local list=mac-winbox
add interface=wlan1 list=mac-winbox
add interface=bridge-local list=mac-winbox
/interface ovpn-server server
set auth=sha1 certificate=server cipher=aes256 enabled=yes port=1190 \
require-client-certificate=yes
/ip address
add address=192.168.88.1/24 comment="default configuration" interface=\
ether2-master-local network=192.168.88.0
add address=10.202.45.229/25 interface=ether1-gateway network=10.202.45.128
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid interface=\
ether1-gateway
/ip dhcp-server lease
add address=192.168.88.201 comment="NAS Synology - Lesnak" mac-address=\
00:11:32:98:99:E5 server=default
add address=192.168.88.200 client-id=1:d8:d:17:d0:29:b9 mac-address=\
D8:0D:17:D0:29:B9 server=default
/ip dhcp-server network
add address=192.168.88.0/24 comment="default configuration" dns-server=\
109.236.119.2,109.236.120.2 gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=10.202.254.1,8.8.8.8
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add action=drop chain=input comment=\
"20.9.2019 <ISP> - zapnute kvoli DNS utokom z vonku" dst-port=53 \
in-interface=ether1-gateway protocol=udp
add action=drop chain=input comment=\
"20.9.2019 <ISP> - zapnute kvoli DNS utokom z vonku" dst-port=53 \
in-interface=ether1-gateway protocol=tcp
add action=accept chain=input comment="Vzdialena sprava" dst-port=8291 \
protocol=tcp
add action=accept chain=input comment=OpenVPN dst-port=1190 protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" \
out-interface=ether1-gateway
/ip firewall service-port
set ftp disabled=yes
/ip route
add distance=1 gateway=10.202.45.129
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
/ip upnp
set allow-disable-external-interface=yes enabled=yes
/ip upnp interfaces
add interface=bridge-local type=internal
add interface=ether1-gateway type=external
/ppp secret
add local-address=192.168.88.1 name=tade password=<heslo> remote-address=\
192.168.88.251 service=ovpn
add local-address=192.168.88.1 name=jan password=<heslo> remote-address=\
192.168.88.252 service=ovpn
/system clock
set time-zone-name=Europe/Bratislava
/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox
/tool romon port
add
od ISP ide gpon do Mikrotiku takže IP je NAT 1:1
Mikrotik je v režime CAP
LAN je 192.168.88.0/24
Od Mikrotiku je cez eth4 kábel do switchu a od switchu ďalej na TP-link router v móde router a LAN na ňom je 192.168.0.0/24
PC má IP 192.168.0.180 na ňom je zdieľaný priečinok
Ostatné PC majú cestu na tento priečinok \\DESKTOP-ALJKSH5\AZsoft
V lokálnej LAN sa viem pripojiť ale cez VPN nie.
Ďakujem za pomoc
Zobrazit příspěvky
