Good day, everyone!
It just so happens that our company has been gradually transitioning to MikroTik devices over the past two years. The main nodes are built on CCR1072, while local points for connecting computers use simpler devices. Naturally, there is also the integration of networks via IPSEC tunnel, which is quite straightforward to set up, thanks to the abundance of materials available online. However, there are certain challenges with mobile client connections; the manufacturer's wiki suggests how to use Shrew Soft. VPN client (this configuration seems clear) and this client is used by 99% of remote access users. As for the remaining 1%, that’s me; I simply got tired of entering my username and password in the client every time and desired a more comfortable setup from my couch for connecting to work networks. I couldn't find instructions for configuring MikroTik for scenarios where it's not behind a gray address, but rather behind a black one and perhaps even multiple NATs in the network. Therefore, I had to improvise, and I suggest taking a look at the results.
Available:
- CCR1072 as the main device. Version 6.44.1
- CAP ac as the home access point. Version 6.44.1
The main feature of the configuration is that the PC and MikroTik must be in the same network with the same addressing, which is provided by the main 1072.
Let’s move on to the configuration:
1. Of course, we enable Fasttrack, but since Fasttrack is not compatible with VPNs, we have to exclude its traffic.
/ip firewall mangle
add action=mark-connection chain=forward comment="ipsec in" ipsec-policy=
in,ipsec new-connection-mark=ipsec passthrough=yes
add action=mark-connection chain=forward comment="ipsec out" ipsec-policy=
out,ipsec new-connection-mark=ipsec passthrough=yes
/ip firewall filter add action=fasttrack-connection chain=forward connection-mark=!ipsec
2. We add network routes in/out of the home and work networks.
/ip firewall raw
add action=accept chain=prerouting dst-address=192.168.33.0/24 src-address=
10.7.76.0/24
add action=accept chain=prerouting dst-address=192.168.33.0/24 src-address=
10.7.98.0/24
add action=accept chain=prerouting disabled=yes dst-address=192.168.55.0/24
src-address=10.7.78.0/24
add action=accept chain=prerouting dst-address=10.7.76.0/24 src-address=
192.168.33.0/24
add action=accept chain=prerouting dst-address=10.7.77.0/24 src-address=
192.168.33.0/24
add action=accept chain=prerouting dst-address=10.7.98.0/24 src-address=
192.168.33.0/24
add action=accept chain=prerouting disabled=yes dst-address=10.7.78.0/24
src-address=192.168.55.0/24
add action=accept chain=prerouting dst-address=192.168.33.0/24 src-address=
10.7.77.0/24
3. We create a user connection description.
/ip ipsec identity
add auth-method=pre-shared-key-xauth notrack-chain=prerouting peer=CO secret=
общий ключ xauth-login=username xauth-password=password
4. We create an IPSEC Proposal.
/ip ipsec proposal
add enc-algorithms=3des lifetime=5m name="prop1" pfs-group=none
5. We create an IPSEC Policy.
/ip ipsec policy
add dst-address=10.7.76.0/24 level=unique proposal="prop1"
sa-dst-address=<white IP 1072> sa-src-address=0.0.0.0 src-address=
192.168.33.0/24 tunnel=yes
add dst-address=10.7.77.0/24 level=unique proposal="prop1"
sa-dst-address=<white IP 1072> sa-src-address=0.0.0.0 src-address=
192.168.33.0/24 tunnel=yes
6. We create an IPSEC profile.
/ip ipsec profile
set [ find default=yes ] dpd-interval=disable-dpd enc-algorithm=
aes-192,aes-128,3des nat-traversal=no
add dh-group=modp1024 enc-algorithm=aes-192,aes-128,3des name=profile_1
add name=profile_88
add dh-group=modp1024 lifetime=4h name=profile246
7. We create an IPSEC peer.
/ip ipsec peer
add address=<white IP 1072>/32 local-address=<ваш адрес роутера> name=CO profile=
profile_88
Now, a bit of simple magic. Since I wasn't keen on changing settings on all devices in the home network, I needed to find a way to attach DHCP to the same network. However, it became evident that MikroTik does not allow more than one address pool on a single bridge, so I found a workaround: I simply created a DHCP Lease for my laptop with manual parameter settings, and since netmask, gateway, and DNS also have option numbers in DHCP, I specified those manually as well.
1. DHCP Option
/ip dhcp-server option
add code=3 name=option3-gateway value="'192.168.33.1'"
add code=1 name=option1-netmask value="'255.255.255.0'"
add code=6 name=option6-dns value="'8.8.8.8'"
2. DHCP Lease
/ip dhcp-server lease
add address=192.168.33.4 dhcp-option=
option1-netmask,option3-gateway,option6-dns mac-address=<MAC адрес ноутбука>
The 1072 configuration is essentially basic; when issuing an IP address to a client, the settings specify that it should provide the manually entered IP rather than one from the pool. For regular clients using personal computers, the subnet remains the same as in the Wiki configuration 192.168.55.0/24.
This type of configuration allows PCs to connect without third-party software, with the tunnel being established by the router as needed. The load on the client CAP is practically minimal, around 8-11% at speeds of 9-10MB/s in the tunnel.
All settings were made via Winbox, although they can also be done through the console with equal success.
Source: habr.com
