Accessing device on hotspot network remotely

RouterOS Beginner Basics
1

Hi everyone

I have the following set up:

DSL MODEM-RB433(ETH1)-HOTSPOT NETWORK SETUP ON RB433(ETH2).

I have a number of Ubiquiti wireless devices setup as AP’s on my hotspot network. I would like to be able to monitor these remotely over the internet.

I have done some reading and it seems that I have to setup port forwarding to each Ubiquiti device.

As far as I know, I will forward all the ports from the DSL modem to ETH1 on the RB433 then in Winbox I must set a firewall rule to forward each port to the specific device on the ETH2 interface.

I am not sure which firewall rule to use in Winbox and I am scared that this could create a security risk on the Hotspot(for example could some use those ports to bypass the hotspot server/accounting?).

I would appreciate some advice!

2

Make a vpn server, who let you into the hotspot network.

3

Do i setup a normal VPN and bridge this to the hotspot network or do I NAT all traffic to the hotspot network?

Could you explain this step by step possibly?

4

Depends on what you want to acces. If its just IP addresses inside, make a pptp or l2tp and give Your vpn Client a internal IP. If you need a l2 Connection. you can make this by a l2tp, or eoip etc.

5

step by step (Ip)

Make a ppp profile
Make a ppp user With a ip from the internal hotspot network.
setup a pptp server (or l2tp. maybe to preffer). (set the mtu to 1280)

Connect to the server from a host, and wolla. you can ping Devices inside.

6

Thanks to everyone for the help

I am battling to get the VPN set up.

I currently have a VPN set up between two Mikrotik routers, but when I try use another device such as a laptop or smartphone I don’t get a connection(in the Mikrotik log it says “VPN:Authenticated”, it goes to “VPN:discounted”).

My setup is:

PPTP Profile :
Everything default except
Local address(Hotspot pool)
DNS Server’s entered

PPTP Secret :
Everything default except
Username, Password
Service : PPTP
Profile : Hotspot profile(described above)
Remote Address : An IP address in hotspot range

PPTP authentication:
MSCHAP1 and MSCHAP2

Am I missing something?