Hi all I have internet in my office and in this case we need to use internet with user and pass for connecting to l2tp for access internet! we have another office in building and we use mikrotik to connect the internet and share internet between the other pcs and phones , know we need to forward the port to some servers , let me clear explain :
we have internet that can connect with L2tp so we use mikrotik to connect internet
we have 3 other lan : 1 for servers (192.168.50.X) 1 for pc and phone office (192.168.55.X) and the enter lan port that from main building with sip account
all pc , phone and servers use l2tp connection that in mikrotik(mikrotik is a client of l2tp)
pc , phone and servers can’t see or ping each other.(but we want happen!)
now we need from outside(Internet) can access to internal port on servers (192.168.50.X) , that’s my config file :
# mar/15/2020 01:05:26 by RouterOS 6.46.1
# software id = XXXXXXX
#
# model = 951G-2HnD
# serial number = XXXXXX
/interface l2tp-client
add add-default-route=yes connect-to=172.16.10.20 disabled=no \
keepalive-timeout=600 name=netPark password=sec user=\
sec
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
management-protection=allowed mode=dynamic-keys name=profile1 \
supplicant-identity="" wpa-pre-shared-key=sec \
wpa2-pre-shared-key=sec
/interface wireless
set [ find default-name=wlan1 ] antenna-gain=0 country=no_country_set \
disabled=no frequency-mode=manual-txpower mode=ap-bridge \
security-profile=profile1 ssid="SSID_SEC"
/ip pool
add name=dhcp_pool0 ranges=192.168.50.2-192.168.50.254
add name=dhcp_pool1 ranges=192.168.55.2-192.168.55.254
add name=VpnToOffice ranges=192.168.99.5-192.168.99.200
add name=dhcp_pool3 ranges=172.16.20.2-172.16.20.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=ether1 name=dhcp1
add address-pool=dhcp_pool1 disabled=no interface=wlan1 name=dhcp2
/ppp profile
add dns-server=172.16.10.20,5.200.200.200 local-address=VpnToOffice name=\
OfficePPTP only-one=yes remote-address=VpnToOffice use-encryption=yes
/interface detect-internet
set detect-interface-list=all
/interface pptp-server server
set authentication=chap,mschap1,mschap2 default-profile=OfficePPTP enabled=\
yes
/ip address
add address=192.168.50.1/24 interface=ether1 network=192.168.50.0
add address=192.168.55.1/24 interface=wlan1 network=192.168.55.0
/ip dhcp-client
add disabled=no interface=ether2 use-peer-dns=no
/ip dhcp-server network
add address=172.16.20.0/24 gateway=172.16.20.1
add address=192.168.50.0/24 gateway=192.168.50.1
add address=192.168.55.0/24 gateway=192.168.55.1
/ip dns
set allow-remote-requests=yes cache-max-ttl=1d servers=\
8.8.8.8,1.1.1.1,8.8.4.4,4.2.2.4,4.2.2.1,8.8.2.2
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address=!172.16.50.11 \
new-routing-mark=netParkRouting passthrough=yes src-address=\
192.168.55.0/24
add action=mark-routing chain=prerouting dst-address=!172.16.50.11 \
new-routing-mark=netParkRoutingToEth passthrough=yes src-address=\
192.168.50.0/24
add action=mark-routing chain=prerouting new-routing-mark=netLocalRouting \
passthrough=yes src-address=172.16.10.0/24
add action=mark-routing chain=prerouting new-routing-mark=\
netLocalRoutingToEth passthrough=yes src-address=172.16.10.0/24
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=SEC protocol=tcp to-addresses=\
192.168.50.5 to-ports=22
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat dst-address=172.16.50.11 out-interface=\
ether2
add action=masquerade chain=srcnat dst-address=172.27.184.38 out-interface=\
netPark
add action=masquerade chain=srcnat out-interface=ether2 src-address=\
172.16.50.11
add action=masquerade chain=srcnat dst-address=!172.16.50.11 out-interface=\
netPark src-address=!172.16.50.11
/ip route
add check-gateway=ping distance=1 gateway=netPark routing-mark=netParkRouting
add check-gateway=ping distance=1 gateway=netPark routing-mark=\
netParkRoutingToEth
add check-gateway=ping distance=1 gateway=ether2 routing-mark=netLocalRouting
add check-gateway=ping distance=1 gateway=ether2 routing-mark=\
netLocalRoutingToEth
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=SEC
set ssh disabled=yes port=SEC
set api disabled=yes
set winbox port=SEC
set api-ssl disabled=yes
/ip ssh
set forwarding-enabled=remote
/ppp secret
add name=user1 password=m1 profile=OfficePPTP
/system clock
set time-zone-name=Asia/Tehran
/system identity
set name="MehrITco(Office)"
/system ntp client
set enabled=yes primary-ntp=5.144.132.2 secondary-ntp=157.119.108.165
/tool traffic-monitor
add disabled=yes interface=netPark name=tmon1 threshold=0
add disabled=yes interface=netPark name=tmon2 threshold=0 traffic=received
in top SEC is use to secure important things