Hello,
I tried something new on my infrastructure with PPTP client but it not really works.
This is why I’m doing the following steps:
For some traffic on special destination IPs I need to send the requests over a VPN to a farm into a different country.
This is my situation before:
I have a VLAN 4 for all my mobile devices and all components which need the mobile devices to be controlled. This VLAN 4 has a separated bridge called “SubBridge”. I choose this way to separate the traffic this devices. The wi-fi networks are controlled by CaPsMAN.
I also have a VLAN 15 for other devices which are directly connected via cable. This devices are hosted on the Bridge called “MainBridge”.
This is what I tried:
I implemented a PPTP client like described in this tutorial - https://support.hidemyass.com/hc/en-us/articles/204558497-Mikrotik-Client-Setup
This is what happened:
The PPTP client is connecting to its farm and everything looks good. If I try to reach the special IPs via my computer in VLAN15 I get the websites and everything looks fine. All requests a send via the PPTP client.
When I try to reach the same IPs and websites via a mobile device I cannot reach the dresses and the websites.
Can you determine what is wrong with my configuration?
# nov/26/2018 18:09:28 by RouterOS 6.43.4
# software id = xxx
#
# model = 960PGS
# serial number = xxx
/caps-man channel
add band=2ghz-g/n control-channel-width=20mhz extension-channel=XX frequency=\
2412,2427 name="2GHz Auswahlliste"
add band=5ghz-n/ac control-channel-width=20mhz extension-channel=XX \
frequency=5180,5260,5280,5300,5320 name="5GHz Auswahlliste"
add frequency=2472 name=3
add frequency=5180 name=36
add frequency=5200 name=40
add frequency=5220 name=44
add frequency=5240 name=48
add frequency=5260 name=52
add frequency=5280 name=56
add frequency=5300 name=60
add frequency=5320 name=64
add frequency=5500 name=100
add frequency=5520 name=104
add frequency=5540 name=108
add frequency=5560 name=112
add frequency=5580 name=116
add frequency=5600 name=120
add frequency=5620 name=124
add frequency=5600 name=128
add frequency=5660 name=132
add frequency=5680 name=136
add frequency=5700 name=140
/interface bridge
add admin-mac=CC:2D:E0:68:3D:3E auto-mac=no comment=defconf name=MainBridge \
pvid=5 vlan-filtering=yes
add admin-mac=CC:2D:E0:68:3D:3D auto-mac=no name=SubBridge protocol-mode=none
/interface ethernet
set [ find default-name=ether1 ] speed=100Mbps
set [ find default-name=ether2 ] poe-out=off speed=100Mbps
set [ find default-name=ether3 ] poe-out=forced-on speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=sfp1 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full disabled=yes
/interface pptp-client
add allow=mschap2 connect-to=1-at.cg-dialup.net disabled=no \
keepalive-timeout=disabled name=PPTP password=passwd user=\
user
/interface vlan
add interface=MainBridge name=VLAN5 vlan-id=5
add interface=MainBridge name=VLAN4 vlan-id=4
add interface=MainBridge name=VLAN11 vlan-id=11
add interface=MainBridge name=VLAN12 vlan-id=12
add interface=MainBridge name=VLAN13 vlan-id=13
add interface=MainBridge name=VLAN14 vlan-id=14
add interface=MainBridge name=VLAN15 vlan-id=15
add interface=MainBridge name=VLAN16 vlan-id=16
add interface=MainBridge name=VLAN17 vlan-id=17
/caps-man datapath
add bridge=SubBridge client-to-client-forwarding=yes l2mtu=1500 \
local-forwarding=no name=datapathSubBridgeWlan
/caps-man configuration
add channel.band=5ghz-n/ac channel.extension-channel=eC channel.frequency=\
5320 channel.skip-dfs-channels=yes country=germany datapath=\
datapathSubBridgeWlan datapath.client-to-client-forwarding=no name=\
Config5GHz_Wohnzimmer rx-chains=0,1,2 \
security.authentication-types=wpa2-psk security.encryption=aes-ccm \
security.group-key-update=2h security.passphrase=pass ssid=Woodroot5 \
tx-chains=0,1,2
add channel.band=2ghz-g/n channel.extension-channel=Ce channel.frequency=2442 \
channel.skip-dfs-channels=yes country=germany datapath=\
datapathSubBridgeWlan datapath.client-to-client-forwarding=no name=\
Config2GHz_Outdoor rx-chains=0,1,2 \
security.authentication-types=wpa2-psk security.encryption=aes-ccm \
security.group-key-update=2h security.passphrase=pass ssid=Woodroot \
tx-chains=0,1,2
add channel.band=2ghz-g/n channel.extension-channel=Ce channel.frequency=2412 \
channel.skip-dfs-channels=yes country=germany datapath=\
datapathSubBridgeWlan datapath.client-to-client-forwarding=no name=\
Config2GHz_Wohnzimmer rx-chains=0,1,2 \
security.authentication-types=wpa2-psk security.encryption=aes-ccm \
security.group-key-update=2h security.passphrase=pass ssid=Woodroot \
tx-chains=0,1,2
add channel.band=2ghz-g/n channel.extension-channel=Ce channel.frequency=2442 \
channel.skip-dfs-channels=yes country=germany datapath=\
datapathSubBridgeWlan datapath.client-to-client-forwarding=no name=\
Config2GHz_Balkonzimmer rx-chains=0,1,2 \
security.authentication-types=wpa2-psk security.encryption=aes-ccm \
security.group-key-update=2h security.passphrase=pass ssid=Woodroot \
tx-chains=0,1,2
add channel.band=5ghz-n/ac channel.extension-channel=Ce channel.frequency=\
5260 channel.skip-dfs-channels=yes country=germany datapath=\
datapathSubBridgeWlan datapath.client-to-client-forwarding=no name=\
Config5GHz_Balkonzimmer rx-chains=0,1,2 \
security.authentication-types=wpa2-psk security.encryption=aes-ccm \
security.group-key-update=2h security.passphrase=pass ssid=Woodroot5 \
tx-chains=0,1,2
add channel.band=5ghz-n/ac channel.extension-channel=Ce channel.frequency=\
5180 channel.skip-dfs-channels=yes country=germany datapath=\
datapathSubBridgeWlan datapath.client-to-client-forwarding=no name=\
Config5GHz_Outdoor rx-chains=0,1,2 \
security.authentication-types=wpa2-psk security.encryption=aes-ccm \
security.group-key-update=2h security.passphrase=pass ssid=Woodroot5 \
tx-chains=0,2
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=192.168.11.150-192.168.11.200
add name=dhcp_pool2 ranges=192.168.12.150-192.168.12.200
add name=dhcp_pool3 ranges=192.168.13.150-192.168.13.200
add name=dhcp_pool4 ranges=192.168.14.150-192.168.14.200
add name=dhcp_pool5 ranges=192.168.15.150-192.168.15.200
add name=dhcp_pool6 ranges=192.168.16.150-192.168.16.200
add name=dhcp_pool7 ranges=192.168.17.150-192.168.17.200
add name=dhcp_pool8 ranges=192.168.4.150-192.168.4.200
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=VLAN11 name=dhcp1
add address-pool=dhcp_pool2 disabled=no interface=VLAN12 name=dhcp2
add address-pool=dhcp_pool3 disabled=no interface=VLAN13 name=dhcp3
add address-pool=dhcp_pool4 disabled=no interface=VLAN14 name=dhcp4
add address-pool=dhcp_pool5 disabled=no interface=VLAN15 name=dhcp5
add address-pool=dhcp_pool6 disabled=no interface=VLAN16 name=dhcp6
add address-pool=dhcp_pool7 disabled=no interface=VLAN17 name=dhcp7
add address-pool=dhcp_pool8 disabled=no interface=SubBridge lease-time=23h59m \
name=dhcp8
/caps-man aaa
set mac-mode=as-username-and-password
/caps-man access-list
add action=accept allow-signal-out-of-range=1s disabled=no interface=any \
signal-range=-85..120 ssid-regexp="" time=\
0s-1d,sun,mon,tue,wed,thu,fri,sat
add action=reject allow-signal-out-of-range=10s disabled=no interface=any \
signal-range=-120..-86 ssid-regexp="" time=\
0s-1d,sun,mon,tue,wed,thu,fri,sat
/caps-man manager
set enabled=yes
/caps-man manager interface
add
add interface=VLAN4
add forbid=yes interface=MainBridge
add interface=SubBridge
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=gn identity-regexp=\
MikroTik-AP-Wohnzimmer master-configuration=\
Config2GHz_Wohnzimmer
add action=create-dynamic-enabled hw-supported-modes=gn identity-regexp=\
MikroTik-AP-Outdoor master-configuration=Config2GHz_Outdoor
add action=create-dynamic-enabled hw-supported-modes=gn identity-regexp=\
MikroTik-Balkonzimmer master-configuration=\
Config2GHz_Balkonzimmer
add action=create-dynamic-enabled hw-supported-modes=ac identity-regexp=\
MikroTik-AP-Wohnzimmer master-configuration=\
Config5GHz_Wohnzimmer
add action=create-dynamic-enabled hw-supported-modes=ac identity-regexp=\
MikroTik-Balkonzimmer master-configuration=\
Config5GHz_WBalkonzimmer
add action=create-dynamic-enabled hw-supported-modes=ac identity-regexp=\
MikroTik-AP-Outdoor master-configuration=Config5GHz_Outdoor
/interface bridge port
add bridge=MainBridge comment=defconf interface=ether2 pvid=5
add bridge=MainBridge comment=defconf hw=no interface=ether3 pvid=5
add bridge=MainBridge comment=defconf interface=ether5
add bridge=MainBridge comment=defconf hw=no interface=sfp1 pvid=5
add bridge=SubBridge interface=VLAN4 pvid=4
add bridge=MainBridge interface=ether4
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=MainBridge tagged=MainBridge,ether2,ether5,ether3,ether4 vlan-ids=\
4
add bridge=MainBridge tagged=ether2,MainBridge vlan-ids=11
add bridge=MainBridge tagged=ether2,MainBridge vlan-ids=12
add bridge=MainBridge tagged=ether2,MainBridge vlan-ids=13
add bridge=MainBridge tagged=ether2,MainBridge vlan-ids=14
add bridge=MainBridge tagged=ether2,MainBridge vlan-ids=15
add bridge=MainBridge tagged=ether2,MainBridge vlan-ids=16
add bridge=MainBridge tagged=ether2,MainBridge vlan-ids=17
add bridge=MainBridge tagged=ether2,ether3,ether4,ether5 vlan-ids=5
/interface list member
add comment=defconf interface=MainBridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether4 list=LAN
add interface=VLAN11 list=LAN
add interface=VLAN12 list=LAN
add interface=VLAN13 list=LAN
add interface=VLAN14 list=LAN
add interface=VLAN15 list=LAN
add interface=VLAN16 list=LAN
add interface=VLAN17 list=LAN
add interface=VLAN5 list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether5 list=LAN
add disabled=yes list=LAN
add disabled=yes list=LAN
add disabled=yes interface=SubBridge list=LAN
add interface=VLAN4 list=LAN
/ip address
add address=192.168.15.15/24 disabled=yes interface=ether4 network=\
192.168.15.0
add address=192.168.4.1/24 disabled=yes interface=VLAN4 network=\
192.168.4.0
add address=192.168.11.1/24 interface=VLAN11 network=192.168.11.0
add address=192.168.12.1/24 interface=VLAN12 network=192.168.12.0
add address=192.168.13.1/24 interface=VLAN13 network=192.168.13.0
add address=192.168.14.1/24 interface=VLAN14 network=192.168.14.0
add address=192.168.15.1/24 interface=VLAN15 network=192.168.15.0
add address=192.168.16.1/24 interface=VLAN16 network=192.168.16.0
add address=192.168.17.1/24 interface=VLAN17 network=192.168.17.0
add address=192.168.5.1/24 interface=MainBridge network=192.168.5.0
add address=192.168.4.1/24 interface=SubBridge network=192.168.4.0
add address=192.168.2.10/24 interface=ether1 network=192.168.2.0
add address=192.168.5.10/24 disabled=yes interface=VLAN5 network=192.168.5.0
/ip dhcp-server lease
add address=192.168.4.163 client-id=1:2c:f0:a2:40:bb:99 mac-address=\
2C:F0:A2:40:BB:99 server=dhcp8
add address=192.168.4.154 client-id=1:d0:d2:b0:7f:2c:59 mac-address=\
D0:D2:B0:7F:2C:59 server=dhcp8
/ip dhcp-server network
add address=192.168.4.0/24 dns-server=192.168.4.1,192.168.2.1 gateway=\
192.168.4.1
add address=192.168.11.0/24 dns-server=192.168.11.1,192.168.2.1 gateway=\
192.168.11.1
add address=192.168.12.0/24 dns-server=192.168.12.1,192.168.2.1 gateway=\
192.168.12.1
add address=192.168.13.0/24 dns-server=192.168.13.1,192.168.2.1 gateway=\
192.168.13.1
add address=192.168.14.0/24 dns-server=192.168.14.1,192.168.2.1 gateway=\
192.168.14.1
add address=192.168.15.0/24 dns-server=192.168.15.1,192.168.2.1 gateway=\
192.168.15.1
add address=192.168.16.0/24 dns-server=192.168.16.1,192.168.2.1 gateway=\
192.168.16.1
add address=192.168.17.0/24 dns-server=192.168.17.1,192.168.2.1 gateway=\
192.168.17.1
/ip dns
set allow-remote-requests=yes servers=192.168.2.1
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=input icmp-options=8:0 in-interface-list=WAN protocol=\
icmp
add action=drop chain=forward icmp-options=8:0 in-interface-list=WAN \
protocol=icmp
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
/ip firewall mangle
add action=mark-routing chain=prerouting disabled=yes new-routing-mark=PPTP \
passthrough=yes src-address=192.168.4.154
add action=mark-routing chain=prerouting disabled=yes new-routing-mark=PPTP \
passthrough=yes src-address=192.168.15.200
add action=mark-routing chain=prerouting disabled=yes new-routing-mark=PPTP \
passthrough=yes src-address=192.168.4.163
add action=mark-routing chain=prerouting disabled=yes new-routing-mark=PPTP \
passthrough=yes src-address=192.168.4.103
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat out-interface=PPTP
/ip route
add distance=1 gateway=PPTP routing-mark=PPTP
add distance=1 gateway=192.168.2.1
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=MikroTik-Keller2
/system logging
add topics=wireless,debug
/system ntp client
set enabled=yes primary-ntp=192.53.103.108 secondary-ntp=44.225.94.177
/system ntp server
set enabled=yes
/system routerboard settings
set silent-boot=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN