Looking for VPN solution behind router

RouterOS General
1

Hello,

I work for an company that installs a lot of different devices that has acces over IP (Cam’s, VoIP, Building automation, Media, Wifi, …). To further help our clients and give them fast and easy remote support we are looking to update our existing remote support solution and give our smal clients with only 1 or 2 devices also the possibility for remote support.

We have 2 different networks 1) (example 1 from diagram) existing netwerk, no control over router or something else, these typically grow over time and 2) (example 2 from diagram) new larger installations with Mikrotik RB3011 as router controlled by us. and here we currently setup VPN access to them.

Fore example 1 i seek a solution to get VPN like access but with juist a simple mikrotik (hEX or something like that) in the network and not as gateway. maybe and PPPoE server at the office these can connect to.

But we have a few requirements to make it easy to use for us and not be an burden to the client.

  1. usable for multiple tech’s: Tech A can go to client 1, and Tech B can go to Client 2
  2. Tech can be at the office or on an remote location like an other client.
  3. The behind existing router’s VPN solution must work in every netwerk
  4. Our existing clients with Mikrotik’s also in this system

Many Thanks,
Maarten Van Parijs
concept_access_to_remote_network.jpg

2

For “small” numbers of customers you can setup L2TP/IPsec VPN on the routers installed at client locations and connecting to your own router.
The connections will all be outbound and normally work over existing NAT routers.
A known limitation is that there can only be 1 client behind the same NAT (so no 2 routers at the same client or 2 clients at an ISP that uses NAT for its clients, e.g. 4G network).
To route the local subnets you can use an autorouting protocol like BGP or OSPF.
Of course you want to have proper firewall rules in place so clients will not be able to access eachother’s networks.

It works, but it will not scale really well (e.g. for hundreds or thousands of client networks).