hello for all my Friends here…! so i tried alot to setup a tunneling protocol between My Windows 10 machine and Ros951ui -(i am talking about L2TP protocol)- but with no avail .
i don’t know if i miss something but well… i apply a lot of configuration out there in youtub , google…etc.but all this doesn’t working .
so please anyone setup L2TP or any other VPN protocol in Ros and get an active connection until now..?
please if anyone can help and thanks in advance.
this is my config in the pictures below
in the server name or address section in my windows vpn setting -red colour- i put my public ip address not my out interface so does that make a different ..?
very thanksful Mr own3r1138 for your replay..!
but what this address 172.17…represent..? do i have to have a docker in my case ..? also can you please send your config on your windows pc..?
Keep in mind that my setup is a bit different from what you want to do my server acts as a VPN server like any third-party VPN service. There is no LAN at this setup but besides this, the L2TP server configuration is the same.
172.17.
No, You don’t need it it’s just an extra DNS server.
do I have to have a docker in my case
No
also can you please send your config on your windows pc
Note: check the official document my P1/P2 is different from the default setting. I’m going to share this part too.
Hello MR own3r1138..! so what i have to write on my terminal in order to export all my data..?
this is my network diagram.
Eth1 represent out interface with ip 192.168.2.2
all other interface represent LAN in Bridge interface with ip=192.168.1.1
in my D-link router-DMZ section i put the ip address of my out interface of Mikrotik 192.168.2.1
so both mikrotik and D-Link in same DMZ
Forget DMZ, its not a wise security move
What you need to do is port forward the applicable ports from the DLINK router to 192.168.2.2
For example if you were using wireguard it would be the wireguard port, if it was L2TP it would be port 1701 etc…
On the mikrotik you need to add access to these ports on the INPUT CHAIN.
This is assuming you want the MT to be a server/receiver for initial vpn connectivity.
hello anav..! yes i setup an access rule im my mikrotik as you mention
for the DMZ it has been there for a while -in my network- and until now i didn’t encounter such a big issue in security. the purpose of DMZ in my case is to setup the forwarding rule
in my mikrotik instead of Dlink router. and that’s rule work fine until now.
Simply open your terminal and type “export hide-sensitive”. Copy& paste it into the text editor. Then, remove any public IP address or sensitive data. It’s ready to be published.
As Anav said you have two main options. I like the first option the most if it’s possible. Also, your public IP is still a valid answer.
If your upstream service is PPPOE you could set your TP-link to bridge mode and set your PPPOE in MT.
Well how can i do that from mikrotik side..? - set my dlink router as abridge and set my pppoe in MT-..?
i don’t think that i find such an option on pppoe section. Please olif there is any quide or anything that explain the setup proccess. So you mean in this case i dont need to use DMZ any more if i do that..?
I checked your export file you should remove your software id and serial number from your export. First, find out how can you continue with your setup then we talk about the MT config.
So you mean in this case i dont need to use DMZ any more if i do that..?
Well, Firstly, it makes your setup more complex which is unnecessary. Secondly, nowadays doesn’t add any benefit with regard to security.
Thirdly, in general, MT is more caple than ISP-provided routers.
set my dlink router as abridge
First, you have to check if this is something that you can achieve.
Mine is TP-link However, TP and D-link GUIs’ are much like each other.
set my pppoe in MT
The easiest way is to set it up from the quick-set menu.
Your VPN IP pool range should be different from your LAN IP pool. You should also add this to your address list. or use ARP.
MT wiki recommends that the VPN range should be different.
name=l2tp ranges=192.168.1.200-192.168.1.230
CLI.
add address=192.168.1.1/24 interface=LAN network=192.168.1.0
add address=192.168.100.1/24 interface=LAN network=192.168.100.0
ip pool
add name=l2tp ranges=192.168.100.2-192.168.100.254
