Hello, I have recently bought a "crs125-24g-1s-rm" for use as a gateway router/switch with a DHCP server and VPN server. The CRS125 is connected to the internet as follows.
WAN > TD-8817 Modem in bridge mode > CRS125 PPPOE client
PPPOE client is using masquerading NAT.
The problem I am having is with the PPTP VPN server. I have set it up, and can connect to the router. But, I cannot ping the router, LAN devices or WAN (8.8.8.
.
For months I have been playing around with it to get it to work and finally I did. With the addition of these IP Firewall rules. The only problem is, when I disconnect the PPTP connection the rules get disabled. Even after reconnecting, the rules are still highlighted red. It needs to be manually enabled again.
add chain=forward in-interface=pptp-shayne
add chain=input in-interface=pptp-shayne
add chain=output out-interface=pptp-shayne
Please help me to get the VPN working. I have attached the full router export below.
aug/23/2014 13:05:26 by RouterOS 6.13
software id = xxxxxx
/interface bridge
add arp=proxy-arp l2mtu=1588 mtu=1460 name=bridge1
/interface ethernet
set [ find default-name=ether1 ] comment="Wifi AP" name="ether1 - WiFi"
set [ find default-name=ether2 ] comment="LAN - ether3-23 are switched off ether2" name="ether2 - LM"
set [ find default-name=ether3 ] master-port="ether2 - LM" name="ether3 T&G"
set [ find default-name=ether4 ] master-port="ether2 - LM" name="ether4 - T&G"
set [ find default-name=ether5 ] master-port="ether2 - LM" name="ether5 - T&G"
set [ find default-name=ether6 ] master-port="ether2 - LM" name="ether6 - T&G"
set [ find default-name=ether7 ] master-port="ether2 - LM" name="ether7 - PP"
set [ find default-name=ether8 ] master-port="ether2 - LM" name="ether8 - PP"
set [ find default-name=ether9 ] master-port="ether2 - LM" name="ether9 - PP"
set [ find default-name=ether10 ] master-port="ether2 - LM" name="ether10 - PP"
set [ find default-name=ether11 ] master-port="ether2 - LM" name="ether11 - JR"
set [ find default-name=ether12 ] master-port="ether2 - LM" name="ether12 - JR"
set [ find default-name=ether13 ] master-port="ether2 - LM" name="ether13 - SG"
set [ find default-name=ether14 ] master-port="ether2 - LM" name="ether14 - SG"
set [ find default-name=ether15 ] master-port="ether2 - LM" name="ether15 - SG"
set [ find default-name=ether16 ] master-port="ether2 - LM" name="ether16 - SG"
set [ find default-name=ether17 ] master-port="ether2 - LM" name="ether17 - ST"
set [ find default-name=ether18 ] master-port="ether2 - LM" name="ether18 - ST"
set [ find default-name=ether19 ] master-port="ether2 - LM" name="ether19 - CNC"
set [ find default-name=ether20 ] auto-negotiation=no full-duplex=no master-port="ether2 - LM" name="ether20 - FP"
set [ find default-name=ether21 ] master-port="ether2 - LM"
set [ find default-name=ether22 ] master-port="ether2 - LM" name="ether22 - NAS"
set [ find default-name=ether23 ] master-port="ether2 - LM" name="ether23 - PABX"
set [ find default-name=ether24 ] comment=WAN name="ether24 - WAN"
set [ find default-name=sfp1 ] disabled=yes master-port="ether2 - LM"
/interface pptp-server
add name=pptp-shayne user=shayne
/ip neighbor discovery
set "ether1 - WiFi" comment="Wifi AP"
set "ether2 - LM" comment="LAN - ether3-23 are switched off ether2"
set "ether24 - WAN" comment=WAN
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m mac-cookie-timeout=3d
/ip pool
add name=dhcp_pool ranges=192.168.0.1-192.168.0.249
add name=vpn_pool ranges=192.168.2.251-192.168.2.255
/ip dhcp-server
add address-pool=dhcp_pool disabled=no interface=bridge1 lease-time=1d name=dhcp1
/port
set 0 name=serial0
/ppp profile
add change-tcp-mss=yes dns-server=192.168.0.1 local-address=192.168.0.250 name=VPS-VPN remote-address=vpn_pool use-compression=yes use-encryption=yes use-mpls=yes use-vj-compression=yes
/interface pppoe-client
add ac-name="" add-default-route=yes allow=pap default-route-distance=1 dial-on-demand=no disabled=no interface="ether24 - WAN" keepalive-timeout=60 max-mru=1480 max-mtu=1480 mrru=1600 name=pppoe-SLT password=xxxxxxx profile=default service-name=""
use-peer-dns=yes user=knxxxxxxx@sltbb
/interface bridge port
add bridge=bridge1 comment="LAN - ether2-23" interface="ether2 - LM"
add bridge=bridge1 comment="Wifi AP" interface="ether1 - WiFi"
/interface pptp-server server
set authentication=mschap2 default-profile=VPS-VPN enabled=yes max-mru=1460 max-mtu=1460
/ip address
add address=192.168.0.1/24 comment="LAN IP subnet" interface=bridge1 network=192.168.0.0
/ip dhcp-server lease
xxxxx
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.0.0/24 list=OurLocalLAN
/ip firewall filter
add chain=input comment="Allow access to the router from LAN using address list" src-address-list=OurLocalLAN
add chain=input comment="Allow access to router using external WINBOX" dst-port=8291 protocol=tcp
add chain=input comment="PPTP VPN" dst-port=1723 protocol=tcp
add chain=input protocol=gre
add chain=forward in-interface=pptp-shayne
add chain=input in-interface=pptp-shayne
add chain=output out-interface=pptp-shayne
add action=drop chain=forward comment="Drop invalid connections" connection-state=invalid
add action=drop chain=input comment="drop ftp brute forcers" dst-port=21 protocol=tcp src-address-list=ftp_blacklist
add chain=output content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp
add chain=forward comment="Allow connections from the LAN" connection-state=new in-interface=bridge1
add chain=forward comment="Allow established connections" connection-state=established
add chain=forward comment="Allow related connections" connection-state=related
add action=drop chain=forward comment="Drop all other connections states"
add chain=input comment="Allow established connections to the router" connection-state=established
add chain=input comment="Allow related connections to the router" connection-state=related
add action=drop chain=input comment="Drop all other traffic to the router"
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-SLT
/ip firewall service-port
set pptp disabled=yes
/ip upnp
set allow-disable-external-interface=no
/lcd
set default-screen=stats time-interval=daily
/lcd pin
set pin-number=xxxx
/lcd interface
set "ether1 - WiFi" interface="ether1 - WiFi"
set "ether2 - LM" interface="ether2 - LM"
set "ether3 T&G" interface="ether3 T&G"
set "ether4 - T&G" interface="ether4 - T&G"
set "ether5 - T&G" interface="ether5 - T&G"
set "ether6 - T&G" interface="ether6 - T&G"
set "ether7 - PP" interface="ether7 - PP"
set "ether8 - PP" interface="ether8 - PP"
set "ether9 - PP" interface="ether9 - PP"
set "ether10 - PP" interface="ether10 - PP"
set "ether11 - JR" interface="ether11 - JR"
set "ether12 - JR" interface="ether12 - JR"
set "ether13 - SG" interface="ether13 - SG"
set "ether14 - SG" interface="ether14 - SG"
set "ether15 - SG" interface="ether15 - SG"
set "ether16 - SG" interface="ether16 - SG"
set "ether17 - ST" interface="ether17 - ST"
set "ether18 - ST" interface="ether18 - ST"
set "ether19 - CNC" interface="ether19 - CNC"
set "ether20 - FP" interface="ether20 - FP"
set ether21 interface=ether21
set "ether22 - NAS" interface="ether22 - NAS"
set "ether23 - PABX" interface="ether23 - PABX"
set "ether24 - WAN" interface="ether24 - WAN"
set sfp1 interface=sfp1
/lcd interface pages
set 0 interfaces="ether1 - WiFi,ether2 - LM,ether3 T&G,ether4 - T&G,ether5 - T&G,ether6 - T&G,ether7 - PP,ether8 - PP,ether9 - PP,ether10 - PP,ether11 - JR,ether12 - JR"
set 1 interfaces="ether13 - SG,ether14 - SG,ether15 - SG,ether16 - SG,ether17 - ST,ether18 - ST,ether19 - CNC,ether20 - FP,ether21,ether22 - NAS,ether23 - PABX,ether24 - WAN"
/ppp secret
add name=xxxxx password=xxxxx profile=VPS-VPN service=pptp
/system clock
set time-zone-name=Asia/Colombo
/system leds
set 0 disabled=yes
/system ntp client
set enabled=yes mode=unicast primary-ntp=192.248.1.168 secondary-ntp=220.247.242.85