Hi Guys,
I have reading article after article after article and I am stuck on how to configure the MikroTik Router to enabled:
VPN Server (over PPPoE) using RADIUS with multiple subnets and still can’t get it 100% there yet.
I have about 95% configured and guess I just having a routing problem between the two LAN subnets, but let me explain in more detail:
I want to allow the MikroTik device to be a VPN Server (that authenticates with RADIUS inside the LAN segment), and then allow the client connecting to have access to the inside LAN.
I got RADIUS working and authenticating properly, I got the VPN also properly established and I can ping the following:
I can ping the PPPoE interface, ether1 and ether2 from the VPN client, but I can’t ping any hosts INSIDE the LAN
I also have full access to the internet when the VPN connection is successfully established - BUT it seems when I do a DNS lookup it seems to be “using” the DNS server on the VPN client’s machine and not the DNS server on the LAN segment which is configured to be used by the VPN clients. I can’t see the “INSIDE LAN” from the VPN client’s machine.
- I would like to enable all VPN protocols due to L2TP being blocked by our cellular networks (not all but some of them)!
Here is my config:
- DSL MODEM: 192.168.2.2
- Briged-mode with PPPoE passthrough (firewall disabled and all ports open)
- WAN1 (PPPoE): ... (this IP is dynamic from ISP) - DynDNS used to resolve host and works 100%
- Use Peer DNS
- Add Default Route
- ETHER1 (Connection to WAN1 - DSL MODEM): 192.168.2.1
- ARP: enabled
- ETHER2 (Connection to INSIDE LAN): 192.168.1.1
- ARP: proxy-arp
- PPP - Interface:
[PPTP Server]: enabled - using profile in #6
[SSTP Server]: enabled - using profile in #6
[L2TP Server]: enabled - using profile in #6
[OVPN Server]: enabled - using profile in #6
- PPP - Profile (Configuration for VPN Clients):
- Local Address: 192.168.3.1
- Remote Address: 192.168.3.0/24
- DNS Server: 192.168.0.1 (INSIDE LAN SERVER)
- WINS Server: 192.168.0.1 (INSIDE LAN SERVER)
- PPP - Secrets:
- Use Radius
- Accounting
- IP - Addresses:
- 192.168.1.1/24 bound to ETHER2
- 192.168.2.1/24 bound to ETHER1
- ... bound to WAN1
- IP - DNS:
- Allow Remote Requests (unticked)
- IP - Firewall [Filter Rules]:
-
All PPTP, L2TP, SSTP, OVPN ports are opened on the INPUT CHAIN, e.g. TCP {1723, 1812, 1813}; GRE; UDP {500, 1701, 4500} - ect…
-
All traffic allowed from LAN to outside
- IP - Firewall [NAT]:
- masquerade rule configured on the WAN1 Interface (as the Out. Interface)
- IP - Firewall [Mangle]:
- change MSS on the forward chain for TCP traffic on the all ppp Interface as the In. Interface
- change MSS on the forward chain for TCP traffic on the all ppp Interface as the Out. Interface
- IP - Firewall [Service Ports]:
- PPTP: enabled
- IP - Routes:
- 0.0.0.0/0: Gateway=... this is the - Dynamic IP; ROUTE FLAGS: DAS
- : Gateway= - Dynamic IP; ROUTE FLAGS: DAC
- 192.168.0.0/24: Gateway=192.168.1.1; ROUTE FLAGS: AS
- 192.168.1.0/24: Gateway=192.168.1.1; ROUTE FLAGS: DAC
- 192.168.2.0/24: Gateway=192.168.2.1; ROUTE FLAGS: DAC
- IP - Settings:
- IP Forward: enabled
- Send Redirects: enabled
- Accept Redirects: disabled
- Secure Redirects: enabled
- Allow Fast Path: enabled
- Allow Hw. Fast Path: disabled
- RP Filter: no
- TCP SynCookies: disabled
- RADIUS:
-
-Services enabled-: ppp + login
-
Address: 192.168.0.1 (INSIDE LAN SERVER)
-
Secret: ******
-
Authentication Port: 1812
-
Accounting Port: 1813
-
Src. Address: 0.0.0.0
-
Any help would be greatly appreciated… as I have already watched 15 videos in total of more than 5 hours, and read countless documents and I am seriously scratching my head on this one?
I would like to keep my VPN clients on the subnet 192.168.3.0/24, DSL+ETHER1 on the subnet 192.168.2.0/24; ETHER2 on subnet 192.168.1.0/24; INSIDE LAN on subnet 192.168.0.0/24