VPN for mobile users that works from everywhere.

gosha · August 31, 2007, 12:22pm

Hi!

Is there a way to make a VPN server on mikrotik, like PPtP but to make it so it will be usable from any client, from behind NAT that does not supports VPN pass-thru and so on?

sergejs · August 31, 2007, 12:27pm

Well, interesting question first of all how MikroTik server could be responsible for remote client.
One of the way to avoid PPTP limitation on NAT environment, use L2TP instead that is newer VPN protocol that has improvements, it does not ask for NAT passtrough helpers.

gosha · August 31, 2007, 1:09pm

Thanks for the answer!

Is there any howtos about configuring windows to be a l2tp client?

janisk · August 31, 2007, 1:36pm

in manual you can see the configuration example

imho it does not differ much from pptp

gosha · August 31, 2007, 4:38pm

It’s really does not differ much on server side. But my XP Pro give me the choice - PPtP or L2TP with IPSec. When I’m trying to establish a connection it writes that this connection requires a certificate which is not found…

t3rm · August 31, 2007, 6:53pm

OpenVPN would be better, i guess ..

gosha · August 31, 2007, 7:38pm

Openvpn can not be installed on Mikrotik…

changeip · August 31, 2007, 7:59pm

openvpn is part of 3.0

gosha · August 31, 2007, 8:09pm

The answer to my question was in manual
There was just need to disable IPSec in registry :

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters:

Value Name: ProhibitIpSec
Data Type: REG_DWORD
Value: 1

And everything started work. Will try with unfriendly NAT network tomorrow. Thanks to all.

gosha · September 1, 2007, 7:57am

What about client on Windows Vista?

gosha · September 3, 2007, 7:27am

Urgently need help!
One of my clients is on Dubai now and he need to connect to his office. PPtP does not works - error 619 (NAT router or firewall blocks backward connection). I tried to configure L2TP by phone but seems that Vista has a difference in configuration. I have no Vista here to try, can someone help us try to configure L2TP client on Vista without IPSEC?

sergejs · September 3, 2007, 11:35am

Probably this will help,
http://www.jacco2.dds.nl/networking/vista-openswan.html#IPsec_without_L2TP

gosha · September 3, 2007, 11:56am

Thanks, but there is IPSec without L2TP and IPSec/L2TP but I need L2TP wothout IPSEC

sergejs · September 3, 2007, 12:10pm

Oh, you are right.
Try to search Microsoft support pages or ask their support for help.

gosha · September 4, 2007, 5:02pm

Is it possible to use L2TP server with IPSEC (certificate or pre-shared keys)?

sergejs · September 5, 2007, 1:17pm

It should be no problem, look at the IPSec and L2TP documentation, how to create L2TP server and IPSec encryption.
As you are planning to use IPSec for mobile clients, then you may not create policy, but use ‘ip ipsec peer’ with address as 0.0.0.0 and generate-policy=yes (that will create dynamic IPSec policy), secret is the same option as preshared key.