VPN over L2TP/IPSEC

RouterOS General
1

I have a Mikrotik Rb450G already setup and now wanting to add VPN service. Do I have to setup PPP/profile/Service - user/password/L2TP or can I just enable L2TP Server then setup under IP/IPSec the service with pre-shared password etc, then under Firewall filter enable input chain>protocol>UDP>DST Ports>500/1701/4500 however, under Advance I would include the SRC Mac address of my laptop! Also, could I add more mac addresses later, such as an iPad?

The VPN is to connect to my home office as the only user from places such as coffee shop, friends or family homes.

2

REMEMBER: TILL NOW (6.11) ONLY ONE L2TP + IPSec CAN BE MADE!!!

And not ask why or how, search on the forum. :laughing:

3

Thank you Rextended for responding and for the hint…that would be okay as I am the only person who would be connecting. However, can you comment on the rest of my question…I would really appreciate it…thanks again!

4

This is what I used to setup L2TP on my RB133.
http://mikrotik.patokatech.com/

5

is using L2TP better than PPTP for VPN connections ?

6

REMEMBER: TILL NOW (6.11) ONLY ONE L2TP + IPSec CAN BE MADE!!!

7

Not true. One client will be able to connect only if more than one client sitting behind the same NATed router and tries to connect to the same server.
In other cases number of connected clients is not limited.

8

True, sorry for the missing clarification! :confused:

9

When will this be fixed?

Sent from my SCH-I545 using Tapatalk

10

Cannot tell you when, but we are working on it.

11

Thanks for the response; however, most responses have nothing to do with answering my question except Jaytcsd’s attempt. I am glad for the clarification regarding the amount of client’s ability to connect via L2TP/Ipsec.

I really want to use the Mac Address of my laptop in conjunction with the pre-shared key and wanted to include that in the firewall filter. I noticed in one of Jaytcsd’s image that an interface had been used for the inclusion of the Mac Address. So, in that case, I have an extra VLAN interface available that I could contemplate, but still include the Mac Address in the firewall filter. Also, the client would be an Apple’s MacBook Pro.

I’ll appreciate anymore input…thanks!

12

I’d like to see if SSTP can be based on a MAC address instead of certificates, I have not been able to get that working.

My experience is that about half of the motel or free hotspots don’t allow L2TP due to port blocking.

13

It is not possible to base sstp and l2tp based on mac address because:

  1. It is not secure
  2. sstp/l2tp clients in most cases are not directly connected so server will not see clients mac address.

If client is directly connected to the server then yes you could use firewall filters to allow connections only form specific mac addresses.

14

Thank you Mikrotik Support (MRZ) and Jaytcsd for responding. Of course, I had to look up SSTP and found out it means Secure Socket Tunneling Protocol…so I learned something new today. I also began to understand why my original idea wouldn’t work. I also must say that I am impressed with Jaytcsd’s firewall setup example and I’ll use the examples in the next few days to set up my VPN. I’ll touch base then if all is good or ask more questions.

15

I based my VPN setup on a wiki article and tips from this forum.

If you want to try SSTP maybe we can figure that out together.

16

dear “mrz”

if i create L2tp+Ipsec VPN server and make 15 user then they connected from 15 Desktop PC at office that have 1 IP public and i gateway ( Network LAN on same NAT ), is this possible that they all connected to the VPN L2tp+IPsec server ?

thanks

17

Yes:

  • If server and clients are in local network (not nated)
  • If each client connects from its own IP address directly reachable by server.
18

hi mrz

thx so i can’t connected more than 1 user if from 1 network that hated.

thx

19

Okay, I am almost complete the VPN over L3TP/IPsec…just stuck on small detail. I am using OS v6.11 and there isn’t the box to check generate policy…instead one has the option to select No, Port Override, or Port Strict. So. that where I am stuck and wondered if I need to to setup policy manually. I know that in Policies > Action, I need to check tunnel because I am not doing transport mode and in my case, SA Src Address is any and SA Dst Address is my ISP IP address…BUT, do also add the same info in Policies > General?
Screen Shot 2014-04-12 at 12.47.19 PM.png

20

Okay, upon read the latest modification to IPsec, I see that Port Override is the “old behavior.” Does that mean by selecting that would generate policy automatically? I wish there would be an example for VPN over L2TP/IPsec that connects to home from anywhere as more, and more folks seek to check in on security cameras or home server. Most examples I have seen are connecting home to an office with a known IP address.

Can someone please respond regarding o the screen shot regarding policy in RouterOS 6.11!