Hey all, I’m going to apologize now in the event these are extremely basic questions or have been answered already. If you know of a post that addresses one of these questions please just post the link and enough said. I appreciate the help.
I’ve set up a router involving around 75 users and its works great so far. I am having a problem doing 3 things and have looked through the manual and searched a bit online.
I have a pool setup for dynamic addresses and setup a dhcp server to use that pool. the pool is 10.10.100.100-10.10.100.254. It assigns addresses just fine but I also need a few static IP’s set for servers. I went ahead and set a servers address as 10.10.100.20 but it will not route externally, it can only ping internal devices on the 100 subnet… why is this or what did I do wrong? If i set the server static in the dhcp pool range it works fine, but I would then have to set static in the dhcp lease page of the routeros. Is there something I’m doing wrong so the .20 routes externally?
I need to forward a port to an ip address. Say simple port 80 for web to server 10.10.100.20. I would like to have remote desktop be accessible on multiple computers from the wan. Is it possible to forward 3389 to say server 10.10.100.20, 10.10.100.21 and 10.10.100.22?
I need a way to VPN into the network. This would likely solve the remote desktop forwarding also. I dont need just a site to site vpn but an actual way a few people can vpn into the network simultaneously if need be. I have no idea how to set this up.
Once again, if you know a good article exists one these please just post that, I hate requiring someone to rewrite a doc or wiki. I have messed around for a while and figured someone could point me in the right direction pretty quickly.
I just set up an L2TP VPN for the same purpose as you are stating. Very easy using Winbox. Just go to PPP and enable the server, then create the appropriate profile and secret used to log in. Let me know if need some screen shots.
Justin
Hilton: The subnet mask should be default 255.255.255.0 and is set that way. So I have dhcp pool 10.10.100.100-10.10.100.254 working fine. Computer nic configured 10.10.100.20 mask 255.255.255.0 and gateway 10.10.100.1. This static address won’t route externally… odd
For the forwarding to 3 servers, technically you dont need 3 external ips (correct me if I’m wrong). You just need to point a different incoming port to a different server address running port 3389. For instance here is the config line I found. Say wan is 69.69.69.69 and to get to server 1 RD externally you would type 69.69.69.69:3389. For server 2 69.69.69.69:3390. Server 3 69.69.69.69:3391.
Techsimp: I do need help with the vpn. So I enabled the ppp package, rebooted. Went to the ppp tab. Clicked L2tp server and clicked enable and then apply. Went to profiles clicked add, put in my name, and set checkboxes “use encryption” to yes, and “Change TCP MSS” to yes (did this because thats what the default encryption profile had). Then went to the secret tab and clicked add. Typed whatever name, entered a password, selected l2tp for the service, and selected my name for the profile and hit apply. I then tried to setup a standard windows dial in vpn with l2tp and it won’t connect. Do I need to add an interface under PPP or do anything specific in the windows vpn configuration properties? I also need 2 different login names and passwords. Any help would be great… thanks
from windows use PPTP, not L2TP. L2TP should work from within windows, but its a few hour pull your hair out session to figure out how to interoperate with mikrotik.
Yes of course, it’s just clutsy, you have to remember who goes to where. A VPN is so more elegant. It’s also extremely dangerous to have just a weak windows password between you and the pimply faced teenage hacker.
Here’s a graphic which details all the required fields to set-up a PPTP VPN.
Next we’ll tackle your routing issue.
BTW, my firewall filter rule is needed if you have a drop rule.
See my config below. Public IPs are x.x.x.x
Also, I use XP to connect and had no problems on my laptop. On the other hand, the laptops at work are not able to do so (not a network limitation as my laptop works at work) but I assume it may be a configuration issue that the IT police have put into place. As I post this I see that hilton has provided a similar solution.
Justin
Thanks to both of you. I ended up using pptp but will experiment with l2tp later, I just needed something I know I could get working quick. I am still having a problem with the way the vpn assigns an address though. On the mikrotik I have my network setup as 10.10.100.1. I have a dhcp assigning range .2-.150. I then setup a vpnpool .200-.210. The VPN connects fine but the address I receive is 10.10.100.200 with a 255.255.255.255 subnet mask and a 0.0.0.0 for default gateway. Obviously the default gateway is not right so I can’t ping any internal devices, and im pretty sure the subnet should be 255.255.255.0. Should the Local address in the ppp profile be set to 10.10.100.1?
Hilton, I dont think I have any rules set. Whats the easiest way to display these to you, keep in mind im a rookie, especially in command line.
Yes the local address should be set to your router’s address, in your case 10.10.100.1
The address and subnet mask assigned to your VPN users is correct, I just think you need to set ARP = ‘proxy-arp’ on the LAN interface. I think by default it’s set to ‘enabled’. This should do the trick.
ok, i set that and i can now ping internal devices. however I no longer got internet on the laptop im using to dial in. So I went into vpn properties and under tcp/ip v4 i unchecked the “use default gateway on remote network” box, and I now get internet. Is this what I should have done? It works but that means I’m not able to get “internet” through the vpn link and out that router…
