I configured RB750 and is accessible from WAN and LAN. Now I try config L2TP VPN but if I start connection from any workstatiton I cannot see anything on the ports 500, 1701, 4500, any attempt in the IPSec connection. All another ports I can see in the Log are fine. And of course I am not able to connect to the VPN.
Can anyone help where could be a problem?
Thank you
Tomas
Code: Select all
# oct/15/2019 15:07:49 by RouterOS 6.45.6
# software id = LU7G-YKYM
#
# model = RB750Gr3
# serial number = 8AFF0A113CC7
/interface bridge
add admin-mac=74:4D:28:07:CA:82 arp=proxy-arp auto-mac=no comment=defconf \
name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip ipsec profile
set [ find default=yes ] enc-algorithm=3des
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=vpn ranges=192.168.2.240-192.168.2.249
/ppp profile
add change-tcp-mss=yes dns-server=192.168.2.23 interface-list=LAN \
local-address=192.168.2.28 name=my-l2tp-profile remote-address=vpn
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set authentication=mschap1,mschap2 default-profile=my-l2tp-profile enabled=\
yes ipsec-secret=******* use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.2.253/23 interface=bridge network=192.168.2.0
add address=x.x.x.x/29 interface=ether1 network=xx.xx.xx.xx
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=192.168.2.0/23 gateway=192.168.2.253
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment="allow access into MT" \
dst-port=8291 log-prefix=x81 protocol=tcp src-address=81.19.x.x
add action=accept chain=input disabled=yes log=yes log-prefix=x81 \
src-address=81.19.x.x
add action=accept chain=input disabled=yes dst-port=500,1701,4500 protocol=\
udp
add action=accept chain=input comment="VPN IPSec" dst-port=500 in-interface=\
ether1 protocol=udp
add action=accept chain=input dst-port=1701 in-interface=ether1 protocol=udp
add action=accept chain=input dst-port=4500 in-interface=ether1 protocol=udp
add action=accept chain=input in-interface=ether1 protocol=ipsec-esp
add action=accept chain=input in-interface=ether1 protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=drop chain=input comment="disable access from WAN into MT" \
dst-port=21,22,25,80,443,8192 in-interface=ether1 protocol=tcp
add action=accept chain=forward src-address=192.168.2.0/24
add action=drop chain=forward dst-address=192.168.2.0/24
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked log=yes log-prefix=WWA
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=input comment="defconf: accept ICMP - PING" log-prefix=\
ping protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN log-prefix=lan
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip route
add distance=1 gateway=x.x.x.x
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ppp secret
add name=aces password=********* profile=my-l2tp-profile service=\
l2tp
/system clock
set time-zone-name=Europe/Prague
/system identity
set name=MT-MuM
/system logging
add prefix=L2TP topics=l2tp
add prefix=IPSec topics=ipsec
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN