Community discussions

MikroTik App
 
mike6715b
newbie
Topic Author
Posts: 34
Joined: Wed Feb 17, 2021 9:07 pm

Multiple VPNs but one per port

Mon Oct 04, 2021 9:57 am

Hello everyone.

I work at a IT company and we manage multiple companys and their infrastructure. Reacently we have been deploying Mikrotiks as main routers/firewalls and placing VPNs so that we can securly connect to local resources at the company and for employees working from home.
All of these companys have Windows AD domains setup and multiple server that need to be setup on employee computers before they can work on them.
What I was wondering, would it be possible to setup 1 Mikrotik at our office and have 5 or 6 VPN clients running on it and depending on what port you plug in, you would be connected to a different company VPN.
Eg. eth02 would connect to company A VPN
eth03 would connect to company B VPN
etc...
We mostly have SSTP connections and one IPsec L2TP.

I would guess i would need to do something with packet-marks and route traffic from each port to a corresponding VPN connection or?
At the moment i would like to do this as a proof of concept and to learn more about Mikrotik from this, i guess, unique use case.
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: Multiple VPNs but one per port

Mon Oct 04, 2021 11:34 am

Yes, as you've already found, the key is "policy routing" (not to be confused with IPsec policies). In short it means that you define multiple routing tables, and you use additional criteria like source address, source port, destination port, ingress interface etc. to choose a particular routing table for each packet.

There are three ways how to indicate the routing table to be used for a packet: rules in /ip route rule and/or in /ip firewall mangle, and VRF where the routing-mark (a routing table name) is assigned based on the ingress interface alone. So if you use VRF, you can even define the same local address and subnet on several interfaces of the Mikrotik if you use a static IP configuration on the PC you want to connect to individual ports.

But as the 8p8c connectors are only rated for a few tens of plug-ins, I suggest you another way - keep the PC connected to the same port, and use pinging of some private IP addresses dedicated for that purpose to switch the VPN to which the PC is connected. Firewall rules would add the source address of such ping request to one of address-lists depending on the pinged address; other firewall rules would match on these address lists and assign a routing-mark to all subsequent packets coming from that source address; and a "garbage-collecting" script would remove old items from these address lists (as firewall rules can only add addresses to address lists but not remove them). The dedicated private IP addresses don't even need to respond.
 
pe1chl
Forum Guru
Forum Guru
Posts: 10231
Joined: Mon Jun 08, 2015 12:09 pm

Re: Multiple VPNs but one per port

Mon Oct 04, 2021 11:35 am

Yes, that is certainly possible.
This simple case may well be solved using VRF.
(VRF is powerful but hardly documented, so when you want to use it in more complicated cases where you want to permit some traffic between VRF is quickly becomes black magic)
But in any case you can use manual configuration using packet marks and route rules to achieve the same thing and have a clear view on what is happening (that you can also extend with own rules for routing between networks when required).

Who is online

Users browsing this forum: Bing [Bot], ezhangiso and 38 guests