MikroTik router - jak nastavit L2TP IPsec server pro Android, iPhone, Windows
V tomto návodu si nastavíme na routeru Mikrotik VPN server L2TP / IPsec server, který půjde použít na zařízení Android, iPhone, Windows, Linux či NAS Synology.
Naše nastavení:
------------------------------------
WAN - eth5
IP pool 172.16.85.1
Nastavení Mikrotik VPN server L2TP / IPsec
IP - Firewall
------------------------------------
/ip firewall filter
add action=accept chain=input protocol=ipsec-esp in-interface=ether5 comment="L2TP-IPSec"
add action=accept chain=input protocol=ipsec-ah in-interface=ether5 comment="L2TP-IPSec"
add action=accept chain=input in-interface=ether5 protocol=udp dst-port=500 comment="L2TP-IPSec"
add action=accept chain=input in-interface=ether5 protocol=udp dst-port=1701 comment="L2TP-IPSec"
add action=accept chain=input in-interface=ether5 protocol=udp dst-port=4500 comment="L2TP-IPSec"
IP - Pool
------------------------------------
Name = l2tp_pool
Addresses = 172.16.85.10-172.16.85.15
PPP - Profiles
------------------------------------
name: ipsec_vpn
local address: 172.16.85.1
remote address: l2tp_pool
dns server: 192.168.85.254
change TCP MSS: default
PPP - Interface tab - L2TP Server
------------------------------------
Enabled
MTU 1460
MRU 1460
Keepalive 30
Default profile ipsec_vpn
Auth mschap2 mschap1
User IPsec yes
IPsec secret: heslo
Allow fatst path: yes
IP - IPsec - Policy proposals
------------------------------------
default:
auth. algorithms: jen sha1
encryption algorithms: aes128, aes192, aes256
PFS group: modp1024
PPP - Secrets
------------------------------------
name: tvůj nickname, nebo cokoliv, třeba vpnuser
password: vymysli si heslo pro tohoto uživatele
service: l2tp
profile: ipsec_vpn
Bridge - arp-proxy
------------------------------------
Bridge -> tab Bridge -> položka bridge1 (popř. bridge-local)
přepnout ARP z enabled na proxy-arp
Možné chyby
l2tp: terminating...-could not detemine local IP address
Celá chyba:
------------------------------------
ISAKMP-SA established ...
firrst L2TP UDP packet received from ...
iphone loggen in, 0.0.0.0
l2tp-iphone: authenticated
l2tp-iphone: terminating...-could not detemine local IP address
iphone logged out ...
l2tp-iphone: disconnected
purging ISAKMP-SA ...
ISAKMP-SA deleted
Oprava FIX:
------------------------------------
PPP profile chybělo Remote address l2tp_pool
Jak zapnout DEBUG pro L2TP / IPSec:
/system logging
add prefix=ipsec topics=ipsec
peer sent packet for dead phase2
phase1 negotiation failed due to time up
Celá chyba:
------------------------------------
peer sent packet for dead phase2
first L2TP UDP packet received from ...
pugring ISAKMP-SA
ISAKMP-SA deleted
respond new phase1 (Identity Protection):
respond new phase1 (Identity Protection):
ISAKMP-SA established
phase1 negotiation failed due to time up
Oprava FIX:
------------------------------------
povolit Ipsec policies
