MikroTik

Aby se NAT používal jen pro připojení do internetu (a například VPN provoz byl routovaný napřímo), je potřeba u pravidla typu srcnat s akci masquerade mít nastaveno Out. Interface na rozhraní, které je připojením do internetu (typicky ether1-gateway).

/ip firewall layer7-protocol add name=uam-zone regexp=corp.uam.im
/ip firewall mangle add chain=prerouting dst-address=<Mikrotik IP> layer7-protocol=uam-zone action=mark-connection new-connection-mark=corp.uam.im-forward protocol=tcp dst-port=53
/ip firewall mangle add chain=prerouting dst-address=<Mikrotik IP> layer7-protocol=uam-zone action=mark-connection new-connection-mark=corp.uam.im-forward protocol=udp dst-port=53
/ip firewall nat add action=dst-nat chain=dstnat connection-mark=corp.uam.im-forward to-addresses=172.17.1.1 commnet="DNS Forward of corp.uam.im"
/ip firewall nat add action=masquerade chain=srcnat connection-mark=corp.uam.im-forward comment="DNS Forward of corp.uam.im"

(ověřeno na 6.41)

pomocí pravidel ve firewallu

/ip firewall layer7-protocol add name=uam-zone regexp=corp.uam.im
/ip firewall nat add action=dst-nat chain=dstnat disabled=no dst-address=10.10.1.254 dst-port=53 layer7-protocol=uam-zone protocol=udp to-addresses=172.17.1.1 to-ports=53
/ip firewall nat add action=dst-nat chain=dstnat disabled=no dst-address=10.10.1.254 dst-port=53 layer7-protocol=uam-zone protocol=tcp to-addresses=172.17.1.1 to-ports=53

kde

• http://www.mikrotik.com/testdocs/ros/2.9/interface/pptp.php
• http://wiki.mikrotik.com/wiki/PPtP_Server_/_VPN dobrej postup
• http://wiki.mikrotik.com/wiki/PPTP_Server_With_Profile
• http://wiki.mikrotik.com/wiki/PPTPServer
• http://mustnofee.com/tutorials/45-building-pppoe-server-with-mikrotik

Zkusit podle http://forum.mikrotik.com/viewtopic.php?f=2&t=36595 (neotestováno)

exportovaný klíč z cacert.org upravit tak, jak očekává openvpn (pro klienta)

openssl pkcs12 -in vladacacert.p12 -clcerts -out client-cacert.pem -nodes
openssl pkcs12 -in vladacacert.p12 -nokeys -cacerts -out root.crt

/certificate create-certificate-request

• vyplnit udaje, dulezite je common name, tam hostname na kterem se budou ostatni prihlasovat
• nakopirovat ze zarizeni certificate-request.pem a jeho obsah podat jako zadost na cacert.org
• vystup ulozit do souboru public-key.pem ten nakopirovat zpet na ftp mikrotiku
• pak naimportovat tenhle public-key.pem s puvodni passphrase, dale naimportovat private-key.pem, ktery se sparuje s vygenerovaným na cacert. a
• provést Decrypt naimportovaných certifikátů
• Změnit přiřazený certifikát v PPP > OVPN.
  • Pokud se klienti nepripoji hned zpet, tak jeste restartovat cely mikrotik.

Zdroj: http://blog.nettraptor.net/?p=446

• Připojení k TTC

I've struggled for a few hours to figure out why my OpenVPN client (using RB750G with RouterOS 4.3) didn't want to route correctly. It connected fine to the Windows OVPN server, applied the routing table entries pushed from the server, but the routing table entries remained „unreachable“. Here's my config:

/interface ovpn-client> print
Flags: X - disabled, R - running 
0    name="ovpn-client" mac-address=00:00:00:00:00:00 max-mtu=1400 connect-to=10.11.12.13 port=1194 mode=ethernet 
      user="username" password="" profile=ovpn-encryption certificate=mycert auth=none cipher=none 
      add-default-route=no

/interface ovpn-client> /ip route print detail
...
11  DC  dst-address=192.168.1.0/24 pref-src=192.168.1.136 gateway=ovpn-client 
        gateway-status=ovpn-client unreachable distance=0 scope=255 

Eventually I managed to solve it, by simply specifying a non 00:00:00:00:00:00 MAC address! eg:

/interface ovpn-client> print
Flags: X - disabled, R - running 
0    name="ovpn-client" mac-address=00:FF:96:21:DF:D4 max-mtu=1400 connect-to=10.11.12.13 port=1194 mode=ethernet 
      user="username" password="" profile=ovpn-encryption certificate=mycert auth=none cipher=none 
      add-default-route=no

• Note: I've used WinBox to configure the ovpn-client in the first place, which automatically adds the mac-address field for the ovpn-client interface

viz: http://forum.mikrotik.com/viewtopic.php?f=2&t=37496