Mikrotik VPN Server L2TP/IPsec
==============================


General
-------

# Bridge
#     Name:         bridge1
#     ARP:          proxy-arp


IP/Pool
    Name:           pool-vpn-server
    Addresses:      {vpn-network-range}   (you can create range within
                                           existing local network or
                                           create new local network only
                                           for vpn connections)

IP/Addresses/[+] (only if vpn network range was created)
    Address:        {local-network-for-vpn}
    Network:
    Interface:      bridge1               (interface of local network,
                                           mostly bride1 or ether2)

--------------------------------------------------------------------------------

L2TP/IPsec Server
-----------------

PPP/Profiles
    (copy default-encryption)

    Name:           vpn-server
    Local Addr:     {router IP}
    Remote Addr:    pool-vpn-server

    Interface List: LAN         (important)

    Change TCP MMS: yes         (check)
    Use Encryption: yes         (check)


PPP/Secrets
    Name:           {user-name}
    Password:       {user-password}
    Service:        any
    Profile:        vpn-server


PPP/Interfaces/[L2TP Server]
                    [x] Enabled
    Default Prfl.:  vpn-server
    Auth.:          mschap2

    Use IPsec:      yes
    IPsec Secret:   {IPsec pre-shared key}


--------------------------------------------------------------------------------

IPSec (check config only)
-------------------------

IP/IPsec/Profiles
    Name:           default
    Hash Alg.:      sha1
    Encrypt. Alg.:  3des, aes-128, (aes-256)
    DH Group:       modp1024, modp2048

    Proposal check: obey
    Lifetime:       1d 00:00:00

                    [x] Nat Traversal


IP/IPsec/Peers
    Address:        0.0.0.0/0
    Port:           {none}
    Local Address:  {none}
    Profile:        default
    Exchange Mode:  main
                    [x] Passive
                    [x] Send INITIAL_CONTACT


IP/IPsec/Policy Proposals
    Name:           default
    Auth. Alg.:     sha1
    Encr. Alg.:     aes-128 cbc, aes-192 cbc, aes-256 cbc
    Lifetime:       00:30:00
    PFS Group:      modp1024


--------------------------------------------------------------------------------

Firewall (add L2TP rules)
-------------------------

IP/Firewall

    New Terminal -> right click -> Paste

/ip firewall filter
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
# l2tp
add action=accept chain=input protocol=udp dst-port=500,1701,4500 comment=l2tp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input protocol=ipsec-ah
# drop
add action=drop chain=input in-interface-list=!LAN comment=drop

/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN


--------------------------------------------------------------------------------

Windows
-------
Nastavení Windows pokud je server i klient za NAT

https://support.microsoft.com/cs-cz/help/926179/how-to-configure-an-l2tp-ipsec-server-behind-a-nat-t-device-in-windows

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent]
"AssumeUDPEncapsulationContextOnSendRule"=dword:00000002


MacOS
-----
Ikona wifi - Otevřít předvolby pro síť
Označit VPN připojení - [Pokročilé]
[x] Posílat vše přes připojení VPN

[Použít]

[Připojit]