Пробросить порт через IPIP туннель получилось, а вот реализовать выход с белым IP на VM 10.0.0.100 и полным пробросом всех портов, ума ( образования ) не хватает.
Тут появился ступор и не понятность куда копать...
Код: Выделить всё
# R1
# RouterOS 7.13.1
/interface ipip
add local-address=46.255.255.74 name=ipip-tunnel1 remote-address=93.255.255.58
/ip address
add address=46.255.255.74/29 interface=ether1 network=46.255.255.72
add address=46.255.255.75/29 interface=ether1 network=46.255.255.72
add address=46.255.255.76/29 interface=ether1 network=46.255.255.72
add address=46.255.255.77/29 interface=ether1 network=46.255.255.72
add address=46.255.255.78/29 interface=ether1 network=46.255.255.72
add address=172.16.0.2/30 interface=ipip-tunnel1 network=172.16.0.0
/ip dns
set servers=1.1.1.1,8.8.8.8
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=wan
add action=masquerade chain=srcnat comment="VPN MSQRD" out-interface=\
ipip-tunnel1
add action=dst-nat chain=dstnat comment=ipip-to-3000 dst-address=\
46.255.255.74 dst-port=3000 in-interface=ether1 protocol=\
tcp to-addresses=172.16.0.1 to-ports=3000
/ip route
add gateway=46.255.255.73
add disabled=no dst-address=10.0.0.0/8 gateway=172.16.0.1 routing-table=main \
suppress-hw-offload=no
Код: Выделить всё
# R2
# RouterOS 7.13.1
# model = RB5009UG+S+
/interface bridge
add arp=proxy-arp name=bridge1
/interface ipip
add local-address=93.255.255.58 name=ipip-tunnel1 remote-address=46.255.255.74
/interface list
add name=wan
add name=lan
/ip pool
add name=dhcp_pool ranges=10.0.0.2-10.255.255.254
/ip dhcp-server
add address-pool=dhcp_pool interface=bridge1 lease-time=10m name=dhcp1
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=sfp-sfpplus1
add bridge=bridge1 interface=lan
/interface list member
add interface=bridge1 list=lan
add interface=ether1 list=wan
/ip address
add address=10.0.0.1/8 interface=bridge1 network=10.0.0.0
add address=172.16.0.1/30 interface=ipip-tunnel1 network=172.16.0.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server lease
add address=10.0.0.100 client-id=\
ff:9f:6e:85:24:0:2:0:0:ab:11:de:27:30:cb:e0:ea:fa:74 mac-address=\
00:0C:29:21:6C:89 server=dhcp1
/ip dhcp-server network
add address=10.0.0.0/8 dns-server=10.0.0.1 gateway=10.0.0.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip firewall nat
add action=masquerade chain=srcnat comment="dhcp1: masquerade" ipsec-policy=\
out,none out-interface-list=wan
add action=masquerade chain=srcnat comment="VPN MSQRD" out-interface=\
ipip-tunnel1
add action=dst-nat chain=dstnat comment=ipip-to-3000 dst-port=3000 \
in-interface=ipip-tunnel1 protocol=tcp \
to-addresses=10.0.0.100 to-ports=3000
