Russian Users MikroTik | Форум пользователей MikroTik

Сделал всё согласно инструкции, результат тот же PPTP есть L2TP нет. Посмотрите пожалуйста, где чего не хватает. (http://wiki.mikrotik.com/wiki/L2TP_%2B_ ... r_and_a_PC)

[admin@MikroTik] > /export compact
# jan/21/2014 10:05:26 by RouterOS 6.7
# software id = A8W7-7LZ0
#
/interface bridge
add l2mtu=1598 name=bridge2 protocol-mode=rstp
add arp=proxy-arp l2mtu=1598 name=lan
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=ukraine disabled=no \
l2mtu=2290 mode=ap-bridge wireless-protocol=802.11
/interface l2tp-server
add name=l2tp-ka user=ka
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk group-ciphers=\
tkip,aes-ccm mode=dynamic-keys unicast-ciphers=tkip,aes-ccm \
wpa-pre-shared-key=okmzaq12 wpa2-pre-shared-key=okmzaq12
/ip dhcp-server
add interface=ether1 name=dhcp1
add interface=bridge2 name=dhcp2
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \
mac-cookie-timeout=3d
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=pptp ranges=192.168.0.200-192.168.0.229
/ppp profile
add change-tcp-mss=yes dns-server=192.168.0.1 local-address=192.168.0.1 name=\
pptp-in only-one=yes remote-address=pptp use-encryption=required
/interface bridge port
add bridge=bridge2 interface=wlan1
add bridge=bridge2 interface=ether2
add bridge=bridge2 interface=ether3
add bridge=bridge2 interface=ether4
add bridge=bridge2 interface=ether5
add bridge=lan interface=ether1
/interface l2tp-server server
set enabled=yes max-mru=1460 max-mtu=1460
/interface pptp-server server
set authentication=chap,mschap1,mschap2 default-profile=pptp-in enabled=yes \
max-mru=1460 max-mtu=1460
/ip address
add address=192.168.0.1/32 interface=wlan1 network=192.168.0.1
add address=192.168.0.1/24 interface=lan network=192.168.0.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether1
/ip dns
set allow-remote-requests=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip ipsec peer
add dpd-interval=disable-dpd dpd-maximum-failures=1 enc-algorithm=3des secret=\
test
/ip ipsec policy
add dst-address=10.1.16.0/28 ipsec-protocols=ah-esp sa-dst-address=10.0.16.10 \
sa-src-address=10.0.16.9 src-address=10.0.0.0/24 tunnel=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge2 type=internal
add interface=ether1 type=external
/ppp secret
add name=user-1 password=123456 profile=pptp-in service=pptp
add name=user-2 password=123456 profile=pptp-in service=pptp
add comment="Some description" local-address=10.0.16.9 name=ka password=ka \
remote-address=10.0.16.10 service=l2tp
/system leds
set 0 interface=wlan1
/system logging
add topics=debug,ipsec
add topics=debug,pptp
add topics=debug,l2tp
/system ntp client
set enabled=yes mode=unicast primary-ntp=62.149.0.30 secondary-ntp=31.28.161.71
[admin@MikroTik] >

В порядок приведите и отключите уже ИПсек

так у меня эот и так прописано же :
[admin@MikroTik] /ip address> add address=192.168.0.1/32 interface=wlan1 network=1
92.168.0.1
failure: already have such address
[admin@MikroTik] /ip address> add address=192.168.0.1/24 interface=lan network=192
.168.0.0
failure: already have such address
/ip dhcp-server] /ip address>
[admin@MikroTik] /ip dhcp-server> add interface=ether1 name=dhcp1
failure: server with such name already exists
[admin@MikroTik] /ip dhcp-server> add interface=bridge2 name=dhcp2
failure: server with such name already exists

и не совсем понял как отключить IPSec , если клиент windows при подключении l2tp по умолчанию требует IPSec

Вам было предложено разобраться с адресами, а не копипастить строки в консоль.
Зачем вам 192.168.0.1/32 на wlan1? Зачем вам два dhcp сервера?

Вот абсолютно новая конфигурация , тут l2tp поднимается внутри сети, не пускает с внешнего адреса.
# jan/21/2014 16:31:44 by RouterOS 6.7
# software id = A8W7-7LZ0
#
/certificate
add common-name=10.190.100.111 country=UA key-size=4096 key-usage="digital-signa\
ture,content-commitment,key-encipherment,data-encipherment,key-agreement,key\
-cert-sign,crl-sign,encipher-only,decipher-only" locality=AAA name=l2tp \
organization=BBB state=None subject-alt-name=email:fgdfg.@bvbn unit=CCC
/interface bridge
add admin-mac=D4:CA:6D:BE:8E:E1 auto-mac=no l2mtu=1598 name=bridge-local \
protocol-mode=rstp
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no l2mtu=2290 mode=\
ap-bridge name=wlan2
/interface ethernet
set [ find default-name=ether1 ] mac-address=D4:CA:6D:BE:8E:E0 name=\
ether1-gateway
set [ find default-name=ether2 ] arp=proxy-arp mac-address=D4:CA:6D:BE:8E:E1 \
name=ether2-master-local
set [ find default-name=ether3 ] mac-address=D4:CA:6D:BE:8E:E2 master-port=\
ether2-master-local name=ether3-slave-local
set [ find default-name=ether4 ] mac-address=D4:CA:6D:BE:8E:E3 master-port=\
ether2-master-local name=ether4-slave-local
set [ find default-name=ether5 ] mac-address=D4:CA:6D:BE:8E:E4 master-port=\
ether2-master-local name=ether5-slave-local
/interface l2tp-server
add name=l2tp-cli2 user=cli-l2tp
/interface ovpn-server
add name=ovpn-in1 user=cli-l2tp
/interface pptp-server
add name=pptp-cli1 user=cli1
/ip neighbor discovery
set bridge-local discover=no
set l2tp-cli2 discover=no
set ovpn-in1 discover=no
set pptp-cli1 discover=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk group-ciphers=\
tkip,aes-ccm mode=dynamic-keys unicast-ciphers=tkip,aes-ccm \
wpa-pre-shared-key=okmzaq12 wpa2-pre-shared-key=okmzaq12
/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \
mac-cookie-timeout=3d
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des,aes-256-cbc pfs-group=modp4096
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=l2tp-pool ranges=192.168.87.2-192.168.87.100
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge-local name=default
add address-pool=dhcp disabled=no name=dhcp1
add address-pool=dhcp interface=ether1-gateway name=dhcp2
add address-pool=dhcp disabled=no interface=wlan2 name=dhcp3
/ppp profile
add change-tcp-mss=yes local-address=192.168.87.1 name=l2tp remote-address=\
l2tp-pool
set 2 local-address=default-dhcp remote-address=default-dhcp
/interface bridge port
add bridge=bridge-local interface=ether2-master-local
add bridge=bridge-local
/interface l2tp-server server
set authentication=mschap2 default-profile=l2tp enabled=yes keepalive-timeout=\
15 max-mru=1418 max-mtu=1418
/interface ovpn-server server
set cipher=blowfish128,aes256 default-profile=l2tp enabled=yes port=443
/interface pptp-server server
set enabled=yes
/ip address
add address=192.168.88.1/24 comment="default configuration" network=\
192.168.88.0
add address=192.168.88.1/24 interface=wlan2 network=192.168.88.0
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid disabled=no \
interface=ether1-gateway
/ip dhcp-server network
add address=192.168.88.0/24 comment="default configuration" dns-server=\
192.168.88.1 gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add chain=input comment="default configuration" protocol=icmp
add chain=input comment="default configuration" connection-state=established
add chain=input comment="default configuration" connection-state=related
add action=drop chain=input comment="default configuration" disabled=yes \
in-interface=ether1-gateway
add chain=forward comment="default configuration" connection-state=established
add chain=forward comment="default configuration" connection-state=related
add action=drop chain=forward comment="default configuration" connection-state=\
invalid disabled=yes
add chain=input comment=L2TP dst-port=1701 packet-mark=esp protocol=udp
add chain=input comment=IPSEC-NAT dst-port=4500 in-interface=ether1-gateway \
protocol=udp
add chain=input comment=IPSEC dst-port=500 protocol=udp
add chain=input comment=IPSEC in-interface=ether1-gateway protocol=ipsec-esp
add chain=input comment="l2tp router server" connection-state=new dst-port=\
500,1701 in-interface=ether1-gateway protocol=udp
/ip firewall mangle
add action=mark-packet chain=input new-packet-mark=esp protocol=ipsec-esp
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" \
out-interface=ether1-gateway to-addresses=0.0.0.0
add action=dst-nat chain=dstnat disabled=yes dst-address=192.168.88.1 dst-port=\
1701 protocol=udp src-address=80.91.185.235 src-port=1701 to-addresses=\
192.168.88.1 to-ports=1701
/ip ipsec peer
add enc-algorithm=aes-256 generate-policy=port-override secret=123456789
/ip ipsec policy
add dst-address=192.168.88.1/32 ipsec-protocols=ah-esp sa-dst-address=\
192.168.88.1 sa-src-address=192.168.88.232 src-address=192.168.88.232/32 \
tunnel=yes
/ip route
add disabled=yes distance=1 gateway=80.91.185.233
add distance=1 dst-address=80.91.185.235/32 gateway="(unknown)"
add distance=1 dst-address=192.168.88.0/24 gateway="(unknown)"
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
/ip upnp interfaces
add interface=bridge-local type=internal
add interface=ether1-gateway type=external
/ppp secret
add local-address=192.168.89.1 name=cli1 password=Qwerty123 profile=\
default-encryption remote-address=192.168.89.2 service=pptp
add local-address=192.168.89.1 name=cli2 password=Qwerty123 remote-address=\
192.168.89.2 service=l2tp
add name=cli-l2tp password=Qwerty123 profile=l2tp service=l2tp
add name=test password=test
/system clock
set time-zone-name=Europe/Kiev
/system logging
add topics=debug,ipsec
add topics=debug,l2tp
add topics=debug,pptp
/system ntp client
set enabled=yes mode=unicast primary-ntp=62.149.0.30 secondary-ntp=62.149.0.30
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=ether3-slave-local
add interface=ether4-slave-local
add interface=ether5-slave-local
add
add interface=bridge-local
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=ether3-slave-local
add interface=ether4-slave-local
add interface=ether5-slave-local
add
add interface=bridge-local

Вы угадать что ли пытаетесь?

почему угадать, перечитал документацию, создал всё заново по порядку и пытаюсь найти ошибку в конфигурации.

Вот, как минимум, четыре ошибки.





А если чуть ближе к теме вопроса - разбирайтесь с принципом работы фаервола на микротике и очередностью правил.

Да я об этих ошибка уже весь день толкую )))

/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.20
add name=dhcp ranges=192.168.88.10-192.168.88.20


[admin@MikroTik] /ip route> print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADS 0.0.0.0/0 10.190.100.254 1
1 X S 0.0.0.0/0 10.190.100.254 1
2 ADC 10.190.100.0/24 10.190.100.111 ether1-gateway 0
3 A S 10.190.100.111/32 10.190.100.254 1
4 ADC 192.168.88.0/24 192.168.88.1 wlan2 0
5 S 192.168.88.0/24 ether1-gateway 1
роуты поправил. спасибо!

/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge-local name=default
add address-pool=dhcp disabled=no name=dhcp1
add address-pool=dhcp interface=ether1-gateway name=dhcp2
add address-pool=dhcp disabled=no interface=wlan2 name=dhcp3 подскажите пожалуйста, какая здесь ошибка. Заранее спасибо !

И тут не совсем понимаю как исправить ошибку.

[admin@MikroTik] /ip address> print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 192.168.88.1/24 192.168.88.0 wlan2
1 D 10.190.100.111/24 10.190.100.0 ether1-gateway