Проблема следующего характера:
есть виндовый VDS сервер с фиксированным внешним IP и RB2011UiAS c 4g модемом от tinkoff.
Необходимо поднять между ними соединение, чтобы потом через подключение к VDS ходить далее в сеть офиса.
При создании l2tp соединения со стороны микрота в сторону сервера, оно какое-то время в состоянии Connecting и потом обрывается.
При этом если настраивать аналогичное соединение с другого роутера, то подключение происходит.
С микрота сервер VDS пингуется.
Подскажите, пожалуйста, куда копать.
Я пошерстил на форуме этот вопрос, рекомендации, которые были связаны с конфигурацией Ipsec и опцией PFC group я пробовал. Не помогло.
В логе пишет вот это: ISAKMP-SA deleted 192.168.8.114[4500]-185.240.102.79[4500] spi:7510d001892e1302:e787631a4df27563 rekey:1
Конфигурация роутера ниже.
Код: Выделить всё
# nov/29/2023 10:40:33 by RouterOS 6.49.10
# software id = WGXV-Q3PM
#
# model = RB2011UiAS
# serial number = HEN08S5CXVM
/interface lte
set [ find ] name=lte1
/interface bridge
add admin-mac=48:A9:8A:F7:CE:10 auto-mac=no comment=defconf name=lan
/interface l2tp-client
add allow=mschap2 connect-to=****** ipsec-secret=*****name=\
ClietnL2tp password=****** use-ipsec=yes user=USER_01
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec policy group
add name=group1
/ip ipsec proposal
set [ find default=yes ] pfs-group=none
/ip pool
add name=default-dhcp ranges=192.168.50.100-192.168.50.150
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=lan name=defconf
/interface bridge port
add bridge=lan comment=defconf interface=ether2
add bridge=lan comment=defconf interface=ether3
add bridge=lan comment=defconf interface=ether4
add bridge=lan comment=defconf interface=ether5
add bridge=lan comment=defconf interface=ether6
add bridge=lan comment=defconf interface=ether7
add bridge=lan comment=defconf interface=ether8
add bridge=lan comment=defconf interface=ether9
add bridge=lan comment=defconf interface=ether10
add bridge=lan comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set authentication=mschap2 ipsec-secret=****** use-ipsec=required
/interface list member
add comment=defconf interface=lan list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=lte1 list=WAN
/ip address
add address=192.168.50.1/24 comment=defconf interface=lan network=\
192.168.50.0
/ip cloud
set ddns-update-interval=1m
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server lease
add address=192.168.50.101 client-id=\
ff:ca:5f:22:27:0:2:0:0:ab:11:6a:bc:6:15:39:66:27:7f mac-address=\
16:76:1A:3B:BE:03 server=defconf
add address=192.168.50.110 client-id=\
ff:56:50:4d:98:0:2:0:0:ab:11:ce:4a:a4:a9:a0:52:b3:26 mac-address=\
52:54:00:1E:9B:24 server=defconf
add address=192.168.50.111 client-id=\
ff:56:50:4d:98:0:2:0:0:ab:11:f1:ac:5a:ed:6:a1:20:a mac-address=\
52:54:00:0E:59:59 server=defconf
add address=192.168.50.102 client-id=1:52:54:0:73:c9:c5 mac-address=\
52:54:00:73:C9:C5 server=defconf
/ip dhcp-server network
add address=192.168.50.0/24 comment=defconf dns-server=192.168.50.1 gateway=\
192.168.50.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,77.88.8.8
/ip dns static
add address=192.168.50.1 comment=defconf name=router.lan
add address=192.168.50.101 name=gt-srv-01
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=accept chain=input dst-port=1723 in-interface-list=WAN protocol=\
tcp
add action=accept chain=input dst-port=50,500,4500,1701 in-interface-list=WAN \
protocol=udp
add action=accept chain=input dst-port=443 in-interface-list=WAN protocol=tcp
add action=accept chain=input protocol=ipsec-esp src-address-list="" \
tcp-flags=""
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip ipsec policy
add group=group1 template=yes
/ip route
add distance=1 gateway=192.168.8.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=8080
/ppp l2tp-secret
add address=******* secret=******
/ppp secret
add name=****** password=******
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=RouterOS
/system routerboard settings
# Firmware upgraded successfully, please reboot for changes to take effect!
set auto-upgrade=yes
/tool graphing interface
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool traffic-monitor
add interface=lte1 name=LTE_WAN trigger=always