Jump to content

VPN между офисами (Mikrotik)

krechet
 Share

Recommended Posts

krechet

krechet

Posted
Posted (edited)

Здравствуйте!

Настраиваю VPN (PPTP) сеть между двумя офисами на 2х Mikrotik 2011UAS.

Микротики друг друга пингуют, пингуют компьютеры в своей локальной сети, но не пингуют компьютеры в удалённой сети. Т.е. с роутера 192.168.1.1 я пингую 192.168.0.1, но не могу пропинговать 192.168.0.253.

Всю голову сломал, в гугле был, proxy-arp включал...

 

Заранее большое спасибо!

 

На первом роутере поднят PPTP сервер, 192.168.0.1/24 локальная сеть, 10.0.0.1 адрес vpn-интерфейса

На втором роутере PPTP-клиент, 192.168.1.1/24 локальная сеть, 10.0.0.2 адрес vpn-интерфейса

 

Конфигурация первого роутера

 

 

[admin@MikroTik] > export

# oct/17/2013 15:44:46 by RouterOS 6.4

# software id = T72J-ECIX

#

/interface bridge

add admin-mac=D5:CA:6B:ED:09:FC auto-mac=no l2mtu=1598 name=lan_bridge \

protocol-mode=rstp

/interface ethernet

set 0 name=inet_master_port01_gbeth

set 1 name=inet_slave_port02_gbeth

set 2 name=port03_gbeth

set 3 name=port04_gbeth

set 4 name=port05_gbeth

set 5 name=port06_fasteth

set 6 name=port07_fasteth

set 7 name=port08_fasteth

set 8 name=port09_fasteth

set 9 name=port10_fasteth

set 10 name=port_sfp

/interface pppoe-client

add add-default-route=yes disabled=no interface=inet_master_port01_gbeth \

name=inet_ertk_pppoe password=secret use-peer-dns=yes user=username

/interface pptp-server

add name=vpn_raduga user=vpn_raduga

/ip neighbor discovery

set inet_master_port01_gbeth discover=no

set port_sfp discover=no

/ip hotspot user profile

set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \

mac-cookie-timeout=3d

/port

set 0 name=serial0

/ppp profile

add name=vpn_profile only-one=yes use-compression=yes use-encryption=yes \

use-vj-compression=yes

/interface bridge port

add bridge=lan_bridge interface=port03_gbeth

add bridge=lan_bridge interface=port04_gbeth

add bridge=lan_bridge interface=port05_gbeth

add bridge=lan_bridge interface=port06_fasteth

add bridge=lan_bridge interface=port10_fasteth

add bridge=lan_bridge interface=port09_fasteth

add bridge=lan_bridge interface=port08_fasteth

add bridge=lan_bridge interface=port07_fasteth

/interface pptp-server server

set enabled=yes

/ip address

add address=192.168.0.1/24 comment=LAN interface=lan_bridge network=\

192.168.0.0

/ip dhcp-client

add dhcp-options=hostname,clientid disabled=no interface=\

inet_master_port01_gbeth

/ip dns

set allow-remote-requests=yes servers=8.8.8.8

/ip firewall filter

add chain=input disabled=yes protocol=icmp

add chain=input connection-state=established disabled=yes

add chain=input connection-state=related disabled=yes

add chain=forward disabled=yes

/ip firewall nat

add chain=srcnat disabled=yes dst-address=192.168.1.0/24 src-address=\

192.168.0.0/24

add action=masquerade chain=srcnat out-interface=inet_ertk_pppoe \

to-addresses=0.0.0.0

/ip route

add distance=1 dst-address=192.168.1.0/24 gateway=10.0.0.2

/ip service

set telnet disabled=yes

set ftp disabled=yes

set www port=81

set ssh disabled=yes

/lcd interface

set port_sfp interface=port_sfp

set inet_master_port01_gbeth interface=inet_master_port01_gbeth

set inet_slave_port02_gbeth interface=inet_slave_port02_gbeth

set port03_gbeth interface=port03_gbeth

set port04_gbeth interface=port04_gbeth

set port05_gbeth interface=port05_gbeth

set port06_fasteth interface=port06_fasteth

set port07_fasteth interface=port07_fasteth

set port08_fasteth interface=port08_fasteth

set port09_fasteth interface=port09_fasteth

set port10_fasteth interface=port10_fasteth

/ppp secret

add local-address=10.0.0.1 name=vpn_raduga password=secret profile=\

vpn_profile remote-address=10.0.0.2 service=pptp

/system clock

set time-zone-name=Asia/Yekaterinburg

/system ntp client

set enabled=yes mode=unicast primary-ntp=89.221.207.113 secondary-ntp=\

93.180.7.2

/tool mac-server

set [ find default=yes ] disabled=yes

add interface=inet_slave_port02_gbeth

add interface=port03_gbeth

add interface=port04_gbeth

add interface=port05_gbeth

add interface=port06_fasteth

add interface=port07_fasteth

add interface=port08_fasteth

add interface=port09_fasteth

add interface=lan_bridge

/tool mac-server mac-winbox

set [ find default=yes ] disabled=yes

add interface=inet_slave_port02_gbeth

add interface=port03_gbeth

add interface=port04_gbeth

add interface=port05_gbeth

add interface=port06_fasteth

add interface=port07_fasteth

add interface=port08_fasteth

add interface=port09_fasteth

add interface=lan_bridge

 

 

 

Конфигурация второого роутера

 

 

[admin@MikroTik] > export

# oct/17/2013 13:23:36 by RouterOS 6.4

# software id = U6Z8-88AA

#

/interface bridge

add name=lan_bridge

/interface ethernet

set 0 name=inet_master_port01_gbeth

set 1 name=inet_slave_port02_gbeth

set 2 name=port03_gbeth

set 3 name=port04_gbeth

set 4 name=port05_gbeth

set 5 name=port06_fasteth

set 6 name=port07_fasteth

set 7 name=port08_fasteth

set 8 name=port09_fasteth

set 9 name=port10_fasteth

set 10 name=sfp_port

/interface pptp-client

add allow=mschap1,mschap2 connect-to=vpn.xxx.ru disabled=no name=vpn_office \

password=secret user=vpn_raduga

/ip hotspot user profile

set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \

mac-cookie-timeout=3d

/port

set 0 name=serial0

/system logging action

set 0 memory-lines=100

set 1 disk-lines-per-file=100

/interface bridge port

add bridge=lan_bridge interface=port03_gbeth

add bridge=lan_bridge interface=port04_gbeth

add bridge=lan_bridge interface=port05_gbeth

add bridge=lan_bridge interface=port06_fasteth

add bridge=lan_bridge interface=port07_fasteth

add bridge=lan_bridge interface=port08_fasteth

add bridge=lan_bridge interface=port09_fasteth

add bridge=lan_bridge interface=port10_fasteth

/ip address

add address=192.168.1.1/24 interface=lan_bridge network=192.168.1.0

add address=178.47.xxx.xxx/30 interface=inet_master_port01_gbeth network=\

178.47.xxx.xxx

/ip dhcp-client

add default-route-distance=0 dhcp-options=hostname,clientid disabled=no \

interface=inet_master_port01_gbeth

/ip dns

set allow-remote-requests=yes servers=8.8.8.8

/ip firewall filter

add chain=input disabled=yes protocol=icmp

add chain=input connection-state=established disabled=yes

add chain=input connection-state=related disabled=yes

add chain=forward disabled=yes

/ip firewall nat

add chain=srcnat disabled=yes dst-address=192.168.0.0/24 src-address=\

192.168.1.0/24

add action=masquerade chain=srcnat out-interface=inet_master_port01_gbeth

/ip route

add distance=1 gateway=178.47.xxx.xxx

add distance=1 dst-address=192.168.0.0/24 gateway=10.0.0.1

/ip service

set telnet disabled=yes

set ftp disabled=yes

set ssh disabled=yes

/lcd interface

set sfp_port interface=sfp_port

set inet_master_port01_gbeth interface=inet_master_port01_gbeth

set inet_slave_port02_gbeth interface=inet_slave_port02_gbeth

set port03_gbeth interface=port03_gbeth

set port04_gbeth interface=port04_gbeth

set port05_gbeth interface=port05_gbeth

set port06_fasteth interface=port06_fasteth

set port07_fasteth interface=port07_fasteth

set port08_fasteth interface=port08_fasteth

set port09_fasteth interface=port09_fasteth

set port10_fasteth interface=port10_fasteth

/system clock

set time-zone-name=Asia/Yekaterinburg

/system ntp client

set enabled=yes mode=unicast primary-ntp=62.76.96.4 secondary-ntp=\

95.140.150.140

 

 

Edited by krechet
vop

vop

Posted
Posted

Скорее всего, где-то нет роутинга. Он должен быть корректным на всех 4-х компьютерах. 192.168.1.5 знает, где ему искать 192.168.0.236? А этот последний знает, куда ему надо отвечать?

  • 1 month later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to topic listing
×
×
  • Create New...