Here we will be configuring a dial-in-vpn using L2TP with IPsec.
In this example we will be using 10.0.1.0/24 for the L2TP clients and for the LAN.
The configuration will detail the following:
- Enable L2TP server
- Create DHCP pool
- Create L2TP profile
- Create a sample user
- Configure IPsec Peer and Proposal
- Create firewall input rule to accept the L2TP connections
- Configure connectivity between dial-in-clients and LAN
Enable the L2TP server.
/interface l2tp-server server
DHCP Pool and L2TP profile
Next we will create a PPP profile which will be used when we create our users.
Here we select the IP used by the router as well as selecting a Pool which we will also configure to give out address to our dial-in-vpn users. Be sure not to include the IP you the router (local IP) in the DHCP range which is created in the pool.
add name=LAN_Pool ranges=10.0.1.51-10.0.1.250
add bridge=LAN local-address=10.0.1.254 name=L2TP remote-address="LAN_Pool"
Secrets is where we create our users. Here we will create the user and password as well as selecting our profile created earlier.
add name=johndoe password=Keepsafe profile=L2TP service=l2tp
IPsec peer and proposal
This is the IPsec part of the setup and the peer and proposal are configured here.
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc,3des
/ip ipsec peer
add address=0.0.0.0/0 exchange-mode=main-l2tp generate-policy=port-override secret=L2TPPresharedKey
Here we create the firewall rules to accept the L2P connection from our dial-in-vpn users. In our example these connections are coming in over the PPPoE interface.
/ip firewall filter
add action=accept chain=input comment="L2TP accept ISAKMP/IKE" dst-port=500 in-interface=pppoe-out1 protocol=udp
add action=accept chain=input comment="L2TP accept IPSec NAT Traversal" dst-port=4500 in-interface=pppoe-out1 protocol=udp
add action=accept chain=input comment="L2TP accept L2TP" dst-port=1701 in-interface=pppoe-out1 log=yes protocol=udp
connectivity between dial-in-clients and LAN
Connection between dial-in-vpn clients and the LAN can be done by either using proxy arp or by routing.
This does not require any configuration as the router will naturally route between connected subnets.
The only thing to remember here is to have a different subnet for the dial-in-vpn clients to the LAN
Here we set proxy-arp on LAN Bridge.
The LAN and L2TP clients use the same subnet.
add arp=proxy-arp name=LAN/ip address
add address=10.0.1.1/24 interface=LAN network=10.0.1.0