Окей, ребята, мне нужно это повторить. Мы изменили топологию для этого сайта следующим образом: ONT Ethernet > Tik Ether 1 (Gateway) > другое локальное сетевое оборудование, включая модем/роутер Verizon. Verizon получает приватный IP от Tik, и VOD, экранное руководство работают нормально. Клиенту всё равно на приложение Fios, главное, чтобы мы получили VPN с его iPhone. Вот моя конфигурация, которую я настроил на Tik. Всё равно не удаётся подключиться. Если кто-то видит проблему, пожалуйста, укажите! Большое спасибо!!
/interface bridge add admin-mac=CC:2D:E0:15:DE:EE auto-mac=no comment=defconf name=bridge
/interface ethernet set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether6 ] name=ether6-master
set [ find default-name=ether10 ] comment=“verizon fios”
/interface list add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
add name=WAN
/interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec policy group add name=ipsec+l2tp
/ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc,3des lifetime=8h
add enc-algorithms=aes-256-cbc name=l2tp-ipsec
/ip pool add name=dhcp ranges=10.13.1.10-10.13.1.254
add name=vpn ranges=192.168.89.2-192.168.89.255
add name=ipsec-pool ranges=10.13.2.2-10.13.2.20
/ip dhcp-server add address-pool=dhcp disabled=no interface=bridge name=defconf
/ppp profile add change-tcp-mss=yes dns-server=10.13.2.1 local-address=10.13.2.1 name=ipsec+l2tp remote-address=ipsec-pool use-upnp=no
set *FFFFFFFE local-address=192.168.89.1 remote-address=vpn
/interface bridge port add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=ether6-master
add bridge=bridge comment=defconf hw=no interface=sfp1
add bridge=bridge interface=ether3
add bridge=bridge interface=ether4
add bridge=bridge interface=ether5
add bridge=bridge interface=ether7
add bridge=bridge interface=ether8
add bridge=bridge interface=ether9
add bridge=bridge interface=ether10
/ip neighbor discovery-settings set discover-interface-list=discover
/interface l2tp-server server set authentication=mschap2 default-profile=ipsec+l2tp enabled=yes max-mru=1460 max-mtu=1460 use-ipsec=yes
/interface list member add interface=ether2-master list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=sfp1 list=discover
add interface=ether6-master list=discover
add interface=ether7 list=discover
add interface=ether8 list=discover
add interface=ether9 list=discover
add interface=ether10 list=discover
add interface=bridge list=discover
add interface=bridge list=mactel
add interface=bridge list=mac-winbox
add interface=ether1 list=WAN
/interface pptp-server server set enabled=yes
/interface sstp-server server set default-profile=default-encryption enabled=yes
/ip address add address=10.13.1.1/24 comment=defconf interface=ether2-master network=10.13.1.0
/ip cloud set ddns-enabled=yes
/ip dhcp-client add comment=defconf dhcp-options=hostname,clientid disabled=no interface=ether1
/ip dhcp-server network add address=10.13.1.0/24 comment=defconf dns-server=8.8.8.8,8.8.4.4 gateway=10.13.1.1 netmask=24
/ip dns set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static add address=10.13.1.1 name=router
/ip firewall filter add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept established,related” connection-state=established,related
add action=accept chain=input comment=“allow l2tp” dst-port=1701 protocol=udp
add action=accept chain=input comment=“allow pptp” dst-port=1723 protocol=tcp
add action=accept chain=input comment=“allow sstp” dst-port=443 protocol=tcp
add action=accept chain=input connection-state=new in-interface=ether1 protocol=ipsec-ah src-address=0.0.0.0
add action=accept chain=input connection-state=new in-interface=ether1 protocol=ipsec-esp src-address=0.0.0.0
add action=accept chain=input connection-state=new dst-port=500 in-interface=ether1 protocol=udp src-address=0.0.0.0
add action=accept chain=input connection-state=new dst-port=1701 in-interface=ether1 protocol=udp src-address=0.0.0.0
add action=accept chain=input connection-state=new dst-port=4500 in-interface=ether1 protocol=udp src-address=0.0.0.0
add action=drop chain=input comment=“defconf: drop all from WAN” in-interface=ether1
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related” connection-state=established,related
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new in-interface=ether1
/ip firewall nat add action=masquerade chain=srcnat comment=“defconf: masquerade” out-interface=ether1
add action=masquerade chain=srcnat comment=“masq. vpn traffic” src-address=192.168.89.0/24
add action=masquerade chain=srcnat comment=“masq. ipsec traffic” disabled=yes src-address=10.13.2.0/24
add action=dst-nat chain=dstnat dst-port=81 in-interface=ether1 protocol=tcp to-addresses=10.13.1.30 to-ports=81
add action=dst-nat chain=dstnat disabled=yes dst-port=81 in-interface=ether1 protocol=udp to-addresses=10.13.1.30 to-ports=81
add action=dst-nat chain=dstnat disabled=yes dst-port=84 in-interface=all-ppp protocol=tcp to-addresses=10.13.1.52 to-ports=84
/ip ipsec peer add address=0.0.0.0/0 compatibility-options=skip-peer-id-validation dh-group=modp1024 enc-algorithm=aes-256 exchange-mode=main-l2tp generate-policy= port-override hash-algorithm=sha256
/ip ipsec policy add dst-address=0.0.0.0/0 protocol=udp src-address=0.0.0.0/0 template=yes
/lcd pin set hide-pin-number=yes pin-number=9876
/ppp secret add local-address=10.13.1.1 name=vpn
add local-address=10.13.1.1 name=lippavisual
add local-address=10.13.1.1 name=EricZ
add local-address=10.13.1.1 name=Test service=l2tp
add name=test1
add caller-id=“ip address” name=tyler profile=ipsec+l2tp service=l2tp
/system clock set time-zone-name=America/New_York
/system logging add topics=debug
add topics=l2tp
add topics=ipsec
/tool mac-server set allowed-interface-list=mactel
/tool mac-server mac-winbox set allowed-interface-list=mac-winbox
[admin@MikroTik] >
