Должно быть исправлено: 13 ноября 2018, 18:29:21, RouterOS 6.43.4 software id = Z0NI-ZVVR, модель = RouterBOARD 3011UiAS, серийный номер = 71A00530D6DD
/interface bridge add dhcp-snooping=yes fast-forward=no name=localnetwork vlan-filtering=yes
/interface ethernet set [ find default-name=ether1 ] name=ether1-WAN-Fiber
set [ find default-name=ether2 ] name=ether2-WAN-Cable
set [ find default-name=ether6 ] name=ether6-LAN
set [ find default-name=ether7 ] name=ether7-LAN
/interface vlan add interface=localnetwork name=vlan_169_cams vlan-id=169
add interface=localnetwork name=vlan_170_dispatch vlan-id=170
add interface=localnetwork name=vlan_180_voice vlan-id=180
/interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec peer profile set [ find default=yes ] dh-group=modp2048 enc-algorithm=aes-256,3des
/ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-128-cbc lifetime=0s pfs-group=none
/ip pool add name=lan-dhcp ranges=192.168.168.50-192.168.168.220
add name=vlan-voice ranges=192.168.180.50-192.168.180.100
add name=vlan-cams ranges=192.168.169.2-192.168.169.10
add name=vlan-dispatch ranges=192.168.170.50-192.168.170.100
add name=VPN-L2tp ranges=10.10.10.10-10.10.10.30
/ip dhcp-server add address-pool=lan-dhcp disabled=no interface=localnetwork name=lan-dhcp
add address-pool=vlan-voice disabled=no interface=vlan_180_voice lease-time=24m name=vlan-voice
add address-pool=vlan-cams disabled=no interface=vlan_169_cams lease-time=24m name=vlan-cams
add address-pool=vlan-dispatch disabled=no interface=vlan_170_dispatch lease-time=24m name=vlan-dispatch-dhcp
/ppp profile add dns-server=8.8.8.8,8.8.4.4 local-address=10.10.10.1 name=VPN-L2TP remote-address=VPN-L2tp use-encryption=required
/interface bridge port add bridge=localnetwork interface=ether6-LAN
add bridge=localnetwork interface=ether7-LAN
/interface bridge vlan add bridge=localnetwork tagged=vlan_169_cams,vlan_170_dispatch,vlan_180_voice untagged=localnetwork vlan-ids=169,170,180
/interface l2tp-server server set authentication=mschap1,mschap2 default-profile=VPN-L2TP enabled=yes keepalive-timeout=disabled
/ip address add address=192.168.168.1/24 interface=localnetwork network=192.168.168.0
add address=50.238/29 interface=ether1-WAN-Fiber network=50.238
add address=96.70/29 interface=ether2-WAN-Cable network=96.70
add address=192.168.180.1/24 interface=vlan_180_voice network=192.168.180.0
add address=192.168.169.1/24 interface=vlan_169_cams network=192.168.169.0
add address=192.168.169.1/24 interface=vlan_170_dispatch network=192.168.169.0
/ip dhcp-server network add address=192.168.168.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.168.1 netmask=24
add address=192.168.169.0/24 dns-server=8.8.8.8 gateway=192.168.169.1 netmask=24
add address=192.168.170.0/24 dns-server=8.8.8.8 gateway=192.168.170.1 netmask=24
add address=192.168.180.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.180.1
/ip dns set servers=8.8.8.8,8.8.4.4
/ip firewall filter add action=accept chain=input dst-port=1701 protocol=udp
add action=accept chain=input dst-port=500 protocol=udp
add action=accept chain=input dst-port=4500 protocol=udp
add action=accept chain=input protocol=ipsec-ah
add action=accept chain=input protocol=ipsec-esp
/ip firewall mangle add action=mark-connection chain=prerouting connection-state=new in-interface=ether1-WAN-Fiber new-connection-mark=wan1 passthrough=yes
add action=mark-connection chain=prerouting connection-state=new in-interface=ether2-WAN-Cable new-connection-mark=wan2 passthrough=yes
add action=mark-routing chain=output connection-mark=wan1 new-routing-mark=wan1-out passthrough=yes
add action=mark-routing chain=output connection-mark=wan2 new-routing-mark=wan2-out passthrough=yes
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=localnetwork new-connection-mark=wan1 passthrough=yes per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting connection-state=new dst-address-type=!local in-interface=localnetwork new-connection-mark=wan2 passthrough=yes per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=prerouting connection-mark=wan1 in-interface=localnetwork new-routing-mark=wan1output passthrough=yes
add action=mark-routing chain=prerouting connection-mark=wan2 in-interface=localnetwork new-routing-mark=wan2output passthrough=yes
/ip firewall nat add action=masquerade chain=srcnat out-interface=ether1-WAN-Fiber
add action=masquerade chain=srcnat out-interface=ether2-WAN-Cable
add action=masquerade chain=srcnat comment="NAT L2TP/IPSEC" src-address=10.10.10.0/24
/ip ipsec peer add address=0.0.0.0/0 exchange-mode=main-l2tp generate-policy=port-override passive=yes secret=12345
/ip route add check-gateway=ping distance=1 gateway=50.238. routing-mark=wan1output
add check-gateway=ping distance=2 gateway=96.70. routing-mark=wan2output
add check-gateway=ping distance=1 gateway=50.238.
add check-gateway=ping distance=2 gateway=96.70.
/lcd set time-interval=daily
/ppp secret add name=test password=test profile=VPN-L2TP service=l2tp
/system clock set time-zone-name=America/Chicago
/system routerboard settings set silent-boot=no
Проверю это на Cisco Catalyst. Теоретически, теперь всё должно быть в порядке, но у меня такое чувство, что балансировка нагрузки работает не совсем правильно, так как большая часть трафика идёт через провайдера по кабелю, который значительно медленнее. Идеально было бы направлять весь HTTP, HTTPS и VoIP трафик только через волоконный провайдер.
У меня настроен IPsec VPN, я могу подключиться к WAN IP, но дальше не могу получить доступ к внутренним ресурсам.
