PPTP VPN interconnection with MikroTik
PPTP VPN setting example on RTX810 & MikroTik RB751G
| LAN interface settings (Use LAN1 Interface) |
ip lan1 address 192.168.100.1/24 |
|---|---|
| WAN Interface settings (Use LAN2 Interface) |
pp select 1 |
| pp keepalive interval 30 retry-interval=30 count=12 | |
| pp always-on on | |
| pppoe use lan2 | |
| pppoe auto disconnect off | |
| pp auth accept pap chap | |
| pp auth myname (User_ID) (Password) | |
| ppp lcp mru on 1454 | |
| ppp ipcp ipaddress on | |
| ppp ipcp msext on | |
| ppp ccp type none | |
| ip pp nat descriptor 1000 | |
| pp enable 1 | |
| ip route default gateway pp 1 | |
| NAT settings | nat descriptor type 1000 masquerade |
| nat descriptor masquerade static 1000 1 192.168.100.1 tcp 1723 | |
| nat descriptor masquerade static 1000 2 192.168.100.1 gre | |
| DHCP Server settings | dhcp service server |
| dhcp server rfc2131 compliant except remain-silent | |
| dhcp scope 1 192.168.100.2-192.168.100.191/24 | |
| DNS settings | dns server pp 1 |
| dns private address spoof on | |
| PPTP VPN settings | pp select 2 |
| pp bind tunnel1 | |
| pp always-on on | |
| pp auth request mschap-v2 | |
| pp auth username (PPTP_ID) (PPTP_Password) | |
| ppp ipcp ipaddress on | |
| ppp ccp type mppe-any | |
| ip pp address 10.0.0.1/32 | |
| ip pp remote address 10.0.0.2 | |
| pptp service type server | |
| pp enable 2 | |
| tunnel select 1 | |
| tunnel encapsulation pptp | |
| tunnel endpoint address 200.1.1.202 | |
| pptp tunnel disconnect time off | |
| tunnel enable 1 | |
| pptp service on | |
| ip route 192.168.88.0/24 gateway tunnel 2 | |
| Filter settings | ip filter 200000 reject 10.0.0.0/8 * * * * |
| ip filter 200001 reject 172.16.0.0/12 * * * * | |
| ip filter 200002 reject 192.168.0.0/16 * * * * | |
| ip filter 200003 reject 192.168.100.0/24 * * * * | |
| ip filter 200010 reject * 10.0.0.0/8 * * * | |
| ip filter 200011 reject * 172.16.0.0/12 * * * | |
| ip filter 200012 reject * 192.168.0.0/16 * * * | |
| ip filter 200013 reject * 192.168.100.0/24 * * * | |
| ip filter 200020 reject * * udp,tcp 135 * | |
| ip filter 200021 reject * * udp,tcp * 135 | |
| ip filter 200022 reject * * udp,tcp netbios_ns-netbios_ssn * | |
| ip filter 200023 reject * * udp,tcp * netbios_ns-netbios_ssn | |
| ip filter 200024 reject * * udp,tcp 445 * | |
| ip filter 200025 reject * * udp,tcp * 445 | |
| ip filter 200026 restrict * * tcpfin * www,21,nntp | |
| ip filter 200027 restrict * * tcprst * www,21,nntp | |
| ip filter 200030 pass * 192.168.100.0/24 icmp * * | |
| ip filter 200031 pass * 192.168.100.0/24 established * * | |
| ip filter 200032 pass * 192.168.100.0/24 tcp * ident | |
| ip filter 200033 pass * 192.168.100.0/24 tcp ftpdata * | |
| ip filter 200034 pass * 192.168.100.0/24 tcp,udp * domain | |
| ip filter 200035 pass * 192.168.100.0/24 udp domain * | |
| ip filter 200036 pass * 192.168.100.0/24 udp * ntp | |
| ip filter 200037 pass * 192.168.100.0/24 udp ntp * | |
| ip filter 200080 pass * 192.168.100.1 tcp * 1723 | |
| ip filter 200081 pass * 192.168.100.1 gre * * | |
| ip filter 200098 reject-nolog * * established | |
| ip filter 200099 pass * * * * * | |
| ip filter 500000 restrict * * * * * | |
| ip filter dynamic 200080 * * ftp | |
| ip filter dynamic 200081 * * domain | |
| ip filter dynamic 200082 * * www | |
| ip filter dynamic 200083 * * smtp | |
| ip filter dynamic 200084 * * pop3 | |
| ip filter dynamic 200085 * * submission | |
| ip filter dynamic 200098 * * tcp | |
| ip filter dynamic 200099 * * udp | |
| pp select 1 | |
| ip pp secure filter in 200003 200020 200021 200022 200023 200024 200025 200030 200032 200080 200081 | |
| ip pp secure filter out 200013 200020 200021 200022 200023 200024 200025 200026 200027 200099 dynamic 200080 200081 200082 200083 200084 200085 200098 200099 | |
| pp enable 1 |
Required Setting on MikroTik Winbox
Set the followings from initial configuration.
PPPoE Connection setting
Location: [PPP] – [Interface]
Configure provider setting for Internet connection.
Firewall setting
Location: [IP] – [Firewall] – [Filter Rules]
Add input filter for UDP TCP port 1723 (Connection).
Add input filter for GRE.
NAT setting
Location: [IP] – [Firewall] – [NAT]
Add NAT entry for communication to opposite site.
PPTP Client setting
Location: [PPP] – [Interface]
Add PPTP Client.
PPP Secret setting
Location: [PPP] – [Secrets]
Add PPP Secret.
Route setting
Location: [IP] – [Routes] – [Routes]
Add Route setting to opposite site.
