Mikrotik Ovpn How To
/certificate
add name=ca common-name=example.com days-valid=3650 key-size=2048 key-usage=crl-sign,key-cert-sign
add name=server common-name=*.example.com days-valid=3650 key-size=2048 key-usage=digital-signature,key-encipherment,tls-server
add name=client common-name=client.example.com days-valid=3650 key-size=2048 key-usage=tls-client
/certificate
sign ca name=ca-certificate
sign server name=server-certificate ca=ca-certificate
sign client name=client-certificate ca=ca-certificate
/certificate
export-certificate ca-certificate export-passphrase=””
export-certificate client-certificate export-passphrase=12345678
(This should give you three files: cert_export_ca-certificate.crt, cert_export_client-certificate.crt, and cert_export_client-certificate.key.
After copying this on computer for later I like to rename them to ca.crt, client.crt, and client.key respectively.)
/ip pool
add name=”vpn-pool” ranges=192.168.8.10-192.168.8.99
/ip dhcp-server network
add address=192.168.8.0/24 comment=vpn dns-server=192.168.8.250 gateway=\
192.168.8.250 netmask=24
/ppp
profile add name=”vpn-profile” use-encryption=yes local-address=192.168.8.250 dns-server=192.168.8.250 remote-address=vpn-pool
secret add name=user profile=vpn-profile password=password
/interface ovpn-server server
set default-profile=vpn-profile certificate=server-certificate require-client-certificate=yes auth=sha1 cipher=aes128,aes192,aes256 enabled=yes
(copy both ca.crt and client.crt to C:\Program Files\OpenVPN\config\ directory alongside client.ovpn.)
/ppp secret
add name=epafos password=test123 profile=open_vpn service=ovpn
/ip firewall filter
add action=accept chain=input comment=VPN dst-port=1194 protocol=tcp
Create 2 txt files (vpn.ovpn and auth.cfg.)
Στο vpn.ovpn κάνουμε copy το παρακάτω
client
dev tap (ΠΡΟΣΟΧΗ σε αυτή την γραμμή. Από default έχει tun. Εάν δεν παίζει το αλλάζουμε σε tap)
proto tcp-client
remote 2.2.2.2 (την public ip ή το dyndns)
port 1194
nobind
persist-key
persist-tun
tls-client
remote-cert-tls server
ca ca.crt
cert client.crt
key client.key
verb 4
mute 10
cipher AES-256-CBC
auth SHA1
auth-user-pass auth.cfg
auth-nocache
redirect-gateway def1
Στο auth.cfg γράφουμε 2 γραμμές μόνο
username
password
ΑΠΟ ROUTER
LAN : VPN NETWORK TOY MIKROTIK π.χ 192.168.8.0/24
GATEWAY : IP MIKROTIK
ΑΠΟ MIKROTIK
Ip – Firewall -NAT
action: Masquerade
src address : VPN NETWORK TOY MIKROTIK π.χ 192.168.8.0/24 ( vpn subnet )
dst address : 192.168.1.0/24 ( local subnet )
Κατεβάζουμε το openvpn client και κάνουμε setup
import το vpn.ovpn και συνδεόμαστε
