есть OVPN server на UBUNTU, есть удаленные клиенты этого сервера. Сейчас основной роутер Zyxel kenetik lite 3, nat включен, порт 1194 для OVPN проброшен. Появилась необходимость заменить на Mikrotik RB3011UiAS и клиенты OVPN перестали видеть сервер, проброс порта так же сделал. Не могу понять в чем проблема, ибо тема для меня новая. Куда смотреть и что править?
Конфиг:
# dec/05/2022 13:10:55 by RouterOS 6.48.3
# software id = AEL9-JNF2
#
# model = RB3011UiAS
# serial number = E14E0E228C0D
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz frequency=2437 name=Main-2G
add band=5ghz-a/n/ac control-channel-width=20mhz frequency=5300 name=Main-5G
add band=2ghz-b/g/n control-channel-width=20mhz name=TG-Guest tx-power=20
/caps-man datapath
add client-to-client-forwarding=yes local-forwarding=yes name=Office
/interface bridge
add arp=reply-only fast-forward=no name=bridge-CAP
add name=bridge1
/caps-man datapath
add bridge=bridge-CAP client-to-client-forwarding=yes name=Guest
/caps-man security
add authentication-types=wpa2-psk comment=B@rrettM82 encryption=aes-ccm name=Tobacco-Group \
passphrase=B@rrettM82
add authentication-types=wpa2-psk comment=Guest_22638827 encryption=aes-ccm name=Guest \
passphrase=22638827
/caps-man configuration
add channel=Main-2G channel.band=2ghz-b/g/n channel.frequency=2437 country=russia3 datapath=\
Office mode=ap name=Office-2G rates.basic="" rx-chains=0,1,2 security=Tobacco-Group ssid=\
Tobacco-Group tx-chains=0,1,2
add channel=Main-5G channel.band=5ghz-a/n/ac channel.frequency=5300 country=russia3 datapath=\
Office mode=ap name=Office-5G security=Tobacco-Group ssid=Tobacco-Group-5G
add channel=TG-Guest country=russia3 datapath=Guest mode=ap name=Guest-2G security=Guest \
security.authentication-types=wpa2-psk security.encryption=aes-ccm ssid=Guest_TG
/interface ovpn-client
add certificate=mikrotik.crt_0 connect-to=10.8.0.1 mac-address=02:99:43:72:85:7B name=\
ovpn-out1 user=mikrotik
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=\
192.168.0.20-192.168.0.200,192.168.1.20-192.168.1.100,192.168.4.2-192.168.4.200
add name=guest ranges=10.10.10.10-10.10.10.200
add name=dhcp_pool2 ranges=10.10.10.2-10.10.10.254
add name=dhcp ranges=192.168.1.11-192.168.1.200
add name=dhcp_pool4 ranges=192.168.88.10-192.168.88.200
add name=dhcp_pool5 ranges=192.168.88.10-192.168.88.200
add name=dhcp_pool6 ranges=192.168.88.10-192.168.88.200
add name=dhcp_pool7 ranges=192.168.0.1-192.168.1.1,192.168.1.11-192.168.255.200
add name=dhcp_pool8 ranges=192.168.1.11-192.168.1.220
/ip dhcp-server
add address-pool=guest interface=bridge-CAP name=dhcp1 relay=10.10.10.1
add address-pool=guest disabled=no interface=bridge-CAP name=dhcp2
add address-pool=dhcp_pool8 interface=bridge1 name=dhcp3
/queue simple
add comment="Set Target IP new TL" max-limit=5M/5M name=New-TL-5M queue=\
pcq-upload-default/pcq-download-default target=bridge-CAP
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=b,g,gn master-configuration=Office-2G \
name-format=prefix-identity name-prefix=2G slave-configurations=Guest-2G
add action=create-dynamic-enabled hw-supported-modes=ac,an master-configuration=Office-5G \
name-format=prefix-identity name-prefix=5G slave-configurations=Office-5G
/interface bridge port
add bridge=bridge1 interface=ether2 restricted-role=yes
add bridge=bridge1 interface=sfp1
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether10
add bridge=bridge1 disabled=yes interface=ether1
add bridge=bridge1 interface=ovpn-out1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface list member
add interface=ether1 list=WAN
add list=LAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=ether9 list=LAN
add interface=ether10 list=LAN
add interface=sfp1 list=LAN
add list=LAN
add interface=bridge1 list=LAN
/ip address
add address=10.10.10.0/24 interface=bridge-CAP network=10.10.10.0
add address=XXX.XXX.XXX.XXX/24 interface=ether1 network=109.236.108.0 (ip провайдера)
add address=192.168.1.2/16 interface=bridge1 network=192.168.0.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=10.10.10.0/24 dns-server=8.8.8.8 gateway=10.10.10.1
add address=192.168.0.0/16 gateway=192.168.1.2 netmask=16
add address=192.168.1.0/24 gateway=192.168.1.10 netmask=24
/ip dns
set allow-remote-requests=yes servers=62.152.64.8,62.152.65.8,78.88.8.8,8.8.8.8,8.8.4.4
/ip firewall address-list
add address=10.8.0.0/24 comment=ovpn list=blackHole
/ip firewall filter
add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=accept chain=input connection-state=invalid dst-port=1194 protocol=udp
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-port=8291 protocol=tcp
add action=drop chain=input
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward connection-nat-state=!dstnat disabled=yes
/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes protocol=tcp \
tcp-flags=syn
add action=mark-routing chain=prerouting dst-address-list=blackHole new-routing-mark=bh
/ip firewall nat
add action=masquerade chain=srcnat comment=LAN out-interface=ether1 out-interface-list=WAN
add action=dst-nat chain=dstnat comment=OVPN dst-port=13919 in-interface=ether1 protocol=udp \
to-addresses=192.168.5.140 to-ports=1194
add action=dst-nat chain=dstnat comment=Zabbix dst-port=32167 in-interface=ether1 protocol=\
tcp to-addresses=192.168.5.140 to-ports=10051
add action=dst-nat chain=dstnat comment="LM NoIP" dst-port=12391 in-interface=ether1 \
protocol=tcp to-addresses=192.168.5.133 to-ports=5655
/ip route
add distance=1 gateway=ovpn-out1 routing-mark=bh
add distance=1 gateway=109.236.108.1
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=Office-//main//
/system ntp client
set enabled=yes primary-ntp=193.171.23.163 secondary-ntp=85.114.26.194
Немного скриншотов:
