Доброго времени суток, не получается подключится к ovpn серверу с внешнего адреса
Есть офис с сетью на tp-link er6020 v1 с последней версией прошивки, на него приходят 2 кабеля от разных провайдеров, оба с белыми ip. От роутера идёт кабель на циско свич с которого уже раскидываются провода по всему офису и mikrotik (6.46.8) rb952ui-5ac2nd в режим моста раздающий wifi.
В какой-то момент появилась необходимость прокинуть vpn, для которой выбрали openvpn как наиболее безболезненный для прохода через нат тплинка. По итогу миркротик настроил вот по этому гайду:
https://interface31.ru/tech_it/2020/01/nastroyka-o...
Сервер - Mikrotik, сертификаты создавались на нём же, правила для фаервола прописаны, на него перенаправлены все запросы с любого из двух ip на 1194 порт с тплинка. Послденее сделано через функцию Virtual server.
Внутри сети всё работает, в то время как с внешнего компьютера/телефона коннект не идёт. Судя по логам коннект доходит до микротика, но по какой-то причине не подключает и я, честно говоря, не особо понимаю почему.
Настройки микротика
# feb/16/2021 18:42:05 by RouterOS 6.46.8
# software id = XLWS-7H1N
#
# model = RouterBOARD 952Ui-5ac2nD
# serial number = 7C30074A2CE2
/interface bridge
add name=bridge1
/interface ethernet
set [ find default-name=ether1 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether2 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether3 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether4 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
set [ find default-name=ether5 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk comment=LAN eap-methods="" \
management-protection=allowed mode=dynamic-keys name=*** \
supplicant-identity="" wpa-pre-shared-key=*** wpa2-pre-shared-key=\
***
/interface wireless
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode \
antenna-gain=0 band=2ghz-b/g/n comment=LAN country=russia disabled=no \
distance=indoors frequency=2437 frequency-mode=superchannel mode=\
ap-bridge security-profile=*** ssid=*** station-roaming=\
enabled tx-power=19 tx-power-mode=all-rates-fixed wireless-protocol=\
802.11 wps-mode=disabled
set [ find default-name=wlan2 ] antenna-gain=0 band=5ghz-a/n/ac country=\
russia disabled=no frequency=5280 frequency-mode=superchannel mode=\
ap-bridge security-profile=*** ssid=*** station-roaming=\
enabled tx-power=19 tx-power-mode=all-rates-fixed wireless-protocol=\
802.11
/interface wireless manual-tx-power-table
set wlan1 comment=LAN
/interface wireless nstreme
set wlan1 comment=LAN enable-polling=no
set wlan2 enable-polling=no
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec policy group
set [ find default=yes ] name=def
add name=ipsec
/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-256,aes-192,aes-128,3des
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256,sha1 enc-algorithms=\
aes-256-cbc,aes-256-ctr,aes-192-cbc,aes-128-cbc,3des
/ip pool
add name=dhcp_pool0 ranges=192.168.2.2-192.168.2.12
add name=dhcp_pool1 ranges=192.168.0.140-192.168.0.200
add name=dhcp_pool2 ranges=192.168.0.150-192.168.0.175
add name=dhcp_pool3 ranges=192.168.2.2-192.168.2.254
add name=dhcp_pool4 ranges=192.168.2.2-192.168.2.254
add name=vpnpool ranges=192.168.0.236-192.168.0.240
/ip dhcp-server
add address-pool=dhcp_pool4 disabled=no interface=bridge1 name=dhcp1 relay=\
192.168.2.1
/ppp profile
add bridge=bridge1 local-address=vpnpool name=ovpn remote-address=vpnpool
add change-tcp-mss=yes dns-server=192.168.0.129 local-address=192.168.0.2 \
name=l2tp remote-address=vpnpool use-compression=yes use-encryption=no
add bridge=bridge1 change-tcp-mss=yes local-address=192.168.0.3 name=pptp \
remote-address=vpnpool use-compression=yes use-encryption=yes use-mpls=no \
use-upnp=no
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
sword,web,sniff,sensitive,api,romon,dude,tikapp"
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=wlan2
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=wlan1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface l2tp-server server
set authentication=mschap2 default-profile=l2tp ipsec-secret=*** \
use-ipsec=yes
/interface list member
add interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=wlan2 list=LAN
add interface=wlan1 list=LAN
/interface ovpn-server server
set auth=sha1 certificate=ovpn-server cipher=aes128 default-profile=ovpn \
enabled=yes require-client-certificate=yes
/interface pptp-server server
set authentication=mschap2 default-profile=default
/ip address
add address=192.168.2.1/24 disabled=yes interface=bridge1 network=192.168.2.0
add address=192.168.0.2/24 interface=ether2 network=192.168.0.0
/ip cloud
set update-time=no
/ip dhcp-client
# DHCP client can not run on slave interface!
add disabled=no interface=ether5
/ip dhcp-server network
add address=192.168.0.0/24 gateway=192.168.0.1
add address=192.168.2.0/24 gateway=192.168.2.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.0.2 name=router.lan
/ip firewall filter
add action=accept chain=input comment=L2TP disabled=yes dst-port=\
1701,500,4500 in-interface-list=all protocol=udp
add action=accept chain=input disabled=yes protocol=l2tp
add action=accept chain=input disabled=yes protocol=ipsec-esp
add action=accept chain=input dst-port=1194 in-interface-list=all log=yes \
protocol=tcp
/ip route
add distance=1 dst-address=10.8.10.0/24 gateway=192.168.0.1
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ppp secret
add name=*** password=*** profile=ovpn service=ovpn
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system ntp client
set enabled=yes primary-ntp=88.147.254.230 secondary-ntp=88.147.254.230 \
server-dns-names=192.168.0.129
Конфиг клиента
client
dev tun
proto tcp
remote белый ip 1194
resolv-retry infinite
nobind
persist-key
persist-tun
pkcs12 "C:\\OVPN\\OVL.p12"
auth-user-pass "C:\\OVPN\\auth.cfg"
askpass "C:\\OVPN\\keypass.cfg"
remote-cert-tls server
route 192.168.0.0 255.255.255.0 192.168.0.2
cipher AES-128-CBC
verb 3
Лог клиента2021-02-18 17:26:49 DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-128-CBC' to --data-ciphers or change --cipher 'AES-128-CBC' to --data-ciphers-fallback 'AES-128-CBC' to silence this warning.
2021-02-18 17:26:49 OpenVPN 2.5.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Oct 28 2020
2021-02-18 17:26:49 Windows version 10.0 (Windows 10 or greater) 64bit
2021-02-18 17:26:49 library versions: OpenSSL 1.1.1h 22 Sep 2020, LZO 2.10
Enter Management Password:
2021-02-18 17:26:49 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
2021-02-18 17:26:49 Need hold release from management interface, waiting...
2021-02-18 17:26:50 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
2021-02-18 17:26:50 MANAGEMENT: CMD 'state on'
2021-02-18 17:26:50 MANAGEMENT: CMD 'log all on'
2021-02-18 17:26:50 MANAGEMENT: CMD 'echo all on'
2021-02-18 17:26:50 MANAGEMENT: CMD 'bytecount 5'
2021-02-18 17:26:50 MANAGEMENT: CMD 'hold off'
2021-02-18 17:26:50 MANAGEMENT: CMD 'hold release'
2021-02-18 17:26:50 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-02-18 17:26:50 TCP/UDP: Preserving recently used remote address: [AF_INET]айпи офиса:1194
2021-02-18 17:26:50 Socket Buffers: R=[65536->65536] S=[65536->65536]
2021-02-18 17:26:50 Attempting to establish TCP connection with [AF_INET] айпи офиса:1194 [nonblock]
2021-02-18 17:26:50 MANAGEMENT: >STATE:1613658410,TCP_CONNECT,,,,,,
2021-02-18 17:26:59 SIGTERM[hard,init_instance] received, process exiting
2021-02-18 17:26:59 MANAGEMENT: >STATE:1613658419,EXITING,init_instance,,,,,
Пример лога с 1194 порта микротика при подключении
18:54:21 firewall,info input: in:bridge1 out:(unknown 0), src-mac d4:6e:0e:a3:26:8c, proto TCP (SYN), внешний ip:1233->192.168.0.2:1194, len 48
18:54:22 firewall,info input: in:bridge1 out:(unknown 0), src-mac d4:6e:0e:a3:26:8c, proto TCP (SYN), внешний ip:1233->192.168.0.2:1194, len 48
18:54:24 firewall,info input: in:bridge1 out:(unknown 0), src-mac d4:6e:0e:a3:26:8c, proto TCP (SYN), внешний ip:1233->192.168.0.2:1194, len 48
18:54:28 firewall,info input: in:bridge1 out:(unknown 0), src-mac d4:6e:0e:a3:26:8c, proto TCP (SYN), внешний ip:1233->192.168.0.2:1194, len 48
Простой
Средний
