Mikrotik RouterOS OVPN setup

 How to setup OVPN on Mikrotik RouterOS v6 and v7

A. Setup OVPN server in RouterOS

1. /cerfiticate
   add name=CA-root common-name=host.domain.cc key-usage=key-cert-sign,crl-sign
   add name=Server-cert common-name=*.host.domain key-usage=digital-signature,key-encipherment,tls-server,tls-client
   sign CA-root
   sign Server-cert ca=CA-root
   set Server-cert trusted=yes
   export-certificate CA-root 
2. /ip pool
   add name=pool-ovpn ranges=172.16.100.1-172.16.100.10
3. /ppp profile
   add local-address=pool-ovpn name=profile-ovpn remote-address=pool-ovpn
4. /ppp secret
   add name=Username password=Password profile=profile-ovpn service=ovpn
5. /interface ovpn-server server
   set auth=sha1 certificate=Server-cert cipher=aes128 default-profile=profile-ovpn enabled=yes port=443

B. Create OPVN client config file

Create a client.ovpn file as follows and put the contents of cert_export_CA_root.crt (/file) in between <ca>-----BEGIN CERTIFICATE----- and  -----END CERTIFICATE-----</ca>

client

dev tun

proto tcp

remote host.domain 443

resolv-retry infinite

nobind

persist-key

persist-tun

cipher AES-128-CBC

auth SHA1

auth-user-pass

redirect-gateway def1

verb 3

<ca>

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

</ca>

C. Use OpenVPN app to connect to host.domain

Import client.ovpn config file and make a connection by input Username and Password.

Line (line.me) Desktop App IPv6 problem

If IPv6 is enable in a Windows computer, the Line desktop application will not able to receive some pictures, videos and files.

Disable IPv6 may solve this problem.

Possible reason is the DNS requeset for Line is answered with AAAA recoreds, but the answered IPv6 addresss cannot be reached.

Mikrotik L2TP/IPsec for Android, iOS, Windows

The most important part is the ipsec profile, ecp256 is required for Windows. Also, the L2TP secret is not supported by iOS. 

Following is the configuration script for ROS 7.7:

/ip pool

add name=l2tp_pool ranges=192.168.100.190-192.168.100.200

/ppp profile

add name=l2tp-profile local-address=l2tp_pool remote-address=l2tp_pool

/ppp secret

add name=sclai profile=l2tp-profile service=l2tp

/ip ipsec profile

set [ find default=yes ] dh-group=ecp256,modp1024 enc-algorithm=\

    aes-256,aes-192,aes-128

/interface l2tp-server server

set authentication=mschap2 default-profile=l2tp-profile enabled=yes use-ipsec=\

    yes

Tiny Core Linux add IPv6 support

1. tce-load  -wi ipv6-netfilter-5.15.10-tinycore.tcz
2. echo "modprobe ipv6" | sudo tee -a /opt/bootlocal.sh
3. /usr/bin/filetool.sh -b

Telnet to a node's console on remote GNS server through SSH tunnel

Connect a node on remote GNS3 server through SSH tunnel

A dstnat is required to forward node_dstnat_port to node_console_port on GNS3 

For telnet

ssh -Nf -L local_port:gns3_server_ip:node_dstnat_port ssh_user@ssh_server

telnet localhost:local_port

User PuTTY to connect a node on remote GNS3 server through SSH tunnel

PuTTY --> SSH server --> GNS3 remote server 

(1) Command line:

C:\>putty username@proxy-ssh-server -L localport:gns3-remote-server:node-console-port

C:\>telnet localhost localport

(2) GUI

Open PuTTY 

-> Session 

Host Name: remote-server-name Port: remote-node-port

->Connection -> Proxy

Proxy type: Local

Proxy hostname: hostname-for-ssh-server

Port: 22

Username: username-for-ssh-server

Password: password-for-ssh-server

local proxy command:

plink -pw %pass %user@%proxyhost -nc %host:%port

-> Session

Saved sessions: name-for-node

click save

更新 .ssh/config 內容如下之後：

1. 如果要連接 vm3，則輸入

ssh vm3 

輸入 pc106 和 vm3 的 password 就可以連線。

2. 如果要從 vm3 下載或上傳資料，則輸入

ssh -Nf pc106

之後，如要複製 $HOME/history 檔案，則可輸入

scp -P 3199 127.0.0.1:history history

就會把檔案從 vm3 下載到本機，要留意的是遠端檔案的正確路徑和名稱。

Host *

        StrictHostKeyChecking no

        Ciphers aes256-gcm@openssh.com

Host pc106

        HostName 120.125.80.106

        LocalForward 3197 163.28.10.197:22

        LocalForward 3198 163.28.10.198:22

        LocalForward 3199 163.28.10.199:22

        LocalForward 3200 163.28.10.200:22

Host vm1

        ProxyCommand ssh 120.125.80.106 -W 163.28.10.197:22

Host vm2

        ProxyCommand ssh 120.125.80.106 -W 163.28.10.198:22

Host vm3

        ProxyCommand ssh 120.125.80.106 -W 163.28.10.199:22

Host vm4

        ProxyCommand ssh 120.125.80.106 -W 163.28.10.200:22

qemu Mikrotik ROS for GNS3 Remote Server

Convert img to qcow2:

qemu-img convert -f raw -O qcow2 chr-7.6.img chr-7.6.qcow2

Boot ROS and connect with webfig:

qemu-system-x86_64 -nic user,hostfwd=tcp:127.0.0.1:6001-:80 "chr-7.6.qcow2"

Boot ROS and connect with winbox:

qemu-system-x86_64 -nic user,hostfwd=tcp:127.0.0.1:6002-:8291 "chr-7.6.qcow2"

For GNS3 remote server:

1. If the first interface is not ether1, do /system/reset-configuration, power off the machine, then upload the image to GNS3.
2. To avoid default route added by dhcp client, use the following script or do /system/reset-configuration with no default configuration and run-after-reset=oob.rsc:

oob.rsc
/ip vrf add name=oob interface=ether1 /ip service set winbox vrf=oob /ip service set www vrf=oob

in /ip firewall managle, the output chain with new-routing-mark will not work if there is no route in the main table; use routing rule instead.

Mikrotik ROS v7 User Manager v5 as RADIUS server (with VLAN)

PART 1. RADIUS server

A. Certificate Generation

menu System/Certificate

Certificates tab:

add (for CA)

General Tab

Name CA-Root

Common Name root

Key Usage Tab

key cert. sign

crl sign

select OK

General Tab

Sign CA-Root

add (for Server certificate)

General Tab

Name Cert-Server

Common Name server

Key Usage Tab

digital signature

key encipherment

data encipherment

key cert. sign

crl sign

tls client

tls server

select OK

General Tab

Sign Cert-Server (with CA CA-Root) 

Check Cert-Server as Trusted (General Tab)

B. User Manager

menu User Manager

Setting Tab

Check Enabled

Certitifcate: select server certitificate (Certitifate Generation)

User tab

add (for MAC auth)

Name 0C:66:17:E7:00:00 (MAC address with capital letter)

Attributes Tunnel-Medium-Type 6
Attributes Tunnel-Type 13
Attributes Tunnel-Private-Group-ID 100 (VLAN ID)

add (for 802.1x)

Name user1  (802.1x login username)

Password 12345 (802.1x login password)

Attributes Tunnel-Medium-Type 6
Attributes Tunnel-Type 13
Attributes Tunnel-Private-Group-ID 100 (VLAN ID)

Router tab

Name RT-1 (name for RADIUS client)

Share secret 123456 (password for RADIUS client)

Address 10.1.1.254 (IP address for RADIUS client)

PART 2. RADIUS client

A. RADIUS client setup

menu RADIUS

add (for do1x service)

Service do1x

Address 10.1.1.1 (IP address for RADIUS server) (Be careful, the IP address must match the RADIUS server's interface address that sending packet back to the client; otherwise, the received packet will be sliently dropped.)

Secert 123456 (password for RADIUS client)

B. Dot1X server setup

menu Do1X

Server Tab

add (for interface)

check dot1x (for 802.1x) or mac auth (for MAC auth)