Mikrotik OpenVPN

OpenVPN server на Mikrotik

Надо сделать на домашнем роутере, что бы связать ходить в оффис. Инициирует соединение офисная машина. Потом с "откудаугодно" подключаюсь с ноута и попадаю в офисную сеть

Создать сертефикаты

Все делаю на линуксе, easy-rsa

cd easy-rsa
less README
vi vars
source vars
./clean-all

Create CA (Certificate Authority, required to sign client and server certificates)

./pkitool --initca 

Create Server Certificate

./pkitool --pass --server RB450  

Convert Server private key to .pem format

openssl rsa -in keys/RB450.key -out keys/RB450.pem

Create Client Certificate

./pkitool --pass client1

Convert Client private key to .pem format

openssl rsa -in keys/client1.key -out keys/client1.pem

Эти соответвенно на Микротик (scp)

RB450.crt
RB450.pem
ca.crt

/certificate
import file=RB450.crt
import file=RB450.pem
import file=ca.crt

На клиентов: (у меня их 2)

ca.crt
client1.crt
client1.pem

Конфигурация МикроТик

/ppp profile
set default change-tcp-mss=yes comment="" name=default only-one=default use-compression=default use-encryption=default use-vj-compression=default
add change-tcp-mss=default comment="" local-address=10.15.32.1 name=OpenVPN only-one=default remote-address=ovpn-pool use-compression=default use-encryption=required use-vj-compression=default
set default-encryption change-tcp-mss=yes comment="" name=default-encryption only-one=default use-compression=default use-encryption=yes use-vj-compression=default

Как я понимаю из вики, авторизация ТОЛЬКО по сертефикату невозможна (мне - и не нужна).Создаю пользователей.

/ppp secret
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 name=username1 password=password1 profile=default routes="" service=any
add caller-id="" comment="" disabled=no limit-bytes-in=0 limit-bytes-out=0 name=username2 password=password2 profile=default routes="" service=any

Конфиг собственно сервера:

/interface ovpn-server server
set auth=sha1,md5 certificate=cert1 cipher=blowfish128,aes128,aes192,aes256 default-profile=OpenVPN enabled=yes keepalive-timeout=disabled mac-address=FE:16:B7:A7:D5:5B max-mtu=1500 mode=ip netmask=24 port=\
    1194 require-client-certificate=no

Мак конечно вводить не нужно. ip в конфиге означает "tun"

Linux

dev tun
proto tcp-client

remote sirmax 1194 # Remote OpenVPN Servername or IP address

ca   /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/client1.crt
key  /etc/openvpn/keys/client1.key

tls-client
port 1194 

user root
group root

#comp-lzo # Do not use compression. It doesn't work with RouterOS (at least up to RouterOS 3.0rc9)

# More reliable detection when a system loses its connection.
ping 15
ping-restart 45
ping-timer-rem
persist-tun
persist-key

# Silence  the output of replay warnings, which are a common false
# alarm on WiFi networks.  This option preserves the  security  of
# the replay protection code without the verbosity associated with
# warnings about duplicate packets.
mute-replay-warnings

# Verbosity level.
# 0 = quiet, 1 = mostly quiet, 3 = medium output, 9 = verbose
verb 3

cipher AES-256-CBC
auth SHA1
pull