1. Tunnel & VPN Divisi Training PT UFOAKSES SUKSES LUARBIASA Jakarta

2. VPN Benefits Enable communications between corporate
private LANs over
Public networks
Leased lines
Wireless links
Corporate resources ( , servers, printers) can be accessed securely by users having granted access rights from outside (home, while travelling, etc.)

3. Jenis Tunnel dan VPN
IPIP
EoIP
PPPoE
PPTP
IPSec
Vlan
L2TP
OVPN

4. VLAN
VLAN is an implementation of the 802.1Q VLAN protocol for MikroTik RouterOS
A VLAN is a logical grouping that allows end users to communicate as if they were physically connected to a single isolated LAN.
As VLAN works on OSI Layer 2,

5. Vlan Network

6. Konfigurasi Vlan On the Router 1
interface vlan> add name=test vlan-id=32 interface=ether1
ip address> add address= /24 interface=test
ip address> /ping
byte pong: ttl=255 time=3 ms
byte pong: ttl=255 time=4 ms

7. On the Router 2
interface vlan> add name=test1 vlan-id=32 interface=ether1
ip address> add address= /24 interface=test1
ip address> /ping
byte pong: ttl=255 time=3 ms
byte pong: ttl=255 time=4 ms

8. Ethernet over IP MikroTik proprietary protocol.
Simple in configuration
Don't have authentication or data encryption capabilities
Encapsulates Ethernet frames into IP protocol 47/gre packets, thus EOIP is capable to carry MAC-addresses
EOIP is a tunnel with bridge capabilities

10. Membuat Tunnel EoIP

11. Check that you are able to ping remote address before creating a tunnel to it
Make sure that your EOIP tunnel will have unique MAC-address (it should be from EF:xx:xx:xx:xx:xx range)
Tunnel ID on both ends of the EOIP tunnel must be the same – it helps to separate one tunnel from other

12. EoIP and Bridging EoIP Interface can be bridged with any other
EoIP or Ethernet-like interface. Main use of EoIP tunnels is to transparently bridge remote networks.
EoIP protocol does not provide data encryption,therefore it should be run over encrypted tunnel interface, e.g., PPTP or PPPoE, if high security is required.

14. Konfigurasi EoIP

15. Seting AP di router 1

16. Create IP address

17. Create Eoip Interface

18. Create Bridge

19. Create Bridge Port

20. View Interface

21. Konfigurasi Router 2
Create station di wlan1

22. Create ip address

23. Create EoIP

24. Create Bridge

25. Create Bridge Port

26. View interface

27. Tes Konfigurasi
Tambahkan ip address di laptop satu kelas dengan ip internet
Ping gateway melalui network EoIP yang telah dibuat.

28. Hasil Tes

29. Workshop EoIP
Create EOIP tunnel with your neighbor(s) Transfer to /22 private networks – this way you
will be in the same network with your neighbor,and local addresses will remain the same
Bridge your private networks via EoIP

30. /32 IP Addresses IP addresses are added to the tunnel interfaces
Use /30 network to save address space, for
example:
/30 and /30 from network
/30
It is possible to use point to point addressing,
for example:
/32, network
/32, network

31. EoIP and /30 Routing

32. EoIP and /32 Routing

33. Local User Database
PPP Profile
PPP Secret

34. Point-to-Point protocol tunnels
A little bit sophisticated in configuration
Capable of authentication and data encryption
Such tunnels are:
PPPoE (Point-to-Point Protocol over Ethernet)
PPTP (Point-to-Point Tunneling Protocol)
L2TP (Layer 2 Tunneling Protocol)
You should create user information before
creating any tunnels

35. PPP Secret
PPP secret (aka local PPP user database) stores PPP user access records
Make notice that user passwords are displayed in the plain text – anyone who has access to the router are able to see all passwords
It is possible to assign specific /32 address to both ends of the PPTP tunnel for this user
Settings in /ppp secret user database override corresponding /ppp profile settings

36. PPP Secret

37. PPP Profile and IP Pools
PPP profiles define default values for user access records stored under /ppp secret submenu
PPP profiles are used for more than 1 user so there must be more than 1 IP address to give out - we should use IP pool as “Remote address” value
Value “default” means – if option is coming from RADIUS server it won't be overrided

38. PPP Profile

39. Change TCP MSS
Big 1500 byte packets have problems going trought the tunnels because:
Standard Ethernet MTU is 1500 bytes
PPTP and L2TP tunnel MTU is 1460 bytes
PPPOE tunnel MTU is 1488 bytes
By enabling “change TCP MSS option, dynamic mangle rule will be created for each active user to ensure right size of TCP packets, so they will be able to go through the tunnel

40. PPTP & L2TP Point-to-Point Tunnelling Protocol
PPTP uses TCP port 1723 and IP protocol 47/ GRE
There is a PPTP-server and PPTP-clients
PPTP clients are available for and/or included in almost all OS
You must use PPTP and GRE “NAT helpers” to connect to any public PPTP server from your private masqueraded network

41. L2TP Tunnels PPTP and L2TP have mostly the same functionality
L2TP traffic uses UDP port 1701 only for link establishment, further traffic is using any available UDP port
L2TP don't have problems with NATed clients – it don't required “NAT helpers”
Configuration of the both tunnels are identical in RouterOS

42. L2TP Aplication secure router-to-router tunnels over the Internet
linking (bridging) local Intranets or LANs (in cooperation with EoIP)
extending PPP user connections to a remote location (for example, to separate authentication and Internet access points for ISP)
accessing an Intranet/LAN of a company for remote (mobile) clients (employees)

43. Creating PPTP/L2TP Client

45. Creating PPTP/L2TP server

46. PPTP Client Lab Create PPTP client
Server Address:
User: admin
Password: admin
Add default route = yes
Make necessary adjustments to access the internet

47. Network L2TP

48. Konfigurasi Script On Router 1 Enable the L2TP server Add a L2TP user:
interface l2tp-server server> set enabled=yes
Add a L2TP user:
ppp secret> add name=james password=pass \... local-address= remote-address=

49. Konfigurasi Script On Router 2 Add a L2TP client:
interface l2tp-client> add user=james password=pass \... connect-to=

50. Monitoring L2TP Client Example of an established connection
interface l2tp-client> monitor test2
status: "connected"
uptime: 4m27s
encoding: "MPPE128 stateless"

51. User Access Control Controlling the Hardware Controlling the Users
Static IP and ARP entries
DHCP for assigning IP addresses and managing ARP entries
Controlling the Users
PPPoE requires PPPoE client configuration
HotSpot redirects client request to the sign-up page
PPTP requires PPTP client configuration

52. PPPoE Point-to-Point Protocol over Ethernet
PPPoE works in OSI 2nd (data link) layer
PPPoE is used to hand out IP addresses to clients based on the user authentication
PPPoE requires a dedicated access concentrator (server), which PPPoE clients connect to.
Most operating systems have PPPoE client software. Windows XP has PPPoE client installed by default

53. PPPoE client

54. PPPoE Client Lab Create PPTP client
Interface: wlan1
Service:pppoe
User: admin
Password: admin
Add default route = yes
Make necessary adjustments to access the internet

55. PPPoE Client Status Check your PPPoE connection
Is the interface enabled?
Is it “connected” and running (R)?
Is there a dynamic (D) IP address assigned to the
pppoe client interface in the IP Address list?
What are the netmask and the network address?
What routes do you have on the pppoe client interface?
See the “Log” for troubleshooting!

56. PPPoE Lab with Encryption
The PPPoE access concentrator is changed to use encryption now
You should use encryption, either
change the ppp profile used for the pppoe client to default-encryption', or,
modify the ppp profile used for the pppoe client to use encryption
See if you get the pppoe connection running

57. PPPoE Server
PPPoE server accepts PPPoE client connections on a given interface
Clients can be authenticated against
the local user database (ppp secrets)
a remote RADIUS server
a remote or a local MikroTik User Manager database
Clients can have automatic data rate limitation according to their profile

58. Creating PPPoE server

59. Workshop PPPoE

60. Konfigurasi Set AP Bridge Mode Set IP Address Set IP Route
Set PPPoE server in Wifi Interface
Set up PPPoE Client ( PPP Secret )
Set up IP Pool ( )
Set up client windows PPPoE

61. PPP interface Bridging
PPP BCP (Bridge Control Protocol)
PPP MP (Multi-link Protocol)

62. PPP Bridge Control Protocol
RouterOS now have BCP support for all async. PPP, PPTP, L2TP & PPPoE (not ISDN) interfaces
If BCP is established, PPP tunnel does not require IP address
Bridged Tunnel IP address (if present) does not applies to whole bridge – it stays only on PPP interface (routed IP packets can go through the tunnel as usual)

63. Setting up BCP
You must specify bridge option in the ppp profiles on both ends of the tunnel.
The bridge must have manually set MAC address, or at least one regular interface in it, because ppp interfaces do not have MAC addresses.

64. PPP Bridging Problem
PPP interface MTU is smaller than standard Ethernet interface
It is impossible to fragment Ethernet frames –tunnels must have inner algorithm how to encapsulate and transfer Ethernet frames via link with smaller MTU
EOIP have encapsulation algorithm enabled by default, PPP interfaces doesn't
PPP interfaces can utilize PPP Multi-link Protocol to encapsulate Ethernet frames

65. PPP Multi-link Protocol
PPP Multi-link Protocol allows to open multiple simultaneous channels between systems
It is possible to split and recombine packets, between several channels – resulting in increase the effective maximum receive unit (MRU)
To enable PPP Multi-link Protocol you must specify MRRU option
In MS Windows you must enable "Negotiate multi-link for single link connections" option

66. PPP Multi-link Protocol