billese10 wrote:開放對端整個ip比較好,只開放icmp我也覺得這方式不夠佳。
大大您好，我自己也...(恕刪)
假設對端固定ip為：123.123.123.123
/ip firewall filter add action=accept chain=input src-address=123.123.123.123
對端是ddns，假設ddns地址為：abc1234.dyndns.org
/ip firewall address-list add list=ipsec address=abc1234.dyndns.org
/ip firewall filter add action=accept chain=input src-address-list=ipsec
gfx wrote:
開放對端整個ip比較好,只開放icmp我也覺得這方式不夠佳。
假設對端固定ip為：123.123.123.123
/ip firewall filter add action=accept chain=input src-address=123.123.123.123
對端是ddns，假設ddns地址為：abc1234.dyndns.org
/ip firewall address-list add list=ipsec address=abc1234.dyndns.org
/ip firewall filter add action=accept chain=input src-address-list=ipsec
大大您好， 我輸入我實體IP , 無論在site tp site 環境 還是4G環境一樣無法登入
(圖片IP有改過，那IP之前換成實體ip)
還有什麼方式site to site 輸入雙方 router os 內網IP 可以看到router os web winbox 登入呢?
以下是我的設定
# SERVER SIDE
# model = RB750Gr3
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=l2tp_pool ranges=10.0.10.0/24
/ppp profile
add change-tcp-mss=yes local-address=10.0.10.1 name=l2tp_profile \
remote-address=l2tp_pool use-encryption=yes
/ppp secret
add comment="for khome dial in" local-address=10.0.10.1 name=Home password=\
home@123 profile=l2tp_profile remote-address=10.0.10.2 routes=\
"192.168.30.0/24 10.0.10.2 1" service=l2tp
add name=QQ123 password=123 profile=l2tp_profile service=l2tp
/interface l2tp-server server
set default-profile=l2tp_profile enabled=yes ipsec-secret=test123 \
max-mru=1460 max-mtu=1460 use-ipsec=yes
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha1,md5 enc-algorithms=\
aes-256-cbc,aes-192-cbc,aes-128-cbc,3des
/ip ipsec peer
add address=10.0.10.2/32 dpd-interval=disable-dpd enc-algorithm=\
aes-256,aes-192,aes-128,3des exchange-mode=main-l2tp generate-policy=\
port-override passive=yes secret=test123
add address=0.0.0.0/0 dh-group=modp1024 enc-algorithm=\
aes-256,aes-192,aes-128,3des exchange-mode=main-l2tp generate-policy=\
port-override passive=yes secret=test123
/ip ipsec policy
add dst-address=192.168.30.0/24 sa-dst-address=10.0.10.2 sa-src-address=\
10.0.10.1 src-address=192.168.88.0/24 tunnel=yes
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.30.0/24 log=yes \
src-address=192.168.88.0/24
# CLIENT SIDE
# model = RB941-2nD
/ip pool
add name=dhcp ranges=192.168.30.10-192.168.30.254
/interface l2tp-client
add connect-to=Server外網IP disabled=no ipsec-secret=test123 name=\
l2tp-out1 password=home@123 use-ipsec=yes user=Home
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha1,md5 enc-algorithms=\
aes-256-cbc,aes-192-cbc,aes-128-cbc,3des
/ip ipsec peer
add address=10.0.10.1/32 dpd-interval=disable-dpd enc-algorithm=\
aes-256,aes-192,aes-128,3des exchange-mode=main-l2tp generate-policy=\
port-override passive=yes secret=test123
/ip ipsec policy
add dst-address=192.168.88.0/24 sa-dst-address=10.0.10.1 sa-src-address=\
10.0.10.2 src-address=192.168.30.0/24 tunnel=yes
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.88.0/24 log=yes \
src-address=192.168.30.0/24
其餘都是預設值
以上理論上應該已經建立site to site VPN了
但是卻好像沒有，問題如下
情況:
1.
在server(RB750Gr3) ping 192.168.30.1 --> OK
在server(RB750Gr3) ping 192.168.88.1 --> OK
在server(RB750Gr3) ping 10.0.10.1 -----> OK
在server(RB750Gr3) ping 10.0.10.2 -----> OK
2.在server區網內的電腦
192.168.88.2 ping 192.168.30.1 --> X
192.168.88.2 ping 192.168.88.1 --> OK
192.168.88.2 ping 10.0.10.1 -----> OK
192.168.88.2 ping 10.0.10.2 -----> OK
3.
在client(RB941-2nD) ping 192.168.30.1 --> OK
在client(RB941-2nD) ping 192.168.88.1 --> OK
在client(RB941-2nD) ping 10.0.10.1 -----> OK
在client(RB941-2nD) ping 10.0.10.2 -----> OK
4.在client區網內的電腦
192.168.30.2 ping 192.168.30.1 --> OK
192.168.30.2 ping 192.168.88.1 --> X
192.168.30.2 ping 10.0.10.1 -----> OK
192.168.30.2 ping 10.0.10.2 -----> OK
問題:為什麼在各自的區網內的裝置無法存取對方網內的裝置....?
是我哪邊沒設定好嗎?
內文搜尋
從 APP 打開
X