View source for PPTP VPN - multiple ADSL remote locations to Cental Office

Central location is connected to Internet with 10 Mbit link, public range of addresses /27 (32 addresses, 30 useful), and there are also more than 100 remote locations connected to the Internet by ADSL or Cable. All those remote connections have to be in VPN with headquarters (HQ) and have full access to all network resources.

First configure HQ router to allow HQ network to access Internet (assign private and public addresses, gateway, NAT...). Next set up remote routers to do the same (private address pppoe dial-up, NAT, routes...) as described in:<br/>
- http://wiki.mikrotik.com/wiki/How_to_Connect_your_Home_Network_to_xDSL_Line

===Assume the following:<br/>===


{| border="1" cellspacing="0" cellpadding="5" align="center" width="700"
| 
| Address
| Subnet mask
| Gateway
|- 
| width="200"|HQ public
| width="150"|<tt>80.80.80.110</tt>
| width="200"|<tt>255.255.255.224 (/27)</tt>
| width="150"|<tt>80.80.80.97</tt>
|-
| HQ private
| <tt>192.168.3.254</tt>
| <tt>255.255.254.0 (/23)</tt>
| <tt>192.168.3.254</tt>
|-
|}
Remote public addresses are dynamic<br/>
{| border="1" cellspacing="0" cellpadding="5" align="center" width="700"
|  
| Address
| Subnet mask
| Gateway
|- 
| width="200"|Remote 1 private
| width="150"|<tt>10.0.1.0/24</tt>
| width="200"|<tt>255.255.255.0 (/24)</tt>
| width="150"|<tt>10.0.1.254</tt>
|-
| Remote 2 private
| <tt>10.0.2.0/24</tt>
| <tt>255.255.255.0 (/24)</tt>
| <tt>10.0.2.254</tt>
|-
| Remote 3 private
| <tt>10.0.3.0/24</tt>
| <tt>255.255.255.0 (/24)</tt>
| <tt>10.0.3.254</tt>
|-
| Remote n private
| <tt>10.0.n.0/24</tt>
| <tt>255.255.255.0 (/24)</tt>
| <tt>10.0.n.254</tt>
|-
|}

==First - set up HQ router.<br/>==


1.enabling server<br/>
 <tt>/ interface l2tp-server server
 set enabled=yes max-mtu=1460 max-mru=1460 \
 authentication=pap,chap,mschap1,mschap2 default-profile=default-encryption</tt>

2.creating users (one for each remote location)<br/>
 <tt>/ ppp secret
 add name="user1" service=l2tp caller-id="" password="P@ssw0rd" \
 profile=default-encryption local-address=192.168.3.254 \
 remote-address=10.0.1.254 routes="" limit-bytes-in=0 limit-bytes-out=0 \
 comment="" disabled=no<br/>
 add name="user2" service=l2tp caller-id="" password="P@ssw0rd" \
 profile=default-encryption local-address=192.168.3.254 \
 remote-address=10.0.2.254 routes="" limit-bytes-in=0 limit-bytes-out=0 \
 comment="" disabled=no<br/>
 add name="user3" service=l2tp caller-id="" password="P@ssw0rd" \
 profile=default-encryption local-address=192.168.3.254 \
 remote-address=10.0.3.254 routes="" limit-bytes-in=0 limit-bytes-out=0 \
 comment="" disabled=no</tt>

3.adding routes (will be "unknown" until remote users connect)<br/>
 <tt>/ ip route
 add dst-address=10.0.1.0/24 gateway=10.0.1.254 scope=255 target-scope=10 \
 comment="" disabled=no<br/>
 add dst-address=10.0.2.0/24 gateway=10.0.2.254 scope=255 target-scope=10 \
 comment="" disabled=no<br/>
 add dst-address=10.0.3.0/24 gateway=10.0.3.254 scope=255 target-scope=10 \
 comment="" disabled=no</tt>

==Second - set up remote router(s)<br/>==

1.Creating client interface on remote location 1<br/>

 <tt>/interface l2tp-client
 add add-default-route=no allow=pap,chap,mschap1,mschap2 comment="" \
 connect-to=80.80.80.110 disabled=no max-mru=1460 max-mtu=1460 \
 mrru=disabled name="l2tp-out1" password="P@ssw0rd" \
 profile=default-encryption user="user1"</tt>

2. Adding route to HQ network (will be inactive until connection is established)<br/>

 <tt>/ip route
 add comment="" disabled=no distance=1 dst-address=192.168.2.0/23 \
 gateway=192.168.3.254 scope=255 target-scope=10</tt>

3.Optional - if you want your remote locations to communicate with each other<br/>

 <tt>/ip route
 add comment="To other offices" disabled=no distance=1 dst-address=10.0.0.0/16 \
 gateway=192.168.3.254 scope=255 target-scope=10</tt>

<blockquote>
Repeat on each remote location changing username
</blockquote>


Enjoy !