Securing L2TP Server for IPSec

From MikroTik Wiki
Revision as of 20:46, 9 December 2012 by Tomaskir (talk | contribs)
Jump to: navigation, search

Applies to RouterOS: v5

Basic Info

The one problem with L2TP/IPSec on Mikrotik is that there is no way to secure the L2TP server to IPSec clients ONLY, if you have people that connect from different public IPs constantly.

In firewall, you have to allow access to the L2TP server, but there is no IPSec policy matcher. Here is my script for securing the L2TP server to IPSec clients only.

The script

# ------------------- header -------------------
# Script by Tomas Kirnak, version 1.0.1
# If you use this script, or edit and
# re-use it, please keep the header intact.
# For more information and details about
# this script please visit the wiki page at
# ------------------- header -------------------
:local InAL 0
:local InRP 0
:local CurrentPeerIP 0

:foreach i1 in [/ip ipsec remote-peers find] do={
  :set CurrentPeerIP [/ip ipsec remote-peers get $i1 remote-address]

  :foreach i2 in [/ip firewall address-list find list=L2TP_Allowed address=$CurrentPeerIP] do={
    :set InAL 1
  if ($InAL = 0) do={/ip firewall address-list add list=L2TP_Allowed address=$CurrentPeerIP}
  :set InAL 0

:foreach i1 in [/ip firewall address-list find list=L2TP_Allowed] do={
  :set CurrentPeerIP [/ip firewall address-list get $i1 address]

  :foreach i2 in [/ip ipsec remote-peers find remote-address=$CurrentPeerIP] do={
    :set InRP 1
  :if ($InRP = 0) do={/ip firewall address-list remove $i1}
  :set InRP 0

Make sure you secure the L2TP server firewall rule with src-address-list=L2TP_Allowed.

Schedule the script to run every 2 or 3 seconds, and the L2TP server is secured.

If allowing established and related connections in firewall, the L2TP server will be availible for as long as the connection is in the conn track table, watch out for that. (Default UDP stream timeout is 3 minutes.)