Tiernan's Comms Closet

I have been running a MikroTik RouterBoard in the house for a couple of months now (the RB750G) and I am very much loving the thing. But one thing you may need to do is setup VPN connections… Here are some tips on how to create a VPN Server and Client on your RouterBoard.

##Client Setup

to setup a client, you need to do the following:

What does that all do? the first line creates an l2tp-client interface, pointing at “servername” with the username and password set. encryption, etc is enabled… Line 2 then enables the client. Line 3 sets all traffic comming from networkaddress/24 (for example, 192.168.0.1/24) to be sent though the VPN. any traffic going into networkaddress (same example) is not sent though the VPN. Line 4 creates a gateway, for all addresses (0.0.0.0/0) to use the VPN address. finally, NAT Masquerading is enabled on the VPN interface.

there are more advanced things you can set above… some examples I can think of are as follows:

• There should be no good reason to limit the amount of VPN connections you have… in theory, you could have multiple…
• for the mangle rule, set the src-address to a single machine in your network. that way, it gets VPN only connections. Also, you could set the dst-address to a single address or network to send only traffic going to a given server though the VPN… Example would be Netflix US traffic to a US VPN server, BBC iPlayer traffic to a UK VPN, etc.
• the example above uses L2TP, but PPTP, SSTP and OpenVPN are also available.

Server Setup

As mentioned above, L2TP, PPTP, SSTP and OpenVPN servers are available on RouterOs. Details on setting them up are available on MicroTik’s Wiki at the following locations:

• OpenVPN
• PPTP
• L2TP
• SSTP

Something I do on a regular basis is use the internet while “out and about”. This could be college, which has a semi open network, or it could be a coffee shop, which also usually has a semi open connection. There is also the possibility of using the a mobile internet connection on my iPhone, which can be slow, but at least its only shared with me… Anyway, over on RevSys.com, there is a post SSH Tunneling made simple which shows you how to open an SSH tunnel to your machine somewhere else (could be at home, as is my case, or a VPS/Dedicated server somewhere, or even on Amazon…) and use that for different things… In the case he shows, its for SMTP access. For my case, i am forwarding my local port 3128 to my Microsoft TMG 2010 Server in house on port 8080. Then my system proxy on my laptop is set to use localhost:3128 for all web and HTTPS requests. Very handy. One other tip: Using the -C flag, so your command may look like:

ssh yourname@remotemachine -L 3128:remoteMachine:8080 -C

will compress data between you and the SSH server, which for basic web browsing (HTML, CSS, JS) will make things faster, but for stuff like images, etc, may not work so well… Your Mileage may Vary…

Also, while on the subject of SSH, Linux Journal has an article on Eleven SSH tricks which mentions compression, Encryption Cyphers, X11 Forwarding, Config files and other interesting bits.