L2TP verbinding iPhone met Mirotik gelukt maar geen internet

[Verwijderd]

Ik doe een poging iptv te kijken op mijn iPhone als ik niet thuis op het Telfort netwerk ben. Ik heb een L2TP verbinding opgezet tussen mijn iPhone en mijn Mikrotik thuis. De verbinding komt wel tot stand maar ik kom het internet niet op. Ik heb hieronder mijn hele configuratie gezet in de hoop dat iemand de fout ziet.

[/code]
# dec2/2015 21:19:18 by RouterOS 6.34rc12
# software id = 3DFR-KF6B
#
/interface bridge
add name=bridge-internet
add name=bridge-iptv
/interface ethernet
set [ find default-name=ether1 ] mac-address=xxx
/interface 6to4
add !keepalive local-address=192.168.2.254 mtu=1280 name=hurricane-ipv6 remote-address=xxx
/interface vlan
add interface=ether1 l2mtu=1594 name=vlan1.1 vlan-id=34
add interface=ether1 l2mtu=1594 name=vlan1.5 vlan-id=4
/interface wireless security-profiles
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=WPA2 supplicant-identity="" wpa-pre-shared-key=xxx wpa2-pre-shared-key=xxx
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name="WPA2 xxx" supplicant-identity="" wpa2-pre-shared-key=xxx
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n dfs-mode=no-radar-detect disabled=no mode=ap-bridge security-profile=WPA2 ssid=xxx
add disabled=no mac-address=xxx master-interface=wlan1 name=wlan2 security-profile="WPA2 xxx" ssid=xxx wds-cost-range=0 wds-default-cost=0
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
add enc-algorithms=3des,aes-256-cbc name=L2TP-Proposal pfs-group=none
/ip pool
add name=default-dhcp ranges=192.168.2.40-192.168.2.99
add name=L2TP-Pool ranges=172.31.86.1-172.31.86.14
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge-internet name=default
/ppp profile
add change-tcp-mss=yes dns-server=8.8.8.8 local-address=L2TP-Pool name=l2tp-profile remote-address=L2TP-Pool use-encryption=required
/interface bridge port
add bridge=bridge-internet interface=ether2
add bridge=bridge-internet interface=ether3
add bridge=bridge-internet interface=vlan1.1
add bridge=bridge-iptv interface=ether5
add bridge=bridge-iptv interface=vlan1.5
add bridge=bridge-internet interface=wlan1
add bridge=bridge-iptv interface=ether4
add bridge=bridge-internet interface=wlan2
/ip firewall connection tracking
set tcp-established-timeout=1h30m
/interface l2tp-server server
set authentication=mschap2 default-profile=l2tp-profile enabled=yes ipsec-secret=MYKEY max-mru=1460 max-mtu=1460 use-ipsec=yes
/interface pptp-server server
set enabled=yes max-mru=1460 max-mtu=1460
/ip address
add address=192.168.2.254/24 interface=bridge-internet network=192.168.2.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=bridge-internet
/ip dhcp-server network
add address=192.168.2.0/24 dns-server=192.168.2.254 gateway=192.168.2.254
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.2.0/24 list=LAN
/ip firewall filter
add chain=input protocol=ipsec-ah
add chain=input protocol=ipsec-esp
add chain=input port=500,1701,4500 protocol=udp
add chain=input src-address-list=LAN
add chain=input connection-state=established
add chain=input connection-state=related
add chain=input dst-port=1723 protocol=tcp
add chain=input protocol=gre
add action=drop chain=input
add action=drop chain=forward connection-state=invalid
add chain=forward connection-state=new in-interface=bridge-internet
add chain=forward connection-state=established
add chain=forward connection-state=related
add action=drop chain=forward
/ip firewall nat
add chain=srcnat dst-address=172.31.86.1-172.31.86.14 src-address=192.168.2.40-192.168.2.99
add action=masquerade chain=srcnat out-interface=bridge-internet
/ip hotspot user
add
/ip ipsec peer
add address=0.0.0.0/0 enc-algorithm=3des,aes-256 exchange-mode=main-l2tp generate-policy=port-override secret=MYKEY
/ip ipsec policy
add proposal=L2TP-Proposal template=yes
/ipv6 address
add address=xxx interface=hurricane-ipv6
add address=xxx interface=bridge-internet
/ipv6 firewall filter
add chain=input comment="Allow established connections" connection-state=established
add chain=input comment="Allow related connections" connection-state=related
add chain=input comment="Allow limited ICMP" limit=50/5s,5 protocol=icmpv6
add chain=input comment="Allow UDP" protocol=udp
add action=drop chain=input
add chain=forward comment="Allow any to internet" out-interface=hurricane-ipv6
add chain=forward comment="Allow established connections" connection-state=established
add chain=forward comment="Allow related connections" connection-state=related
add action=drop chain=forward
/ipv6 route
add distance=1 dst-address=2000::/3 gateway=xxx
/ppp secret
add name=MYUSER password=MYPASSWORD profile=l2tp-profile service=l2tp
/system clock
set time-zone-name=Europe/Amsterdam
/system leds
set 0 interface=wlan1
/system ntp client
set enabled=yes primary-ntp=72.251.251.11 secondary-ntp=131.211.8.244
[/code]

[ Voor 23% gewijzigd door Verwijderd op 02-12-2015 22:02 ]

[MisteRMeesteR]

Ik zelf ben onbekend met Microtik maar wordt het verkeer van je VPN client nu niet toegestaan door je firewall vanwege deze regel:

code:

/ip firewall address-list
add address=192.168.2.0/24 list=LAN

Ik zie in je configuratie nergens de IP range van je VPN clients voorbij komen, enkel 'LAN'.

code:

/ip firewall filter
add chain=input protocol=ipsec-ah
add chain=input protocol=ipsec-esp
add chain=input port=500,1701,4500 protocol=udp
add chain=input src-address-list=LAN

[The Fatal]

wat als je de account voor je iPhone eens een remote adres geeft in je normale IP range?
dit zijn je default adressen: add name=default-dhcp ranges=192.168.2.40-192.168.2.99

Wat als je in ppp secret voor je account /ppp secret
add name=MYUSER password=MYPASSWORD profile=l2tp-profile service=l2tp een statisch ip address geeft 192.168.2.20 bv, werkt het dan wel?

/ppp secret
edit "MYSUSER"
remote-address
192.168.2.20

[Verwijderd]

Dank beide. Helaas werkt het nogsteedes niet. iPhone krijgt netjes fixed ip toegewezen, maar komt nogsteeds het internet niet op.

[/code]
/ip firewall
add chain=input src-address-list=LAN
add chain=input src-address-list=192.168.2.40-192.168.2.99


/ip firewall nat
add chain=srcnat dst-address=192.168.2.40-192.168.2.99 src-address=192.168.2.40-192.168.2.99
add action=masquerade chain=srcnat out-interface=bridge-internet

/ppp secret
add name=MYUSER password=MYPASSWORD profile=l2tp-profile remote-address=192.168.2.20 service=l2tp
[/code]