本帖最後由 gfx86674 於 2018-2-20 14:37 編輯
再看你的例子，VLAN能雙向。我用兩個Bridge 是單向的。 能否做一個VLAN over EOIP over SSTP例子? 中國的Et ...
yiucsw 發表於 2018-2-19 01:56 
sstp連線用的是互聯網協議位址,屬layer3
與ethernet和eoip-tunnel的layer2是兩回事...您不能在ip mode(layer3)做更高位階(如:layer2)的行為
您說的sstp+eoip表現不佳,或許更正確的形容是sstp不好,而非eoip.
sstp經網友測試似乎有20M的瓶頸,沒法再達更高的數據
——————————————————————————————————————
RouterOS v6.41後bridge添加vlan新功能,才賣弄新技巧把vlan放入主題裡;
若是不用vlan,就如您所說的用2個bridge也不是不可,或許更容易配置.
範例:
只有HK提供Public地址供遠端連接,所以HK為sstp-server ,CN為sstp-client
CN:192.168.100.254/24 / private-address:10.200.0.53
HK:192.168.200.254/24 / public-address:123.123.123.123
CN:
ether5:直接翻牆至Hong Kong
192.168.100.0/24連接CN外的地址,透過policy routing改由ISP2連接
192.168.100.201-192.168.100.250有連外國需求,
綁HK_DNS-Server,免除被DNS被污染風險.
HK:
ether5:直接翻牆至China
192.168.200.0/24連接是CN地址,透過policy routing改由ISP1連接
192.168.100.0/24 <=> 192.168.200.0/24 電腦群組彼此可互連- #ＣＮ:
- /interface sstp-client
- add authentication=pap certificate=cert connect-to=123.123.123.123:443 name=sstp-out1 password=123 user=123 verify-server-address-from-certificate=no
- /interface eoip
- add allow-fast-path=no name=eoip-hk tunnel-id=200 local-address=172.16.0.1 remote-address=172.16.0.0
- add allow-fast-path=no name=eoip-cn tunnel-id=100 local-address=172.16.0.1 remote-address=172.16.0.0
- /interface bridge
- add name=bridge-local
- add name=bridge-remote
- /interface bridge port
- add bridge=bridge-local interface=eoip-cn
- add bridge=bridge-local interface=ether2
- add bridge=bridge-local interface=ether3
- add bridge=bridge-local interface=ether4
- add bridge=bridge-remote interface=eoip-hk
- add bridge=bridge-remote interface=ether5
- /ip address
- add address=10.200.0.53/24 interface=ether1 network=10.200.0.0
- add address=192.168.100.254/24 interface=bridge-local network=192.168.100.0
- /ip route
- add distance=2 dst-address=192.168.200.0/24 gateway=172.16.0.0
- add distance=3 gateway=172.16.0.0 routing-mark=vpn
- add distance=5 gateway=ether1
- /ip firewall nat
- set [find action="masquerade"] out-interface=ether1 dst-address=!192.168.200.0/24
- add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address=192.168.100.201-192.168.100.250 to-addresses=192.168.200.254
- /ip firewall mangle
- add action=accept chain=prerouting dst-address=192.168.200.0/24
- add action=mark-routing chain=prerouting dst-address-type=!local dst-address-list=!cn new-routing-mark=vpn passthrough=no src-address=192.168.100.0/24
- #ＨＫ:
- /interface sstp-server server
- set authentication=pap certificate=cert default-profile=default enabled=yes port=443
- /ppp secret
- add local-address=172.16.0.0 remote-address=172.16.0.1 name=123 password=123 routes="192.168.100.0/24 172.16.0.1 2" service=sstp
- /interface eoip
- add allow-fast-path=no name=eoip-cn tunnel-id=100 local-address=172.16.0.0 remote-address=172.16.0.1
- add allow-fast-path=no name=eoip-hk tunnel-id=200 local-address=172.16.0.0 remote-address=172.16.0.1
- /interface bridge
- add name=bridge-local
- add name=bridge-remote
- /interface bridge port
- add bridge=bridge-local interface=eoip-hk
- add bridge=bridge-local interface=ether2
- add bridge=bridge-local interface=ether3
- add bridge=bridge-local interface=ether4
- add bridge=bridge-remote interface=eoip-cn
- add bridge=bridge-remote interface=ether5
- /ip address
- add address=123.123.123.123/24 interface=ether1 network=123.123.123.0
- add address=192.168.200.254/24 interface=bridge-local network=192.168.200.0
- /ip route
- add distance=3 gateway=172.16.0.1 routing-mark=vpn
- add distance=5 gateway=ether1
- /ip firewall nat
- set [find action="masquerade"] out-interface=ether1 dst-address=!192.168.100.0/24
- /ip firewall mangle
- add action=mark-routing chain=prerouting dst-address-list=cn new-routing-mark=vpn passthrough=no src-address=192.168.200.0/24
|
發表於 2018-2-10 16:46
| 
