vpn2.rsc

# Configurazione OpenVPN Server
# di Stefano Pigozzi

# Mikrotik resettato
# IP: 192.168.88.1
# Username: admin

# Disabilita il firewall
/ip firewall filter
    disable 1,2,3,4,5,6,7
/ip firewall nat
    disable 0

# Imposta gli indirizzi IP del router
/ip address
    add comment="VPN Server" address="10.10.10.1/24" interface="ether1"

# Crea un pool di IP da assegnare ai futuri client
/ip pool
    add name="vpn-pool" ranges="10.10.10.10-10.10.10.254"

# Crea un profilo per la trasmissione ppp (point to point)
/ppp profile
    add name="vpn-profile" local-address="10.10.10.1" remote-address="vpn-pool" use-encryption="required"

# Crea un utente per la VPN
# Username: sas
# Password: ses
/ppp secret 
    add name="sas" password="ses" profile="vpn-profile" service="ovpn"

# Genera ed esporta i certificati
# Password: qwertyuiop
/certificate
    add name="ca" common-name="Certificate Authority" key-usage="key-cert-sign,crl-sign"
    add name="vpn-server" common-name="Server"
    add name="vpn-client" common-name="Client"
    sign 0 name="ca-signed" ca-crl-host="192.168.88.1"
    sign 1 name="vpn-server" ca="ca-signed"
    sign 2 name="vpn-client" ca="ca-signed"
    export-certificate 0
    export-certificate 2 export-passphrase="qwertyuiop"
    # I file da scaricare sono cert_export_ca-signed.crt
    #                          cert_export_vpn-client.crt
    #                          cert_export_vpn-client.key

# Configura il server OpenVPN
/interface ovpn-server server
    set enabled="yes" certificate="vpn-server" default-profile="vpn-profile" auth="sha1" cipher="aes256" netmask="24" require-client-certificate="yes"