L2TP/IPSec serverini faqat IPSec mijozlariga cheklash skripti

⏱ O‘qish vaqti: 3 daqiqa

Qisqacha

L2TP serverini faqat IPSec remote‑peer IP manzillariga cheklash.
Skript avtomatik ravishda L2TP_Allowed address‑listni yaratadi va yangilaydi.
Firewall qoidasi src‑address‑list=L2TP_Allowed bilan L2TP trafikini filtrlash.
Skriptni har 2‑3 soniyada scheduler orqali ishga tushirish.

L2TP/IPSec serverlari ko‘p hollarda turli jamoat IP manzillaridan ulanishlarni qabul qiladi, bu esa xavfsizlik zaifligiga olib keladi. Skript yordamida serverni faqat haqiqiy IPSec mijozlariga ruxsat berish mumkin. Bu usul firewallda maxsus address‑list yaratib, ularga mos kelgan paketlarni filtrlaydi.

Talablar

MikroTik routerga administrator huquqi bilan kirish
Mavjud L2TP/IPSec server konfiguratsiyasi
Terminal yoki WinBox orqali skript va scheduler qo‘shish imkoniyati

Sozlash bosqichlari

1. Skriptni RouterOS ga qo‘shish

:foreach i1 in [/ip ipsec remote-peers find] kabi iboralar orqali barcha IPSec remote‑peer manzillarini o‘qiydi va L2TP_Allowed address‑listga qo‘shadi.

Skriptni terminalda ko‘chirib, yangi script sifatida saqlang.

Basic Info
The one problem with L2TP/IPSec on Mikrotik is that there is no way to secure the L2TP server to IPSec clients ONLY, if you have people that connect from different public IPs constantly.

In firewall, you have to allow access to the L2TP server, but there is no IPSec policy matcher. Here is my script for securing the L2TP server to IPSec clients only.

What to configure
Make sure you secure the L2TP server firewall rule with src-address-list=L2TP_Allowed.

add chain=input dst-port=1701 protocol=udp src-address-list=L2TP_Allowed
Schedule the script to run every 2 or 3 seconds, and the L2TP server is secured.

If allowing established and related connections in firewall, the L2TP server will be availible for as long as the connection is in the conn track table, watch out for that. (Default UDP stream timeout is 3 minutes.)

The script

# ------------------- header -------------------
# Script by Tomas Kirnak, version 1.0.2
# If you use this script, or edit and
# re-use it, please keep the header intact.
#
# For more information and details about
# this script please visit the wiki page at
# http://wiki.mikrotik.com/wiki/Securing_L2TP_Server_for_IPSec
# ------------------- header -------------------
{
:local InAL 0
:local InRP 0
:local rawIp 0
:local CurrentPeerIP 0

:foreach i1 in [/ip ipsec remote-peers find] do={
  :set rawIp [/ip ipsec remote-peers get $i1 remote-address]
  
  :if ([:len [:find $rawIp ":"]] = 0) do={
    :set CurrentPeerIP $rawIp
  } else={
    :set CurrentPeerIP [:pick $rawIp 0 [:find $rawIp ":"]]
  }

  :foreach i2 in [/ip firewall address-list find list=L2TP_Allowed address=$CurrentPeerIP] do={
    :set InAL 1
  }
  if ($InAL = 0) do={/ip firewall address-list add list=L2TP_Allowed address=$CurrentPeerIP}
  :set InAL 0
}

:foreach i1 in [/ip firewall address-list find list=L2TP_Allowed] do={
  :set CurrentPeerIP [/ip firewall address-list get $i1 address]

  :foreach i2 in [/ip ipsec remote-peers find] do={
    :set rawIp [/ip ipsec remote-peers get $i2 remote-address]
	
    :if ([:len [:find $rawIp ":"]] = 0) do={
      :set CurrentPeerIP $rawIp
    } else={
      :set CurrentPeerIP [:pick $rawIp 0 [:find $rawIp ":"]]
    }
  
    :if ($CurrentPeerIP = [/ip firewall address-list get $i1 address]) do={
      :set InRP 1
	}
  }
  :if ($InRP = 0) do={/ip firewall address-list remove $i1}
  :set InRP 0
}
}
Credit: wiki.mikrotik.com

2. L2TP_Allowed address‑listga asoslangan firewall qoidasi qo‘shish

add chain=input dst-port=1701 protocol=udp src-address-list=L2TP_Allowed

Bu qoidada faqat address‑listdagi IP manzillar L2TP (UDP 1701) ga kirishiga ruxsat beriladi.

3. Skriptni scheduler bilan avtomatlashtirish

Scheduler orqali skriptni har 2‑3 soniyada ishga tushiring, masalan har 2 soniyada. Skript doimiy ravishda address‑listni yangilab turadi.

Tekshirish

L2TP_Allowed address‑list ichida faqat IPSec remote‑peer IP manzillar mavjudligini tekshiring; firewall qoidasi bu ro‘yxatga mos kelgan paketlarni ruxsat beradi.

Diqqat:

Agar ‘established, related’ qoidalar qo‘shilgan bo‘lsa, L2TP ulanishi conn‑track jadvalida 3 daqiqagacha ochiq qoladi.
Skriptni juda qisqa intervallarda (masalan, 1 s) ishga tushirish router yukini oshirishi mumkin.
Skript IPv4 manzillarni ajratadi; IPv6 manzillar uchun qo‘shimcha o‘zgartirish talab etiladi.

Muammolar va yechimlar

L2TP_Allowed ro‘yxatida IP manzillar paydo bo‘lmayapti

Skriptni administrator huquqi bilan ishga tushiring va /ip ipsec remote-peers ro‘yxatini tekshiring.

Xulosa

Ushbu skript va firewall qoidasi L2TP serverini faqat haqiqiy IPSec mijozlariga cheklaydi, tarmoq xavfsizligini oshiradi. Scheduler yordamida ro‘yxat doimiy yangilanadi, shuning uchun qo‘lda qo‘shish kerak bo‘lmaydi. Sozlamalarni sinab ko‘ring va kerakli intervallarni tanlang.

Manba: Securing L2TP Server for IPSec — mikrotiktool.github.io