Achei que fosse compartilhar um script de configuração direto que permite ao Windows 10 se conectar via VPN IKEv2 a um MikroTik. Testei isso no Windows 10 versão 2004 e RouterOS 6.45.9 (longo prazo) + 6.47.3 (estável). Testei no hardware MikroTik: CRS125, CCR1009, HexS, RB750, RB951, RB2011.
Com a Covid-19, muitos pequenos negócios precisaram trabalhar remotamente de casa. Configurei eles usando uma VPN IKEv2 entre Windows 10 e o roteador MikroTik. Uso há meses. Montei isso com várias instruções encontradas na internet e adicionei comandos PowerShell necessários para fazê-lo funcionar.
Achei útil colocar toda a configuração (cliente e servidor) em um post só, testada nas versões mais recentes.
Configuração do MikroTik
Criar Certificados no MikroTik
/certificate add name=template-CA common-name=ca.domain.com subject-alt-name=DNS:ca.domain.com days-valid=3650 key-size=2048 organization=domain.com key-usage=crl-sign,key-cert-sign
/certificate add name=template-Router common-name=remote.domain.com subject-alt-name=DNS:1234567890ab.sn.mynetname.net days-valid=1095 key-size=2048 organization=domain.com key-usage=tls-server
/certificate add name=template-User common-name=Template subject-alt-name=email:[email protected] days-valid=396 key-size=2048 organization=domain.com key-usage=tls-client
/certificate add name=CA copy-from=template-CA
/certificate add name=Router copy-from=template-Router
/certificate add [email protected] copy-from=template-User
/certificate sign CA
/certificate set trusted=yes CA
/certificate sign Router ca=CA
/certificate set trusted=yes Router
/certificate sign [email protected] ca=CA
/certificate set trusted=yes [email protected]
Exportar Certificados para o sistema de arquivos do MikroTik
/certificate export-certificate CA type=pem
/certificate export-certificate Router type=pem
/certificate export-certificate [email protected] type=pkcs12 export-passphrase=certKeyPass
Configurar IP Pool para usuários VPN
/ip pool add name=pool-vpn ranges=10.10.10.10-10.10.10.50
Configurar IPSec no MikroTik
# Substitua 192.168.0.0/24 pela rede remota
/ip ipsec mode-config add name="modeconf-vpn" address-pool=pool-vpn address-prefix-length=32 split-include=192.168.0.0/24 system-dns=no
/ip ipsec proposal add name="proposal-vpn" lifetime=8h pfs-group=none auth-algorithms=sha512,sha256,sha1 enc-algorithms=aes-256-cbc,aes-256-ctr,aes-256-gcm,aes-192-ctr,aes-192-gcm,aes-128-cbc,aes-128-ctr,aes-128-gcm
/ip ipsec profile add name="profile-vpn" nat-traversal=yes proposal-check=obey dh-group=modp2048,modp1536,modp1024 enc-algorithm=aes-256,aes-192,aes-128 hash-algorithm=sha256
/ip ipsec policy group add name="group-vpn"
/ip ipsec policy add dst-address=10.10.10.0/24 group="group-vpn" proposal="proposal-vpn" src-address=0.0.0.0/0 template=yes ipsec-protocols=esp level=require protocol=all action=encrypt
# substitua x.x.x.x pelo IP público
/ip ipsec peer add name="peer-WAN" exchange-mode=ike2 address=0.0.0.0/0 local-address=x.x.x.x passive=yes send-initial-contact=yes profile="profile-vpn"
Adicionar as Identidades IPSec
/ip ipsec identity add auth-method=digital-signature certificate=Router generate-policy=port-strict match-by=certificate mode-config="modeconf-vpn" peer="peer-WAN" policy-template-group="group-vpn" remote-id=user-fqdn:[email protected] [email protected]
Adicionar as regras de Firewall
Coloque-as mais acima nas regras do filtro - e, como U/Kaldek apontou nos comentários, precisam estar antes das regras FastTrack.
/ip firewall filter add chain=input action=accept protocol=udp dst-port=500,4500 comment="Políticas IPSec"
/ip firewall filter add chain=input action=accept protocol=ipsec-esp
/ip firewall filter add chain=forward action=accept ipsec-policy=in,ipsec
/ip firewall filter add chain=forward action=accept ipsec-policy=out,ipsec
Baixar Certificados
Normalmente, no Winbox, vá em arquivos, clique com o botão direito nos certificados exportados e escolha “Download”.
Instalar Certificados no Cliente Windows 10 (PowerShell)
# Substitua CertPass pela senha do certificado exportado
$certpass = $(ConvertTo-SecureString -String "CertPass" -AsPlainText -Force)
Push-Location "C:\Users\JohnDoe\Desktop\CertsFromMikrotik"
Import-Certificate -FilePath 'cert_export_CA.crt' -CertStoreLocation Cert:\LocalMachine\root
Import-Certificate -FilePath 'cert_export_Router.crt' -CertStoreLocation Cert:\LocalMachine\CA
Import-PfxCertificate -FilePath '[email protected]' -CertStoreLocation Cert:\LocalMachine\My -Password $certpass
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cert.Import($(Join-Path -Path $(Get-Location) -ChildPath cert_export_CA.crt))
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cert.Import($(Join-Path -Path $(Get-Location) -ChildPath cert_export_CA.crt))
Criar a conexão VPN no Windows 10 (PowerShell)
# Substitua 1234567890ab.sn.mynetname.net pelo DNS dinâmico do seu roteador
Add-VpnConnection -Name "VPN Test" -ServerAddress "1234567890ab.sn.mynetname.net" -TunnelType Ikev2 -SplitTunneling -EncryptionLevel Required -AuthenticationMethod MachineCertificate -MachineCertificateIssuerFilter $cert
Feito isso, o usuário deve conseguir clicar no ícone de rede na bandeja do sistema e clicar em “Conectar” na VPN…