http://mikrotik.moscow Новое в теме IPSEC VPN туннель не работает. форума RouterOS на сайте Mikrotik.moscow [mikrotik.moscow] ru http://backend.userland.com/rss2 Sun, 09 Aug 2026 17:55:14 -0400 IPSEC VPN туннель не работает. RouterOS в форуме RouterOS.
Большое спасибо, туннель работает отлично.
30.11.2005 19:12:00, saci.]]> http://mikrotik.moscow/forum/forum57/62474-ipsec-vpn-tunnel-ne-rabotaet./message239749 http://mikrotik.moscow/forum/forum57/62474-ipsec-vpn-tunnel-ne-rabotaet./message239749 Wed, 30 Nov 2005 19:12:00 -0500 RouterOS IPSEC VPN туннель не работает. RouterOS в форуме RouterOS.
Маскировка в правилах src-nat должна быть на втором месте, правило принятия должно быть первым.
30.11.2005 19:00:00, Tonda.]]> http://mikrotik.moscow/forum/forum57/62474-ipsec-vpn-tunnel-ne-rabotaet./message239748 http://mikrotik.moscow/forum/forum57/62474-ipsec-vpn-tunnel-ne-rabotaet./message239748 Wed, 30 Nov 2005 19:00:00 -0500 RouterOS IPSEC VPN туннель не работает. RouterOS в форуме RouterOS.
Я начинающий пользователь Mikrotik роутера и пытаюсь настроить IPsec туннель между двумя Mikrotik роутерами, но туннель не работает. Версия RouterOS 2.8.28. Помогите, пожалуйста.

**КОНФИГУРАЦИЯ РОУТЕРА 1:**

`/ ip address`
`add address=10.0.0.1/24 network=10.0.0.0 broadcast=10.0.0.255 interface=WAN comment="" disabled=no`
`add address=192.168.10.254/24 network=192.168.10.0 broadcast=192.168.10.255 interface=LAN comment="" disabled=no`

`/ ip firewall`
`set input name="input" policy=accept comment=""`
`set forward name="forward" policy=accept comment=""`
`set output name="output" policy=accept comment=""`

`/ ip firewall service-port`
`set ftp ports=21 disabled=no`
`set pptp disabled=yes`
`set gre disabled=yes`
`set h323 disabled=yes`
`set mms disabled=no`
`set irc ports=6667 disabled=no`
`set quake3 disabled=no`
`set tftp ports=69 disabled=no`

`/ ip firewall src-nat`
`add out-interface=WAN action=masquerade comment="" disabled=no`
`add src-address=192.168.10.0/24 dst-address=192.168.20.0/24 action=accept comment="" disabled=no`

`/ ip firewall connection tracking`
`set enabled=yes`
`set tcp-syn-sent-timeout=2m`
`set tcp-syn-received-timeout=1m`
`set tcp-established-timeout=5d`
`set tcp-fin-wait-timeout=2m`
`set tcp-close-wait-timeout=1m`
`set tcp-last-ack-timeout=30s`
`set tcp-time-wait-timeout=2m`
`set tcp-close-timeout=10s`
`set udp-timeout=30s`
`set udp-stream-timeout=3m`
`set icmp-timeout=30s`
`set generic-timeout=10m`

`/ ip ipsec policy`
`add src-address=192.168.10.0/24:any dst-address=192.168.20.0/24:any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=10.0.0.1 sa-dst-address=10.0.0.2 proposal=default manual-sa=none dont-fragment=clear disabled=no`

`/ ip ipsec peer`
`add address=10.0.0.2/32:500 secret="gvejimezyfopmekun" generate-policy=no exchange-mode=main send-initial-contact=yes proposal-check=obey hash-algorithm=sha1 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no`

`/ ip ipsec proposal`
`add name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no`

**КОНФИГУРАЦИЯ РОУТЕРА 2:**

`/ ip address`
`add address=10.0.0.2/24 network=10.0.0.0 broadcast=10.0.0.255 interface=WAN comment="" disabled=no`
`add address=192.168.20.254/24 network=192.168.20.0 broadcast=192.168.20.255 interface=LAN comment="" disabled=no`

`/ ip firewall`
`set input name="input" policy=accept comment=""`
`set forward name="forward" policy=accept comment=""`
`set output name="output" policy=accept comment=""`

`/ ip firewall service-port`
`set ftp ports=21 disabled=no`
`set pptp disabled=yes`
`set gre disabled=yes`
`set h323 disabled=yes`
`set mms disabled=no`
`set irc ports=6667 disabled=no`
`set quake3 disabled=no`
`set tftp ports=69 disabled=no`

`/ ip firewall src-nat`
`add out-interface=WAN action=masquerade comment="" disabled=no`
`add src-address=192.168.20.0/24 dst-address=192.168.20.0/24 action=accept comment="" disabled=no`

`/ ip firewall connection tracking`
`set enabled=yes`
`set tcp-syn-sent-timeout=2m`
`set tcp-syn-received-timeout=1m`
`set tcp-established-timeout=5d`
`set tcp-fin-wait-timeout=2m`
`set tcp-close-wait-timeout=1m`
`set tcp-last-ack-timeout=30s`
`set tcp-time-wait-timeout=2m`
`set tcp-close-timeout=10s`
`set udp-timeout=30s`
`set udp-stream-timeout=3m`
`set icmp-timeout=30s`
`set generic-timeout=10m`

`/ ip ipsec policy`
`add src-address=192.168.20.0/24:any dst-address=192.168.10.0/24:any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=10.0.0.2 sa-dst-address=10.0.0.1 proposal=default manual-sa=none dont-fragment=clear disabled=no`

`/ ip ipsec peer`
`add address=10.0.0.1/32:500 secret="gvejimezyfopmekun" generate-policy=no exchange-mode=main send-initial-contact=yes proposal-check=obey hash-algorithm=sha1 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no`

`/ ip ipsec proposal`
`add name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no`
30.11.2005 16:48:00, saci.]]> http://mikrotik.moscow/forum/forum57/62474-ipsec-vpn-tunnel-ne-rabotaet./message239747 http://mikrotik.moscow/forum/forum57/62474-ipsec-vpn-tunnel-ne-rabotaet./message239747 Wed, 30 Nov 2005 16:48:00 -0500 RouterOS