PPTP隧道連接應(yīng)用實(shí)例

1、pptp隧道連接應(yīng)用實(shí)例以下是一個(gè)使用互聯(lián)網(wǎng)上的加密pptp隧道連接兩個(gè)企業(yè)網(wǎng)局域網(wǎng)的例子：在這個(gè)例子中有兩個(gè)不同地區(qū)辦公室的路由器，需要讓兩個(gè)辦公局域網(wǎng)的主機(jī)之間實(shí)現(xiàn)互訪：homeoffice 接口localhomeoffice 10.150.2.254/24接口tointernet 192.168.80.1/24remoteoffice 接口tointernet 192.168.81.1/24接口 localremoteoffice 10.150.1.254/24每個(gè)路由器連接到當(dāng)?shù)氐膇sp，任何一個(gè)路由器可以通過互聯(lián)網(wǎng)訪問到對(duì)端的路由器。homeoffice配置在homeoffice端建

2、立pptp服務(wù)器，首先我們進(jìn)入/ppp secret目錄下添加客戶端賬號(hào)：adminhomeoffice ppp secret> add name=ex service=pptp password=123456local-address=10.0.103.1 remote-address=10.0.103.2adminhomeoffice ppp secret> print detailflags: x - disabled 0 name="ex" service=pptp caller-id="" password="123456

3、" profile=default local-address=10.0.103.1 remote-address=10.0.103.2 routes="" adminhomeoffice ppp secret>winbox操作如下：在interface pptp-server server目錄下，啟用pptp服務(wù)器：adminhomeoffice interface pptp-server server> set enabled=yesadminhomeoffice interface pptp-server server> print ena

4、bled: yes mtu: 1460 mru: 1460 authentication: mschap2 default-profile: defaultadminhomeoffice interface pptp-server server>winbox下配置進(jìn)入ppp目錄下啟用pptp server：remoteoffice配置在remoteoffice路由器添加一個(gè)pptp客戶：adminremoteoffice interface pptp-client> add connect-to=192.168.80.1 user=ex . password=123456 disa

5、bled=noadminremoteoffice interface pptp-client> printflags: x - disabled, r - running 0 r name="pptp-out1" mtu=1460 mru=1460 connect-to=192.168.80.1 user="ex" password="123456" profile=default add-default-route=no adminremoteoffice interface pptp-client>winbox在int

6、erface中添加pptp-client這樣，一個(gè)pptp隧道就在路由器之間創(chuàng)建好了。這個(gè)隧道就像在ip地址為10.0.103.1及10.0.103.2的路由器之間的三層點(diǎn)對(duì)點(diǎn)連接。pptp局域網(wǎng)的互訪pptp隧道建立完成后，僅是路由器間可以互訪，但兩個(gè)企業(yè)間的局域網(wǎng)需要通過設(shè)置路由完成連接為了在pptp隧道上互訪企業(yè)間本地網(wǎng)絡(luò)，需要添加以下路由：adminhomeoffice > ip route add dst-address=10.150.1.0/24 gateway=10.0.103.2adminremoteoffice > ip route add dst-address

7、=10.150.2.0/24 gateway=10.0.103.1或者也可以在pptp服務(wù)器（homeoffice）上通過用戶配置的routes參數(shù)完成，remoteoffice還是需要在/ip route中配置路由：adminhomeoffice ppp secret> print detailflags: x - disabled 0 name="ex" service=pptp caller-id="" password="123456" profile=default local-address=10.0.103.1 r

8、emote-address=10.0.103.2 routes="" adminhomeoffice ppp secret> set 0 routes="10.150.1.0/24 10.0.103.2 1"adminhomeoffice ppp secret> print detailflags: x - disabled 0 name="ex" service=pptp caller-id="" password="123456" profile=default local-ad

9、dress=10.0.103.1 remote-address=10.0.103.2 routes="10.150.1.0/24 10.0.103.2 1" adminhomeoffice ppp secret>目的路由：10.150.1.0/24pptp的網(wǎng)關(guān)：10.0.103.2distance路徑： 1winbox中修改routes參數(shù)測(cè)試pptp隧道連接：adminremoteoffice> /ping 10.0.103.110.0.103.1 pong: ttl=255 time=3 ms10.0.103.1 pong: ttl=255 time=3

10、ms10.0.103.1 pong: ttl=255 time=3 msping interrupted3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 3/3.0/3 ms測(cè)試通過pptp隧道到localhomeoffice接口的連接：adminremoteoffice> /ping 10.150.2.25410.150.2.254 pong: ttl=255 time=3 ms10.150.2.254 pong: ttl=255 time=3 ms10.150.2.254

11、 pong: ttl=255 time=3 msping interrupted3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 3/3.0/3 ms通過pptp隧道連接終端客戶下面的例子顯示了通過終端電腦與遠(yuǎn)程辦公網(wǎng)絡(luò)進(jìn)行pptp加密隧道通信，如外地出差的同時(shí)，通過筆記本電腦連接會(huì)公司的網(wǎng)絡(luò)進(jìn)行遠(yuǎn)程信息管理和查詢這個(gè)例子中的路由器：remoteoffice 接口tointernet 192.168.81.1/24接口office 10.150.1.254/24在pptp服務(wù)器上設(shè)

12、置用戶帳號(hào)：adminremoteoffice ppp secret> add name=ex service=pptp password=123456local-address=10.150.1.254 remote-address=10.150.1.2adminremoteoffice ppp secret> print detailflags: x - disabled 0 name="ex" service=pptp caller-id="" password="123456" profile=default lo

13、cal-address=10.150.1.254 remote-address=10.150.1.2 routes="" adminremoteoffice ppp secret>啟用pptp服務(wù)：adminremoteoffice interface pptp-server server> set enabled=yesadminremoteoffice interface pptp-server server> print enabled: yes mtu: 1460 mru: 1460 authentication: mschap2 default-

14、profile: defaultadminremoteoffice interface pptp-server server>在筆記本電腦訪問回公司后，需要訪問內(nèi)部網(wǎng)絡(luò)資源，需要配置規(guī)則才能確保通常，有兩種方法：局域網(wǎng)連接方法1：代理arp必須在'office'接口上啟用，這樣可以通過代理arp訪問，但有個(gè)缺點(diǎn)是內(nèi)外的dhcp服務(wù)可能會(huì)受到影響：adminremoteoffice interface ethernet> set office arp=proxy-arpadminremoteoffice interface ethernet> printflag

15、s: x - disabled, r - running # name mtu mac-address arp 0 r tointernet 1500 00:30:4f:0b:7b:c1 enabled 1 r office 1500 00:30:4f:06:62:12 proxy-arpadminremoteoffice interface ethernet>在winbox中進(jìn)入interface目錄下，選擇office接口設(shè)置arp為proxy-arp局域網(wǎng)連接方法2：通過nat設(shè)置masquerade，規(guī)則要求對(duì)所有來訪數(shù)據(jù)進(jìn)行偽裝，這樣保證內(nèi)外網(wǎng)通過轉(zhuǎn)換通信adminremoteoffice /ip firewall nat> add chain=srcn