Memperkenalkan tugas harus menyediakan penutup stabil Internet mulus dan Wi-Fi luas bangunan 300 m 2 dengan kemungkinan beban desain hingga 100 orang. Sekilas, ini terlihat seperti kesalahan. Tetapi tambahkan saja beberapa detail, dan tugas menjadi lebih rumit:
bangunannya terletak di kawasan hutan di mana tidak ada optik, jadi pilihan kami adalah komunikasi seluler;
Anda perlu memastikan siaran video reguler, yaitu untuk mencapai Internet yang stabil dengan satu penyedia GSM;
anggaran terbatas.
Total: kerugian dan pembuangan dari base station terjadi pada waktu yang paling tidak tepat.
Saya telah menemui masalah seperti itu di pusat panggilan tanpa saluran komunikasi khusus, kompleks pelapor seluler, sistem jarak jauh yang kritis. Kesulitan dapat muncul tidak hanya dalam kasus VoIP dan streaming video, tetapi juga dengan permintaan saluran pengiriman terjamin untuk lalu lintas yang sensitif terhadap kerugian. Sayangnya, tidak selalu memungkinkan untuk memasok optik dan membeli peralatan yang mahal.
Dalam artikel ini saya akan menunjukkan bagaimana dalam satu proyek saya memecahkan masalah ini "murah dan ceria" - opsi ini cocok untuk bisnis kecil. Pada akhirnya, saya akan menawarkan solusi dengan anggaran yang tidak terlalu murah - untuk pelanggan besar.
Garis besar solusi sekilas
, , . LTE- Cat4 Cat6 – – Cat12 , – . , LTE-. .
: , bonding, TCP-OpenVPN- .
" " – CLOUD HOSTED ROUTER (CHR) Router OS;
L2TP- IPsec;
L2TP over IPsec EoIP-;
EoIP- bonding-;
– TCP- OpenVPN-.
:
- R1 . , MikroTik CCR, , . – , (VRRP ).
OpenVPN UDP 7- RouterOS, TCP.
, . LTE- , .
. R1 ( ) – – R2 ().
R1
IP -. CHR Edge VMware, Edge UDP 1701, 500 4500 NAT-T – IPSec Network Address Translator Traversal. Edge.
firewall filter UDP 1701, 500 4500. IP Edge, NAT Traversal !
IPsec-:
/ip ipsec profile set [ find default=yes ] dh-group=modp1024 enc-algorithm=3de
L2TP-:
/ppp profile add change-tcp-mss=no name=profile01 use-compression=no use-encryption=no use-mpls=no use
:
/ppp secret add local-address=172.16.0.1 name=l2tp_R1-R2_ISP1 password=ros7.elements.forever profile=profile01 remote-address=172.16.0.2 service=l2tp add local-address=172.16.0.5 name=l2tp_R1-R2_ISP2 password=ros7.elements.forever profile=profile01 remote-address=172.16.0.6 service=l2tp
L2TP- IPsec:
/interface l2tp-server server set authentication=mschap2 caller-id-type=number default-profile=profile01 enabled=yes ipsec-secret= use-ipsec=yes
EoIP- L2TP/IPsec-:
/interface eoip add keepalive=1s,5 local-address=172.16.0.1 mac-address=00:00:00:00:00:A1 name=eoip-tun1_over_l2tp_R1-R2_ISP1 remote-address=172.16.0.2 tunnel-id=1 add keepalive=1s,5 local-address=172.16.0.5 mac-address=00:00:00:00:00:B1 name=eoip-tun2_over_l2tp_R1-R2_ISP2 remote-address=172.16.0.6 tunnel-id=2
keepalive timeout 1 EoIP- ID.
bonding IP-:
/interface bonding add lacp-rate=1sec mii-interval=1ms mode=broadcast name=bonding1 slaves=eoip-tun1_over_l2tp_R1-R2_ISP1,eoip-tun2_over_l2tp_R1-R2_ISP2
/ip address add address=172.16.1.1/30 interface=bonding1
, mode ( bonding-) broadcast, . bonding-. , .
OpenVPN-
OpenVPN , CHR. . /ppp profile /ppp secret OpenVPN:
/ppp profile
add change-tcp-mss=no name=profile02 use-compression=no use-encryption=no use-mpls=no use
/ppp secret
add local-address=172.16.2.1 name=ovpn_over_bonding1 password=ros7.elements.forever profile=profile02 remote-address=172.16.2.2 service=ovpn
/interface ovpn-server server
set auth=sha1 certificate=server.crt_0 cipher=aes256 default-profile=profile02 enabled=yes keepalive-timeout=30 port=1194 require-client-certificate=yes
nat- R2, R1:
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN src-address=192.168.1.0/24
R2 OpenVPN-:
/ip route
add check-gateway=ping distance=1 dst-address=192.168.1.0/24 gateway=172.16.2.2
R2
LTE- IP- -. output :
/ip route add distance=1 dst-address= 198.51.100.10/32 gateway=lte1 add distance=1 dst-address= 198.51.100.20/32 gateway=lte2 /ip firewall filter add action=drop chain=output dst-address= 198.51.100.10 out-interface=lte2 add action=drop chain=output dst-address= 198.51.100.20 out-interface=lte1
R1 /ip ipsec profile:
/ip ipsec profile set [ find default=yes ] dh-group=modp1024 enc-algorithm=3de
/ppp profile:
L2TP/IPsec- - :
/ppp profile add change-tcp-mss=no name=profile01 use-compression=no use-encryption=no use-mpls=no use /interface l2tp-client add allow=mschap2 connect-to= 198.51.100.10 disabled=no ipsec-secret= ros7.elements.forever keepalive-timeout=30 name=l2tp_to_R1_over_ISP1 password=ros7.elements.forever profile=profile01 use-ipsec=yes user=l2tp_R1-R2_ISP1 add allow=mschap2 connect-to= 198.51.100.20 disabled=no ipsec-secret= ros7.elements.forever keepalive-timeout=30 name=l2tp_to_R1_over_ISP2 password=ros7.elements.forever profile=profile01 use-ipsec=yes user=l2tp_R1-R2_ISP2
EoIP- R1, local remote IP L2TP/IPsec- R2. Bonding- , R1:
/interface eoip add keepalive=1s,5 local-address=172.16.0.2 mac-address=00:00:00:00:00:A2 name=eoip-tun1_over_l2tp_R1-R2_ISP1 remote-address=172.16.0.1 tunnel-id=1 add keepalive=1s,5 local-address=172.16.0.6 mac-address=00:00:00:00:00:B2 name=eoip-tun2_over_l2tp_R1-R2_ISP2 remote-address=172.16.0.5 tunnel-id=2 /interface bonding add lacp-rate=1sec mii-interval=1ms mode=broadcast name=bonding1 slaves=eoip-tun1_over_l2tp_R1-R2_ISP1,eoip-tun2_over_l2tp_R1-R2_ISP2 /ip address add address=172.16.1.2/30 interface=bonding1
, :
OpenVPN- R2:
/ppp profile add change-tcp-mss=no name=profile02 use-compression=no use-encryption=no use-ipv6=no use-mpls=no use-upnp=no /interface ovpn-client add certificate=client.crt_0 cipher=aes256 connect-to=172.16.1.1 mac-address=00:00:00:00:00:C2 name=ovpn_over_bonding1 password= profile=profile02 use-peer-dns=no user="ovpn_over_bonding1 " verify-server-certificate=yes
R, EoIP – RS. OpenVPN . – OpenVPN-. /ip firewall mangle :
/ip firewall mangle add action=mark-routing chain=prerouting dst-address-list=google_sites dst-port=1935 new-routing-mark=pc_to_stream-youtube_over_R1 passthrough=yes protocol=tcp src-address=192.168.1.1
OpenVPN- :
/ip route add check-gateway=ping distance=1 gateway=172.16.2.1 routing-mark=pc_to_stream-youtube_over_R1
!
L2TP OpenVPN-. , , , L2TP OpenVPN, .
RouterOS /tools . /tools Packet Sniffer + Wireshark.
" mtu", .
. RSRP, RSRQ SINR , . .
! L2TP, EoIP, : OpenVPN SSTP.
, . LTE- : random.
-, ( , .). , LTE-. , .
QOS – , LTE, VoIP. , .
, L2TP IPsec R1. IP LTE- firewall . NAT , . IP , MikroTik ip – cloud, DNS- IP, DDNS.
, , : peplink MAX HD4 LTE , – . .
:
, , MPTCP (Multipath TCP).