VPN در میکروتیک: اتصال شعبه‌ها و دسترسی کارمندها با WireGuard و L2TP/IPsec

/interface/wireguard/add name=wg-branch listen-port=13231
/ip/address/add address=10.10.10.1/30 interface=wg-branch
/interface/wireguard/print

/interface/wireguard/peers/add interface=wg-branch public-key="BRANCH-PUBLIC-KEY" \
    allowed-address=10.10.10.2/32,192.168.30.0/24
/ip/route/add dst-address=192.168.30.0/24 gateway=wg-branch
/ip/firewall/filter/add chain=input protocol=udp dst-port=13231 action=accept \
    place-before=4 comment="WireGuard"

/interface/wireguard/add name=wg-hq listen-port=13231
/ip/address/add address=10.10.10.2/30 interface=wg-hq
/interface/wireguard/peers/add interface=wg-hq public-key="HQ-PUBLIC-KEY" \
    endpoint-address=203.0.113.10 endpoint-port=13231 \
    allowed-address=10.10.10.1/32,192.168.10.0/24 persistent-keepalive=25s
/ip/route/add dst-address=192.168.10.0/24 gateway=wg-hq

/interface/wireguard/add name=wg-staff listen-port=13232
/ip/address/add address=10.20.0.1/24 interface=wg-staff
/interface/wireguard/peers/add interface=wg-staff name=ali-laptop \
    allowed-address=10.20.0.11/32 private-key=auto \
    client-address=10.20.0.11/32 client-dns=192.168.10.1 \
    client-endpoint=203.0.113.10 client-allowed-address=192.168.10.0/24
/interface/wireguard/peers/show-client-config [find name=ali-laptop]

/ip/pool/add name=vpn-pool ranges=10.30.0.10-10.30.0.50
/ppp/profile/add name=vpn local-address=10.30.0.1 remote-address=vpn-pool dns-server=192.168.10.1
/interface/l2tp-server/server/set enabled=yes use-ipsec=required ipsec-secret="LONG-RANDOM-PSK" \
    default-profile=vpn
/ppp/secret/add name=reza password="STRONG-PASSWORD" service=l2tp profile=vpn
/ip/firewall/filter/add chain=input protocol=udp dst-port=500,1701,4500 action=accept place-before=4
/ip/firewall/filter/add chain=input protocol=ipsec-esp action=accept place-before=4

/ip/firewall/mangle/add chain=forward protocol=tcp tcp-flags=syn out-interface=wg-branch \
    action=change-mss new-mss=clamp-to-pmtu passthrough=yes