Introducir la tarea debe proporcionar una cobertura estable de Internet y Wi-Fi sin interrupciones en un área de construcción de 300 m 2 con una carga de diseño posible de hasta 100 personas. A primera vista, parece una falla. Pero solo agregue un par de detalles, y la tarea se vuelve más complicada:
el edificio está ubicado en una zona boscosa donde no hay ópticas, por lo que nuestra opción son las comunicaciones móviles;
debe garantizar transmisiones de video regulares, es decir, lograr una Internet estable con un solo proveedor GSM;
el presupuesto es limitado.
Total: pérdidas y volcados de la estación base se infiltran en el momento más inoportuno.
Me he encontrado con estos problemas en centros de llamadas sin canales de comunicación dedicados, complejos de reporteros móviles, sistemas remotos críticos. Pueden surgir dificultades no solo en el caso de VoIP y transmisión de video, sino también con cualquier solicitud de un canal de entrega garantizado para tráfico sensible a pérdidas. Desafortunadamente, no siempre es posible suministrar ópticas y comprar equipos costosos.
, " " – . – .
, , . LTE- Cat4 Cat6 – – Cat12 , – . , LTE-. .
: , bonding, TCP-OpenVPN- .
" " – CLOUD HOSTED ROUTER (CHR) Router OS;
L2TP- IPsec;
L2TP over IPsec EoIP-;
EoIP- bonding-;
– TCP- OpenVPN-.
:
- R1 . , MikroTik CCR, , . – , (VRRP ).
OpenVPN UDP 7- RouterOS, TCP.
, . LTE- , .
. R1 ( ) – – R2 ().
R1
IP -. CHR Edge VMware, Edge UDP 1701, 500 4500 NAT-T – IPSec Network Address Translator Traversal. Edge.
firewall filter UDP 1701, 500 4500. IP Edge, NAT Traversal !
IPsec-:
/ip ipsec profile set [ find default=yes ] dh-group=modp1024 enc-algorithm=3de
L2TP-:
/ppp profile add change-tcp-mss=no name=profile01 use-compression=no use-encryption=no use-mpls=no use
:
/ppp secret add local-address=172.16.0.1 name=l2tp_R1-R2_ISP1 password=ros7.elements.forever profile=profile01 remote-address=172.16.0.2 service=l2tp add local-address=172.16.0.5 name=l2tp_R1-R2_ISP2 password=ros7.elements.forever profile=profile01 remote-address=172.16.0.6 service=l2tp
L2TP- IPsec:
/interface l2tp-server server set authentication=mschap2 caller-id-type=number default-profile=profile01 enabled=yes ipsec-secret= use-ipsec=yes
EoIP- L2TP/IPsec-:
/interface eoip add keepalive=1s,5 local-address=172.16.0.1 mac-address=00:00:00:00:00:A1 name=eoip-tun1_over_l2tp_R1-R2_ISP1 remote-address=172.16.0.2 tunnel-id=1 add keepalive=1s,5 local-address=172.16.0.5 mac-address=00:00:00:00:00:B1 name=eoip-tun2_over_l2tp_R1-R2_ISP2 remote-address=172.16.0.6 tunnel-id=2
keepalive timeout 1 EoIP- ID.
bonding IP-:
/interface bonding add lacp-rate=1sec mii-interval=1ms mode=broadcast name=bonding1 slaves=eoip-tun1_over_l2tp_R1-R2_ISP1,eoip-tun2_over_l2tp_R1-R2_ISP2
/ip address add address=172.16.1.1/30 interface=bonding1
, mode ( bonding-) broadcast, . bonding-. , .
OpenVPN-
OpenVPN , CHR. . /ppp profile /ppp secret OpenVPN:
/ppp profile
add change-tcp-mss=no name=profile02 use-compression=no use-encryption=no use-mpls=no use
/ppp secret
add local-address=172.16.2.1 name=ovpn_over_bonding1 password=ros7.elements.forever profile=profile02 remote-address=172.16.2.2 service=ovpn
/interface ovpn-server server
set auth=sha1 certificate=server.crt_0 cipher=aes256 default-profile=profile02 enabled=yes keepalive-timeout=30 port=1194 require-client-certificate=yes
nat- R2, R1:
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN src-address=192.168.1.0/24
R2 OpenVPN-:
/ip route
add check-gateway=ping distance=1 dst-address=192.168.1.0/24 gateway=172.16.2.2
R2
LTE- IP- -. output :
/ip route add distance=1 dst-address= 198.51.100.10/32 gateway=lte1 add distance=1 dst-address= 198.51.100.20/32 gateway=lte2 /ip firewall filter add action=drop chain=output dst-address= 198.51.100.10 out-interface=lte2 add action=drop chain=output dst-address= 198.51.100.20 out-interface=lte1
R1 /ip ipsec profile:
/ip ipsec profile set [ find default=yes ] dh-group=modp1024 enc-algorithm=3de
/ppp profile:
L2TP/IPsec- - :
/ppp profile add change-tcp-mss=no name=profile01 use-compression=no use-encryption=no use-mpls=no use /interface l2tp-client add allow=mschap2 connect-to= 198.51.100.10 disabled=no ipsec-secret= ros7.elements.forever keepalive-timeout=30 name=l2tp_to_R1_over_ISP1 password=ros7.elements.forever profile=profile01 use-ipsec=yes user=l2tp_R1-R2_ISP1 add allow=mschap2 connect-to= 198.51.100.20 disabled=no ipsec-secret= ros7.elements.forever keepalive-timeout=30 name=l2tp_to_R1_over_ISP2 password=ros7.elements.forever profile=profile01 use-ipsec=yes user=l2tp_R1-R2_ISP2
EoIP- R1, local remote IP L2TP/IPsec- R2. Bonding- , R1:
/interface eoip add keepalive=1s,5 local-address=172.16.0.2 mac-address=00:00:00:00:00:A2 name=eoip-tun1_over_l2tp_R1-R2_ISP1 remote-address=172.16.0.1 tunnel-id=1 add keepalive=1s,5 local-address=172.16.0.6 mac-address=00:00:00:00:00:B2 name=eoip-tun2_over_l2tp_R1-R2_ISP2 remote-address=172.16.0.5 tunnel-id=2 /interface bonding add lacp-rate=1sec mii-interval=1ms mode=broadcast name=bonding1 slaves=eoip-tun1_over_l2tp_R1-R2_ISP1,eoip-tun2_over_l2tp_R1-R2_ISP2 /ip address add address=172.16.1.2/30 interface=bonding1
, :
OpenVPN- R2:
/ppp profile add change-tcp-mss=no name=profile02 use-compression=no use-encryption=no use-ipv6=no use-mpls=no use-upnp=no /interface ovpn-client add certificate=client.crt_0 cipher=aes256 connect-to=172.16.1.1 mac-address=00:00:00:00:00:C2 name=ovpn_over_bonding1 password= profile=profile02 use-peer-dns=no user="ovpn_over_bonding1 " verify-server-certificate=yes
R, EoIP – RS. OpenVPN . – OpenVPN-. /ip firewall mangle :
/ip firewall mangle add action=mark-routing chain=prerouting dst-address-list=google_sites dst-port=1935 new-routing-mark=pc_to_stream-youtube_over_R1 passthrough=yes protocol=tcp src-address=192.168.1.1
OpenVPN- :
/ip route add check-gateway=ping distance=1 gateway=172.16.2.1 routing-mark=pc_to_stream-youtube_over_R1
!
L2TP OpenVPN-. , , , L2TP OpenVPN, .
RouterOS /tools . /tools Packet Sniffer + Wireshark.
" mtu", .
. RSRP, RSRQ SINR , . .
! L2TP, EoIP, : OpenVPN SSTP.
, . LTE- : random.
-, ( , .). , LTE-. , .
QOS – , LTE, VoIP. , .
, L2TP IPsec R1. IP LTE- firewall . NAT , . IP , MikroTik ip – cloud, DNS- IP, DDNS.
, , : peplink MAX HD4 LTE , – . .
:
, , MPTCP (Multipath TCP).