ros的外网为pppoe接入，用户使用pptp内网拨号到ros，然后通过其中一条pppoe伪装上网。

admin

环境：

ros为ccr，pppoe为3根电信接入，每根电信4拨，一共12根ADSL，pptp的pool池，设置为12个IP，每个IP进行伪装到其中一根pppoe上网，pptp的帐号就一个帐号密码，允许重复拨号。

由于电信多拨，需要设置多个vrrp，来拨号，可以让拨号出去的mac都不同，所以生成了12个vrrp，生成12个id。

每个pppoe进入一个vlan，一个vlan id对应一个pppoe

vvrp启用，还需要对vrrp主网卡设置ip，然后对vrrp设置ip，才能启用。ip随便编写

目的地址如果是局域网的，不要从pppoe出口出去上网，排除了下lanip

1. <font face="Tahoma">/interface bridge
   
2. add name=bridge1-lan
   
3. add name=bridge2-wan
   
4. /interface vlan
   
5. add interface=bridge2-wan name=vlan801 vlan-id=801
   
6. add interface=bridge2-wan name=vlan802 vlan-id=802
   
7. add interface=bridge2-wan name=vlan803 vlan-id=803
   
8. /interface vrrp
   
9. add interface=vlan801 name=vrrp1
   
10. add interface=vlan801 name=vrrp2 vrid=2
    
11. add interface=vlan801 name=vrrp3 vrid=3
    
12. add interface=vlan801 name=vrrp4 vrid=4
    
13. add interface=vlan802 name=vrrp5 vrid=5
    
14. add interface=vlan802 name=vrrp6 vrid=6
    
15. add interface=vlan802 name=vrrp7 vrid=7
    
16. add interface=vlan802 name=vrrp8 vrid=8
    
17. add interface=vlan803 name=vrrp9 vrid=9
    
18. add interface=vlan803 name=vrrp10 vrid=10
    
19. add interface=vlan803 name=vrrp11 vrid=11
    
20. add interface=vlan803 name=vrrp12 vrid=12
    
21. /interface pppoe-client
    
22. add disabled=no interface=vrrp1 name=pppoe-out1 password=电信密码1 user=电信帐号1
    
23. add disabled=no interface=vrrp2 name=pppoe-out2 password=电信密码1 user=电信帐号1
    
24. add disabled=no interface=vrrp3 name=pppoe-out3 password=电信密码1 user=电信帐号1
    
25. add disabled=no interface=vrrp4 name=pppoe-out4 password=电信密码1 user=电信帐号1
    
26. add disabled=no interface=vrrp5 name=pppoe-out5 password=电信密码2 user=电信帐号2
    
27. add disabled=no interface=vrrp6 name=pppoe-out6 password=电信密码2 user=电信帐号2
    
28. add disabled=no interface=vrrp7 name=pppoe-out7 password=电信密码2 user=电信帐号2
    
29. add disabled=no interface=vrrp8 name=pppoe-out8 password=电信密码2 user=电信帐号2
    
30. add disabled=no interface=vrrp9 name=pppoe-out9 password=电信密码3 user=电信帐号3
    
31. add disabled=no interface=vrrp10 name=pppoe-out10 password=电信密码3 user=电信帐号3
    
32. add disabled=no interface=vrrp11 name=pppoe-out11 password=电信密码3 user=电信帐号3
    
33. add disabled=no interface=vrrp12 name=pppoe-out12 password=电信密码3 user=电信帐号3
    
34. /interface wireless security-profiles
    
35. set [ find default=yes ] supplicant-identity=MikroTik
    
36. /ip pool
    
37. add name=pptp ranges=172.22.22.1-172.22.22.12
    
38. /ppp profile
    
39. set *FFFFFFFE dns-server=223.5.5.5,223.6.6.6 local-address=172.22.22.254 on-up=":log error (\$"user"."/".\$"local-address"."/".\$"remote-address\
    
40. "."/".\$"caller-id"."/".\$"called-id"."/".\$"interface")\r\
    
41. \n:log error (\$"remote-address")\r\
    
42. \n:global aaa [:pick \$"remote-address" 10 13]\r\
    
43. \n:log error \$aaa\r\
    
44. \n/interface pppoe-client enable ("pppoe-out".\$aaa)" only-one=no remote-address=pptp
    
45. /interface bridge port
    
46. add bridge=bridge1-lan interface=ether12
    
47. add bridge=bridge1-lan interface=ether11
    
48. add bridge=bridge1-lan interface=ether10
    
49. add bridge=bridge1-lan interface=ether9
    
50. add bridge=bridge2-wan interface=ether1
    
51. add bridge=bridge2-wan interface=ether2
    
52. add bridge=bridge2-wan interface=ether3
    
53. add bridge=bridge2-wan interface=ether4
    
54. add bridge=bridge2-wan interface=ether5
    
55. add bridge=bridge2-wan interface=ether6
    
56. add bridge=bridge2-wan interface=ether7
    
57. add bridge=bridge2-wan interface=ether8
    
58. /interface pptp-server server
    
59. set enabled=yes
    
60. /ip address
    
61. add address=192.168.64.201/24 interface=bridge1-lan network=192.168.64.0
    
62. add address=123.123.1.1 interface=vrrp1 network=123.123.1.1
    
63. add address=123.123.1.0 interface=vlan801 network=123.123.1.0
    
64. add address=123.123.1.2 interface=vrrp2 network=123.123.1.2
    
65. add address=123.123.1.3 interface=vrrp3 network=123.123.1.3
    
66. add address=123.123.1.4 interface=vrrp4 network=123.123.1.4
    
67. add address=123.123.2.0 interface=vlan802 network=123.123.2.0
    
68. add address=123.123.2.1 interface=vrrp5 network=123.123.2.1
    
69. add address=123.123.2.2 interface=vrrp6 network=123.123.2.2
    
70. add address=123.123.2.3 interface=vrrp7 network=123.123.2.3
    
71. add address=123.123.3.1 interface=vrrp9 network=123.123.3.1
    
72. add address=123.123.3.0 interface=vlan803 network=123.123.3.0
    
73. add address=123.123.3.2 interface=vrrp10 network=123.123.3.2
    
74. add address=123.123.3.3 interface=vrrp11 network=123.123.3.3
    
75. add address=123.123.3.4 interface=vrrp12 network=123.123.3.4
    
76. add address=123.123.2.4 interface=vrrp8 network=123.123.2.4
    
77. /ip firewall address-list
    
78. add address=192.168.0.0/16 list=lanip
    
79. add address=172.16.0.0/16 list=lanip
    
80. add address=10.0.0.0/8 list=lanip
    
81. /ip firewall mangle
    
82. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp1 passthrough=no src-address=172.22.22.1
    
83. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp2 passthrough=no src-address=172.22.22.2
    
84. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp3 passthrough=no src-address=172.22.22.3
    
85. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp4 passthrough=no src-address=172.22.22.4
    
86. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp5 passthrough=no src-address=172.22.22.5
    
87. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp6 passthrough=no src-address=172.22.22.6
    
88. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp7 passthrough=no src-address=172.22.22.7
    
89. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp8 passthrough=no src-address=172.22.22.8
    
90. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp9 passthrough=no src-address=172.22.22.9
    
91. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp10 passthrough=no src-address=172.22.22.10
    
92. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp11 passthrough=no src-address=172.22.22.11
    
93. add action=mark-routing chain=prerouting dst-address-list=!lanip new-routing-mark=pptp12 passthrough=no src-address=172.22.22.12
    
94. /ip firewall nat
    
95. add action=masquerade chain=srcnat out-interface=all-ppp
    
96. add action=masquerade chain=srcnat out-interface=bridge1-lan
    
97. /ip route
    
98. add distance=1 gateway=pppoe-out1 routing-mark=pptp1
    
99. add distance=1 gateway=pppoe-out2 routing-mark=pptp2
    
100. add distance=1 gateway=pppoe-out3 routing-mark=pptp3
     
101. add distance=1 gateway=pppoe-out4 routing-mark=pptp4
     
102. add distance=1 gateway=pppoe-out5 routing-mark=pptp5
     
103. add distance=1 gateway=pppoe-out6 routing-mark=pptp6
     
104. add distance=1 gateway=pppoe-out7 routing-mark=pptp7
     
105. add distance=1 gateway=pppoe-out8 routing-mark=pptp8
     
106. add distance=1 gateway=pppoe-out9 routing-mark=pptp9
     
107. add distance=1 gateway=pppoe-out10 routing-mark=pptp10
     
108. add distance=1 gateway=pppoe-out11 routing-mark=pptp11
     
109. add distance=1 gateway=pppoe-out12 routing-mark=pptp12
     
110. add distance=1 dst-address=10.0.0.0/8 gateway=192.168.64.254
     
111. add distance=1 dst-address=172.16.0.0/16 gateway=192.168.64.254
     
112. add distance=1 dst-address=192.168.0.0/16 gateway=192.168.64.254
     
113. /ip service
     
114. set telnet disabled=yes
     
115. set ftp disabled=yes
     
116. set www disabled=yes
     
117. set ssh disabled=yes
     
118. set api disabled=yes
     
119. set winbox port=8081
     
120. set api-ssl disabled=yes
     
121. /ppp secret
     
122. add name=pptp帐号 password=pptp密码 profile=default-encryption service=pptp
     
123. /system clock manual
     
124. set dst-delta=+08:00 time-zone=+08:00
     
125. /system ntp client
     
126. set enabled=yes primary-ntp=10.10.2.2 secondary-ntp=10.10.2.3</font>

复制代码

ppp脚本那边设置pptp拨号上来 ，就重启对应的pppoe拨号

1. <font face="Tahoma">:log error ($"user"."/".$"local-address"."/".$"remote-address"."/".$"caller-id"."/".$"called-id"."/".$"interface")
   
2. :log error ($"remote-address")
   
3. :global aaa [:pick $"remote-address" 10 13]
   
4. :log error $aaa
   
5. /interface pppoe-client enable ("pppoe-out".$aaa)</font>

复制代码