RM-CJJ zapConnect VPN Portal Admin

Add VPN Client

Base CCR Server Script

Run this once on RM-CJJ Main CCR only. It creates the client VPN base server settings and does not touch the working billing VPN.

# ==========================================================
# RM-CJJ CLIENT VPN BASE SERVER SCRIPT
# RUN ON: RM-CJJ MAIN CCR ONLY
# SAFE: Does not touch billing VPN 10.88.88.0/24
# ==========================================================

# --- WireGuard server for ROS7 clients ---
/interface wireguard
:if ([:len [find name="WG-CLIENTVPN"]] = 0) do={
    add name="WG-CLIENTVPN" listen-port=51820 mtu=1420 comment="RM-CJJ CLIENT VPN WIREGUARD SERVER"
} else={
    set [find name="WG-CLIENTVPN"] listen-port=51820 mtu=1420 comment="RM-CJJ CLIENT VPN WIREGUARD SERVER"
}

/ip address
:if ([:len [find comment="RM-CJJ CLIENT VPN WG GATEWAY"]] = 0) do={
    add address=10.99.99.1/24 interface="WG-CLIENTVPN" comment="RM-CJJ CLIENT VPN WG GATEWAY"
} else={
    set [find comment="RM-CJJ CLIENT VPN WG GATEWAY"] address=10.99.99.1/24 interface="WG-CLIENTVPN"
}

# --- L2TP profile for ROS6 clients ---
/ppp profile
:if ([:len [find name="RM-CJJ-L2TP-CLIENTS"]] = 0) do={
    add name="RM-CJJ-L2TP-CLIENTS" local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
} else={
    set [find name="RM-CJJ-L2TP-CLIENTS"] local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
}

# --- Firewall allow rules for client VPN only ---
/ip firewall filter
:if ([:len [find comment="RM-CJJ ALLOW WIREGUARD CLIENT VPN"]] = 0) do={
    add chain=input action=accept protocol=udp dst-port=51820 comment="RM-CJJ ALLOW WIREGUARD CLIENT VPN"
}

:if ([:len [find comment="RM-CJJ ALLOW CLIENT VPN TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.99.99.0/24 comment="RM-CJJ ALLOW CLIENT VPN TO CCR"
}

:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.98.99.0/24 comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"
}

# --- IMPORTANT PROTECTED ITEMS ---
# Do not touch remote.rmcjjzap.com
# Do not touch 10.88.88.0/24
# Do not touch 10706, 10788, 1128, 1129

VPN Clients

ID	Code	Name	Choice	WG IP	L2TP IP	Status	Open

VPN Client Management

Add VPN Client

Base CCR Server Script

VPN Clients