RM-CJJ zapConnect VPN Portal Admin

Add VPN Client

Base CCR Server Script

Run this once on RM-CJJ Main CCR only. It creates the client VPN base server settings and does not touch the working billing VPN.

# ==========================================================
# RM-CJJ CLIENT VPN BASE SERVER SCRIPT
# RUN ON: RM-CJJ MAIN CCR ONLY
# RUN ONCE ONLY
# SAFE: Does not touch billing VPN 10.88.88.0/24
# NO DUPLICATE: search first before add
# ==========================================================

# Protected billing setup - DO NOT TOUCH:
# remote.rmcjjzap.com
# 10.88.88.0/24
# 10706 / 10788 / 1128 / 1129
# RM-CJJ-BILLING-VPN

# --- WireGuard server for ROS7 clients ---
/interface wireguard
:if ([:len [find name="WG-CLIENTVPN"]] = 0) do={
    add name="WG-CLIENTVPN" listen-port=51820 mtu=1420 comment="RM-CJJ CLIENT VPN WIREGUARD SERVER"
} else={
    set [find name="WG-CLIENTVPN"] listen-port=51820 mtu=1420 comment="RM-CJJ CLIENT VPN WIREGUARD SERVER"
}

/ip address
:if ([:len [find comment="RM-CJJ CLIENT VPN WG GATEWAY"]] = 0) do={
    add address=10.99.99.1/24 interface="WG-CLIENTVPN" comment="RM-CJJ CLIENT VPN WG GATEWAY"
} else={
    set [find comment="RM-CJJ CLIENT VPN WG GATEWAY"] address=10.99.99.1/24 interface="WG-CLIENTVPN"
}

# --- L2TP server/profile for ROS6 clients ---
/ppp profile
:if ([:len [find name="RM-CJJ-L2TP-CLIENTS"]] = 0) do={
    add name="RM-CJJ-L2TP-CLIENTS" local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
} else={
    set [find name="RM-CJJ-L2TP-CLIENTS"] local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
}

/interface l2tp-server server
set enabled=yes use-ipsec=required ipsec-secret="RM-CJJ-CLIENTVPN-2026" authentication=mschap2 default-profile="RM-CJJ-L2TP-CLIENTS" keepalive-timeout=60

# --- Firewall rules, search first before add ---
/ip firewall filter
:if ([:len [find comment="RM-CJJ ALLOW WIREGUARD CLIENT VPN"]] = 0) do={
    add chain=input action=accept protocol=udp dst-port=51820 comment="RM-CJJ ALLOW WIREGUARD CLIENT VPN"
}

:if ([:len [find comment="RM-CJJ ALLOW CLIENT VPN TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.99.99.0/24 comment="RM-CJJ ALLOW CLIENT VPN TO CCR"
}

:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP IPSEC WAN"]] = 0) do={
    add chain=input action=accept protocol=udp dst-address=122.52.226.212 dst-port=500,4500,1701 comment="RM-CJJ ALLOW ROS6 L2TP IPSEC WAN"
}

:if ([:len [find comment="RM-CJJ ALLOW ROS6 IPSEC ESP WAN"]] = 0) do={
    add chain=input action=accept protocol=ipsec-esp dst-address=122.52.226.212 comment="RM-CJJ ALLOW ROS6 IPSEC ESP WAN"
}

:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.98.99.0/24 comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"
}

# Verify base only
/interface wireguard print detail where name="WG-CLIENTVPN"
/ppp profile print detail where name="RM-CJJ-L2TP-CLIENTS"
/interface l2tp-server server print
/ip firewall filter print where comment~"RM-CJJ ALLOW WIREGUARD|RM-CJJ ALLOW CLIENT VPN|RM-CJJ ALLOW ROS6"

VPN Clients

ID	Code	Name	Choice	WG IP	L2TP IP	Status	Open
2	GNVHSFACULTY	GNVHSFaculty	ros6_l2tp		10.98.99.3	active	Open
1	GNVHS	GNVHS	ros6_l2tp		10.98.99.2	active	Open

VPN Client Management

Add VPN Client

Base CCR Server Script

VPN Clients