RM-CJJ zapConnect VPN Portal Admin

Total Clients 4

ROS7 WireGuard 2

ROS6 L2TP 4

Server DNS clientvpn.rmcjjzap.com

Add VPN Client

Base CCR Server Script

Run this once on RM-CJJ Main CCR only. It creates the client VPN base server settings and does not touch the working billing VPN.

# ==========================================================
# RM-CJJ CLIENT VPN BASE SERVER SCRIPT
# RUN ON: RM-CJJ MAIN CCR ONLY
# RUN ONCE ONLY
# SAFE: Does not touch billing VPN 10.88.88.0/24
# NO DUPLICATE: search first before add
# ==========================================================

# Protected billing setup - DO NOT TOUCH:
# remote.rmcjjzap.com
# 10.88.88.0/24
# 10706 / 10788 / 1128 / 1129
# RM-CJJ-BILLING-VPN

# --- WireGuard server for ROS7 clients ---
/interface wireguard
:if ([:len [find name="WG-CLIENTVPN"]] = 0) do={
    add name="WG-CLIENTVPN" listen-port=51820 mtu=1420 comment="RM-CJJ CLIENT VPN WIREGUARD SERVER"
} else={
    set [find name="WG-CLIENTVPN"] listen-port=51820 mtu=1420 comment="RM-CJJ CLIENT VPN WIREGUARD SERVER"
}

/ip address
:if ([:len [find comment="RM-CJJ CLIENT VPN WG GATEWAY"]] = 0) do={
    add address=10.99.99.1/24 interface="WG-CLIENTVPN" comment="RM-CJJ CLIENT VPN WG GATEWAY"
} else={
    set [find comment="RM-CJJ CLIENT VPN WG GATEWAY"] address=10.99.99.1/24 interface="WG-CLIENTVPN"
}

# --- L2TP server/profile for ROS6 clients ---
/ppp profile
:if ([:len [find name="RM-CJJ-L2TP-CLIENTS"]] = 0) do={
    add name="RM-CJJ-L2TP-CLIENTS" local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
} else={
    set [find name="RM-CJJ-L2TP-CLIENTS"] local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
}

/interface l2tp-server server
set enabled=yes use-ipsec=required ipsec-secret="RM-CJJ-CLIENTVPN-2026" authentication=mschap2 default-profile="RM-CJJ-L2TP-CLIENTS" keepalive-timeout=60

# --- Firewall rules, search first before add ---
/ip firewall filter
:if ([:len [find comment="RM-CJJ ALLOW WIREGUARD CLIENT VPN"]] = 0) do={
    add chain=input action=accept protocol=udp dst-port=51820 comment="RM-CJJ ALLOW WIREGUARD CLIENT VPN"
}

:if ([:len [find comment="RM-CJJ ALLOW CLIENT VPN TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.99.99.0/24 comment="RM-CJJ ALLOW CLIENT VPN TO CCR"
}

:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP IPSEC WAN"]] = 0) do={
    add chain=input action=accept protocol=udp dst-address=122.52.226.212 dst-port=500,4500,1701 comment="RM-CJJ ALLOW ROS6 L2TP IPSEC WAN"
}

:if ([:len [find comment="RM-CJJ ALLOW ROS6 IPSEC ESP WAN"]] = 0) do={
    add chain=input action=accept protocol=ipsec-esp dst-address=122.52.226.212 comment="RM-CJJ ALLOW ROS6 IPSEC ESP WAN"
}

:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.98.99.0/24 comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"
}

# Verify base only
/interface wireguard print detail where name="WG-CLIENTVPN"
/ppp profile print detail where name="RM-CJJ-L2TP-CLIENTS"
/interface l2tp-server server print
/ip firewall filter print where comment~"RM-CJJ ALLOW WIREGUARD|RM-CJJ ALLOW CLIENT VPN|RM-CJJ ALLOW ROS6"

VPN Clients

ID	Code	Name	Choice	WG IP	L2TP IP	Status	Open
4	TESTING	Testing	both	10.99.99.3	10.98.99.5	active	Open
3	RM	RM	both	10.99.99.2	10.98.99.4	active	Open
2	GNVHSFACULTY	GNVHSFaculty	ros6_l2tp		10.98.99.3	active	Open
1	GNVHS	GNVHS	ros6_l2tp		10.98.99.2	active	Open

Selected Client: GNVHSFACULTY — GNVHSFaculty

WireGuard IP: N/A

L2TP IP: 10.98.99.3

L2TP Username: gnvhsfaculty

L2TP Password: HXUdJTXENdyybG3SSt

Editable Client VPN Settings / Manual Ports

Set the client's real MikroTik ports here. Scripts will use these values and will not change the client's existing service ports.

Endpoint DNS

WireGuard Endpoint Port

Client Winbox Port

Client API Port

Client WebFig Port

L2TP IPsec Secret

Admin CCR Script

# ==========================================================
# RM-CJJ ADMIN CCR SCRIPT FOR GNVHSFACULTY
# RUN ON: RM-CJJ MAIN CCR ONLY
# SAFE: search first before apply, no duplicate
# DOES NOT TOUCH BILLING VPN
# ==========================================================

# Protected billing setup - DO NOT TOUCH:
# remote.rmcjjzap.com
# 10.88.88.0/24
# 10706 / 10788 / 1128 / 1129
# RM-CJJ-BILLING-VPN

# --- ROS6 L2TP/IPsec account for GNVHSFACULTY ---
/ppp profile
:if ([:len [find name="RM-CJJ-L2TP-CLIENTS"]] = 0) do={
    add name="RM-CJJ-L2TP-CLIENTS" local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
} else={
    set [find name="RM-CJJ-L2TP-CLIENTS"] local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
}

/interface l2tp-server server
set enabled=yes use-ipsec=required ipsec-secret="RM-CJJ-CLIENTVPN-2026" authentication=mschap2 default-profile="RM-CJJ-L2TP-CLIENTS" keepalive-timeout=60

/ip firewall filter
:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP IPSEC WAN"]] = 0) do={
    add chain=input action=accept protocol=udp dst-address=122.52.226.212 dst-port=500,4500,1701 comment="RM-CJJ ALLOW ROS6 L2TP IPSEC WAN"
}
:if ([:len [find comment="RM-CJJ ALLOW ROS6 IPSEC ESP WAN"]] = 0) do={
    add chain=input action=accept protocol=ipsec-esp dst-address=122.52.226.212 comment="RM-CJJ ALLOW ROS6 IPSEC ESP WAN"
}
:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.98.99.0/24 comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"
}

/ppp secret
:local secretId [find comment="RM-CJJ-L2TP-GNVHSFACULTY"]
:if ([:len $secretId] = 0) do={
    :set secretId [find name="gnvhsfaculty"]
}
:if ([:len $secretId] = 0) do={
    add name="gnvhsfaculty" password="HXUdJTXENdyybG3SSt" service=l2tp profile="RM-CJJ-L2TP-CLIENTS" remote-address=10.98.99.3 disabled=no comment="RM-CJJ-L2TP-GNVHSFACULTY"
} else={
    set $secretId name="gnvhsfaculty" password="HXUdJTXENdyybG3SSt" service=l2tp profile="RM-CJJ-L2TP-CLIENTS" remote-address=10.98.99.3 disabled=no comment="RM-CJJ-L2TP-GNVHSFACULTY"
}

# --- Verify this client only ---
/interface wireguard peers print detail where comment="RM-CJJ-WG-GNVHSFACULTY"
/ppp secret print detail where comment="RM-CJJ-L2TP-GNVHSFACULTY"
/ip firewall filter print where comment~"RM-CJJ ALLOW"

Client Script — ROS6 L2TP/IPsec

# ==========================================================
# RM-CJJ CLIENT MIKROTIK SCRIPT ROS6 L2TP/IPSEC - GNVHSFACULTY
# RUN ON: CLIENT MIKROTIK ROS6 ONLY
# SAFE: Does not change existing Winbox/API/WebFig service ports
# ==========================================================

# Client configured ports:
# Winbox: 8291
# API: 8728
# WebFig: 80

/interface l2tp-client
:if ([:len [find comment="RM-CJJ-L2TP-CLIENT-GNVHSFACULTY"]] = 0) do={
    add name="L2TP-RMCJJ-GNVHSFACULTY" connect-to=clientvpn.rmcjjzap.com user="gnvhsfaculty" password="HXUdJTXENdyybG3SSt" use-ipsec=yes ipsec-secret="RM-CJJ-CLIENTVPN-2026" profile=default-encryption add-default-route=no use-peer-dns=no disabled=no comment="RM-CJJ-L2TP-CLIENT-GNVHSFACULTY"
} else={
    set [find comment="RM-CJJ-L2TP-CLIENT-GNVHSFACULTY"] connect-to=clientvpn.rmcjjzap.com user="gnvhsfaculty" password="HXUdJTXENdyybG3SSt" use-ipsec=yes ipsec-secret="RM-CJJ-CLIENTVPN-2026" profile=default-encryption add-default-route=no use-peer-dns=no disabled=no
}

/ip firewall filter
:if ([:len [find comment="RM-CJJ-L2TP-MGMT-GNVHSFACULTY"]] = 0) do={
    add chain=input action=accept protocol=tcp src-address=10.98.99.0/24 dst-port=8291,8728,80 comment="RM-CJJ-L2TP-MGMT-GNVHSFACULTY"
} else={
    set [find comment="RM-CJJ-L2TP-MGMT-GNVHSFACULTY"] action=accept protocol=tcp src-address=10.98.99.0/24 dst-port=8291,8728,80
}

VPN Client Management

Add VPN Client

Base CCR Server Script

VPN Clients

Selected Client: GNVHSFACULTY — GNVHSFaculty

Editable Client VPN Settings / Manual Ports

Admin CCR Script

Client Script — ROS6 L2TP/IPsec