RM-CJJ zapConnect VPN Portal Admin

Total Clients 5

ROS7 WireGuard 3

ROS6 L2TP 5

Server DNS clientvpn.rmcjjzap.com

Add VPN Client

Base CCR Server Script

Run this once on RM-CJJ Main CCR only. It creates the client VPN base server settings and does not touch the working billing VPN.

# ==========================================================
# RM-CJJ CLIENT VPN BASE SERVER SCRIPT
# RUN ON: RM-CJJ MAIN CCR ONLY
# RUN ONCE ONLY
# SAFE: Does not touch billing VPN 10.88.88.0/24
# NO DUPLICATE: search first before add
# ==========================================================

# Protected billing setup - DO NOT TOUCH:
# remote.rmcjjzap.com
# 10.88.88.0/24
# 10706 / 10788 / 1128 / 1129
# RM-CJJ-BILLING-VPN

# --- WireGuard server for ROS7 clients ---
/interface wireguard
:if ([:len [find name="WG-CLIENTVPN"]] = 0) do={
    add name="WG-CLIENTVPN" listen-port=51820 mtu=1420 comment="RM-CJJ CLIENT VPN WIREGUARD SERVER"
} else={
    set [find name="WG-CLIENTVPN"] listen-port=51820 mtu=1420 comment="RM-CJJ CLIENT VPN WIREGUARD SERVER"
}

/ip address
:if ([:len [find comment="RM-CJJ CLIENT VPN WG GATEWAY"]] = 0) do={
    add address=10.99.99.1/24 interface="WG-CLIENTVPN" comment="RM-CJJ CLIENT VPN WG GATEWAY"
} else={
    set [find comment="RM-CJJ CLIENT VPN WG GATEWAY"] address=10.99.99.1/24 interface="WG-CLIENTVPN"
}

# --- L2TP server/profile for ROS6 clients ---
/ppp profile
:if ([:len [find name="RM-CJJ-L2TP-CLIENTS"]] = 0) do={
    add name="RM-CJJ-L2TP-CLIENTS" local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
} else={
    set [find name="RM-CJJ-L2TP-CLIENTS"] local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
}

/interface l2tp-server server
set enabled=yes use-ipsec=required ipsec-secret="RM-CJJ-CLIENTVPN-2026" authentication=mschap2 default-profile="RM-CJJ-L2TP-CLIENTS" keepalive-timeout=60

# --- Firewall rules, search first before add ---
/ip firewall filter
:if ([:len [find comment="RM-CJJ ALLOW WIREGUARD CLIENT VPN"]] = 0) do={
    add chain=input action=accept protocol=udp dst-port=51820 comment="RM-CJJ ALLOW WIREGUARD CLIENT VPN"
}

:if ([:len [find comment="RM-CJJ ALLOW CLIENT VPN TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.99.99.0/24 comment="RM-CJJ ALLOW CLIENT VPN TO CCR"
}

:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP IPSEC WAN"]] = 0) do={
    add chain=input action=accept protocol=udp dst-address=122.52.226.212 dst-port=500,4500,1701 comment="RM-CJJ ALLOW ROS6 L2TP IPSEC WAN"
}

:if ([:len [find comment="RM-CJJ ALLOW ROS6 IPSEC ESP WAN"]] = 0) do={
    add chain=input action=accept protocol=ipsec-esp dst-address=122.52.226.212 comment="RM-CJJ ALLOW ROS6 IPSEC ESP WAN"
}

:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.98.99.0/24 comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"
}

# Verify base only
/interface wireguard print detail where name="WG-CLIENTVPN"
/ppp profile print detail where name="RM-CJJ-L2TP-CLIENTS"
/interface l2tp-server server print
/ip firewall filter print where comment~"RM-CJJ ALLOW WIREGUARD|RM-CJJ ALLOW CLIENT VPN|RM-CJJ ALLOW ROS6"

VPN Clients

ID	Code	Name	Choice	WG IP	L2TP IP	Status	Open
5	GNVHS2	GNVHS2	both	10.99.99.4	10.98.99.6	active	Open
4	TESTING	Testing	both	10.99.99.3	10.98.99.5	active	Open
3	RM	RM	both	10.99.99.2	10.98.99.4	active	Open
2	GNVHSFACULTY	GNVHSFaculty	ros6_l2tp		10.98.99.3	active	Open
1	GNVHS	GNVHS	ros6_l2tp		10.98.99.2	active	Open

Selected Client: RM — RM

WireGuard IP: 10.99.99.2

L2TP IP: 10.98.99.4

L2TP Username: rm

L2TP Password: anPDZHWUXDVpL4fjd8

Editable Client VPN Settings / Manual Ports

Set the client's real MikroTik ports here. Scripts will use these values and will not change the client's existing service ports.

Endpoint DNS

WireGuard Endpoint Port

Client Winbox Port

Client API Port

Client WebFig Port

L2TP IPsec Secret

Admin CCR Script

# ==========================================================
# RM-CJJ ADMIN CCR SCRIPT FOR RM
# RUN ON: RM-CJJ MAIN CCR ONLY
# SAFE: search first before apply, no duplicate
# DOES NOT TOUCH BILLING VPN
# ==========================================================

# Protected billing setup - DO NOT TOUCH:
# remote.rmcjjzap.com
# 10.88.88.0/24
# 10706 / 10788 / 1128 / 1129
# RM-CJJ-BILLING-VPN

# This client's connection settings:
# Remote Domain: clientvpn.rmcjjzap.com
# Billing/API: clientvpn.rmcjjzap.com:10800 -> client local API 8728
# Remote MikroTik: clientvpn.rmcjjzap.com:10707 -> client local Winbox 8291
# WebConfig: clientvpn.rmcjjzap.com:10900 -> client local WebFig 80

# --- ROS7 WireGuard peer for RM ---
/interface wireguard
:if ([:len [find name="WG-CLIENTVPN"]] = 0) do={
    add name="WG-CLIENTVPN" listen-port=51820 mtu=1420 comment="RM-CJJ CLIENT VPN WIREGUARD SERVER"
} else={
    set [find name="WG-CLIENTVPN"] listen-port=51820 mtu=1420 comment="RM-CJJ CLIENT VPN WIREGUARD SERVER"
}

/ip firewall filter
:if ([:len [find comment="RM-CJJ ALLOW WIREGUARD CLIENT VPN"]] = 0) do={
    add chain=input action=accept protocol=udp dst-port=51820 comment="RM-CJJ ALLOW WIREGUARD CLIENT VPN"
}
:if ([:len [find comment="RM-CJJ ALLOW CLIENT VPN TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.99.99.0/24 comment="RM-CJJ ALLOW CLIENT VPN TO CCR"
}
# WireGuard public key missing.
# Save client public key in portal first before running this peer section.
# Client WG IP reserved: 10.99.99.2/32
# Peer comment key: RM-CJJ-WG-RM

# --- ROS6 L2TP/IPsec account for RM ---
/ppp profile
:if ([:len [find name="RM-CJJ-L2TP-CLIENTS"]] = 0) do={
    add name="RM-CJJ-L2TP-CLIENTS" local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
} else={
    set [find name="RM-CJJ-L2TP-CLIENTS"] local-address=10.98.99.1 use-encryption=yes only-one=yes change-tcp-mss=yes comment="RM-CJJ CLIENT VPN L2TP PROFILE"
}

/interface l2tp-server server
set enabled=yes use-ipsec=required ipsec-secret="RM-CJJ-CLIENTVPN-2026" authentication=mschap2 default-profile="RM-CJJ-L2TP-CLIENTS" keepalive-timeout=60

/ip firewall filter
:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP IPSEC WAN"]] = 0) do={
    add chain=input action=accept protocol=udp dst-address=122.52.226.212 dst-port=500,4500,1701 comment="RM-CJJ ALLOW ROS6 L2TP IPSEC WAN"
}
:if ([:len [find comment="RM-CJJ ALLOW ROS6 IPSEC ESP WAN"]] = 0) do={
    add chain=input action=accept protocol=ipsec-esp dst-address=122.52.226.212 comment="RM-CJJ ALLOW ROS6 IPSEC ESP WAN"
}
:if ([:len [find comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"]] = 0) do={
    add chain=input action=accept src-address=10.98.99.0/24 comment="RM-CJJ ALLOW ROS6 L2TP CLIENTS TO CCR"
}

/ppp secret
:local secretId [find comment="RM-CJJ-L2TP-RM"]
:if ([:len $secretId] = 0) do={
    :set secretId [find name="rm"]
}
:if ([:len $secretId] = 0) do={
    add name="rm" password="anPDZHWUXDVpL4fjd8" service=l2tp profile="RM-CJJ-L2TP-CLIENTS" remote-address=10.98.99.4 disabled=no comment="RM-CJJ-L2TP-RM"
} else={
    set $secretId name="rm" password="anPDZHWUXDVpL4fjd8" service=l2tp profile="RM-CJJ-L2TP-CLIENTS" remote-address=10.98.99.4 disabled=no comment="RM-CJJ-L2TP-RM"
}

# Per-client remote port forwarding on CCR for this VPN client.
# Search first, no duplicate.
/ip firewall nat
:if ([:len [find comment="RM-CJJ-NAT-API-RM"]] = 0) do={
    add chain=dstnat action=dst-nat protocol=tcp dst-address=122.52.226.212 dst-port=10800 to-addresses=10.98.99.4 to-ports=8728 comment="RM-CJJ-NAT-API-RM"
} else={
    set [find comment="RM-CJJ-NAT-API-RM"] action=dst-nat protocol=tcp dst-address=122.52.226.212 dst-port=10800 to-addresses=10.98.99.4 to-ports=8728
}

:if ([:len [find comment="RM-CJJ-NAT-WINBOX-RM"]] = 0) do={
    add chain=dstnat action=dst-nat protocol=tcp dst-address=122.52.226.212 dst-port=10707 to-addresses=10.98.99.4 to-ports=8291 comment="RM-CJJ-NAT-WINBOX-RM"
} else={
    set [find comment="RM-CJJ-NAT-WINBOX-RM"] action=dst-nat protocol=tcp dst-address=122.52.226.212 dst-port=10707 to-addresses=10.98.99.4 to-ports=8291
}

:if ([:len [find comment="RM-CJJ-NAT-WEBFIG-RM"]] = 0) do={
    add chain=dstnat action=dst-nat protocol=tcp dst-address=122.52.226.212 dst-port=10900 to-addresses=10.98.99.4 to-ports=80 comment="RM-CJJ-NAT-WEBFIG-RM"
} else={
    set [find comment="RM-CJJ-NAT-WEBFIG-RM"] action=dst-nat protocol=tcp dst-address=122.52.226.212 dst-port=10900 to-addresses=10.98.99.4 to-ports=80
}

:if ([:len [find comment="RM-CJJ-SRCNAT-RM"]] = 0) do={
    add chain=srcnat action=masquerade protocol=tcp dst-address=10.98.99.4 dst-port=8291,8728,80 comment="RM-CJJ-SRCNAT-RM"
} else={
    set [find comment="RM-CJJ-SRCNAT-RM"] action=masquerade protocol=tcp dst-address=10.98.99.4 dst-port=8291,8728,80
}

/ip firewall filter
:if ([:len [find comment="RM-CJJ-FWD-MGMT-RM"]] = 0) do={
    add chain=forward action=accept protocol=tcp dst-address=10.98.99.4 dst-port=8291,8728,80 comment="RM-CJJ-FWD-MGMT-RM"
} else={
    set [find comment="RM-CJJ-FWD-MGMT-RM"] action=accept protocol=tcp dst-address=10.98.99.4 dst-port=8291,8728,80
}

# --- Verify this client only ---
/interface wireguard peers print detail where comment="RM-CJJ-WG-RM"
/ppp secret print detail where comment="RM-CJJ-L2TP-RM"
/ip firewall filter print where comment~"RM-CJJ ALLOW"

Client Script — ROS7 WireGuard

# ==========================================================
# RM-CJJ CLIENT MIKROTIK SCRIPT ROS7 WIREGUARD - RM
# RUN ON: CLIENT MIKROTIK ROS7 ONLY
# SAFE: Does not change existing Winbox/API/WebFig service ports
# ==========================================================

# Client configured ports:
# Winbox: 8291
# API: 8728
# WebFig: 80

/interface wireguard
:if ([:len [find comment="RM-CJJ-WG-CLIENT-RM"]] = 0) do={
    add name="WG-RMCJJ-RM" mtu=1420 comment="RM-CJJ-WG-CLIENT-RM"
} else={
    set [find comment="RM-CJJ-WG-CLIENT-RM"] mtu=1420
}

/ip address
:if ([:len [find comment="RM-CJJ-WG-IP-RM"]] = 0) do={
    add address=10.99.99.2/32 interface="WG-RMCJJ-RM" comment="RM-CJJ-WG-IP-RM"
} else={
    set [find comment="RM-CJJ-WG-IP-RM"] address=10.99.99.2/32 interface="WG-RMCJJ-RM"
}

/interface wireguard peers
:if ([:len [find comment="RM-CJJ-WG-PEER-RM"]] = 0) do={
    add interface="WG-RMCJJ-RM" public-key="CCR_SERVER_PUBLIC_KEY_HERE" endpoint-address=clientvpn.rmcjjzap.com endpoint-port=51820 allowed-address=10.99.99.0/24 persistent-keepalive=25 comment="RM-CJJ-WG-PEER-RM"
} else={
    set [find comment="RM-CJJ-WG-PEER-RM"] public-key="CCR_SERVER_PUBLIC_KEY_HERE" endpoint-address=clientvpn.rmcjjzap.com endpoint-port=51820 allowed-address=10.99.99.0/24 persistent-keepalive=25
}

/ip firewall filter
:if ([:len [find comment="RM-CJJ-WG-MGMT-RM"]] = 0) do={
    add chain=input action=accept protocol=tcp src-address=10.99.99.0/24 dst-port=8291,8728,80 comment="RM-CJJ-WG-MGMT-RM"
} else={
    set [find comment="RM-CJJ-WG-MGMT-RM"] action=accept protocol=tcp src-address=10.99.99.0/24 dst-port=8291,8728,80
}

Client Script — ROS6 L2TP/IPsec

# ==========================================================
# RM-CJJ CLIENT MIKROTIK SCRIPT ROS6 L2TP/IPSEC - RM
# RUN ON: CLIENT MIKROTIK ROS6 ONLY
# SAFE: Does not change existing Winbox/API/WebFig service ports
# ==========================================================

# Client configured ports:
# Winbox: 8291
# API: 8728
# WebFig: 80

/interface l2tp-client
:if ([:len [find comment="RM-CJJ-L2TP-CLIENT-RM"]] = 0) do={
    add name="L2TP-RMCJJ-RM" connect-to=clientvpn.rmcjjzap.com user="rm" password="anPDZHWUXDVpL4fjd8" use-ipsec=yes ipsec-secret="RM-CJJ-CLIENTVPN-2026" profile=default-encryption add-default-route=no use-peer-dns=no disabled=no comment="RM-CJJ-L2TP-CLIENT-RM"
} else={
    set [find comment="RM-CJJ-L2TP-CLIENT-RM"] connect-to=clientvpn.rmcjjzap.com user="rm" password="anPDZHWUXDVpL4fjd8" use-ipsec=yes ipsec-secret="RM-CJJ-CLIENTVPN-2026" profile=default-encryption add-default-route=no use-peer-dns=no disabled=no
}

/ip firewall filter
:if ([:len [find comment="RM-CJJ-L2TP-MGMT-RM"]] = 0) do={
    add chain=input action=accept protocol=tcp src-address=10.98.99.0/24 dst-port=8291,8728,80 comment="RM-CJJ-L2TP-MGMT-RM"
} else={
    set [find comment="RM-CJJ-L2TP-MGMT-RM"] action=accept protocol=tcp src-address=10.98.99.0/24 dst-port=8291,8728,80
}

VPN Client Management

Add VPN Client

Base CCR Server Script

VPN Clients

Selected Client: RM — RM

Editable Client VPN Settings / Manual Ports

Admin CCR Script

Client Script — ROS7 WireGuard

Client Script — ROS6 L2TP/IPsec