diff --git a/docs/ikev2-howto-zh.md b/docs/ikev2-howto-zh.md index 8ae2be6..c4fcfb5 100644 --- a/docs/ikev2-howto-zh.md +++ b/docs/ikev2-howto-zh.md @@ -413,12 +413,26 @@ sudo chmod 600 ikev2vpnca.cer vpnclient.cer vpnclient.key **注：** 这些步骤由 [@Unix-User](https://github.com/Unix-User) 提供。 1. 将生成的 `.p12` 文件安全地传送到你的计算机。 -1. 在 WinBox 中，转到 System > certificates > import. -1. 将 `.p12` 证书文件导入两次（是的，导入同一个文件两次）。 -1. 在 terminal 中运行以下命令： + + ![routeros get certificate](images/routeros-get-cert.gif) + +2. 在 WinBox 中，转到 System > certificates > import. 将 `.p12` 证书文件导入两次（是的，导入同一个文件两次）。检查你的 certificates panel。你应该看到 2 个文件，其中标注 KT 的是密钥。 + + ![routeros import certificate](images/routeros-import-cert.gif) + +3. 在 terminal 中运行以下命令。将以下内容替换为你自己的值。 +`YOUR_VPN_SERVER_IP_OR_DNS_NAME` 是你的 VPN 服务器 IP 或域名。 +`IMPORTED_CERTIFICATE` 是上面第 2 步中的证书名称，例如 `vpnclient.p12_0` +（标记为 KT 的那一行 - Priv. Key Trusted - 如果未标记为 KT，请再次导入证书）。 +`THESE_ADDRESSES_GO_THROUGH_VPN` 是你想要通过 VPN 浏览因特网的本地网络地址。 +假设 RouterOS 后面的本地网络是 `192.168.0.0/24`，你可以使用 `192.168.0.0/24` +来指定整个网络，或者使用 `192.168.0.10` 来指定仅用于一个设备，依此类推。 + ```bash + /ip firewall address-list + add address=THESE_ADDRESSES_GO_THROUGH_VPN list=local /ip ipsec mode-config - add name=ike2-rw responder=no + add name=ike2-rw responder=no src-address-list=local /ip ipsec policy group add name=ike2-rw /ip ipsec profile @@ -428,12 +442,12 @@ sudo chmod 600 ikev2vpnca.cer vpnclient.cer vpnclient.key /ip ipsec proposal add name=ike2-rw pfs-group=none /ip ipsec identity - add auth-method=digital-signature certificate=certificate.p12_1 generate-policy=port-strict mode-config=ike2-rw \ + add auth-method=digital-signature certificate=IMPORTED_CERTIFICATE generate-policy=port-strict mode-config=ike2-rw \ peer=ike2-rw-client policy-template-group=ike2-rw /ip ipsec policy add group=ike2-rw proposal=ike2-rw template=yes ``` -1. 检查你的 certificates panel。你应该看到 2 个文件，其中标注 KT 的是密钥。具体请参见 [#1112](https://github.com/hwdsl2/setup-ipsec-vpn/issues/1112#issuecomment-1059628623)。 +4. 更多信息请参见 [#1112](https://github.com/hwdsl2/setup-ipsec-vpn/issues/1112#issuecomment-1059628623)。 > 已在以下系统测试 > mar/02/2022 12:52:57 by RouterOS 6.48 diff --git a/docs/ikev2-howto.md b/docs/ikev2-howto.md index 717ef38..c03cd53 100644 --- a/docs/ikev2-howto.md +++ b/docs/ikev2-howto.md @@ -416,22 +416,23 @@ If you get an error when trying to connect, see [Troubleshooting](#troubleshooti 1. Securely transfer the generated `.p12` file to your computer. -![getcertificate](https://user-images.githubusercontent.com/38821945/158036447-a0d60a1b-27dc-4cf8-b3af-85787a08f1c9.gif) + ![routeros get certificate](images/routeros-get-cert.gif) -2. In WinBox, go to System > certificates > import. -2.1. Import the `.p12` certificate file twice (yes, import the same file two times!). +2. In WinBox, go to System > certificates > import. Import the `.p12` certificate file twice (yes, import the same file two times!). Verify in your certificates panel. You will see 2 files, the one that is marked KT is the key. -![importcertificate](https://user-images.githubusercontent.com/38821945/158036615-b842a5bb-5c08-427d-9130-7359c584c0b1.gif) + ![routeros import certificate](images/routeros-import-cert.gif) + +3. Run these commands in terminal. Replace the following with your own values. +`YOUR_VPN_SERVER_IP_OR_DNS_NAME` is your VPN server IP or DNS name. +`IMPORTED_CERTIFICATE` is the name of the certificate from step 2 above, e.g. `vpnclient.p12_0` +(the one flagged with KT - Priv. Key Trusted - if not flagged as KT, import certificate again). +`THESE_ADDRESSES_GO_THROUGH_VPN` are the local network addresses that you want to browse through the VPN. +Assuming that your local network behind RouterOS is `192.168.0.0/24`, you can use `192.168.0.0/24` +for the entire network, or use `192.168.0.10` for just one device, and so on. -3. Run these in terminal, replace YOUR_VPN_SERVER_IP_OR_DNS_NAME with your server ip/dns, -IMPORTED_CERTIFICATE is the certificate that you get on step 2 something like certificate.p12_0 -(the one flagged with KT - Priv. Key Trusted - if not flagged as KT, import certificate again) -and THESE_ADDRESS_GO_TRHOUGHT_VPN with the addresses that will browse through the VPN, -assuming your network is in that range that you can use 192.168.0.0/24 for the entire network, -or 192.168.0.10 for just one client, and so on ```bash /ip firewall address-list - add address=THESE_ADDRESS_GO_TRHOUGHT_VPN list=local + add address=THESE_ADDRESSES_GO_THROUGH_VPN list=local /ip ipsec mode-config add name=ike2-rw responder=no src-address-list=local /ip ipsec policy group @@ -443,12 +444,12 @@ or 192.168.0.10 for just one client, and so on /ip ipsec proposal add name=ike2-rw pfs-group=none /ip ipsec identity - add auth-method=digital-signature certificate=IMPORTED_CERTIFICATE.p12_1 generate-policy=port-strict mode-config=ike2-rw \ + add auth-method=digital-signature certificate=IMPORTED_CERTIFICATE generate-policy=port-strict mode-config=ike2-rw \ peer=ike2-rw-client policy-template-group=ike2-rw /ip ipsec policy add group=ike2-rw proposal=ike2-rw template=yes ``` -1. Verify in your certificates panel. You will see 2 files, the one that is marked KT is the key. See [#1112](https://github.com/hwdsl2/setup-ipsec-vpn/issues/1112#issuecomment-1059628623) for more details. +4. For more information, see [#1112](https://github.com/hwdsl2/setup-ipsec-vpn/issues/1112#issuecomment-1059628623). > tested on > mar/02/2022 12:52:57 by RouterOS 6.48 diff --git a/docs/images/routeros-get-cert.gif b/docs/images/routeros-get-cert.gif new file mode 100644 index 0000000..dcdc0dc Binary files /dev/null and b/docs/images/routeros-get-cert.gif differ diff --git a/docs/images/routeros-import-cert.gif b/docs/images/routeros-import-cert.gif new file mode 100644 index 0000000..4dc1255 Binary files /dev/null and b/docs/images/routeros-import-cert.gif differ