意外と情報がないので、参考まで
BL1500HMなど、VPN未搭載のルーターとYAMAHA RTXルーターの２重ルーター環境のサンプルです。
■環境
2026.2.22
BL1500HM 192.168.0.1 DMZ 192.168.0.2
⇒ auは滅多にグローバルIPが変わらないのでIPアドレス変更通知アプリでメール通知しています。
RTX830 RTX1300 (LAN2)192.168.0.2 – (LAN1)192.158.250.252
RTX830 Rev.15.02.31 (Fri Jul 5 10:40:25 2024)
Gateway 192.168.250.1
■設定
MSCHAPv2
SharedKey 59635963
user 1 aaaa bbbb
user 2 cccc dddd
■config.txt
user attribute connection=serial,telnet,remote,ssh,sftp,http gui-page=dashboard,lan-map,config login-timer=172800
ip route default gateway dhcp lan2
ip keepalive 1 icmp-echo 10 5 dhcp lan2
ip lan1 address 192.168.250.1/24
ip lan1 proxyarp on
ip lan2 address 192.168.0.2/24
ip lan2 secure filter in 101003 101020 101021 101022 101023 101024 101025 10103
0 101032 101100 101101 101102 101103
ip lan2 secure filter out 101013 101020 101021 101022 101023 101024 101025 1010
26 101027 101099 dynamic 101080 101081 101082 101083 101084 101085 101098 10109
9
ip lan2 nat descriptor 200
pp select anonymous
pp bind tunnel1
pp auth request mschap-v2
pp auth username aaaa bbbb
pp auth username cccc dddd
ppp ipcp ipaddress on
ppp ipcp msext on
ppp ccp type none
ip pp remote address pool 192.168.250.11-192.168.250.29
ip pp mtu 1258
pp enable anonymous
tunnel select 1
tunnel encapsulation l2tp
ipsec tunnel 1
ipsec sa policy 1 1 esp aes-cbc sha-hmac
ipsec ike keepalive use 1 off
ipsec ike nat-traversal 1 on
ipsec ike pre-shared-key 1 text 59635963
ipsec ike remote address 1 any
l2tp tunnel disconnect time off
ip tunnel tcp mss limit auto
tunnel enable 1
ip filter 101000 reject 10.0.0.0/8 * * * *
ip filter 101001 reject 172.16.0.0/12 * * * *
ip filter 101002 reject 192.168.0.0/16 * * * *
ip filter 101003 reject 192.168.250.0/24 * * * *
ip filter 101010 reject * 10.0.0.0/8 * * *
ip filter 101011 reject * 172.16.0.0/12 * * *
ip filter 101012 reject * 192.168.0.0/16 * * *
ip filter 101013 reject * 192.168.250.0/24 * * *
ip filter 101020 reject * * udp,tcp 135 *
ip filter 101021 reject * * udp,tcp * 135
ip filter 101022 reject * * udp,tcp netbios_ns-netbios_ssn *
ip filter 101023 reject * * udp,tcp * netbios_ns-netbios_ssn
ip filter 101024 reject * * udp,tcp 445 *
ip filter 101025 reject * * udp,tcp * 445
ip filter 101026 restrict * * tcpfin * www,21,nntp
ip filter 101027 restrict * * tcprst * www,21,nntp
ip filter 101030 pass * 192.168.250.0/24 icmp * *
ip filter 101031 pass * 192.168.250.0/24 established * *
ip filter 101032 pass * 192.168.250.0/24 tcp * ident
ip filter 101033 pass * 192.168.250.0/24 tcp ftpdata *
ip filter 101034 pass * 192.168.250.0/24 tcp,udp * domain
ip filter 101035 pass * 192.168.250.0/24 udp domain *
ip filter 101036 pass * 192.168.250.0/24 udp * ntp
ip filter 101037 pass * 192.168.250.0/24 udp ntp *
ip filter 101099 pass * * * * *
ip filter 101100 pass * 192.168.250.1 udp * 500
ip filter 101101 pass * 192.168.250.1 esp
ip filter 101102 pass * 192.168.250.1 udp * 4500
ip filter 101103 pass * 192.168.250.1 udp * 1701
ip filter 500000 restrict * * * * *
ip filter dynamic 101080 * * ftp
ip filter dynamic 101081 * * domain
ip filter dynamic 101082 * * www
ip filter dynamic 101083 * * smtp
ip filter dynamic 101084 * * pop3
ip filter dynamic 101085 * * submission
ip filter dynamic 101098 * * tcp
ip filter dynamic 101099 * * udp
nat descriptor type 200 masquerade
nat descriptor address outer 200 primary
nat descriptor masquerade static 200 1 192.168.250.1 udp 500
nat descriptor masquerade static 200 2 192.168.250.1 esp
nat descriptor masquerade static 200 3 192.168.250.1 udp 4500
nat descriptor masquerade static 200 4 192.168.250.1 udp 1701
ipsec auto refresh on
ipsec transport 1 1 udp 1701
telnetd host lan
dhcp service server
dhcp server rfc2131 compliant except remain-silent
dhcp scope 1 192.168.250.2-192.168.250.2/24
dns host lan1
dns server dhcp lan2
dns server select 500201 dhcp lan2 any .
dns private address spoof on
l2tp service on
httpd host lan1
statistics traffic on
Support Industries