How-to VPN: Private Internet Access (PIA) and MikroTik Router

netravnenLeave a comment 
# First create a vpn profile to use when creating l2tp/pptp connections
# to privateinternetaccess.

/ppp profile add change-tcp-mss=yes comment="PIA VPN" \
dns-server=209.222.18.222,209.222.18.218 name=privateinternetaccess \
only-one=no use-compression=no use-encryption=required use-ipv6=no \
use-mpls=no use-upnp=no

# Create the l2tp interface

/interface l2tp-client add comment="PIA VPN Germany" \
connect-to=germany.privateinternetaccess.com disabled=no \
name=pia-de-l2tp password=[l2tp-password] \
profile=privateinternetaccess user=[l2tp-username]
# [l2tp-username]
# Your PIA username for l2tp/pptp/socks connections
# beginning with 'x' (not 'p'!)
# [l2tp-password]
# Your PIA password for l2tp/pptp/socks connections 

# Create a firewall mangle rule to mark traffic we want to
# go through the vpn.

/ip firewall mangle add action=mark-routing \
chain=prerouting comment="PIA VPN Germany" \
new-routing-mark="PPTP RM" passthrough=yes \
src-address=[ip-range-to-forward-through-vpn]
# [ip-range-to-forward-through-vpn]
# Fx. 192.168.1.0/24 or 192.168.1.2-192.168.1.254 

# Create the NAT rule and tell it to use the vpn interface.

/ip firewall nat add action=masquerade chain=srcnat \
comment="PIA VPN Germany" out-interface=pia-de-l2tp
# Create a corresponding default route to match the previous NAT
# rule. Which only get used when traffic has been marked with
# 'PPTP RM'.

/ip route add comment="PIA VPN Germany" disabled=yes \
distance=1 gateway=pia-de-l2tp routing-mark="PPTP RM"

# Now you should see traffic from clients in the ip range
# of [ip-range-to-forward-through-vpn] go through the vpn.

Add Danish NemID X.509 public certificate to RIPE Database

netravnen

General

If you ever used the RIPE Database.

You know the following RIPE Maintainer Authentication methods is possible.

  1. SSO (a.k.a. single sign on)
  2. key-cert (GnuPG keys + X.509 certificate)
  3. MD5 encrypted passwords

NemID

  1. IF you have the danish NemID follow the guidelines here to configure NemID on your computer. And then for you email program.
  2. Go find your public certificate here and download it.
  3. Open the certificate locally on your computer and prepend every line with ‘certif: ‘ so it looks the example below. Remember the key-value pairs:
    • key-cert: auto
    • mnt-by: xyz
    • source: ripe

Example

key-cert: AUTO-1
certif: -----BEGIN CERTIFICATE-----
certif: MIID8zCCA1ygAwIBAgICAIIwDQYJKoZIhvcNAQEEBQAwcTELMAkGA1UEBhMCRVUx
certif: EDAOBgNVBAgTB0hvbGxhbmQxEDAOBgNVBAoTB25jY0RFTU8xHTAbBgNVBAMTFFNv
certif: ZnR3YXJlIFBLSSBUZXN0aW5nMR8wHQYJKoZIhvcNAQkBFhBzb2Z0aWVzQHJpcGUu
certif: bmV0MB4XDTAzMDkwODEwMjYxMloXDTA0MDkwNzEwMjYxMlowfTELMAkGA1UEBhMC
certif: TkwxETAPBgNVBAoTCFJJUEUgTkNDMRAwDgYDVQQLEwdNZW1iZXJzMRgwFgYDVQQD
certif: Ew91ay5idC50ZXN0LXVzZXIxLzAtBgkqhkiG9w0BCQEWIHRlc3QtdXNlckBsaW51
certif: eC50ZXN0bGFiLnJpcGUubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
certif: AQEArv3srxyl1QA3uS4dxdZbSsGrfBrMRjMb81Gnx0nqa6i+RziIf13lszB/EYy0
certif: PgLpQFdGLdhUQ52YsiGOUmMtnaWNHnEJrBUc8/fdnA6GVdfF8AEw1PTfJ6t2Cdc9
certif: 2SwaF+5kCaUDwmlOgbM333IQmU03l3I1ILs32RpQyZ+df/ovHNrVzeLc2P59isac
certif: bfjM2S0SXPQzHjuVLH40eOgVuXA/5LAYs51eXqwtKszSxFhqekf+BAEcRDrXmIT4
certif: e3zfiZOsXKe0UfaEABgHUMrYjsUCJ8NTMg6XiVSNwQQmXCdUbRvK7zOCe2iCX15y
certif: 9hNXxhY/q/IW54W5it7jGXq/7wIDAQABo4IBCDCCAQQwCQYDVR0TBAIwADARBglg
certif: hkgBhvhCAQEEBAMCBaAwCwYDVR0PBAQDAgXgMBoGCWCGSAGG+EIBDQQNFgtSSVBF
certif: IE5DQyBDQTAdBgNVHQ4EFgQUzdajNaRorkDTAW5O6Hpa3z9pP3AwgZsGA1UdIwSB
certif: kzCBkIAUHpLUfvaBVfxXVCcT0kh9NJeH7ouhdaRzMHExCzAJBgNVBAYTAkVVMRAw
certif: DgYDVQQIEwdIb2xsYW5kMRAwDgYDVQQKEwduY2NERU1PMR0wGwYDVQQDExRTb2Z0
certif: d2FyZSBQS0kgVGVzdGluZzEfMB0GCSqGSIb3DQEJARYQc29mdGllc0ByaXBlLm5l
certif: dIIBADANBgkqhkiG9w0BAQQFAAOBgQByg8L8RaiIz5k7n5jVwM/0oHSf48KRMBdn
certif: YdN2+eoEjVQbz48NtjbBTsOiUYj5AQWRHJrKtDQ+odbog0x7UsvhXjjBo/abJ6vI
certif: AupjnxP3KpSe73zmBUiMU8mvXLibPP1xuI2FPM70Y7fgeUehbmT7wdgqs7TEtYww
certif: PeUqjPPTZg==
certif: -----END CERTIFICATE-----
mnt-by: YOUR-MNT
source: RIPE

Afterwards you should be able to sign emails send to “RIPE Database” <auto-dbm@ripe.net> with your NemID certificate and the updates gets approved if your maintainer has authorization over the object you try to create/modify/delete.

 

My X.509 certificate