How to set up proper separation between LAN and VPN clients?

Question

VPN

Good afternoon. There is a misunderstanding on setting up a separate addressing in the network on Mikrotik. Given:
Network 192.168.88.0\24, all office PCs + all VPN clients (L2TP) are connected there.
It is necessary to limit the speed of VPN + clients as a whole logically separated.
Please tell me if the configuration algorithm that I implemented to create a separate subnet for VPN clients is correct:
1. Created an address pool from the 192.168.101.0\24 network called vpn_pool;
2. Created a PPP profile for connection with addresses from vpn_pool;
3. Created a subnet 192.168.101.0\24 in IP-DHCP Server.
4. Created a user, set up a connection - there is a connection, but I don't see the received IP in leases.
And on this I have a lack of materiel, what is further necessary so that I can fully manage a separate subnet?

Answer 1

Resolved the issue:
On the existing L2TP Mikrotik server, you need to bring VPN clients to a separate subnet. To do this:
Create a separate pool with the desired address for vpn clients (I made 192.168.102.0/24)
Make an l2tp profile, specifying pool p.1 as remote address, local address - gateway (for example, 192.168.1.0 - network, 192.168.1.1 - gateway), specify the dns server in the profile.
We make a user, bind a vpn profile.
connect from the client. If nothing is changed, then by default the gateway for the client has become an office router through which he will go to the Internet (for this, you also need to register masquerading in nat on the vpn interface). If it suits you, then ok, we don’t change anything. If you need a client speed limit, then:
In Windows, in the VPN connection settings in the network, ipv4 section, there is a checkbox to set the default gateway on the remote network. We take it off.
We register a route to the office subnet from our vpn network:
route -p add 192.168.88.0 mask 255.255.255.0 192.168.102.1 , the p flag for a permanent route, otherwise it crashes after reboot.
reconnect We
reduce the speed in queues

Answer 2

And this ip will not be in dhcp lease, because. dhcp is not involved from the word at all.
I recommend reading about the interface list and how they can be used in conjunction with the ppp profile.

Answer 3

It would be more correct. I am writing from my phone. So sorry to be short.
1 creation of 2 bridges.
2 create 4 sheets
3 create routes
4 create dhcp . Lan/vpn
5 having a built topology, you can ban and cut both the entire network and 1