Hello everyone!
I configured s2s VPN between Mikrotik abd Checkpoint. All works fine, i can ping Mikrotik from remote site and access internal resources. But when i try connect to Mikrotik to its LAN IP (via winbox or SSH) from remote network it disconnects giving an error “refuced”.
WAN IP also don`t work, because Checkpoint drops unencrypted packets to vpn peer according policy.
Maybe it was a mistake in firewall rules, here it
add address=xxx.xxx.xxx.0/24 list=trusdet_net
add address=xxx.xxx.xxx.xxx list=trusdet_net
add address=172.30.20.0/24 list=vpn_domain
add address=10.2.2.0/24 list=vpn_domain
add address=172.30.40.0/24 list=vpn_domain
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related connection-type=“”
add action=accept chain=input comment=“default configuration” protocol=icmp
add action=accept chain=input comment=“Accept established / Related” connection-state=established,related
add action=accept chain=input comment=“ANY from trusted” src-address-list=trusdet_net
add action=accept chain=input comment=“ANY from VPN” src-address-list=vpn_domain
add action=drop chain=input comment=“Cleanup INPUT” in-interface=ether1-gateway
add action=accept chain=forward comment=“Accept established / Related” connection-state=established,related
add action=accept chain=forward comment=“ACCEPT VPN” src-address-list=vpn_domain
add action=drop chain=forward comment=“Cleanup FORWARD”
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address-list=vpn_domain new-routing-mark=to_vpn passthrough=no src-address=172.31.3.0/24
/ip firewall nat
add action=accept chain=srcnat routing-mark=to_vpn src-address=172.31.3.0/24
add action=masquerade chain=srcnat comment=“default configuration” out-interface=ether1-gateway
/ip firewall raw
add action=notrack chain=prerouting comment=“No track from VPN Domain” src-address-list=vpn_domain
How configure mikrotik to allow connect from vpn network?