Access winbox remotely over VPN

Hello everyone
I want to access my router through winbox over the internet, so I setup a L2TP VPN on the router and wrote down the local IP that the VPN server gave the router and on the other device (on the internet), which is connected to the same VPN server and is within the same subnet trying to access the router with winbox but got the error that is saying the connection timed out.
P.S. I use the following rule in router /firewall nat and also I change the default winbox port.
Nat rule: add action=dst-nat chain=dstnat comment=“Remote winbox” disabled=no dst-port=
1111 log=yes log-prefix=“Remote winbox” protocol=tcp to-addresses=
192.168.88.1 to-ports=9999

I try to connect to router by using 192.168.5.6 (router IP on VPN server subnet):1111

Anyone? :confused:

If you got your VPN right… Nat is not involved with reaching winbox.

That would be an INPUT RULE matching the interface or subnet of your VPN CLIENT.

Hi,
ping is working, from VPN client to 192.168.5.6?
I think, NAT rule is good…

Still the same even after adding the input rule for VPN interface.
Actually after adding the rule I got hit on the rule and packets count but still the same connection timed out error.

@gamesif
No pinging the private IP address of the router on the VPN subnet is not working.
P.S. Both of my devices (router - windows) are clients of a VPN server that I don’t have access to server (I think it’s Nord).

There is no difference even when using /ip cloud

The side from which you want to connect with winbox, need to know two things from a routing aspect.

  • routing ‘internet access’ to VPN provider IP address
  • routing ‘L2TP VPN access’ to l2tp tunnel IP on this side

What shows?
(in Windows command prompt)

route print
tracert 192.168.5.6

@gemesif
172.19.19.45 is the router I want to connect to. (was 192.168.5.6 but I change the VPN server so it’s 172.19.19.45 now)
Here you go:
Screenshot 2022-06-23 010345.png
with 172.19.19.45:
Screenshot 2022-06-23 010426.png
with Mikrotik /ip cloud DDNS:
Screenshot 2022-06-23 010525.png
with /ip cloud DDNS it’s not connecting to winbox too, but I had the same setup some where else but with static public IP and I could easily connect to the router with winbox.

I think we need to find a solution in this direction:

https://docs.microsoft.com/en-us/windows/security/identity-protection/vpn/vpn-routing

“Network routes are required for the stack to understand which interface to use for outbound traffic. One of the most important decision points for VPN configuration is whether you want to send all the data through VPN (force tunnel) or only some data through the VPN (split tunnel). This decision impacts the configuration and the capacity planning, as well as security expectations from the connection.”

It was a problem with Nord VPN network.
Thank you guys

Please explain me why you censore private IP addresses…

Is better you understand the differencies between public and private IP space…

C:\Users\RexTended>route print

Elenco interfacce
13…08 60 6e 90 22 e4 …Intel(R) 82579V Gigabit Network Connection
6…08 60 6e f2 d6 6a …Intel(R) 82574L Gigabit Network Connection
1…Software Loopback Interface 1

IPv4 Tabella route

Route attive:
Indirizzo rete Mask Gateway Interfaccia Metrica
0.0.0.0 0.0.0.0 192.168.11.254 192.168.11.11 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
192.168.11.0 255.255.255.0 On-link 192.168.11.11 281
192.168.11.11 255.255.255.255 On-link 192.168.11.11 281
192.168.11.255 255.255.255.255 On-link 192.168.11.11 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 192.168.11.11 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 192.168.11.11 281

Route permanenti:
Nessuna