I have a S2S tunnel between Azure(subnet 10.11.10.0/24) and my Mikrotik (subnet 192.168.4.0/24)
Tunnel works.
From Azure I can reach LAN on Mikrotik and vice versa – From Mikrotik can reach Azure LAN.
VPN from Azure side is ‘Route-Based’
Problem is Azure server doesn’t have access to Internet.
From Azure server I can ping devices on local network on Mikrotik, can ping gateway (192.168.4.1) but can’t ping WAN address in Mikrotik.
Goal is to have all traffic from Azure go via Mikrotik including access to internet.
Current config:
/ip ipsec profile
add dh-group=modp1024 enc-algorithm=aes-256 hash-algorithm=sha256 lifetime=8h name=Azure
/ip ipsec peer
add address=23.97.x.x/32 exchange-mode=ike2 local-address=95.48.x.x name=Azure_Peer profile=Azure
add exchange-mode=ike2 name=az passive=yes profile=Azure
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha512,sha256,sha1
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc lifetime=7h30m name=Azure_Proposal pfs-group=none
/ip ipsec identity
add peer=Azure_Peer secret=Haslo
/ip ipsec policy
add dst-address=10.11.10.0/24 level=unique peer=Azure_Peer proposal=Azure_Proposal sa-dst-address=23.97.x.x sa-src-address=95.48.x.x src-address=192.168.4.0/24 tunnel=yes
/ip firewall filter
add action=fasttrack-connection chain=forward comment="default configuration" connection-state=established,related disabled=yes
add action=accept chain=input comment="Allow Azure subnet traffic to the router" ipsec-policy=in,ipsec src-address=10.11.10.0/24
add action=accept chain=forward comment="Allow Azure subnet traffic through the router" src-address=10.11.10.0/24
add action=accept chain=forward comment="IPSec Out Accept" ipsec-policy=out,ipsec
add action=accept chain=forward comment="IPSec In Accept" ipsec-policy=in,ipsec
add action=drop chain=input comment="DNS request from WAN" dst-port=53 in-interface=ether1-WAN protocol=tcp
add action=drop chain=input comment="Winbox from WAN" dst-port=8291 in-interface=ether1-WAN protocol=tcp src-port=""
add action=accept chain=input comment="Allow PING " protocol=icmp
add action=accept chain=input connection-state=established,related
add action=accept chain=forward comment="Akceptuj polaczenia powiazane i zestawione" connection-state=established,related log-prefix=All-connection
/ip firewall mangle
add action=change-mss chain=forward comment=Azure dst-address=10.11.10.0/24 new-mss=1350 passthrough=yes protocol=tcp tcp-flags=syn
/ip firewall nat
add action=accept chain=srcnat comment=Azure dst-address=10.11.10.0/24 src-address=192.168.4.0/24
add action=masquerade chain=srcnat out-interface=ether1-WAN
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface=ether1-WAN
Used these to help me out:
https://docs.microsoft.com/en-us/archive/blogs/netgeeks/creating-a-site-to-site-vpn-ipsec-ikev2-with-azure-and-mikrotik-routeros
https://github.com/Azure/Azure-vpn-config-samples/blob/bdc2939a90210a7aa8957f49a40eb0e8312530aa/MikroTik/Current/Site-to-Site_VPN_using_MikroTik_RouterOS.md
Also found this:
http://forum.mikrotik.com/t/ipsec-tunnel-to-azure-wont-connect-solved/137357/1
but it have following config:
/ip ipsec policy
add comment=Azure dst-address=172.16.0.0/20 peer=Azure proposal=\
azure-ipsec-proposal sa-dst-address=51.azu.re.ip sa-src-address=0.0.0.0 \
src-address=192.168.2.0/24 tunnel=yes
Also I used Mikrotik wiki:
https://wiki.mikrotik.com/wiki/Routing_through_remote_network_over_IPsec
Essentially it’s the same thing as in previous links.