Cannot access the router via WinBox when the device has a second IP

Cannot access the router via WinBox when the device has a second IP. An L2TP connection was established and a second address was assigned for the tunnel through it. When entering the IP from the bridge, everything works fine, but when logging in with the second IP, it just hangs at login, and it turns out later that this happens not even through the tunnel itself, but also through the local network.

If there are multiple LANs, then usually in the ''Input'' chain we specify which Interface-List will have access to the LAN. Without seeing your firewall config it is difficult to say what you have defined there. Maybe you have defined access only from specific subnets... in the IP-services section... No one can know this because you have given too little information.

5 entry ''Input'' chain...

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input in-interface-list=LAN (router access....)
add action=drop chain=input comment="drop all else"
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="allow internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow port forwarding" connection-nat-state=dstnat { disable or remove if not required }
add action=drop chain=forward comment="drop all else"

When connecting with L2tp, you also need to specify which Lan this connection will access. Example: access will be at Lan1 (172.16.0.1/24), Lan2 (172.16.1.1/24), or Lan3 (172.16.2.X....etc.

The problem is that the normal Winbox doesn’t connect and just freezes, while version 4 connects, but it’s impossible to use it.

Likely your computer doesn't have a route to the L2TP connection IP, via the bridge IP of the router.
So, the packets from your computer to that IP are going somewhere else.

Just use the bridge IP to connect from your computer. The connectivity failure via L2TP is something else. Likely L2TP connection not being a member of the LAN interface lists as mentioned above and assuming something near default firewall config.

Edit:
Strangely, I was not considering the common case where the router is your default gateway :frowning: in which case another route is not required.

Another possibility is that the router L2TP IP address is only present on the router when the L2TP connection is UP.
Commonly the assignment of the L2TP connection to the LAN interface list would be done in the ppp Profile configuration.

Possible scenario is that you have masquarade defined in your router and therefore:

if router gets a packet targeted to one of it's WAN addreesses it accepts it but answers with "the other address" as masquarade picks it up as MT tends to use the "lowest addresss" assigned to the interface
router tries to send the packet back but the address forces it to use not the original interface the packet come from but the one that fits better according to routing rules and selected WAN address.
if you have only one WAN with multiply addresses then the packet goes to wrong gateway
the result is that packet goes "somewhere" but not to your computer back.

Solution:

try to change masquarade rule to src-nat to the one that specifies proper addresses.
check if, as suggested, you have proper routes installed in your computer