Cannot get VPN tunnel to work properly without NAT

RouterOS General
1

Since Some asshole hijacked my thread im starting a new one

I eastablished a PPTP tunnel between to MiKrotik devices and my tunnel was working for the most part until i disabled the Nat masquerade rule. MY question is why did i need the nat rule for the tunnel to work? It seems i may have a problem with my config.


Thank you

2

are you establishing pptp from RouterOS to RouterOS, or a machine behind the firewall ? Are you using public IPs ? Are the packets having to get fragmented because your on DSL or something ? There are many reasons, without seeing your config it would be hard to tell.

Sam

3

The Home office endpoint has an ethernet connection from the building with a static IP address. The Branch office is connecting through a DSL using the PPPOE client.
The home office lan ip address is 10.0.0.0/24 and the Branch office network address is 10.0.10.0/24. I am Establishing the connection from the branch office through the DSL PPPOE connection. Both ends of my VPN are mikrotik Router OS 2.9.43.


Thank you

4

you probably need connection tracking becuase of fragmented packets … not because pptp needs it. Try changing your MTU to something like 1300 or so and see what happens.

Sam

5

should i try changing the PPPOE MTU or the PPTP MTU? or both


Thank you

6

My guess is that you are assigning the PPtP tunnel an IP from either the 10.0.0.0/24 or 10.0.10.0/24 network. If so, you need to set arp=proxy-arp on the interface with the same IP range (10.0.10.0/24 or 10.0.0.0/24). This is in the documentation, fwiw.

7

Did you come here to play twenty questions? The people that answer questions don’t get paid for their time, so don’t make them play “twenty questions” with you. We simply should not have to play Twenty Questions to get the information needed to be able to help you out with the problem. Don’t try guesswork solutions without properly defining the problem, tell us all the important details up front so we don’t need to go through a lot of questions to determine the cause of your network problem. Gathering more data before attempting solutions is the smart course.

P.S. And don’t tell that there arent any network technicians here, as you usually do.

8

Hey Pete, Who the heck are you talking to? Are you sure you posted in the correct thread?


Butch, Thank you for the suggestion. I will give it a try later in the week.