Hello-
I set up a L2TP VPN configuration and am able to connect just fine however I am unable to browse any internal LAN resources via http. After a few hours of troubleshooting I narrowed my problem down to firewall rules. Proxy Arp did not fix the issue. I disabled my filter rules and was able to then browse the LAN, however I can’t seem to figure out what tweak to in order to allow my VPN client to connect to these resources.
I have an internal network setup in the 192.168.1.0/24 IP range and a VPN pool allocated to the addresses 192.168.1.190-199. Eth1 is connected to my WAN and Eth3 is the LAN Master Switch
Here is my firewall list. Also any other pointers on the rules put in place would be welcome as this is my first time using RouterOS firewall rules.
/ip firewall address-list
add address=192.168.1.0/24 list=LAN
/ip firewall filter
add action=accept chain=input comment=\
"Allow access from the LAN using address list" src-address-list=LAN
add action=accept chain=input connection-state=new in-interface=ether1 log=\
yes log-prefix=IPSEC_Firewall_ protocol=udp src-port=500,1701,4500
add action=accept chain=input connection-state=new connection-type="" \
in-interface=ether1 protocol=ipsec-esp
add action=drop chain=forward comment="Drop Invalid Connections" \
connection-state=invalid log=yes
add action=accept chain=forward comment="Allow connections from the LAN" \
connection-state=new in-interface=ether3
add action=accept chain=forward comment="Allow Established Connections" \
connection-state=established
add action=accept chain=forward comment="Allow related Connections" \
connection-state=related
add action=drop chain=forward comment=\
"Drop all other traffic through the router"
add action=accept chain=input comment=\
"Allow Established Connections to the router" connection-state=\
established
add action=accept chain=input comment=\
"Allow related connections to the router"
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=drop chain=input comment="Drop Invalid Connections" \
connection-state=invalid
add action=drop chain=input comment="Log and drop everything else" log=yes \
log-prefix=DROP_
/ip firewall nat
add action=masquerade chain=srcnat dst-address=0.0.0.0/0 out-interface=ether1 \
src-address=192.168.1.0/24