Clavister ike-LantoLan route problems?

RouterOS Beginner Basics
1

I’m still a newbee!

i however managed to make a tunnel to our Clavister main Firewall
clavister-iketunnel-censored.JPG
i dont know much about clavister!



[admin@MikroTik88] > /export
# feb/29/2016 14:31:38 by RouterOS 6.34.2
# software id = PLP3-P4UV
#
/interface bridge
add admin-mac=00:0C:42:E1:B2:A7 auto-mac=no comment=defconf name=bridge
add disabled=yes name=wifi-bridge
/interface ethernet
set [ find default-name=ether1 ] name=WAN
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether3 ] master-port=ether2-master
set [ find default-name=ether4 ] master-port=ether2-master
set [ find default-name=ether5 ] master-port=ether2-master
/interface eoip
add !keepalive local-address=MyLocalWanIP mac-address=02:73:00:00:00:00 name=eoip-tunnel1 remote-address=MyServerPublicIP \
    tunnel-id=0
/ip neighbor discovery
set WAN discover=no
set bridge comment=defconf
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.99
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=WAN
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.0.5,192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept establieshed,related" connection-state=established,related
add chain=input comment="IPSEC-ESP 50" connection-state=new connection-type="" dst-port=50 in-interface=WAN protocol=udp
add chain=input comment="IPSEC" connection-state=new connection-type="" dst-port=500,1701,4500 in-interface=WAN protocol=udp
add chain=input comment="IPSEC-AH 51" connection-state=new connection-type="" dst-port=51 in-interface=WAN protocol=udp
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=WAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add chain=forward comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=\
    new in-interface=WAN
/ip firewall nat
add chain=srcnat dst-address=192.168.0.0/24 src-address=192.168.88.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=eoip-tunnel1
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=WAN
/ip ipsec peer
add address=MyServerPublicIP/32 enc-algorithm=aes-256,aes-192,aes-128,3des generate-policy=port-strict local-address=\
    MyLocalWanIP nat-traversal=no secret=0xMyHexPSK
/ip ipsec policy
set 0 disabled=yes
add dst-address=192.168.0.0/24 proposal=Site2Site sa-dst-address=MyServerPublicIP sa-src-address=MyLocalWanIP src-address=\
    192.168.88.0/24 tunnel=yes
/ip route
add check-gateway=ping comment=MailServer disabled=yes distance=1 dst-address=MyMailServerIP/32 gateway=192.168.0.254 pref-src=\
    192.168.88.1
add comment="TAB LAN" distance=1 dst-address=192.168.0.0/24 gateway=eoip-tunnel1 pref-src=192.168.88.1
add distance=1 dst-address=192.168.0.254/32 gateway=eoip-tunnel1 pref-src=192.168.88.1 scope=10
/ip route rule
add dst-address=MyMailServerIP/32 interface=eoip-tunnel1 src-address=192.168.88.0/24 table=main
add action=lookup-only-in-table dst-address=MyMailServerIP/32 interface="Thage Tunnel" src-address=192.168.88.0/24 table=main

The problems: i have missed something.
from the mikrotik lan (192.168.88.0) i can reach everyting on the HQ LAN (192.168.0.0) (intranet pages, SMB shares, RDP services etc)
from HQ LAN i cant reach anyting but the mikrotik (192.168.88.1) (i would like to reach printers web interface, and use RDP services)
my route to the mailserver does not work at all… (i want mailtrafik to go trough the tunnel)
Note: the mail route woked it i used an L2TP but then all trafik was routed trough the tunnel

2

the net on the other side of the tunnel is 192.168.0.0/24 but i also wanna route to our mailserver witch is in our dmz
i wanna reache the mailserver trough the tunnel.. its already set up on the tunnel server (clavister) and works on the other offices clavisters.. but i wanna use an mikrotik instead.. and the mail route is the only thing i cant figure out (for now)
the clavister internal adress is 192.168.0.254 and i can ping this from my mikrotik office

i tried to make a route to the mailserverip via 192.168.0.254, but it marks as unreacheble and skips the route and goes trough the default gateway route (0.0.0.0) instead

if i tries to make the route via the eoip-tunnel or the bridge, route marks it like OK, but when trying to ping, it ties to use the route but the ping command responds host unreachable (instead of timeout)

how do i get trafic to the mailserver go trough the tunnel

3 
/ip firewall filter
add chain=forward comment="allow trafifc from HQ" dst-address=192.168.88.0/24 src-address=192.168.0.0/24

now i can reach the mikrotik subnet from den HQ subnet

todo: fix the mailroute