Connecting to OVPN server through LTE interface

RouterOS Beginner Basics
1

Hello,

I am trying to connect remotely to a LAN network by configuring a OVPN server in a mikrotik router and accessing it through a LTE interface.
I have an android phone connected on the usb port, with usb tethering activated.
I followed the following tutorial step by step: http://systemzone.net/mikrotik-openvpn-setup-with-windows-client/
It doesn’t work, and I have some questions.

I will describe what I have so far:

  1. LTE connection to internet (works)
  • android phone connected to usb port
  • dynamic ip address of LTE interface: 192.168.42.22/24
  • dynamic route: 0.0.0.0/0 gateway 192.168.42.129
  • dhcp client for LTE interface
  • nat rule: chain->srcnat action->masquerade

I can ping google.com, so I have an internet connection.

  1. OVPN server configured
  • local bridge with ip 192.168.90.1/24
  • DNS server 8.8.8.8, on the dynamic servers :192.168.42.129 → I think this field contains the default gateway of LTE interface, so you can access 8.8.8.8. But I don’t understand why is it called Dynamic Servers.
  • I created certificates like in the tutorial
  • enabled OVPN server
  • created ppp secret with local address 192.168.90.1(bridge) and 192.168.90.10 remote address
  • I activated on the LTE interface proxy-arp
  • then I configured OVPN client on windows

The client doesn’t connect to the server.

The problem is this: I have a public address on my phone, a local address on my phone and a dynamic address on LTE interface.
I replaced the WAN ip address from the tutorial with the public address. And it doesn’t work.

Should I define a default gateway in the same network as the public address?
Does the router know to route everything coming to the public ip address to the dynamic address of the LTE?

What should I put in the CA CRL Host input field? The address of the LTE or the public one?

Basically, I don’t know how to adapt the tutorial to my specific problem.

He adds in the tutorial the public IP to ether1. I have LTE1 with a dynamic ip. Where do I add the public IP? Should I add it somewhere?

2

Hi ionutm94,

Apologies but I don’t have the answer for you, as I am having a similar issue.

What I can tell you is that I have OpenVPN server working fine over a standard PPPoE (connect an FTTC modem into ether1 and then authenticate to provider) connection but as soon as I tried to connect from the Internet inbound via the LTE on a hAP ac2 device, using a Vodafone SIM … I cannot.

The main differences I can see is that the normal WAN connection presents the external IP through to the ether1 interface where as the LTE interface has another layer of NAT, and I’m wondering if the problem is double-NAT (hoping someone else may be able to confirm)?

I had thought possibly https://wiki.mikrotik.com/wiki/Manual:Interface/LTE#Passthrough may help but I don’t think it would.

Has anyone managed to get OpenVPN server working, using only the LTE interface as opposed to something on one of the ether ports?

Thanks
Neil

3

Hi,

I think the problem for both of you lies basically how mobile providers handle their IP address space.

They mask the public ip address and assign your device a private LAN address behind their respective public IP.

The problem in your case is that you get a private IP on the LTE interface and the NAT is not a DMZ-like 1:1 NAT with the public IP, but plain masquerading.

You can do nothing this case by playing with your router’s settings.

Providers - if any - can give you maybe a different APN in order to get a routeable, public IP on the LTE interface. Contact your provider with this problem.

Best,

Pal Vig