If I read that correctly it means that WAN connections to your winbox are correctly blocked but other internal connections such as ipsec vpn incoming traffic that comes out on the router is allowed to winbox, similar how a LAN user may access winbox if the firewall rules permit.
I think this is only partly true. This is how the router can be accessed with Winbox via the L2TP/IPSec remote connection.
But if I connect remotely to the router with L2TP/IPSec VPN, I still can’t access the internet, only the local (BLUE_VLAN) network…
The Winbox access is limited to the 192.168.0.0/23 IP address range (192.168.0.1-192.168.1.254) so that it can be accessed from both the office and home networks.
However, from the office via the IPSec Site2site VPN, the router is still not reachable with Winbox, but I can ping the router.
In the end I was basically successful, everything seems to be working. Of course, we still need to test it for a while…
Emboldened by this, today I prepared the configuration of the office router and uploaded it to the router. Everything seems to work here too except for the IPSec Site2Site VPN between the office and my home. Both places have Mikrotik Hapac2 routers and they try to connect with the previously working IPSec settings, but there is an error message “phase 1 negotiation failed due to time up” in the log.
I found that there might be a tcp mss problem, but I checked the set value and it is fine. This would be very important to me because I cannot supervise the office network and devices.
Can anyone help what is causing the problem?
Thanks for your help.
When you are ready to drop 3 different VPNs and use only one let me know? Will need the requirements answered though. 
I found a post to restart the routers on both sides at the same time. I tried to restart it from the office earlier, but due to limited access, I could only restart one at a time. Of course, I didn’t know any of them because they were working on it with openVPN…
Tonight I restarted both and IPSec Site2Site VPN, L2TP/IPSec remote management VPN and openVPN to the server are working. All three run…
But there is another problem that I can access the office and home networks and the devices operating on them via the IPSec Site2site VPN, but only the remote router is not accessible with Winbox but I can ping it . So I don’t even get SNMP data from the remote router…
I need to find the rule that prohibits access to the remote pouter.
Any ideas?
Typically a rule on the remote router is required to allow traffic from outside it, or you dont have a route on a local router to it, OR you dont have route on the remote router to tell it where to send the return traffic from your queries.
Exactly. I got this far because the problem was not solved by disabling the drop rules. I’m trying to figure out what rule would be needed, although I have no idea yet…
I hope that if I figure it out, it will also solve the SNMP problem…
I’m trying all possible solutions in a row and I’m going through the old config to see if it helps.
But it would be a great idea…
So its more likely a routing issue somewhere, or a firewall rule that you have that is already dropping the traffic.
It seems that VLANs are the cause of the problem, but I don’t know how to solve it.
There are two Mikrotik routers and both connect to the Internet with static public IP addresses. Between them is an IPSec Saite2Site VPN. This connects the VLAN of one router with the IP address range 192.168.0.0/24 to the VLAN of the other IP address range 192.168.1.0/24. One router’s IP address is 192.168.0.254, while the other’s is 192.168.1.254.
The traffic between the two VLANs works, all devices are accessible in either VLAN, but the routers cannot be reached from the other VLAN via the IPSec VPN. You can ping the routers from the other VLAN, but you cannot connect to them from the other VLAN with Winbox. The router in that VLAN can be reached from the same VLAN.
It seems that the problem is caused by the VLAN setting. What could be the reason for this?
No one has any ideas?
Thanks and Regards
Quick look at config, posted in #7 above, shows that there isn’t a rule allowing winbox access via IP from remote site. Or I didn’t find it.
Thanks for your help @mkx.
What rule is needed for this? Can you give me an example?
Thanks and Regards
Once a remote user comes through a vpn and hits the local router, you need an input rule to allow access to winbox.
Same as you would for the admin who resides on the local router.
add chain=input action=accept in-interface=WGNAME src-address=remoteuserIP { If it was wireguard the remote user was coming in on }
This was the solution. I thought that it should be forwarded between the local and the remote subnet. I didn’t think that the input caused a problem because it seemed that the traffic was accepted between the two subnets.
I was wrong about this and thank you for pointing out my wrong thinking. That’s why sometimes you need a fresh set of eyes to see the problem…
I will test everything again, thanks for the help.
Thanks and Regards