EDIT: this appears to be a config error in one of my routers, works as expected after rebuilding from default config.
I cannot seem to route through a tunnel I have created using either IPIP/GRE with an IPsec secret. I can ping hosts on the remote LAN from each router, but not from remote hosts. The network is setup like this:
where the tunnel IP is set to the tunnel interface, and there is a route on both routers with tunnels, with remote tunnel IP as gateway for the remote LAN. I can ping the remote tunnel IP from my LAN, but not remote hosts. On my 192.168.20.0/24 LAN I have 192.168.20.1 as DHCP gateway, although I have set gateway to 192.168.20.2 with the same results
Are you running any routing protocols? Also, please post at least /ip route export from all 3 devices when a tunnel (IPIP or GRE) is up.
No routing protocols as yet..
These are actual values for WAN IPs
Router 192.168.20.1
/ip route export
add distance=1 gateway=192.168.20.2
add distance=1 dst-address=10.0.0.0/8 gateway=10.122.4.65
add distance=1 dst-address=192.168.10.0/24 gateway=192.168.200.1
/ip address export
add address=192.168.20.1/24 comment="default configuration" interface=bridge-local network=192.168.20.0
add address=10.108.24.161/27 comment="WAN config IP range" interface=ether4-WAN network=10.108.24.160
add address=10.122.4.79/27 comment="WAN IP" interface=vlan10-ether4-WAN network=10.122.4.64
add address=192.168.1.1/24 interface=bridge-local network=192.168.1.0
add address=192.168.2.2/24 interface=bridge2-Guest network=192.168.2.0
add address=192.168.200.2/29 interface=ipip-tunnel1 network=192.168.200.0
Router 192.168.20.2
/ip route export
add distance=1 dst-address=10.0.0.0/8 gateway=192.168.20.1
add distance=1 dst-address=192.168.10.0/24 gateway=192.168.20.1
add distance=1 dst-address=192.168.200.0/29 gateway=192.168.20.1
/ip address export
add address=192.168.2.1/24 interface=ether4-Guest network=192.168.2.0
Router 192.168.10.1
/ip route export
add distance=1 dst-address=10.0.0.0/8 gateway=10.123.0.33
add distance=1 dst-address=192.168.110.0/24 gateway=192.168.200.2
/ip address export
add address=192.168.1.1/24 disabled=yes interface=bridge1-Lan network=192.168.1.0
add address=192.168.10.1/24 comment=defconf interface=bridge1-Lan network=192.168.10.0
add address=10.110.1.97/27 comment="WAN config IP range" interface=ether5-WAN network=10.110.1.96
add address=10.123.0.39/27 comment="WAN IP" interface=VLAN10-ether5 network=10.123.0.32
add address=192.168.200.1/29 interface=ipip-tunnel1 network=192.168.200.0
Router 192.168.20.2 should be irrelevant since the problem occurs when the LAN gateway is 192.168.20.1
Post the tunnel configs as well please
/interface export
and /ip firewall nat export too please.
Sure,
Router 192.168.10.1
/interface> export
# jul/14/2017 19:24:17 by RouterOS 6.37.5
# software id = 0W4T-E1VF
#
/interface bridge
add name=bridge1-Lan
/interface ethernet
set [ find default-name=ether1 ] name=ether1-InternetPort
set [ find default-name=ether2 ] name=ether2-UniFi
set [ find default-name=ether3 ] master-port=ether2-UniFi name=ether3-Rpi
set [ find default-name=ether4 ] master-port=ether2-UniFi
set [ find default-name=ether5 ] name=ether5-WAN
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1-InternetPort name=pppoe-Internet password=****** use-peer-dns=yes user=user@ISP
/interface gre
add allow-fast-path=no disabled=yes ipsec-secret=secret !keepalive local-address=10.123.0.39 name=GRE-tunnel1 remote-address=10.122.4.79
/interface ipip
add allow-fast-path=no ipsec-secret=secret local-address=10.123.0.39 name=ipip-tunnel1 remote-address=10.122.4.79
/interface eoip
add allow-fast-path=no disabled=yes ipsec-secret=secret local-address=10.123.0.39 mac-address=MAC name=EoIP-tunnel1 remote-address=
tunnel-id=0
/interface vlan
add interface=ether5-WAN name=VLAN10-WAN vlan-id=10
/interface list
add name=list1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=bridge1-Lan interface=ether2-UniFi
/interface list member
add interface=ether1-InternetPort list=list1
add interface=VLAN10-WAN list=list1
/ip firewall nat export
# jul/14/2017 19:30:21 by RouterOS 6.37.5
# software id = 0W4T-E1VF
#
/ip firewall nat
add action=accept chain=srcnat comment="IPsec VPN" disabled=yes dst-address=192.168.110.0/24 src-address=192.168.10.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=pppoe-Internet
add action=masquerade chain=srcnat out-interface=VLAN10-WAN to-addresses=10.123.0.39
add action=dst-nat chain=dstnat comment="WAN DNS redirect" dst-port=53 in-interface=bridge1-Lan layer7-protocol=as-a protocol=udp to-addresses=10.96.0.10
add action=dst-nat chain=dstnat dst-port=53 in-interface=bridge1-Lan layer7-protocol=as-ptr protocol=udp to-addresses=10.96.0.10
add action=dst-nat chain=dstnat dst-port=840-850 protocol=tcp to-addresses=192.168.10.99 to-ports=840-850
add action=dst-nat chain=dstnat dst-port=840-850 protocol=udp to-addresses=192.168.10.99 to-ports=840-850
add action=dst-nat chain=dstnat dst-port=80 protocol=tcp to-addresses=192.168.10.99 to-ports=80
add action=dst-nat chain=dstnat disabled=yes dst-port=840-850 in-interface=VLAN10-WAN protocol=tcp to-addresses=192.168.10.99 to-ports=840-850
add action=dst-nat chain=dstnat disabled=yes dst-port=840-850 in-interface=VLAN10-WAN protocol=udp to-addresses=192.168.10.99 to-ports=840-850
add action=masquerade chain=srcnat comment=hairpin disabled=yes dst-address=192.168.10.99 dst-port=840-850 out-interface=bridge1-Lan protocol=tcp src-address=\
192.168.0.0/16
add action=dst-nat chain=dstnat comment=hairpin disabled=yes dst-address=IP dst-port=840-850 protocol=tcp to-addresses=192.168.10.99 to-ports=840-850
Router 192.168.20.1
/interface export
# jul/14/2017 20:09:28 by RouterOS 6.39.2
# software id = A3KP-R0P2
#
/interface bridge
add admin-mac=MAC auto-mac=no fast-forward=no name=bridge-local
add name=bridge2-Guest
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce disabled=no distance=indoors frequency=auto mode=\
ap-bridge wireless-protocol=802.11 wps-mode=disabled
/interface ethernet
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether3 ] master-port=ether2-master name=ether3
set [ find default-name=ether4 ] name=ether4-WAN
/interface gre
add allow-fast-path=no disabled=yes ipsec-secret=secret !keepalive local-address=10.122.4.79 name=GRE-tunnel1 remote-address=\
10.123.0.39
/interface ipip
add allow-fast-path=no ipsec-secret=secret local-address=10.122.4.79 name=ipip-tunnel1 remote-address=10.123.0.39
/interface eoip
add allow-fast-path=no disabled=yes ipsec-secret=secret local-address=10.122.4.79 mac-address=MAC name=EoIP-tunnel1 \
remote-address=10.123.0.39 tunnel-id=0
/interface vlan
add interface=ether4-WAN name=VLAN10 vlan-id=10
/interface ethernet
set [ find default-name=ether1 ] master-port=ether2-master name=ether1-Downstairs
/interface pppoe-client
add add-default-route=yes interface=ether1-Downstairs keepalive-timeout=60 name=pppoe-out1 password=password use-peer-dns=yes user=\
name@ISP
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=WPAkey \
wpa2-pre-shared-key=WPAkey
add authentication-types=wpa-psk,wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=Guest supplicant-identity="" \
wpa-pre-shared-key=GuestWPAKey wpa2-pre-shared-key=GuestWPAKey
/interface wireless
add disabled=no keepalive-frames=disabled mac-address=MAC master-interface=wlan1 multicast-buffering=disabled name=\
wlan-Guest security-profile=Guest ssid=Guest wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface bridge port
add bridge=bridge-local interface=ether2-master
add bridge=bridge-local interface=wlan1
add bridge=bridge2-Guest interface=wlan-Guest
[admin@Router] > /ip firewall nat export
# jul/14/2017 20:12:29 by RouterOS 6.39.2
# software id = A3KP-R0P2
#
/ip firewall nat
add action=accept chain=srcnat comment="IPsec VPN" disabled=yes dst-address=192.168.10.0/24 out-interface=VLAN10 src-address=\
192.168.20.0/24
add action=masquerade chain=srcnat comment="default configuration" disabled=yes out-interface=pppoe-out1
add action=dst-nat chain=dstnat comment="WAN DNS" dst-port=53 in-interface=bridge-local layer7-protocol=as-ptr protocol=udp \
to-addresses=10.96.0.10
add action=dst-nat chain=dstnat dst-port=53 in-interface=bridge-local layer7-protocol=as-a protocol=udp to-addresses=10.96.0.10
add action=masquerade chain=srcnat out-interface=VLAN10
add action=masquerade chain=srcnat out-interface=ether4-WAN
add action=masquerade chain=srcnat out-interface=bridge-local src-address=192.168.2.0/24
add action=dst-nat chain=dstnat disabled=yes protocol=tcp src-port=8292 to-addresses=192.168.20.2 to-ports=8291
Router 192.168.20.2
/interface export
# jul/14/2017 20:22:39 by RouterOS 6.39.2
# software id = DLZ8-0USZ
#
/interface bridge
add admin-mac=MAC auto-mac=no comment=defconf fast-forward=no name=bridge
add fast-forward=no name=bridge2-Guest
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce disabled=no distance=indoors frequency=\
auto mode=ap-bridge ssid=SSID wireless-protocol=802.11 wps-mode=disabled
/interface ethernet
set [ find default-name=ether2 ] name=ether2-master
set [ find default-name=ether3 ] master-port=ether2-master
set [ find default-name=ether4 ] name=ether4-Guest
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 keepalive-timeout=60 name=pppoe-DSL password=passwored profile=\
default-encryption use-peer-dns=yes user=user@ISP
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" mode=dynamic-keys supplicant-identity=MikroTik \
wpa-pre-shared-key=WPAkey wpa2-pre-shared-key=WPAkey
add authentication-types=wpa-psk,wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=Guest \
supplicant-identity="" wpa-pre-shared-key=GuestWPAKey wpa2-pre-shared-key=GuestWPAKey
/interface wireless
add disabled=no keepalive-frames=disabled mac-address=MAC master-interface=wlan1 multicast-buffering=disabled name=\
wlan2-Guest security-profile=Guest ssid=Guest wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge2-Guest interface=wlan2-Guest
add bridge=bridge2-Guest interface=ether4-Guest
/ip firewall nat> export
# jul/14/2017 20:23:08 by RouterOS 6.39.2
# software id = DLZ8-0USZ
#
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=pppoe-DSL
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=pppoe-DSL src-address=192.168.2.0/24
The over-arching theme I’d like to start with is configuration complexity reduction. You seem to have duplicate rules in places (for sure on 192.168.10.1/24). Let’s get rid of the tunnels that aren’t IPIP for now at least. As we reduce the amount of configurations present the problem will come to light much easier. I suspect it has something to do with routes and or NAT but I’d rather get you in a better place overall.
Internet on 192.168.20.1 also?
Does the 192.168.20.1 have an active DSL connection? I’m guessing you added the 192.168.20.2 router and moved DSL to it. Is that correct? If so, clean off the DSL config from 192.168.20.2.
IPSec VPN NAT Exclusion Rules
You have a NAT exclusion rule for an IPSec VPN that differ. Did you have an Internet based Site to Site VPN in the past? Is this rule meant to apply to a remote access VPN?
192.168.10.1:
/ip firewall nat add action=accept chain=srcnat comment="IPsec VPN" disabled=yes dst-address=192.168.110.0/24 src-address=192.168.10.0/24
192.168.20, here you contradict the 192.168.10.1 rule with:
/ip firewall nat add action=accept chain=srcnat comment="IPsec VPN" disabled=yes dst-address=192.168.10.0/24 out-interface=VLAN10 src-address=192.168.20.0/24
WAN IP Addressing
What’s with the 2 allocations of RFC1918 (private - 10.0.0.0/8) addressing on the community WAN. You only appear to be using 1. Which 1 is correct? Did they assign you 2 blocks intentionally? What’s the difference between the two?
Ok yep I realize this config is very unpolished, but I’m not super familiar with the OS so its a bit of an exercise for me.
- No internet on 192.168.20.1
- Accept rules are from an attempt to use IPSec only for VPN as in the mikrotik wiki. This was successful, but messy and didn’t allow me to use the remote site as gateway (to my understanding). I’ve deleted them
- There are two allocations of 10.0.0.0/8 for each site, one is an IP for the client station (my WAN IP), the other is a subnet allocated from the WAN if I wanted to route hosts at that location, I’m just using it for an IP for config of the client stations. The WAN IP runs as a VLAN on that port/cable to the client station.
I solved this with the initial GRE config on the Mikrotik wiki, after resetting to default settings on all routers and building up fresh. I only did this after finding more routing errors..
Excellent! Yup, I figured it was in routing or NAT so that’s good to hear. Sometimes it helps to remove the clutter from previous troubleshooting attempts (reset to default).