I have a series of hAP lite devices with RouterOS v6 connected via Ovpn to an RB4011iGS+ router with RouterOS v7.
All traffic from clients connected to the hAP lite routers is forwarded through the Ovpn tunnel with nat enabled and exits the RB4011iGS+ router correctly.
The configuration is solid and has never given me any problems.
After some time, I ordered another hAP lite, which had RouterOS v7 installed by default, and that's when the trouble started. I updated it to the latest available version (7.20.6) and started the configuration.
I immediately noticed that the command for configuring route policies had changed, but that was no big deal.
I then saw that it no longer seemed necessary to use the "routing-mark," but it was necessary to create a new routing table and a route that called it up, no big deal.
Then I configured the routing rule, basically the same configuration but with a different menu.
When I tested the router, the Ovpn came up correctly, I could reach the hAP lite router remotely, but the traffic from the clients connected to the hAP router came out directly from the local connectivity and not on the Ovpn tunnel. That's when I started to get frustrated.
To simplify your help, here is the configuration:
/ppp profile
add local-address=192.168.200.27 name=openvpn-server remote-address=192.168.200.254
/ip firewall nat
add action=masquerade chain=srcnat comment="LAN to Internet Remote" \
log-prefix="LAN to Internet Remote" src-address=192.168.88.0/24
/routing/table/
add name=ovpn fib
/ip route
add comment="LAN to Internet Remote" distance=1 gateway=ovpn-client routing-table=ovpn
/routing rule
add comment="Policy Route - LAN to Internet" dst-address=0.0.0.0/0 \
src-address=192.168.88.0/24 table=ovpn
It has been a fairly long time since I had the pleasure of dealing with v6, but as far I recall, policy routing, at least for the relatively simple cases, can be transplanted 1-1 into v7, with the necessary manual addition of the routing table.
So, if you're happy with your v6 config, attempt to use it as-is in v7.
It is very nice that you highlighted the portion of the config that you think is relevant. But: please also include a full export as well.
There are two things I suspect might be your problem:
There is no default route installed in the ovpn table. With "lookup" being the action in your routing rule, the lookup falls back to "main" if it is not successful in the specified table. Add the default!
Just a warning: the default firewall has changed a lot from v6 to v7 - be careful that it doesn't mess things up for you. Either transplant the firewall from v6 (again, if you're fully happy with it) or carefully analyze the new one and make sure that it fits your use case.
EDIT: Sorry, I missed that you have in fact added the route.
The default route in the ovpn table is shown as inactive and won't work. Did you by chance put ovpn-client in a VRF (named ovpn)? If yes, the static route you added has to specify the gateway as ovpn-client@ovpn, not just ovpn-client.
Oh, if you really use VRF and ovpn-client is in VRF ovpn then in your routing table you also need to leak the return route for 192.168.88.0/24 to be accessible from the ovpn VRF.
Alternatively, don't use VRF anymore (remove the VRF assignment). Then you won't need to put @ovpn at the end of the gateway in the table ovpn. And the route I just mentioned above is also not needed.
However, if your traffic still exits via main then the issue is somewhere else. If possible post the full configuration /export (after redaction of sensitive data).
Ah, I only noticed this screenshot right now. Remove min-prefix=0 from this routing rule, please. Better to remove the rule and recreate it without setting anything in min-prefix at all.
Also, next time, please write in your post the true content of your configuration. It's now obvious that the commands you wrote in your posts don't match what really are on your router, forcing us to play guessing games.
Now the remote client with IP 192.168.88.x browses with the public IP of the central router connected to Ovpn.
The configuration of RouterOS version 6 was much simpler and more intuitive; here, I have complicated matters for myself. I also note that this type of router (RB941-2nD) with version 7 is particularly slow.
I sincerely thank everyone for their assistance; on my own, it would have taken me a long time.
