I ve been reading and searching a solution for 2 problems i have im mu Mikrotik HaP Lite with 6.49.17.
The thing is i tried to setup an IPSEC VPN for acessing my home network with my android 14 phone. Because i am no expert, I followed this video:
I have managed to stablish the VPN - my phone connects, but i do not reach any of my internal equipment (ex. network disk).
Also,- and that i did not know why - i lost / can not manage to connect using my “standard” PPTP VPN that comes with mikrotik “xxxxx.sn.mynetname.net” that i have being using my laptop PPTP PC connection.
Can someone give me a hand how to solve these situations?
tell me if you need any log / settings print i have that i will place it here.
ikev2: If your hap lite is not the internet gateway, you will possibly need to put some sort of NAT on it, so vpn connections
to devices on the local network get masqueraded. (The devices on the local network will likely try to reply to the main gateway rather than the Mikrotik). Otherwise, not quite sure why they cannot connect.
pptp: I have read in these forums that some?? ISP’s are dropping gre packets (which pptp uses as its transport), as well
as pptp being old and very insecure.
You should perhaps use ikev2 for this also.
If you do it using certificates, (mikrotik has instructions) it is pretty solid.
Another (major) option would be to upgrade to version 7 and use wireguard for both clients.
Thanks for inputs / help.
Regarding IKEv2: in fact, the mikrotik is not my main gateway, is it behing the ISP router, with a DMZ for it.
In the NAT rules i have:
Rule 2 - masq VPN traffic
[General]
Chain=scrnat
Src. Address=192.168.89.0/24
[Action]
Action=masquerade
Rule 3
[General]
Chain=dstnat
Dst. Address=192.168.1.64 (my internal mikrotik IP)
Protocol=6 (tcp)
Dst. Port=21 (because i wanted to acess to internet FTP server)
In. interface=ether1-gateway
[Action]
Action=dstnat
To Addresses=192.168.2.94 (my internal FTP server ip)
To Port=21
Rule 4
[General]
Chain=dstnat
Protocol=6 (tcp)
Dst. Port=22 (because i wanted to acess to internet FTP server)
In. interface=ether1-gateway
[Action]
Action=dstnat
To Addresses=192.168.2.94 (my internal FTP servel ip)
To Port=21
Should i add the rule:
add action=accept chain=input comment=“Allow IKEv2 Traffic” src-address=
172.17.153.0/24, where “172.17…” should be the IP address range from your ikev2 pool (i’ve created one IP Pool, named “pool-vpn-ipsec”
Addresses=10.10.11.10-10.10.11.20 ?
ISP are not “cutting off” access to the pptp here at least yet, because i have the exact same equipment at my fathers home (and also same ISP, router and OS version) and i managed to connect with PPTP to his mikrotik with no problem (via windows of course). I think is something i did while trying to create ipsec VPN on my router that caused the no access problem, but i do not know what…!
Regarding upgrading for version 7, i ve read that my equipment - HaP lite - is very limited and it does not behave wellwith that OS versin, so i still have 6.49.17 version
Again that you for all the help and cooperation, waiting for your reply,
Hi. somehow i managed to gain access to PPTP VPN with placing firewall rules on the top. Still no access to local ip machines with IPSEC … VPN connects but no ping to internal machines! Even with the rules you have placed on the post… any suggestions?!
Thanks @mkx
Open terminal window and execute /export file=aynnameyouwish … fetch resulting file to your management computer, open it with your favourite text editor, redact any sensitive information (such as serial number, public IP address, wireless PSK, etc.) and copy-paste it inside
Hi,
I changed the firewall filter rules, and while I still don’t like them much, the ikev2 now should work.
They appear to be based on a very old routeros version.
The ipsec policy rules have to go above the fasttrack rule. (They seem to work below it when pinging things,
but fail when actually trying to make connections)
You should reenable the input drop from !mactel rule…
@anav is good at holistic views of firewalls/routers.
impecable… it work. Thank you.
just for me to learn a little more… why “You should reenable the input drop from !mactel rule”, what is the objective of this rule?
It will block people/devices on the internet from attempting to login to your router.
(Or using other services your router may provide, that you haven’t provided a rule to allow)
The default on a Mikrotik is to allow (input, and also forwarding), you should normally block access you don’t specifically want.