Help whit routes

RouterOS General
1

Hello friends, I want to see if someone can help me in a problem that I have, I am new to mikrotik.

I have 1 LAN (ether3) 40.20.0.0/20 within this network I have a program that goes to the ip 10.0.0.0/8
I have my ISP (ether1) in a public ip 187.x.x.x for Internet browsing
I have a VPN Server (ether2) with ip 10.34.0.230/30

What I need to do is that all the traffic that is for 10.35.x.x goes through the VPN with an ip 10.34.x.x
And all the other traffic to the WEB comes from the ISP or the local network

Note: Internet browsing works perfectly

Example:

40.20.1.1 requests connection to 10.35.x.x

40.20.1.1 changes to 10.34.1.1 and exits by 10.34.x.x (VPN SERVER) to connect to 10.35.x.x

So far I have everything running less the connection to the VPN, even though I have seen tutorials I can not find the solution.

Sorry if I do not express myself in a good way in technicalities but I’m new in this network, but the need to work is greater, that’s why I want to learn.

I appreciate your support

Thank you

2

You need implement policy based routing with routing marks and conenction marks.
https://wiki.mikrotik.com/wiki/Policy_Base_Routing

3

I already implemented the change, but still does not allow the connection.

4

If I understood you correctly, this is what you should do:

With this command we will mark all packets originating from 40.20.0.0/20 and assign it routing mark “ForVPN”

/ip firewall mangle add chain=prerouting action=mark-routing new-routing-mark=ForVPN passthrough=yes src-address=40.20.0.0/20

Now, if you want traffic sourcing from 40.20.0.1 for example to become 10.34.0.1, or 40.20.2.2 to become 10.34.2.2, we will perform netmap, like this:

/ip firewall nat add chain=srcnat action=netmap to-address= 10.34.0.0/20 routing-mark=ForVPN dst-address=10.35.x.x out-interface=YourVPNInterface

Note that in dst-address you must specify exact host or subnet where traffic is going, you cannot leave it 10.35.x.x, and there will be a problem with address 40.20.0.230 because it will translate to 10.34.0.230 and that address is on your Mikrotik.

Also, note that you will need to have route in your routing table with destination 10.35.x.x gateway=IP of remote VPN router. And on remote router you will need to have route for 10.34.0.0/20.