IKEv2 RoadWarrior + IPSec Site-to-Site NAT Issue

RouterOS General
1

I have two policy based IPsec site-to-site tunnels connecting two sites B and C, at Site A on a MikroTik RB760iGS that works flawlessly. I have an IKEv2 RoadWarrior remote access setup on the Tik that works correctly as well. I am running into issues when trying to get RoadWarrior clients to connect to Site B or C. When pinging from the RoadWarrior, the ICMP packet makes it to the destination computer, and the ping reply makes it back to the Tik but not back to the RoadWarrior client at 10.0.80.254


Here’s a detailed breakdown of what’s going on:

RoadWarrior pool is 10.0.80.0/24
Site A (MikroTik) LAN is 10.10.20.0/24
Site B LAN is 192.168.2.0/24
Site C LAN is 192.168.3.0/24

I have a masquerade rule to change 10.0.80.0/24 into 10.10.20.0/24 before heading to Site B

add action=masquerade chain=srcnat dst-address=192.168.2.0/24 log=yes \
    out-interface=bridge src-address=10.0.80.0/24 to-addresses=10.10.20.0/24

and added Site B to the routes list

add disabled=no dst-address=192.168.2.0/24 gateway=bridge routing-table=main \
    suppress-hw-offload=no

After some packet sniffing with Wireshark, I could see that ping from the Road Warrior reaches the destination computer at Site B. The ping reply makes it back to the Tik at Site A but does not make it to the Road Warrior client.

Looking at the firewall log, I can see that the ping gets srcnat’ed and heads to the destination

forward: in:ether1 out:bridge, connection-state:new,snat , proto ICMP (type 8, code 0), 10.0.80.254->192.168.2.61, NAT (10.0.80.254->10.10.20.1)->192.168.2.61, len 60

and ping reply from the destination comes back

forward: in:ether1 out:ether1, connection-state:established,snat , proto ICMP (type 0, code 0), 192.168.2.61->10.0.80.254, NAT 192.168.2.61->(10.10.20.1->10.0.80.254), len 60

The only thing that looks odd to me is that the out interface is ether1 instead of bridge.

Am I missing something obvious here? :confused:

2

Here’s the full configuration on the Tik

# aug/10/2022 09:31:54 by RouterOS 7.4
# software id = 49UR-2U4T
#
# model = RB760iGS

/interface bridge
add admin-mac=xx:xx:xx:xx:xx:xx auto-mac=no comment=defconf igmp-snooping=yes \
    name=bridge
add name=bridge-loopback
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec peer
add address=public.ip.site.b/32 name=IPsec-Site B
add address=public.ip.site.c/32 name=IPsec-Site C
/ip ipsec policy group
add name="group vpn.ikev2.xyz.com"
/ip ipsec profile
add dh-group=modp2048,modp1536,modp1024 enc-algorithm=aes-256,aes-192,aes-128 \
    hash-algorithm=sha256 name="profile vpn.ikev2.xyz.com"
/ip ipsec peer
add exchange-mode=ike2 local-address=public.ip.site.a name=\
    "peer vpn.ikev2.xyz.com" passive=yes profile=\
    "profile vpn.ikev2.xyz.com"
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-128-cbc,aes-128-ctr \
    pfs-group=modp2048
add auth-algorithms=sha512,sha256,sha1 enc-algorithms="aes-256-cbc,aes-256-ctr\
    ,aes-256-gcm,aes-192-ctr,aes-192-gcm,aes-128-cbc,aes-128-ctr,aes-128-gcm" \
    lifetime=8h name="proposal vpn.ikev2.xyz.com" pfs-group=none
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name="pool vpn.ikev2.xyz.com" ranges=10.0.80.2-10.0.80.254
/ip dhcp-server
add address-pool=default-dhcp disabled=yes interface=bridge name=defconf
/ip ipsec mode-config
add address-pool="pool vpn.ikev2.xyz.com" address-prefix-length=32 name=\
    "modeconf vpn.ikev2.xyz.com" split-include=10.10.20.0/24 static-dns=\
    10.10.20.250 system-dns=no
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=all
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=10.10.20.1/24 comment=defconf interface=bridge network=10.10.20.0
add address=10.0.80.0/24 interface=bridge-loopback network=10.0.80.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip dhcp-client
add comment=defconf interface=ether1 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.1.254 netmask=24
/ip dns
set allow-remote-requests=yes servers=10.10.20.250
/ip dns static
add address=192.168.1.254 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment=\
    "Allow UDP 500,4500 IPSec for public.ip.site.a/22" dst-address=public.ip.site.a \
    dst-port=500,4500 protocol=udp
add action=accept chain=input comment="Allow IPsec-esp for public.ip.site.a/22" \
    dst-address=public.ip.site.a protocol=ipsec-esp
add action=accept chain=input comment=\
    "IKEv2: Allow ALL incoming traffic from 10.0.80.0/24 to this RouterOS" \
    ipsec-policy=in,ipsec src-address=10.0.80.0/24
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment=\
    "IKEv2: Allow ALL forward traffic from 10.0.80.0/24 to Anywhere" \
    src-address=10.0.80.0/24
add action=accept chain=forward comment=\
    "IKEv2: Allow ALL forward traffic from 10.0.80.0/24 to Anywhere" \
    dst-address=10.0.80.0/24
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat dst-address=192.168.2.0/24 log=yes \
    out-interface=bridge src-address=10.0.80.0/24 to-addresses=10.10.20.0/24
add action=accept chain=srcnat comment="IPsec Admin NAT" dst-address=\
    10.0.20.0/24 src-address=10.10.20.0/24
add action=masquerade chain=srcnat comment=\
    "SRC-NAT\r\
    \nIKE2:10.0.80.0/24 --> ether1 traffic" disabled=yes src-address=\
    10.0.80.0/24 to-addresses=public.ip.site.a
add action=masquerade chain=srcnat comment=\
    "MSQRD IKE2:10.0.80.0/24 -->\r\
    \nWAN traffic\"" disabled=yes ipsec-policy=out,none out-interface-list=\
    WAN src-address=10.0.80.0/24
add action=accept chain=srcnat comment="IPsec Site B-Site A NAT" dst-address=\
    192.168.2.0/24 src-address=10.10.20.0/24
add action=accept chain=srcnat comment="IPsec-Site C-Site A NAT" \
    dst-address=192.168.3.0/24 src-address=10.10.20.0/24 src-address-list=""
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip ipsec identity
add peer=IPsec-Site B
add peer=IPsec-Site C
add auth-method=digital-signature certificate=vpn.ikev2.xyz.com \
    generate-policy=port-strict match-by=certificate mode-config=\
    "modeconf vpn.ikev2.xyz.com" peer="peer vpn.ikev2.xyz.com" \
    policy-template-group="group vpn.ikev2.xyz.com" remote-certificate=\
    admin@vpn.ikev2.xyz.com remote-id=user-fqdn:admin@vpn.ipsec.xyz.com
/ip ipsec policy
set 0 disabled=yes
add dst-address=192.168.2.0/24 peer=IPsec-Site B src-address=10.10.20.0/24 \
    tunnel=yes
add dst-address=192.168.3.0/24 peer=IPsec-Site C src-address=10.10.20.0/24 \
    tunnel=yes
add dst-address=10.0.80.0/24 group="group vpn.ikev2.xyz.com" proposal=\
    "proposal vpn.ikev2.xyz.com" src-address=0.0.0.0/0 template=yes
/ip route
add disabled=no dst-address=192.168.2.0/24 gateway=bridge routing-table=main \
    suppress-hw-offload=no
add disabled=no distance=1 dst-address=10.0.80.254/32 gateway=bridge \
    pref-src=0.0.0.0 routing-table=main scope=30 suppress-hw-offload=no \
    target-scope=10
/ip smb
set domain=MMPBC
/ip upnp
set enabled=yes
/ip upnp interfaces
add forced-ip=public.ip.site.a interface=ether1 type=external
add interface=bridge type=internal
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORSite AID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system identity
set name=Site A-Router
/system ntp client
set enabled=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN