Internal clients cannot PING remote gateway IPSEC VPN

RouterOS General
1

Hello to all,
I have tow sites connected trough an IPSEC site-to-site VPN and most of the things are working great. Internal clients in one site can see/access internal clients in the other one.
The things that are not working or maybe I do not understand them are:

  • router in either site cannot ping internal address (LAN) of the other one
  • router in either site cannot PING internal clients of the other site.
    Long story short, router in site A cannot PING the LAN IP of router in site B or any client in site B, and vice-versa.

Traffic is allowed in firewall on the forward rule. I don’t know if I need anything else. Ideas?

Thanks in advance,
Adrian

2

It’s because packets from router itself use wrong source address and they don’t match policy. Policy-based IPSec doesn’t have routes, it seems as if remote side is reachable via default gateway, so if router sends anything there, it uses WAN address as source. You can fix it either using srcnat, or with fake routes where you set pref-src. It doesn’t matter where such route points to, it won’t be actually used. It can be e.g. empty bridge:

/interface bridge
add name=ipsec protocol-mode=none
/ip route
add dst-address=<remote subnet>/<mask> gateway=ipsec pref-src=<router's address from local subnet>
3

Thank you very much, worked like a charm.

Can you by any chance show an example of how it is done with src-nat? Trying to learn this routers and the best way is when you get in trouble.
Adrian

4 
/ip firewall nat
add chain=srcnat src-address-type=local dst-address=<remote subnet>/<mask> action=src-nat to-addresses=<router's address from local subnet>

But route with pref-src is better, because it works for everything. E.g. if you do traceroute from one LAN to another, there will by default be a hole where remote router should be. Route with pref-src fixes it, but srcnat doesn’t.

5

Thank you very much, much appreciate it.