Please try to be more polite, If not me, somebody else will edit your posts. We have strict moderation here, as we like to keep the forum clean.
Brand new Toshiba laptop with brand new Win7 simply doesn’t get IP from 4.5/3.20/3.30 DHCP via ethernet
I’m also Toshiba with Win7 user and NEVER noticed any problem with RouterOS DHCP server.
Regards, Grzegorz.
Like I said, it’s a problem with Vista, not 7
Yesterday I was trying to set up L2TP/IPSec VPN using ROS v4.11 with public IP and Windows XP SP3 client behind NAT with the same result: it does not work when client is behind NAT. Instead of encapsulating replies it sends data to NAT router IP address directly. I just went through all related posts in this forum and found no answer. I also didn’t see any replies from MikroTik people confirming or denying the problem.
Any update on this NAT-T IPSEC problem? I think fixing it would make a lot of people happy.
Hi,
I have send the MikroTik support team this mail, because I have a similar problem - L2TP/IPsec over NAT is not working:
[…]
I have trouble with the setup of an L2TP / IPSec connection between a Windows XP SP3 Client an the RB450G Routerboard with Router OS v4.11, if the Client-PC is behind a NAT-Router (AVM Fritz!Box) which has a so called “VPN Passthrough” mode. The IKE connection from the Client-PC is coming from UDP Port 500, the NAT-Router keep the port, so the connection comes via WAN IP of the NAT-Router with UDP Port 500 to the WAN-Interface of the RB450G.
The connection is accepted by the RB450G, an IPSec policy is automatically created and the IPsec SA is also created. So fare so good.
But inside the SA the source IP is the Private IP (e.g. 192.168.10.5) of the Windows XP SP3 client, not the WAN IP from which the connection was coming.
In this situation the RB450G is not switching to the IPSec NAT-T mode, even if the connection was not arriving via UDP Port 4500.
The RB450G knows “only” that traffic to (here in my example) 192.168.10.5 must be encrypted.
The problem is now, that the L2TP daemon of the RB450G is using as L2TP Client-IP the WAN IP from the Windows XP SP3 Client and is sending all answering L2TP packets directly to this WAN IP. The L2TP traffic is NOT secured by the established IPsec tunnel.
Of course, the RB450 has no IPSec policy set for doing this…
Note: If the Client-PC is connected directly to the Internet (has a Public IP) everything works fine. The firewall of the RB450G accept UDP Port 500 and 4500 on the WAN interface. Every IPSec ESP packet is marked with a “VPN IN” packet mark while traveling through the prerouting chain of the Firewall Mangle table.
So incoming L2TP traffic on the WAN interface is only accepted, if it was marked with the “VPN IN” packet mark.
Any ideas?
I try to use NAT, to change the destination IP of L2TP packets.
The problem here is: How to create and delete a “dynamic” NAT rule for the L2TP connection, if the connection was entering the RB450G via IPSec over the routers WAN interface? And how to extract the “wrong” Private IP from the IPSec SA?
some config snippets:
/ip ipsec peer> print
0 address=0.0.0.0/0:500 auth-method=pre-shared-key secret="*****************" generate-policy=yes exchange-mode=main send-initial-contact=no
nat-traversal=yes proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=8h lifebytes=0 dpd-interval=disable-dpd
dpd-maximum-failures=5
/ip ipsec proposal> print
0 name=“default” auth-algorithms=md5 enc-algorithms=3des lifetime=1h pfs-group=none
Hi,
after some nice email conversation I wrote this mail to the MikroTik Support Team:
Hi Support Team,
NAT-T is enabled on the MikroTik router.
Yesterday I tested 3 times the L2TP/IPSec connection form the Windows XP SP3 Client-PC to the MikroTik Router (VPN Server), while changing the NAT-T-Registry-Parameter “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPSec” in Windows XP, set the “AssumeUDPEncapsulationContextOnSendRule” to 0, 1 or 2 and restarted the IPSec service on the Windows XP PC (see > http://support.microsoft.com/kb/926179/en-us> ).
It doesn’t matter if the Parameter “AssumeUDPEncapsulationContextOnSendRule” is set or which value it has.
The L2TP/IPSec connection is not working.Reason:
IKE connection comes in via UDP/500 (because my SOHO-NAT-Router leaves the port as it is) into the MikroTik Router.
The MikroTik Router is not recognizing that the connecting IPSec peer (Windows XP PC) is behind a NAT-Router and is not forcing the Windows XP PC to connect via UDP/4500 (NAT-T). So the IKE connection is not changing to the NAT-T mode. The IPSec connection (ESP) is established while the IPSec peer addresses are the Public IP’s of the MikroTik Router and the Windows XP Client (here the Public IP of the NAT-Router of course). The IPSec Policy inside the MikroTik Router is created automatically and uses as SA Source IP the PRIVATE IP (e.g. 192.168.10.5) of the Windows XP Client.So what happens now is that the IPSec Tunnel is “ready” but the L2TP connection to the L2TP server on the MikroTik Router is comming from the PUBLIC IP of the Windows XP Client, while the IPSec SA is using the PRIVATE IP. The MikroTik Router is not securing the L2TP answering packets. You can see this on the NAT-Router (Windows XP client behind) while doing a paket captureing. The L2TP answer packets are coming directly to the PUBLIC IP (so reaching directly the NAT Router).
[…]
And I got the following answer:
[…]
Thank you very much for the description. Right now I understand where is the problem.
Currently there is issue with NAT-T and generate-policy. The policy is being generated for private IP address of the router, you should add manually additional policy with src-address=your_MikroTik_router dst-address=your_NAT_router
Either use static /ip ipsec policy.
We are working on the solution for this problem.
[…]
Prompt, for somebody work correctly RB750 IPSec when one of the device is located behind a NAT?
IPsec-SA request for X.X.X.X queued due to no phase 1 found.
This error in any order repeats on both devices.
Prompt, for somebody work correctly RB750 when one of the device is located for NAT?
NAT UDP 500,4500
Private LAN1------RB750_1 (Public IP1) ==== Internet ==== (Public IP2) DSL Modem (Private IP1)------(Private IP2) RB750_2 behind NAT------Private LAN2
The error stands out:
IPsec-SA request for X.X.X.X queued due to no phase 1 found.
This error in any order repeats on both devices.
It turns out that RB750 can’t correctly work in such configuration??
I should add manually additional policy with src-address=your_MikroTik_router dst-address=your_NAT_router - on both router ?
On both router generate-policy=no and nat-traversal=no ?
If you’re going to specifically turn off NAT-T, how is it going to work across NAT?
I am turn on NAT-T on both device, but connection not work.
Has found a way out
I have decided to use tunnel IPIP with enciphering IPSec.
I am turn-on on both peers. This old config.
Tell me, why RouterOS no work correctly with two ipsec policy have equal adress in Src and Dst Address
ip ipsec peer add address=10.0.101.5/32:500 auth-method=pre-shared-key secret=“1qaz2wsx” generate-policy=yes exchange-mode=main send-initial-contact=yes nat-traversal=no proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 dpd-interval=10s dpd-maximum-failures=2
ip ipsec peer add address=10.0.102.5/32:500 auth-method=pre-shared-key secret=“1qaz2wsx” generate-policy=yes exchange-mode=main send-initial-contact=yes nat-traversal=no proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 dpd-interval=10s dpd-maximum-failures=2
One policy always in state invalid.
Any update on this? Will it be fixed for v5.0?
Any update on Nat-T L2TP/IPSEC policie problem ?
Changelog for v5.0 RC3 says it is fixed now, although I haven’t tried it myself yet…
Hi All,
I have the latest stable version 5.11 with the same problem. Do you have any advice how to solved it?
Thanks
If you are sure it is still the exact same problem, then create a supout file and email support@mikrotik.com
Hopefully they would be able to use your information to keep fixing it.
Did anyone actually managed to connect mikrotik with public IP and client behind NAT using L2TP/IPSec/NAT-T on 5.x?
When the client isn’t behind NAT it works without problems on 5.14, but when it’s behind NAT I simply cannot get it to work…
A confirmation that it really is working and a complete config would be highly appreciated!
All “points” are RB2011-IL with RO 5.21
This is a laboratory build.
after hours … IPSec(NAT-T)/L2TP work through NAT.
we have Main point(A) with public address and client(B) behind NAT.
Main Point(A):
http://s9.postimage.org/6hqt6d8zz/Untitled2.png
Client behind NAT(B):
http://s14.postimage.org/udfdokii9/Untitled.png
This is only way that work, including On the “Server” generating policy and on client policy is manual entry.
Mirroring port on point(A) show:
http://s8.postimage.org/dup78lon9/Untitled3.png
I upgraded to RO 5.24 and followed the steps from the last post, but still no luck connecting…
Can you please post your full configuration of IPSec, as well as the ports you forwarded on the NAT router? Thank you!