IPSEC connection between 2 Mikrotik routers. Can send but cannot recieve data

RouterOS Beginner Basics
1

Hello everyone!

I ran into a problem when building an IPSEC tunnel between 2 microtik routers, both behind NAT routers and firewalls.

I did this in the past successfully following online guides, but this time I fell into a problem. The tunnel is established, both phase 1 and 2 is up, I set up the src NAT rules and the Masquarade rules but pinging doesn't seem to work. When I asked the other side, they said they can see incoming data from me and there is an outcoming answer but in my ipsec connections I can only see outgoing data, no incoming ones.

image
image259×325 6.37 KB

There are a couple of oddities alongside this:

On the recieveing end it seems like I'm connecting through a random port not the 4500 we established, that might be a local natting issue

Second is the more important, in the firewall connections I can see a ip50 ipsec-esp connection that sends data but doesn't receive it, only this VPN tunnel has a connection like this. From what I heard ESP should only work when NAT traversal is off, but it is turned on, on the other side it is on auto, is it possible this is a version difference issue? I see no incoming ip50 data on my microtik, I even put an allowing rule on top of the firewall rules to check, maybe it's a port forwarding issue from the router? Is it possible to force NAT traversal on when in auto mode?

Thank you in advance!

2

When you worry about NAT traversal, first change the config to use IKEv2 instead of classic IKE.

3

It's already in IKEv2, forgot to mention, that is also why I am confused by the esp connection.

4

IKEv2 can use a direct ESP connection as well, but only when it does not detect NAT.

It can fail when ESP is somehow blocked or not handled by a router inbetween.

I am running an IPsec VPN server with IKEv2 and it has both ESP and port 4500 connections all working fine.

5

If the tunnel is established, it sounds like a routing problem on the remote side. Are policies properly configured there? Is the NAT masquerade rule set to not srcnat "out ipsec policies"?

6

the masquerade rule is currently in srcnat, ipsec-policy is set to out,none.

I need to check the remote side

Since then I have made a no track raw rule for incoming traffic and that seemed to be doing something, I can see incoming data on the tunnel and the firewall logs give me Syn,Ack signals so there is communication. However, test pings and testing open ports doesn't seem to work, does the raw rule stop something, do I need to set up a static route of sorts?

7

The only thing you need is a route that somehow routes the destination traffic to some interface.

Normally the default route is good enough for that. But when you have e.g. added blackhole routes for RFC1918 traffic that can be a problem and you may need to add a route for your destination somewhere.

It does not matter where the route actually points, because IPsec policies will pickup the matching traffic and send it to the tunnel instead.

8

Instead of theorizing what the problem might be, suggest exporting the configs of both sides, removing credentials and sensitive info from them and posting them here