IPSEC Establishing, but not passing traffic

RouterOS General
1

I am at my witts end here. I have two mikrotiks setup as office routers. I am attempting to setup an IPSEC vpn between them that that both offices can see the other network. I am getting the session established, but not able to pass traffic…
Equipment on both sides is a Mikrotik hAP Mini both running 6.41

here is the latest config attempt, and i still cannot get it to pass traffic:

R1 Ruidoso 192.168.88.0/24 1.1.1.1

ip firewall nat add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.89.0/24
ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade

ip ipsec policy add src-address=192.168.88.0/24 dst-address=192.168.89.0/24 action=encrypt tunnel=yes sa-src-address=1.1.1.1 sa-dst-address=2.2.2.2
ip ipsec peer add address=2.2.2.2 exchange-mode=main secret=“somesecret”

/ip firewall raw
add action=notrack chain=prerouting src-address=192.168.88.0/24 dst-address=192.168.89.0/24
add action=notrack chain=prerouting src-address=192.168.88.0/24 dst-address=192.168.89.0/24



R2 Lovington 192.168.89.0/24 2.2.2.2

ip firewall nat add chain=srcnat src-address=192.168.89.0/24 dst-address=192.168.88.0/24
ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade

ip ipsec policy add src-address=192.168.89.0/24 dst-address=192.168.88.0/24 action=encrypt tunnel=yes sa-src-address=2.2.2.2 sa-dst-address=1.1.1.1
ip ipsec peer add address=1.1.1.1 exchange-mode=main secret=“somesecret”


/ip firewall filter add chain=output action=mark-connection new-connection-mark=ipsec passthrough=yes log=no log-prefix=”” ipsec-policy=out,ipsec
/ip firewall filter add chain=input action=mark-connection new-connection-mark=ipsec passthrough=yes log=no log-prefix=”” ipsec-policy=in,ipsec

/ip firewall raw
add action=notrack chain=prerouting src-address=192.168.89.0/24 dst-address=192.168.88.0/24
add action=notrack chain=prerouting src-address=192.168.89.0/24 dst-address=192.168.88.0/24

Session is established, i have identical installed SA’s on both sides.

R1 Firewall Rules:

/ip firewall filter
add action=accept chain=input comment=“defconf: accept established,related”
connection-state=established,related
add action=accept chain=input dst-port=8291 protocol=tcp src-address=
3.3.3.3/27
add action=accept chain=input src-address=2.2.2.2
add action=fasttrack-connection chain=forward comment=FastTrack
connection-mark=!ipsec connection-state=established,related
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=drop chain=input comment=“defconf: drop all from WAN” in-interface=
ether1
add action=accept chain=forward comment=“defconf: accept established,related”
connection-state=established,related
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=
invalid
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface=ether1
add action=fasttrack-connection chain=forward comment=FastTrack
connection-mark=!ipsec connection-state=established,related
add action=fasttrack-connection chain=forward comment=FastTrack
connection-mark=!ipsec
/ip firewall mangle
add action=mark-connection chain=output comment=“Mark IPsec connections”
ipsec-policy=out,ipsec new-connection-mark=ipsec passthrough=yes
add action=mark-connection chain=input ipsec-policy=in,ipsec
new-connection-mark=ipsec passthrough=yes
/ip firewall nat
add chain=srcnat dst-address=192.168.89.0/24 src-address=192.168.88.0/24
add action=masquerade chain=srcnat comment=“defconf: masquerade” out-interface=
ether1
add action=masquerade chain=srcnat out-interface=ether1
/ip firewall raw
add action=notrack chain=prerouting dst-address=192.168.89.0/24 src-address=
192.168.88.0/24
add action=notrack chain=prerouting dst-address=192.168.89.0/24 src-address=
192.168.88.0/24


R2 Firewall Rules:

add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=accept chain=input dst-port=8291 protocol=tcp src-address=
3.3.3.3/27
add action=accept chain=input src-address=1.1.1.1
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related disabled=yes
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=
invalid
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
add action=fasttrack-connection chain=forward comment=FastTrack
connection-mark=!ipsec connection-state=established,related disabled=yes
add action=fasttrack-connection chain=forward comment=FastTrack
connection-mark=!ipsec connection-state=established,related
add action=fasttrack-connection chain=forward comment=FastTrack
connection-mark=!ipsec connection-state=established,related
add action=fasttrack-connection chain=forward comment=FastTrack
connection-mark=!ipsec
/ip firewall mangle
add action=mark-connection chain=output comment=“Mark IPsec connections”
ipsec-policy=out,ipsec new-connection-mark=ipsec passthrough=yes
add action=mark-connection chain=input ipsec-policy=in,ipsec
new-connection-mark=ipsec passthrough=yes
/ip firewall nat
add chain=srcnat dst-address=192.168.88.0/24 src-address=192.168.89.0/24
add action=masquerade chain=srcnat comment=“defconf: masquerade” ipsec-policy=
out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-address=68.233.148.25 dst-port=443
protocol=tcp to-addresses=192.168.98.20 to-ports=443
add action=masquerade chain=srcnat dst-address=192.168.89.20 dst-port=443
out-interface=bridge protocol=tcp src-address=192.168.89.0/24
add action=masquerade chain=srcnat out-interface=ether1
/ip firewall raw
add action=notrack chain=prerouting dst-address=192.168.88.0/24 src-address=
192.168.89.0/24
add action=notrack chain=prerouting dst-address=192.168.88.0/24 src-address=
192.168.89.0/24

Any help would be greatly appeciated, thank you!!!

2

I can see that as compared to the configurations you’ve posted in your other similar topic, you have added the following:

/ip firewall raw
add action=notrack chain=prerouting dst-address=192.168.89.0/24 src-address=\
192.168.88.0/24
add action=notrack chain=prerouting dst-address=192.168.89.0/24 src-address=\
192.168.88.0/24

However, you’ve made a copy-paste error, inserting the same rule twice instead of swapping the src-address and dst-address (so you handle A->B packets “twice” instead of handling A->B by one rule and B->A by the other one).

And you have made this mistake at both routers.

After fixing that, you should be able to ping between devices connected to the respective subnets. Bear in mind that action=notrack doesn’t prevent just the fasttracking of these packets but connection-tracking of these packets as a whole, so any firewall rules relying on connection-state condition will be ineffective for them. This is fine if you do not want to filter the traffic between the subnets, but you’ll have to deal with that in a more complex manner if you need some filtering.