thank you but how can I fix it??
I didn’t look at the original topic and I thought this problem occurred at the user end. The website didn’t load is not enough information. To be able to help you, one needs more information.
- Did you config the server-side your self or it’s a third-party service?
- Are you able to load any other website filtered and non-filtered content?
- What is the client OS?
- Is the server provides any DNS-like functionality? If yes, is the client should use it?
Network diagram, export config, screenshot, ping, nslookup, and route prints will provide more detail regarding your issue. I strongly advise you to share any of this helpful information.
Yes I config server-side myself.
websites loaded completely without problem but when it comes to videos it doesn’t load even thumbnail get load.
Client os is Android.
No, It uses 8.8.8.8, and 1.1.1.1 as DNS for VPN clients.
I Believe it is because of ISP. when I connect to home wifi it works without a problem but with sim card LTE internet I have this problem.
Hello!
I have the same problem as it was described previously in this topic:
when i connect from mobile to local wlan then connect to VPN is connected, problem is if i connect from wan internet router not accept connection. settings not allowed connect from internet.
i read instruction and put all rules in right position in firewall but without success!
Please Help!
this is my config
/interface bridge
add admin-mac=6C:3B:6B:E8:18:1F auto-mac=no comment=defconf name=bridge
add name=bridge-loopback
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip ipsec policy group
add name="group vpn.ike2"
/ip ipsec profile
add dh-group=modp4096,modp2048,modp1536,modp1024 enc-algorithm=\
aes-256,aes-192,aes-128 hash-algorithm=sha256 name="profile vpn.ike2"
/ip ipsec peer
add exchange-mode=ike2 local-address=6.6.6.6 name="peer 6.6.6.6" \
passive=yes profile="profile vpn.ike2"
/ip ipsec proposal
add auth-algorithms=sha512,sha256,sha1 enc-algorithms="aes-256-cbc,aes-256-ctr\
,aes-256-gcm,aes-192-ctr,aes-192-gcm,aes-128-cbc,aes-128-ctr,aes-128-gcm" \
lifetime=8h name="proposal vpn.ike2" pfs-group=none
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name="pool vpn.ike2" ranges=10.0.88.2-10.0.88.254
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/ip ipsec mode-config
add address-pool="pool vpn.ike2" address-prefix-length=32 name=\
"modeconf vpn.ike2" split-include=192.168.88.0/24
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set certificate=7***********4.sn.mynetname.net-CA
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=10.0.88.0/24 interface=bridge-loopback network=10.0.88.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1h
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" disabled=yes \
dst-address=127.0.0.1
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"\"Allow UDP 500,4500\r\
\nIPSec for 6.6.6.6\"" dst-address=6.6.6.6 dst-port=500,4500 \
in-interface=ether1 in-interface-list=WAN log=yes protocol=udp
add action=accept chain=input comment=\
"\"Allow IPSec-esp\r\
\nfor 6.6.6.6\"" dst-address=6.6.6.6 protocol=ipsec-esp
add action=accept chain=input comment="\"IKE2: Allow ALL\r\
\nincoming traffic from 10.0.88.0/24 to\r\
\nthis RouterOS\"" ipsec-policy=in,ipsec src-address=10.0.88.0/24
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=accept chain=forward comment="\"IKE2: Allow ALL\r\
\nforward traffic from 10.0.88.0/24 to\r\
\nOFFICE network\"" dst-address=192.168.88.0/24 ipsec-policy=in,ipsec \
src-address=10.0.88.0/24
add action=accept chain=forward comment="\"IKE2: Allow ALL forward\r\
\ntraffic from 10.0.88.0/24 to ANY\r\
\nnetwork\" " dst-address=0.0.0.0/0 ipsec-policy=in,ipsec src-address=\
10.0.88.0/24
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=change-mss chain=forward comment=\
"\"IKE2: Clamp TCP MSS from\r\
\n10.0.88.0/24 to ANY\"" ipsec-policy=in,ipsec new-mss=1360 protocol=tcp \
src-address=10.0.88.0/24 tcp-flags=syn tcp-mss=!0-1360
add action=change-mss chain=forward comment=\
"\"IKE2: Clamp TCP MSS from ANY\r\
\nto 10.0.88.0/24\"" dst-address=10.0.88.0/24 ipsec-policy=out,ipsec \
new-mss=1360 protocol=tcp tcp-flags=syn tcp-mss=!0-1360
/ip firewall nat
add action=masquerade chain=srcnat comment=\
"\"MSQRD IKE2:10.0.88.0/24 -->\r\
\nWAN traffic\"" ipsec-policy=out,none out-interface-list=WAN \
src-address=10.0.88.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=accept chain=srcnat ipsec-policy=out,none out-interface-list=WAN
add action=src-nat chain=srcnat comment=\
"\"SRC-NAT\r\
\nIKE2:10.0.88.0/24 --> ether1 traffic\"" ipsec-policy=out,none \
out-interface=ether1 src-address=10.0.88.0/24 to-addresses=62.212.41.116
/ip ipsec identity
add auth-method=digital-signature certificate=7*********4.sn.mynetname.net \
generate-policy=port-strict match-by=certificate mode-config=\
"modeconf vpn.ike2" peer="peer 6.6.6.6" policy-template-group=\
"group vpn.ike2" remote-certificate=c1@7*********4.sn.mynetname.net \
remote-id=user-fqdn:c1@7*********4.sn.mynetname.net
/ip ipsec policy
add dst-address=0.0.0.0/0 group="group vpn.ike2" proposal="proposal vpn.ike2" \
src-address=0.0.0.0/0 template=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Asia/Tbilisi
/system ntp client
set enabled=yes server-dns-names="0.asia.pool.ntp.org,1.asia.pool.ntp.org,2.as\
ia.pool.ntp.org,3.asia.pool.ntp.org"
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
deanisus i have taken a look at you’re config. It looks like you’re VPN router is behind another router. Is it LTE, Fibre, Cable. What is connected to ether1 port?
If you’re Mikrotik router is behind another router that connects to the internet (a LTE based router or LTE based cpe from you’re ISP for instance), if it is a Mikrotik like a LHGG then you should turn of pass-thru function if you have it enable on the APN settings and run a no-ip script linked to a no-ip DDNS on the ISP router. You should also port forward ports 500 and 4500 from you’re ISP router to the router IP behind it that you want to VPN to. It is highly likely that you’re LTE ISP is running one or even more carrier grade NATs in front of you’re ISP router. To detect if you’re LTE based ISP has a CG NAT you can go and ask google “what is my ip”. If google responds with a ip address that is not the same as reported by you’re LTE interface then you are double NATed or even tripple NATed by you’re ISP. Commonly a No-IP script can bypass the CG NATs for the LTE interface’s public IP given to it is most likely is a true public IP. If you ISP router is just a simple wireless cpe connection (not cellular) or some form of cable connection then you out of luck. You will not be able to VPN to you’re network without a Public VPN service. The address given to a normal wireless CPE is not a public IP.
Thanks for your answer!
I have checked my ip by google and other ways, replay was the same IP= 62.212.41.116.
My connection to ISP is by fiber optic. Fiber is coming directly to my apartment, than i have ISP Fiberoptic media converter and after my Mikrotik.
To be honest i am already thinking that my ISP is blocking some ports. It is very pity, i spent more than 3 days to find way out from this situation 
.
Change this:
add action=drop chain=input comment="defconf: drop all not coming from LAN"\
in-interface-list=!LAN
To this:
add action=drop chain=input comment="defconf: drop all not coming from LAN or VPN" \
in-interface-list=!LAN log-prefix="Drop All Input Not From LAN or VPN ::: Filter" \
src-address=!10.0.88.0/24
That is about all I can say. Somewhere something that is holding you’re Public IP is not forwarding ports 500 and 4500 to you. Those ports must be DST-NATed to the VPN router in order for this type of VPN to work. Either that or you are being blocked by ISP.
@deanisus
action=accept chain=input dst-address=6.6.6.6 dst-port=500,4500 in-interface=ether1 in-interface-list=WAN log=yes protocol=udp
action=accept chain=input dst-address=6.6.6.6 protocol=ipsec-esp
action=accept chain=input ipsec-policy=in,ipsec src-address=10.0.88.0/24
what is 6.6.6.6?
So the 62.212.41.XXX is public unless you are behind a CGNAT. check if you can see the same IP as the address of your WAN interface. As I could not find any /IP addresses in your exported config.
In your NAT setting you have two rules that do the same thing.
You have a masquerade and an src-nat for the same src-address. If your IP is static do a src-nat if its NOT ( its dynamic) you should use masquerade.
action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=WAN src-address=10.0.88.0/24
action=src-nat chain=srcnat ipsec-policy=out,none out-interface=ether1 src-address=10.0.88.0/24 to-addresses=62.212.41.XXX
These are my firewall rules for IKEv2.
/ip firewall filter
add action=accept chain=input comment=IPsec dst-port=500,4500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input dst-port=53 ipsec-policy=in,ipsec protocol=udp
add action=accept chain=input dst-port=53 ipsec-policy=in,ipsec protocol=tcp
/ip firewall nat
add action=src-nat chain=srcnat comment="VIA WAN" ipsec-policy=out,none out-interface-list=WAN to-addresses=PUBLIC_IP
Hello and thank you for the tutorial. I am connected to the VPN, but I can not see the computers from the network (through VPN). What can I do to see the computers through VPN? Thank you. With ping command the computer respond but I cannot see it in Network folder in Windows.
Is there an alternative to
masquerade traffic coming from VPN clients, so devices on your LAN sees that traffic is coming from the router IP rather than VPN IP
I would like VPN clients to be able to connect to other devices, and appear with their own IP.
Hello
I was already able to connect to the Mikrotik router in my house via mobile, but I cannot browse the Internet on my mobile when I connected through VPN
I can send and receive WhatsApp messages, but I cannot make call via WhatsApp, whether video or audio
Youtube is very slow
speed test app in mobile not working when I connect via VPN
I can’t access my files at home
Hi,
I’m having an error message on my MikroTik, however it’s not the Tik’s fault, but it’s a Windows one (just wanted to share, because this could help anyone):
I have 2 Tiks (Tik1 and Tik2), and I generated one IKEv2 Client Certificate on both, and exported them. Then on my Windows (10) machine, I have installed both of these certificates to the default machine storage location, and created 2 VPN connections to these Tiks.
One of the VPN is succeeding (Tik1), however the other is not, Tik2 reports this:
can't verify peer's certificate from store
I went through the logs, and found that in case I only import one certificate onto my machine, I can make either Tik1 or Tik2 work.
However, importing both certificates will make Tik2 fail, as Windows seems offering the wrong certificate to the server.
Do you have any idea on how could I defeat this problem?
PowerShell - Connection
Add-VpnConnection -Name "IKEv2" -ServerAddress "ike.site.com" -TunnelType "ikev2" -AuthenticationMethod "MachineCertificate"
Set-VpnConnection -Name "IKEv2" -RememberCredential $True -SplitTunneling $False
Set-VpnConnection -Name "IKEv2" -MachineCertificateIssuerFilter 'C:\VPN\Certs\ca-ike.ike.site.com.crt'
Set-VpnConnectionIPsecConfiguration -ConnectionName "IKEv2" -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None -DHGroup Group14 -PassThru -Force
PowerShell - Certificate
CERTUTIL -addstore -enterprise -f -v root "C:\VPN\Certs\ca-ike.ike.site.com.crt"
CERTUTIL -f -p secure-password -importpfx "C:\VPN\Certs\ikev2-ike.ike.site.com.p12"
As soon as I typed this, I have found the solution here: http://forum.mikrotik.com/t/ikev2-win10-select-certificate-multiple-vpn-tunels/120437/1 .
Hello,
After following the instructions I’m able to access the internet and can ping/ssh into all hosts on LAN using strongSwan on my android phone, but I can’t ssh or winbox into the router and most web services running on local hosts are inaccessible. Port scanner on my phone shows all expected ports open, but after a couple of minutes the browser spits out ERR_NETWORK_CHANGED. I’m able to access my IP camera management pages, but this is extremely slow. Once my TrueNAS page managed to load with many elements broken, but I wasn’t able to reproduce this. I had no luck with the rest. Any idea what might be happening here?
Full config below:
# nov/19/2022 16:59:04 by RouterOS 6.49.5
# software id = LJ3K-Q7MQ
#
# model = RB4011iGS+5HacQ2HnD
/interface bridge
add admin-mac=2C:C8:1B:90:31:04 auto-mac=no comment=defconf name=bridge
/interface wireless
# managed by CAPsMAN
# channel: 5785/20-eCee/ac(27dBm)+5210/80(27dBm), SSID: iwakura, CAPsMAN forwarding
set [ find default-name=wlan1 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX country="united states" distance=indoors frequency=auto \
installation=indoor mode=ap-bridge secondary-frequency=auto ssid=\
iwakura-5g wireless-protocol=802.11
# managed by CAPsMAN
# channel: 2442/20-eC/gn(27dBm), SSID: iwakura, CAPsMAN forwarding
set [ find default-name=wlan2 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
country="united states" distance=indoors frequency=auto installation=\
indoor mode=ap-bridge ssid=iwakura wireless-protocol=802.11 wps-mode=\
disabled
/interface vlan
add interface=bridge name=vlan-guest vlan-id=10
/interface bonding
add mode=802.3ad name=asuka-bond slaves=ether5,ether6 transmit-hash-policy=\
layer-2-and-3
/caps-man configuration
add country="united states" datapath.bridge=bridge installation=indoor name=\
cfg security.authentication-types=wpa2-psk security.encryption=aes-ccm \
ssid=iwakura
add country="united states" datapath.bridge=bridge datapath.vlan-id=10 \
datapath.vlan-mode=use-tag installation=indoor name=cfg-guest \
security.authentication-types=wpa2-psk security.encryption=aes-ccm ssid=\
iwakura-guest
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \
supplicant-identity=MikroTik
add authentication-types=wpa2-psk disable-pmkid=yes eap-methods="" mode=\
dynamic-keys name=guest-wifi supplicant-identity=MikroTik
/ip ipsec policy group
add name=vpn
/ip ipsec profile
add dh-group=modp1024 enc-algorithm=aes-256 hash-algorithm=sha256 name=vpn
/ip ipsec peer
add exchange-mode=ike2 name=vpn passive=yes profile=vpn
/ip ipsec proposal
add enc-algorithms=aes-256-cbc name=vpn pfs-group=none
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp-pool-guest ranges=192.168.99.2-192.168.99.254
add name=vpn-pool ranges=192.168.77.2-192.168.77.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-script="# Domain to b\
e added to your DHCP-clients hostname\r\
\n:local topdomain;\r\
\n:set topdomain \"lan\";\r\
\n\r\
\n# Use ttl to distinguish dynamic added DNS records\r\
\n:local ttl;\r\
\n:set ttl \"00:59:59\";\r\
\n\r\
\n# Set variables to use\r\
\n:local hostname;\r\
\n:local hostip;\r\
\n:local free;\r\
\n\r\
\n# Remove all dynamic records\r\
\n/ip dns static;\r\
\n:foreach a in=[find] do={\r\
\n :if ([get \$a ttl] = \$ttl) do={\r\
\n :put (\"Removing: \" . [get \$a name] . \" : \" . [get \$a address])\
;\r\
\n remove \$a;\r\
\n }\r\
\n}\r\
\n\r\
\n/ip dhcp-server lease ;\r\
\n:foreach i in=[find] do={\r\
\n /ip dhcp-server lease ;\r\
\n :if ([:len [get \$i host-name]] > 0) do={\r\
\n :set free \"true\";\r\
\n :set hostname ([get \$i host-name] . \".\" . \$topdomain);\r\
\n :set hostip [get \$i address];\r\
\n /ip dns static ;\r\
\n# Check if entry already exist\r\
\n :foreach di in [find] do={\r\
\n :if ([get \$di name] = \$hostname) do={\r\
\n :set free \"false\";\r\
\n :put (\"Not adding already existing entry: \" . \$hostname);\r\
\n }\r\
\n }\r\
\n :if (\$free = true) do={\r\
\n :put (\"Adding: \" . \$hostname . \" : \" . \$hostip ) ;\r\
\n /ip dns static add name=\$hostname address=\$hostip ttl=\$ttl;\r\
\n }\r\
\n }\r\
\n}" name=defconf
add address-pool=dhcp-pool-guest disabled=no interface=vlan-guest \
lease-script="# Domain to be added to your DHCP-clients hostname\r\
\n:local topdomain;\r\
\n:set topdomain \"guest\";\r\
\n\r\
\n# Use ttl to distinguish dynamic added DNS records\r\
\n:local ttl;\r\
\n:set ttl \"00:59:59\";\r\
\n\r\
\n# Set variables to use\r\
\n:local hostname;\r\
\n:local hostip;\r\
\n:local free;\r\
\n\r\
\n# Remove all dynamic records\r\
\n/ip dns static;\r\
\n:foreach a in=[find] do={\r\
\n :if ([get \$a ttl] = \$ttl) do={\r\
\n :put (\"Removing: \" . [get \$a name] . \" : \" . [get \$a address])\
;\r\
\n remove \$a;\r\
\n }\r\
\n}\r\
\n\r\
\n/ip dhcp-server lease ;\r\
\n:foreach i in=[find] do={\r\
\n /ip dhcp-server lease ;\r\
\n :if ([:len [get \$i host-name]] > 0) do={\r\
\n :set free \"true\";\r\
\n :set hostname ([get \$i host-name] . \".\" . \$topdomain);\r\
\n :set hostip [get \$i address];\r\
\n /ip dns static ;\r\
\n# Check if entry already exist\r\
\n :foreach di in [find] do={\r\
\n :if ([get \$di name] = \$hostname) do={\r\
\n :set free \"false\";\r\
\n :put (\"Not adding already existing entry: \" . \$hostname);\r\
\n }\r\
\n }\r\
\n :if (\$free = true) do={\r\
\n :put (\"Adding: \" . \$hostname . \" : \" . \$hostip ) ;\r\
\n /ip dns static add name=\$hostname address=\$hostip ttl=\$ttl;\r\
\n }\r\
\n }\r\
\n}" name=dhcp-guest
/ip ipsec mode-config
add address-pool=vpn-pool name=vpn system-dns=no
/ppp profile
add dns-server=192.168.77.1 local-address=192.168.77.1 name=ovpn \
remote-address=vpn-pool use-encryption=yes
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=cfg \
slave-configurations=cfg-guest
/interface bridge filter
# no interface
add action=drop chain=forward in-interface=*F
# no interface
add action=drop chain=forward out-interface=*F
# no interface
add action=drop chain=forward in-interface=*10
# no interface
add action=drop chain=forward out-interface=*10
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf disabled=yes interface=ether5
add bridge=bridge comment=defconf disabled=yes interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
add bridge=bridge interface=*F
add bridge=bridge interface=*10
add bridge=bridge interface=asuka-bond
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1 certificate=iwakura-server cipher=aes128,aes192,aes256 \
default-profile=ovpn enabled=yes require-client-certificate=yes
/interface wireless cap
#
set bridge=bridge caps-man-addresses=127.0.0.1 enabled=yes interfaces=\
wlan2,wlan1
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.99.1/24 interface=vlan-guest network=192.168.99.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server lease
add address=192.168.88.65 client-id=1:dc:2c:6e:a1:99:cb mac-address=\
DC:2C:6E:A1:99:CB server=defconf
add address=192.168.88.247 mac-address=6C:29:90:22:C4:AD server=defconf
add address=192.168.88.62 mac-address=C8:2E:47:5E:A0:EC server=defconf
add address=192.168.88.238 mac-address=C8:2E:47:5F:1B:1A server=defconf
add address=192.168.88.246 mac-address=6C:29:90:F3:02:42 server=defconf
add address=192.168.88.248 mac-address=70:66:55:24:52:39 server=defconf
add address=192.168.88.242 client-id=ff:32:10:a8:60:0:3:0:1:44:61:32:10:a8:60 \
mac-address=44:61:32:10:A8:60 server=defconf
add address=192.168.88.224 mac-address=6C:29:90:30:23:98 server=defconf
add address=192.168.88.253 client-id=1:a8:5e:45:e6:62:0 mac-address=\
A8:5E:45:E6:62:00 server=defconf
add address=192.168.88.18 client-id=1:0:a0:98:45:2e:ce mac-address=\
00:A0:98:45:2E:CE server=defconf
add address=192.168.88.17 client-id=1:9c:8e:cd:33:33:8c mac-address=\
9C:8E:CD:33:33:8C server=defconf
add address=192.168.88.249 mac-address=46:C8:13:B5:11:B7 server=defconf
add address=192.168.88.86 client-id=1:e4:3e:d7:e8:a:66 mac-address=\
E4:3E:D7:E8:0A:66 server=defconf
add address=192.168.88.87 client-id=1:9c:8e:cd:31:ce:5e mac-address=\
9C:8E:CD:31:CE:5E server=defconf
add address=192.168.88.88 client-id=1:9c:8e:cd:35:a1:c4 mac-address=\
9C:8E:CD:35:A1:C4 server=defconf
add address=192.168.88.89 client-id=1:9c:8e:cd:35:71:87 mac-address=\
9C:8E:CD:35:71:87 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
add address=192.168.99.0/24 gateway=192.168.99.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
add address=192.168.88.249 name=asuka
add address=192.168.88.65 name="cAP AC.lan" ttl=59m59s
add address=192.168.88.247 name=wiz_22c4ad.lan ttl=59m59s
add address=192.168.88.62 name=sta_5EA0EC.lan ttl=59m59s
add address=192.168.88.238 name=sta_5F1B1A.lan ttl=59m59s
add address=192.168.88.246 name=wiz_f30242.lan ttl=59m59s
add address=192.168.88.248 name="Notion Bridge: af032729.lan" ttl=59m59s
add address=192.168.88.242 name=My-ecobee.lan ttl=59m59s
add address=192.168.88.224 name=wiz_302398.lan ttl=59m59s
add address=192.168.88.253 name=lith.lan ttl=59m59s
add address=192.168.88.18 name=homeassistant.lan ttl=59m59s
add address=192.168.88.17 name=amcrest-0.lan ttl=59m59s
add address=192.168.88.86 name=LGwebOSTV.lan ttl=59m59s
add address=192.168.88.87 name=AMC060659E02B065F3.lan ttl=59m59s
add address=192.168.88.88 name=AMC06077D149D25368.lan ttl=59m59s
add address=192.168.88.89 name=AMC060C689217BC93A.lan ttl=59m59s
add address=192.168.88.94 name=wiz_2837e3.lan ttl=59m59s
add address=192.168.88.254 name=nixos.lan ttl=59m59s
/ip firewall address-list
add address=192.168.77.2-192.168.77.254 comment=VPN list=allowed_to_router
/ip firewall filter
add action=drop chain=forward dst-address=192.168.88.0/24 in-interface=\
vlan-guest src-address=192.168.99.0/24
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="Allow IPSEC/IKE2 connections" \
dst-port=500,4500 protocol=udp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=change-mss chain=forward comment="Fix MSS for VPN server" new-mss=\
1360 passthrough=yes protocol=tcp src-address=192.168.77.2-192.168.77.254 \
tcp-flags=syn tcp-mss=!0-1360
add action=change-mss chain=forward comment="Fix MSS for VPN server" \
dst-address=192.168.77.2-192.168.77.254 new-mss=1360 passthrough=yes \
protocol=tcp tcp-flags=syn tcp-mss=!0-1360
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment=\
"Masquerade VPN traffic so devices see connections made from router IP" \
src-address-list=allowed_to_router
/ip ipsec identity
add auth-method=digital-signature certificate=iwakura-server comment=\
"Iwakura client1" generate-policy=port-strict match-by=certificate \
mode-config=vpn peer=vpn policy-template-group=vpn remote-certificate=\
iwakura-client1
/ip ipsec policy
add dst-address=192.168.66.0/24 src-address=0.0.0.0/0 template=yes
add dst-address=0.0.0.0/0 group=vpn proposal=vpn src-address=0.0.0.0/0 \
template=yes
/system clock
set time-zone-name=America/Denver
/system identity
set name=iwakura
/system leds
add interface=wlan2 leds="wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-le\
d,wlan2_signal4-led,wlan2_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive
/system logging
add topics=ipsec,!debug
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool sniffer
set filter-interface=all filter-ip-address=192.168.77.4/32 \
filter-operator-between-entries=and
Hi all,
I managed to connect my android devices using StrongSWAN and it was straightforward without any headache. but unfortunately, with iOS devices, it didn’t work. I imported the certificate and followed the steps without any luck.
P.S: nothing is showing in the MikroTik logs when I try to connect from iOS devices.
I would appreciate any suggestions or assistance.
Best,
Thanks a lot.
After upgraded my Mobile to Android-12, all my remote devices was not accessible due to ikev2 validation required.
i was struggling with this from month.
I would like to thank for this quick simple and easy Guidance, that resolved my problem
Thanks again
In Android 13 IKEv2/IPSec PSK has native support in OS, How to setup the Tik as a server for IKEv2/IPSec PSK VPN tunnel?
Hi
thanks for your post…
after connecting VPN connection the local internet is showing no internet access, pl suggest me what to do…
thank reddy gvg
Many, Many Thanks!!! The guide is oerfect also for RB4011 with vers.:7.6.
THANKS!