IPsec + IKEv2 not routing

RouterOS General
1

Good evening,

we have a classic basic config, eth1-wan, all other eth in bridge (192.168.101.5/24) (LAN). Now we need to connect to this network from more laptop (at same network with one public ip). I configured L2TP + IKEv2 like in this pdf : https://mum.mikrotik.com/presentations/MY19/presentation_7008_1560543676.pdf

steps: (created the cerificate)
/interface bridge add name=bridge-loopback
/ip address add address=10.0.88.1/24 interface=bridge-loopback network=10.0.88.0
/ip pool add name=“pool vpn.ike2.xyz” ranges=10.0.88.2-10.0.88.254
/ip ipsec mode-config add address-pool=“pool vpn.ike2.xyz” address-prefixlength=32 name=“modeconf vpn.ike2.xyz” splitinclude=0.0.0.0/0 staticdns=10.0.88.1 system-dns=no
…so go on (@ pdf)

I tried configure the firewall and NAT, but no communication over the vpn tunel. (not clear to me what i read in pdf documentum)
Laptop can connect, got IP address 10.0.88.5, can ping 10.0.88.1 and other connected laptop over IKEv2 (10.0.88.6) too.
But cant ping (communicate) the basic bridge (192.168.101.1) and server on this LAN. How need to configure the firewall and NAT for this connection?

Sorry for my english, thanks for the read.

2

Is it not easy, or just am i lama? :slight_smile: So all client get dynamic ip, what not listed in ip/address list. Is it normal? What is my way, please.

3

Lama se anglicky píše s dvěma L.

/ip firewall address-list items are not populated automatically by default. You can populate them manually, or configure some of the objects capable of assigning IP addresses (like DHCP servers or ppp-based server interfaces) to add each assigned address to a pre-configured address-list (or several lists), or configure firewall rules to add source or destination address of a packet to some address-list.

In /ip ipsec mode-config, the role of the src-address-list is a different one - the address received from the responder is not added to that address-list, but an action=src-nat rule referring to that src-address-list is dynamically added to chain srcnat of /ip firewall nat if that mode-config row is used.

4

Thanks for Your reply.

“Lama se anglicky píše s dvěma L.” This is correct, sorry :slight_smile:

In /ip ipsec mode-config we use as “responder” were set “address pool”

 /ip ipsec mode-config print

1  R name="modeconf vpn.ikev2" system-dns=no 
      static-dns=192.168.101.10,192.168.101.16 
      address-pool=pool mikrotik-ikev2 address-prefix-length=32 
      split-dns=""

/ip firewall address-list is empty…

How use ppp or dhcp server with ikev2? Dont understand this, sorry.

5

You’ve picked the wrong part from what I intended to say. In the OP, you’ve complained that the address assigned to the IKEv2 client didn’t appear on any address-list, and I was trying to explain that there is no reason why it should. Some processes that can assign addresses (like an IPsec responder referring to a mode-config row) can also add the assigned addresses to an address-list if configured like that, but this is not the case for the IPsec responder. Then I’ve taken another assumption, that you’ve set something in src-address-list of the mode config, expecting that it will cause adding the address assigned to the client from the pool, which is not the case.

6

So let’s take it from the other side - why it bothers you that the address assigned to the IKEv2 client doesn’t appear in any address-list? Address-lists are firewall objects, so do some of your firewall rules match on some src-address-list or dst-address-list, and as the address of the client isn’t added to that list, the firewall doesn’t let that client’s traffic through?

7

Now we need to connect to this network from more laptop (at same network with one public ip).

From - from where to where you wan’t to connect?

from your text i understand what you want from INTRANET to INTRANET?
or like most of people? client from world → to mikrotik router → to local network? recommend to follow https://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Road_Warrior_setup_using_IKEv2_with_RSA_authentication
I had this setup in empty CHR router and it works… like need almost :smiley: