Hi, I configured a Mikrotik with IPSec/L2TP successfully, but I can´t acces to shared folders (Windows SMB), can’t configure UAP with (UniFi Controller) and can’t access to Mikrotik by MAC address (“CDP” it’s not working by VPN).
I can access to network devices by HTTP/HTTPS and do ping.
The L2TP name is confusing. L2TP does support bridging (L2) mode, but it is just one of possible modes, and the Windows native VPN client does not support it.
The fact that L2TP is secured using IPsec has nothing to do with that, as even without IPsec the L2TP is tunnelling everything via UDP over L3.
The only VPN I know whose Windows client supports L2 tunnelling is OpenVPN. Its Mikrotik implementation is, however, far from optimal. But you may also consider a small Mikrotik next to the PC which would establish an L2 tunnel using L2TP (over IPsec) in bridge mode, or EoIP over IPsec.
These are different things. ARP proxy functionality allows the router to respond with its own MAC address to ARP requests for IPs outside the requestor’s subnet, so the requestor then sends the packets to the router and the router forwards them to the actual destination at L3, but this is not the same like L2 forwarding. The OP requires full L2 transparency.
openvpn support at router os is very poor, because implementation of openvpn in router os use TCP transport which leads in huge performance loss. I suggest to try l2tp only.
Ok, I configured OpenVPN, and I can see the network over HTTP and ping, but again I can’t see the network resouces, UAP access points, and Mikrotik neighbors.
/ip pool
add name=OpenVPN ranges=10.0.0.2-10.0.0.10
/ip neighbor discovery settings
set default-for-dynamic=yes
/interface ovpn-server server
set auth=sha1 certificate=SERVER-OVPN cipher=aes256 enabled=yes require-client-certificate=yes
/ppp profile
add dns-server=8.8.8.8,8.8.4.4 local-address=10.0.0.1 name=OpenVPN only-one=no remote-address=OpenVPN use-encryption=yes
/ppp secret
add name=XXXXXX password=XXXXXX profile=OpenVPN service=ovpn
To have IPSec/L2TP working at layer 2 level, you should have the VPN address pool in the same broadcast domain of your LAN. Example:
LAN: 192.168.1.0/24
VPN Pool: 192.168.1.10-192.168.1.20
Then in the PPP you should configure as termination address the same address of the Mikrotik (e.g. 192.168.1.1) and configure the proxy-arp on the interface (bridge or ethernet) where the Mikrotik is connected to the LAN.
Unfortunately, proxy-arp and L2 tunnel are not the same. Proxy-arp means that the router responds with its own MAC address to ARP requests for IP addresses in one of its subnets, not that it forwards L2 frames with broadcast dst-mac-address to these subnets.
To use an actual L2 bridging functionality of L2TP, you need to indicate a local bridge in the profile to which the /interface l2tp-client (on client side) and /interface l2tp-server server or /ppp secret (on server side) refer.
For OpenVPN, you need to use the TAP mode to have L2 bridging support. So in the ovpn file on the client, replace dev tun by dev tap, and on the Mikrotik, set the bridge in profile the way I’ve described above for L2TP.
Just to make sure we’re hitting all the right points. The video covers a remote access VPN and your requirements that are not working are:
SMB based file access
MAC based access to a MikroTik
UniFi AP registration with a controller
The UniFi AP item is what’s throwing me for a loop. Are you really in need of connecting 2 locations together (site-to-site) VPN? Both?
Note: If you are trying to adopt a UniFi AP remotely it uses a couple of methods similar to how Cisco discovers controllers. You can add a DNS record, use a DHCP option (43) or locally set the controller IP via SSH.
