IPsec setting help pls!!

RouterOS General
1

hi All,

I configure IPsec site to site recently..but I’m unable to ping either site lan..my setting are straight forward for testing purposes. Eg as below

Site A
Wan 1.1.1.1
Lan 192.168.1.0/24

Site B
Wan 2.2.2.2
Lan 192.168.2.0/24

IPsec connection is establish no issue..I can see both sa connected but unable to ping lan on remote site. But I can ping over thru wan. For eg

Site A if I enter 192.168.2.1 from winbox I cannot get connected. But if I enter wan address 2.2.2.2 from winbox I can connect to the router on site B. Any setting I’m missing from this? Please help.

2

You didn’t post your config, so it’s a guessing game. Two popular choices are:

a) Missing exception for NAT. Anything destined for remote network gets srcnatted like any other outgoing traffic. Configured policy no longer applies, because source address is different. So nothing is actually sent via tunnel.

b) Firewall on remote devices. E.g. Windows by default allow ping only from local subnet.

3

my configuration as below

Router A
/ip ipsec peer
add address=192.168.80.1/32 auth-method=pre-shared-key secret=“test”


Router A
/ip ipsec policy
add src-address=10.1.202.0/24 src-port=any dst-address=10.1.101.0/24 dst-port=any
sa-src-address=192.168.90.1 sa-dst-address=192.168.80.1
tunnel=yes action=encrypt proposal=default

Router B
/ip ipsec peer
add address=192.168.90.1/32 auth-method=pre-shared-key secret=“test”

Router A
/ip firewall nat
add chain=srcnat action=accept place-before=0
src-address=10.1.202.0/24 dst-address=10.1.101.0/24

Rotuer B
/ip firewall nat
add chain=srcnat action=accept place-before=0
src-address=10.1.101.0/24 dst-address=10.1.202.0/24

Router AB
/ip firewall filter
add chain=forward action=accept place-before=1
src-address=10.1.101.0/24 dst-address=10.1.202.0/24 connection-state=established,related
add chain=forward action=accept place-before=1
src-address=10.1.202.0/24 dst-address=10.1.101.0/24 connection-state=established,related

Router AB
/ip firewall filter
add action=accept chain=input in-interface=ether1 protocol=ipsec-esp
comment=“allow L2TP VPN (ipsec-esp)”
add action=accept chain=input dst-port=500,1701,4500 in-interface=ether1 protocol=udp
comment=“allow L2TP VPN (500,4500,1701/udp)”

4

Router AB
/ip firewall filter
add chain=forward action=accept place-before=1
src-address=10.1.101.0/24 dst-address=10.1.202.0/24 connection-state=established,related
add chain=forward action=accept place-before=1
src-address=10.1.202.0/24 dst-address=10.1.101.0/24 connection-state=established,related

I don’t see a rule that allows new sessions, therefore your established/related rule never matches anything. Try removing the connection-state=established, related option of those 2 rules.

5

Anyone has IPsec firewall configuration setting that can share with me?

My scenario is as below

Site A
Connected internet thru pppoe

Site B
Connected internet thru pppoe from vlan500 tag to eth1

Other IPsec configuration is standard from what I get it thru forum. Trying to establish site-to-site. From IPsec it look established. I can see both wan ip in installed-sa. But I cannot ping from either site..

Thanks

6

Did you try what previous post suggested?

7

Yes did that, but no luck…still trying to figure out..hopefully someone can share with me the setting..which I can try with

Cheer

8

Disable one of the peers, flush the installed-sa. Then re-enable the peers and look at the installed-sa, they should show no bytes/packets transferred.

Now try to ping from one side. If the installed-sa show bytes/packets in one direction, the issue is caused by firewall rules on the opposite side.

If both installed-sa show no bytes/packets, it is the LAN->WAN rules or policy matching on the local side. If both show bytes/packets, it is the WAN->LAN rules on the local side.

And be aware that some route must exist at local side to the subnet of the remote side (a default route is enough). The packets will not actually be sent down that route, but if no route exists, the packets are dropped before the IPsec policy can match them.

That’s the reason why you should always post the complete configuration (see a hint in my automatic signature) rather than quoting only fragments which you consider important from it.

Also bear in mind that pinging to/from the Mikrotik itself and to/from a device connected to its LAN are handled by different firewall rules.

9

Hi,

Have you look at IP route one both routers, to make sure there is a route to reach both LAN trough the tunnel ?



\

10

Hi,

Yes when I trying to ping from site-a to site-b I can see site-a packet in sa-install but site-b remain 0byte. Same thing if I do it on site-b, site a will show 0byte. It’s somehow to do with firewall setting I guess..I try allow few firewall setting but still no luck..

Setting I include

Chain=input action=accept protocol=IPSec-esp
Chain=input action=accept protocol=udp
Chain=Srcnat action=accept arc-add=x.x.x.x DST-add=x.x.x.x
And include accept port 500,1701,4500

11

Order of firewall rules matters. I don’t write for fun of the rabbits that only posting a complete configuration can provide you a useful advice.

If an installed-sa at one end says it has sent packets and the same installed-sa at the remote end doesn’t see them, either the ESP packets did not get through (but I suppose the WANs of the two devices are connected just using an Ethernet patchcord), or the firewall rules enabling incoming ESP are not at the correct place in the chain, or something is broken in Mikrotik software. I’ve recently had to force UDP encapsulation of ESP on some remote connections, assuming that the ISPs block ESP, but maybe it is actually a bug in 6.42.x?