IPsec Site 2 Site not working

RouterOS Beginner Basics
1

Hey,
fist of all, i want to say, that i’m very new to this, so please be patient, if i don’t understand so quick.

I just want to establish a site 2 site ipsec connection between 2 places, but i didn’t get it to work good.

There must be a small mistake anywhere, but i didn’t find it, and time is running out, so i please need your help.
I looked at every tutorial i can find, but everything should be ok.

Place 1:
ext. ip: 178.189.59.xx
int. ip: 192.168.20.0/24

Place2:
ext. ip: 84.115.29.xx
int. ip: 192.168.10.0/24

Phase one, is working, on both sides are the correct remote peer in list.
But there are no SAs Keys in the list, so maybe the connection is not established right?
Passphrase is correct on both. Also Policy is correct on both. Proposal is same.

NAT:
Place 1: srcnat, Src: 192.168.20.0/24, Dest: 192.168.100.0/24, accept, on top of list.
Place 2: vice versa

I’m not able to ping the other side, in any direction. Public ips are pinkable from both sides.

2

My first thought is adding the routing.

/ip route
add distance=1 dst-address=192.168.10.0/24 gateway=ether1

Second thought is firewall rules.

/ip firewall filter
add add chain=forward src-address=192.168.10.0/24

Last thought is to enable IPSec logging to see what’s going on. But, if you have Phase 1 up, and you are sure that your policies are correct, then it’s likely just filter and route issues. If you post your IPSec export, we can help more.

3

I guess this is a mistake from you writting it here, check the router just in case:

NAT: Place 1: srcnat, Src: 192.168.20.0/24, Dest: 192.168.10> 0> .0/24, accept, on top of list.

also in firewall I have added this rules:

/ip firewall filter
add chain=input action=accept protocol=ipsec-esp

IPSEC - IKE

/ip firewall filter
add chain=input action=accept protocol=udp in-interface=pppoe-out1 dst-port=500

and in your case I would add this one:

/ip firewall filter
add chain=forward action=accept src-address=192.168.20.0/24 dst-address=192.168.10.0/24

in both routers, change the source address
also try to ping the remote lan through your Lan Interface