Hi all,
I am trying to set up a site-site tunnel from my Mikrotik at home (behind a NATting DSL router) and my VPS (no NAT) running Strongswan.
The network looks like:
Public home ip: 1.1.1.1
NAT ip of Mikrotik: 10.1.2.80
Public ip strongswan server: 2.2.2.2
192.168.88.0/24(LAN)–Mikrotik–10.1.2.0/24—Fritzbox(DSL router) (1.1.1.1)-----internet-----Strongswan server (2.2.2.2)
Now this router is going to travel with me to similar situations (behind NAT), so i dont want to change anything in the NATting DSL router. The Mikrotik behind NAT is going to set up the tunnel, so i feel this should be possible. I have included as much as possible of information.
What happens is that sometimes phase 2 is completed and i have the following entries in the SA’s:
SPI Src. Address Dst. Address Auth. Algorithm Encr. Algorithm Current Bytes
E c7ae8dc7 10.1.2.80 2.2.2.2 sha1 aes cbc 0
E f67d655 2.2.2.2 10.1.2.80 sha1 aes cbc 0
That looks sort of okay. I am not sure if the 10.1.2.80 should be there, but that may be correct as the tunnel is now up.
I cannot get traffic over this tunnel though (ping the remote end). How can i start debugging this? (am i missing a NAT firewall rule that is preventing traffic from passing into the tunnel?)
Thanks in advance.
Jeroen
[admin@MikroTik] /ip> export compact
# apr/12/2017 23:24:21 by RouterOS 6.38.5
# software id = QG52-GD39
#
/ip ipsec proposal
add enc-algorithms=aes-128-cbc name=testproposal pfs-group=none
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no \
interface=ether1
/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip firewall filter
add action=accept chain=input comment="defconf: accept ICMP" protocol=\
icmp
add action=accept chain=input comment=\
"defconf: accept established,related" connection-state=\
established,related
add action=accept chain=input comment=\
"Allow IPSec from VPN server" dst-port=500,4500 \
in-interface=ether1 protocol=udp
add action=accept chain=input comment="accept http(s) on wan" dst-port=\
80,443 in-interface=ether1 protocol=tcp
add action=drop chain=input comment="defconf: drop all from WAN" \
in-interface=ether1
add action=fasttrack-connection chain=forward comment=\
"defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related" connection-state=\
established,related
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=\
!dstnat connection-state=new in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface=ether1
/ip ipsec peer
add address=2.2.2.2/32 comment="VPN server" dh-group=\
modp2048 enc-algorithm=aes-256 exchange-mode=ike2 hash-algorithm=\
sha256 my-id=user-fqdn:email@address.be port=500 secret=\
asdlkj
/ip ipsec policy
add comment="IP tunnel" dst-address=0.0.0.0/0 proposal=\
testproposal sa-dst-address=2.2.2.2 sa-src-address=\
1.1.1.1 src-address=192.168.88.0/24 tunnel=yes
Strongswan configuration:
ipsec.conf:
config setup
charondebug="all"
strictcrlpolicy=no
uniqueids = yes
conn %default
keyexchange=ikev2
conn office
mobike=yes
left=2.2.2.2
leftsubnet=0.0.0.0/0
right=1.1.1.1
rightid=email@address.be
rightsubnet=192.168.88.0/24
keyexchange=ikev2
authby=secret
ike=aes256-sha256-modp2048
esp=aes128-sha1
modeconfig=push
type=tunnel
auto=route
ipsec.secrets:
: PSK "asdlkj"