all seemed to be well and good, I could ping the remote servers I can connect to the remote mikrotik, but when I ssh into a remote server, I can move around fine cd ls apt all work. when I go to edit a file or run top the connection freezes, it doesn’t drop doesn’t do anything, I can create a new connection and kill the hung process and regain control of that terminal. but if the action is repeated the result is also.
I have a rb2011UiAS-2HnD-IN and a rb1100AHx2
I am not sure what specifically what info would be useful to diagnose, but please inform me and I would be more than happy to provide it.
it seems the tunnel is created properly, I can ping and connect to everything both ways. but once I ssh into a machine and run top or try to modify a file (vi, nano, emacs, cat) the session freezes until it times out and drops. Use of cd, ls, uptime show no issues. I can post my filter rules and nat rules. Thank you in advance any help is greatly appreciated.
I can see all the machines from both sides and I can connect to them with ssh, but one I do anything that uses any measurable bandwidth the connection freezes. if I forward port 22 for ssh and connect that way there is no such issues.
I’ve been using the Mikrotik for quite a few years now and have ALWAYS had the problem you describe. I have talked with experts with the Mikrotik and never could get them to understand the problem. From their perspective, “why would anyone use SSH to connect to a device through an IPSEC tunnel?” The experts think a person would always use telnet over an IPSEC tunnel. And if all you are connecting to is hardware (e.g., switches, routers, etc.) telnet will work well for you.
But for those of us that have to connect to servers running a flavor of Linux, SSH is the common approach. A person ALWAYS uses SSH to login to a server when they are on a local network with the server (i.e., not through an IPSEC tunnel). But when you are no longer local to the network, the IPSEC tunnels created by the Mikrotik ALWAYS mess up at varying points in the connection. This is an extremely frustrating issue with Mikrotik. And as I alluded to in the beginning, I have seen this for quite a few years now dating back to the 5.x releases.
If only the people at Mikrotik found it as frustrating.
it is a TCP MSS issue.
you have two possibilites to fix this:
mangle rules at one end of the tunnel to set MSS back to ~1400 or so.
forget IPSec Tunnel mode (sucks anyway), use GRE/IPIP/EOIP between the two sites with the new ipsec-secret option and clamp-mss=yes. in this case you can run an ordinary routing protocol over the tunnel, like OSPF or BGP, and have much better control over everything. not to mention tunnel keepalives which then indicate whether the tunnel is up or not - it’s great for redundancy.
in case you are using older ROS w/o tunnel encryption support, or you need certificate authentication, you can build the same tunnel, and set up IPSEC ESP transport mode with the tunnel source and destination. (which normally happens automatically when used with tunnels + ipsec-secret)
Thank you, for the insight and recommendations, I’ll try to implement the changes and report back.
An interesting note, I was recently at my dc setting up remote term on the servers and tested creating a ssh connection from there to my home (home being siteA and the dc being my siteB) and on that direction all works fine no drop or freeze, so that really put a spin on things, things are sometimes easier to diagnose when they are consistent haha
btw I am running ROS v6.29.1 on both devices, I’ll try the different approaches suggested and report back.
the very first example is how to change MSS, and once I set that at my target site (siteB) I have no more freezing ssh connection. As it was also pointed out that it might be better to implement IPsec through another method I’ll probably try this in the near future, but right now it is cause to celebrate, it works!