having some issues with site to site VPN, IPSec with preshared key.
The setup was working for three years, with almost no issues. At 29.12 suddenly it stopped, the VPN tunnel does not come up at all.
There is one main HQ 750GR3 router, and three routers also 750GR3, which are connecting to HQ.
Routers are not behind NAT.
For Peer Addresses I am using MT Cloud DDNS name on all routers.
The tunnel get established as soon as I use public IP addresses in the IPSec Peer config, but it is not working with MT Cloud name anymore.
Tried restarting all MT routers and ISP modems, NTP time zone and clock are in sync over all routers. Tried changing DNS servers in MT routers, tried with 8.8.8.8, 4.4.4.4, default ISP DNS servers and so on.
I am able to ping all MT routers by its Cloud DDNS name and I am getting ping reply from the correct public IP addeess.
Tracing route to ns2.kissthenet.net [159.148.172.251]
over a maximum of 30 hops:
1 20 ms 15 ms 11 ms 192.168.32.1
2 12 ms 23 ms 16 ms bras-mostar-2-hx.tel.net.ba [85.94.144.50]
3 11 ms 12 ms 12 ms 85.94.145.97
4 15 ms 26 ms 17 ms brdrmo-mo2.tel.net.ba [85.94.144.181]
5 31 ms 51 ms 26 ms gos11-gos12.net.t-com.hr [195.29.246.145]
6 20 ms 20 ms 18 ms hst12-gst24-3.ip.t-com.hr [195.29.241.113]
7 21 ms 27 ms 22 ms htr11-hst12.ip.t-com.hr [195.29.3.69]
8 31 ms 30 ms 24 ms gte01-htr11-3.ip.t-com.hr [195.29.241.142]
9 24 ms 21 ms 23 ms zgb-b2-link.ip.twelve99.net [62.115.183.214]
10 27 ms 32 ms 285 ms bpt-b4-link.ip.twelve99.net [62.115.122.174]
11 * 34 ms 30 ms win-bb1-link.ip.twelve99.net [62.115.137.224]
12 38 ms 40 ms 52 ms ffm-bb1-link.ip.twelve99.net [62.115.137.202]
13 72 ms 64 ms 81 ms s-bb1-link.ip.twelve99.net [62.115.143.28]
14 75 ms 73 ms 70 ms riga-b3-link.ip.twelve99.net [62.115.139.197]
15 78 ms 73 ms 74 ms siatet-ic-332270.ip.twelve99-cust.net [213.248.84.33]
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 75 ms 72 ms 69 ms cloud2.mikrotik.com [159.148.172.251]
But should the newer firmware conntact cloud and cloud2.mikrotik.com?? I get reply from those when pinging.
It is allraedy enabled, here is what i found out, when I try to ping the routers by its MT DDNS names, from within mikrotik terminals I do not get a reply!!! But pinging all others domains works well.
[admin@xxxxxx] > ping xxxxxxxxx.sn.mynetname.net
invalid value for argument address:
invalid value of mac-address, mac address required
invalid value for argument ipv6-address
while resolving ip-address: could not get answer from dns server
I got burned by the magic of MT’s DDNS outages a couple times. Now I run a script on my router that updates a DNS record in Cloudflare and I’ve had 0 issues since. I love MT just not their DDNS service.
It’s paid but stupid cheap to register a domain for x years and then ddns away. Worth it to me. And you can create subdomains if you have multiple sites you employ this with… Each with their own dynamically updated DNS record. I’m using it with two sites.
I got it working with free DDNS service called duckdns.org. There are also automaticly generated scripts for IP updates for all kind of operating systems and devices, including Mikrotik.
It is definitly an Mikrotik DDNS issue. Will stop using it.
