I am setting up an IPSEC VPN to a remote site from HQ. I am using IPEC in tunnel mode. The tunnel is up, and I can talk to devices on the remote site’s LAN. My issue arises because I need to route all traffic, including internet traffic, through the VPN. This is a requirement as we need to access devices with public IPs that are using an ACL that limits connections to HQ’s address range. I know that I can use a L2TP/IPSEC VPN and accomplish the same thing (I currently have a config that does just that) but I would prefer to use IPSEC for the lower overhead and ease of setup. At this point I also just want to figure out why this config is not working.
Remote site LAN: 192.168.40.0/24
IPSEC Policy Remote: SRC Address 192.168.40.0/24; DST Address 0.0.0.0/0
IP Route Remote: 192.168.30.0/24 reachable from WAN
HQ LAN: 192.168.30.0/24
IPSEC Policy HQ: SRC Address 192.168.30.0/24; DST Address 192.168.40.0/24
IP Route HQ: 192.168.40.0/24 reachable from WAN
To test what is going on I start a ping to 8.8.8.8 from a laptop connected to the remote site.
I have set up firewall log rules on the HQ Tik for Raw, Mangle, NAT and Filter and narrowed them down to where I am only capturing the google pings with the rules.
Following the Mikrotik packet flow diagrams I can see the ping arrive at the HQ Tik encrypted and hit the log rules for:
Prerouting → Raw Prerouting → Mangle Prerouting
Input → Mangle Input → Filter Input
Once the packet is unencrypted at Step 5 I can then see it start over at step 6, Prerouting. I see it hit the log rules for: Prerouting → Raw Prerouting → Mangle Prerouting and then according to the diagrams it should move to Forward but I never see it hit the Mangle Forward log rule. I have set up various DST-NAT logging rules to see if I am missing something, but I have not seen the ping hit any of them either. I am not using any Bridges or VLANs on either side of the tunnel.
This is the log for 2 pings.
02:21:45 firewall,info RAW-PREROUT-ENCRYPT prerouting: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto 50, 66.xxx.xxx.50->66.xxx.xxx.80, len 140
02:21:45 firewall,info MANGLE-PREROUTING–ENCRYPT prer: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto 50, 66.xxx.xxx.50->66.xxx.xxx.80, len 140
02:21:45 firewall,info MANGLE-INPUT-ENCRYPT input: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto 50, 66.xxx.xxx.80->66.xxx.xxx.50, len 140
02:21:45 firewall,info ENCRYPT-FILTER-INPUT input: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto 50, 66.xxx.xxx.50->66.xxx.xxx.80, len 140
02:21:45 firewall,info ENCRYPT-FILTER-INPUT input: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto 50, 66.xxx.xxx.50->66.xxx.xxx.80, len 140
02:21:45 firewall,info RAW-PREROUT-UNENCRYPT preroutin: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto ICMP (type 8, code 0), 192.168.40.251->8.8.8.8, len 60
02:21:45 firewall,info MANGLE-PREROUTING-UNENCRYPT pre: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto ICMP (type 8, code 0), 192.168.40.251->8.8.8.8, len 60
02:21:50 firewall,info RAW-PREROUT-ENCRYPT prerouting: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto 50, 66.xxx.xxx.50->66.xxx.xxx.80, len 140
02:21:50 firewall,info MANGLE-PREROUTING–ENCRYPT prer: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto 50, 66.xxx.xxx.50->66.xxx.xxx.80, len 140
02:21:50 firewall,info MANGLE-INPUT-ENCRYPT input: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto 50, 66.xxx.xxx.50->66.xxx.xxx.80, len 140
02:21:50 firewall,info ENCRYPT-FILTER-INPUT input: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto 50, 66.xxx.xxx.50->66.xxx.xxx.80, len 140
02:21:50 firewall,info ENCRYPT-FILTER-INPUT input: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto 50, 66.xxx.xxx.50->66.xxx.xxx.80, len 140
02:21:50 firewall,info RAW-PREROUT-UNENCRYPT preroutin: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto ICMP (type 8, code 0), 192.168.40.251->8.8.8.8, len 60
02:21:50 firewall,info MANGLE-PREROUTING-UNENCRYPT pre: in:ether7 out:(unknown 0), src-mac 00:19:30:ff:ff:ff, proto ICMP (type 8, code 0), 192.168.40.251->8.8.8.8, len 60
Can someone explain to me what is happening here? Is it dying in the Routing Decision or somewhere else? Any suggestions for config changes I may need are most welcome and I can provide any additional current configs if anyone needs them.