A point to add for clarification is that I currently use one of the publicly available vpn server addresses provided by www.vpngate.net, which is a free service and their servers are relatively stable and durable (but does it matter so much at this stage I wonder?). Surely, procuring a vpn subscription from NordVPN, or Linode, etc. is the proper way to go once my current config issue is resolved.
Bearing that in mind:
I input a working vpn server address (from www.vpngate.net) under PPP → Interface → ToVPN (this is my interface name) → Dial Out (in order to activate the L2TP VPN). Note please that I have also added use-ipsec=yes → use-ipsec=required as per last comment by @kalamaja.
Now:
When I plug my laptop directly to ISP modem with an Ethernet cable and open https://whatismyipaddress.com I get the IP-address from my ISP.
When I plug Mikrotik to ISP modem and plug the laptop to Mikrotik with an Ethernet cable and open https://whatismyipaddress.com again, this time I get the vpn address noted in p1 above, meaning that the L2TP VPN is connected to the vpngate server and config is thus seemingly okay. But, strangely enough, still I can’t get access to blocked sites even though my IP address is now shown in IP finder as being outside my ISP location!!? Apparently, my L2TP+IPSec connection doesn’t work correctly (as mentioned by @kalamaja in his comment-3 yesterday) and needs fixing, but I can’t tell how.
Below, is my latest configuration WITH VPN status connected:
# jan/03/2022 10:02:44 by RouterOS 6.49
# software id = 65I6-VCH5
#
# model = RB941-2nD
# serial number = D0550D7B5504
/interface bridge
add name=bridge1-Local
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN
/interface l2tp-client
add add-default-route=yes connect-to=XXX.XXX.XXX.XXX disabled=no name=ToVPN \
use-ipsec=yes user=XXXXXXXX
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=profile1-LocalWiFi supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
disabled=no frequency=2432 hide-ssid=yes mode=ap-bridge security-profile=\
profile1-LocalWiFi ssid=OurHome wps-mode=disabled
/ip pool
add name=dhcp_pool0 ranges=172.16.1.21-172.16.1.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=bridge1-Local lease-time=\
3h10m name=dhcp1
/interface bridge port
add bridge=bridge1-Local interface=ether4 multicast-router=disabled
add bridge=bridge1-Local interface=ether3 multicast-router=disabled
add bridge=bridge1-Local interface=wlan1 multicast-router=disabled
add bridge=bridge1-Local interface=ether2 multicast-router=disabled
/interface l2tp-server server
set enabled=yes [u]use-ipsec=required[/u]
/ip address
add address=172.16.1.1/24 interface=bridge1-Local network=172.16.1.0
/ip dhcp-client
add add-default-route=no disabled=no interface=ether1-WAN
/ip dhcp-server network
add address=172.16.1.0/24 gateway=172.16.1.1
/ip firewall nat
add action=masquerade chain=srcnat src-address=172.16.1.0/24
/ip route
add distance=1 dst-address=XXX.XXX.XXX.XXX/32 gateway=192.168.1.1
add distance=1 dst-address=192.168.1.0/24 gateway=192.168.1.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox port=7911
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Amsterdam
/system clock manual
set dst-end="jan/01/2025 00:00:00" dst-start="jan/01/2021 00:00:00" \
time-zone=+03:30
Please let me know if I should provide any other information to help find out what is wrong. I wanted to upload and share a number of screenshots that show various config sections in Winbox, but I couldn’t figure out how to actually upload them here. The insert image icon on top menu requires the ‘mage path’ to be inserted as . But, being my first time, how can I insert images from my hard drive? There’s no path/url for it.
Hello,
Okay, I really think your config is wrong and you have to add those rules that I mentioned. + your l2tp client dose not have any local IP from the server in IP or route.
For attachments
Honestly, I think the best course of action is to reset config your router Because you don’t have any of the default settings. And then try to add your VPN to your router.
I did share the correct config for your VPN to work. So you could just uses my screenshots to config yours. If you CANT, I would be happy to remotely config your router for you.
1 - This command is server-side you can not set your client to required.
2 - You may get the IP from your default route but your config missing a huge part.
First, your connected L2TP does not have any IP address. Locally.
Second, the routes in your router are wrong.
3 - you do not have any mangle/NAT rules.
4- why did you enable your l2tp server?
/interface l2tp-server server
set enabled=yes [u]use-ipsec=required[/u]
Hi,
Thank you so much for your attention and advice. I really appreciate it.
I have taken note of your replies to points 1, 2 & 3. All understood.
So, I need to reset the config based on your instructions. Let me try this out and come back to you with the end result once I can get everything in place, hopefully in the correct order (I will take up your offer to do the config for me remotely with great pleasure if I fail to do the config by myself since I haven’t done this sort of stuff before!).
In the meantime, I presume I should receive from you the relevant ‘script’ for the firewall rules shown in your attached screenshot. Correct?
If you reset your config then you should have the same Firewall rules as mine.
Then you can try to add your VPN + the 3 rules I mention so you can pass traffic over the VPN.
But anyway here is a default firewall rules IPv4
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
update
I think you can not use these rules as you don’t have a default config you don’t have an in-interface-list so you should change it to an in-interface=ether1-WAN
and bridge1-Local due to your current config.
add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface=!bridge1-Local
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new in-interface=ether1-WAN
Regarding 4, my chief reason to purchase the Mikrotik was/is to tunnel my whole internet traffic through it so that all my clients at home could bypass the ISP’s firewall. Therefore, I asked the seller to set up the router for me to make this possible, preferably using OpenVPN Server with Windows clients. Instead, he enabled L2TP VPN server on the router saying it was not possible to set up OpenVPN Server on Mikrotik, which I now understand this is not so! I have also learnt in the intervening period that OpenVPN Server is mainly used for remote connection to a local network(s) behind the Mikrotik, but that’s a different story I guess. Having said that, I should mention that I have even tried a few times, without success, to set up OpenVPN Server on a separate similar Mikrotik for the above purpose based on some how-to procedures I found in YouTube, but I could never get the final ovpn profile to connect to the openvpn server from my Windows client.That’s an aim I am still pursuing with great interest.
You’re very wrong.
If your purpose is to bypass the ISP firewall, Then you are using a VPN protocol to connect to a VPN server. You don’t need to enable / config any VPN server in PPP you only need to add a VPN as a client. you don’t provide any services. all of your devices are running under your Mikrotik and therefore you can configure your router to do whatever you wanna do with your local aspect of the network and then use a VPN as a client running on the router to forward it to WWW through a VPN tunnel.
update
What you want to do with an OpenVPN is the same as l2tp so you don’t need to do a server-side config. The Mikrotik OpenVPN didn’t have UDP support and still doesn’t have it in your software version. and if you use a TCP as your ISP is filtering there is a good chance that it is gonna kill your connection speed or even not pass the firewall.
as the config file for OpenVPN, this is just a concept. no client certificate is required on the server-side.
client
dev tun
proto udp
remote IP port
resolv-retry infinite
nobind
persist-key
persist-tun
auth-user-pass
auth-nocache
verb 3
#comp-lzo
cipher AES-256-CBC
data-ciphers AES-256-CBC
route 0.0.0.0 0.0.0.0
redirect-gateway def1
remote-cert-tls server
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
I have to admit that I am pretty confused and lost by all the technicalities you’ve mentioned here in your updated comments.
Please correct me if I am wrong. Put simply:
You say that in order to bypass the ISP firewall, I have been on the wrong path all along since I am trying to use a VPN protocol (be it l2tp, or openvpn) to connect to a VPN server. Okay. Fair enough. I didn’t know this. If this is wrong practice, then it’s wrong and should be abandoned. Perhaps this explains the reason for the peculiar behavior of my current vpn connection and config.
You then say in order to bypass the ISP firewall (which is my main intention of using the Mikrotik router), I just need to ‘add a VPN as client’ without the need to enable/config any VPN server in PPP. Okay. But, ‘how’ and ‘where’ to ‘add a VPN as client’ to run on the router? Please clarify.
Based on 2, do I still need to do a factory reset of the router and configure it anew according to your 3 rules and screenshots? If not, what changes/modifications does it need in order to allow adding a vpn as client to it?
How can I connect to this ‘added client VPN’ later from my Windows/IOS clients in my local network?
Last but not least, you say I should avoid setting up OpenVpn Server on Mikrotik for the purpose of bypassing ISP firewall due to its lack of support for UDP (I knew this before) and other limitations. Okay. But, hearing that ‘no client certificate is required on the server-side’ is surprising since all the literature I have read on OpenVPN Server (including Mikrotik wiki) require 3 certificates (namely, the main ‘Authority Certificate’ or CA as well as the ‘Server’ and ‘Client’ key) to be created, signed and exported for the OpenVPN to work. This, of course, is a side note to the issue at hand that could be discussed separately. I just pointed it out in response to your remark that ‘no client certificate is required on the server-side’.
you are asking a lot of Q let me try to simplify this for you.
1/2
Perhaps you are thinking because you want to pass the traffic of your local device over VPN you should somehow enable server binding in your router. but this is not the case. you set up a VPN Client in your router and config your local network in the router in such a way as to pass the traffic over the VPN client.
So The VPN Connection that you created is correct, It is an L2TP-out(L2TP Client) but your router has some miss configs.
you don’t need an L2TP server/OpenVPN server. your router is the client, not a server. This is an L2TP Server binding.
/interface l2tp-server server
set enabled=yes use-ipsec=required
This is an L2TP Client it could be an OpenVPN client if you want to use OpenVPN.
3------------------------------------------------------------------------
I strongly suggest the RESET config with the default factory setting. your current config does not have the default config this is hard to troubleshoot. you also did some changes your self as I can see in the first and last config export so to keep it simple and easy to manage yes. Alarm - before you do reset. remove the MT from your network connect your PC/phone to your DSL modem directly to see if you can connect to the internet directly. there is no config in your MT that suggests any problem if you reset config but as I don’t know the full setup scenario check this before you do.
The full path
reset-config | Disable The FastTrack | Reboot | L2TP Client | Mangle | NAT | Route
Confirm everything works, You should enable the FastTrack after you did your test. But let us just stop here for now. I don’t wanna confuse you more than you are.
4---------------------------------------------------------------------------
you don’t have to connect to anything from your endpoint device. you simply config your router in such a way that it will pass your endpoint device traffic over the provided VPN on the router itself.
5-------------------------------------------------------------------------
You can configure your OpenVPN server with different scenarios.
The one you mentioned yes it does require at least 2 certs. you could use the CA at the OPVN server itself and one for the client.
This certificate is self-signed. and the authority of the CA is CA itself. so as there is no higher authority verifying your CA then you should export and install the certificates to any device that you want to connect with it. or you could simply put your CA and Client cert in your client profile.
I did not tell you that you could not use OpenVPN. If you update to V7 you could use it and properly you should as it is a better option than L2TP but if you do update then there are better options such as Wireguard will be available with an update to newer kernel But as I understand your device doesn’t have enough ram for it. It’s a shame. Still, nothing is prevent you to upgrade your hardware or using an IKEv2 at your V6 RouterOS.
the update - I may have been miss lead you.
but I could never get the final ovpn profile to connect to the OpenVPN server from my Windows client
The OpenVPN config file that I share with you is for the windows client connection as you mentioned in your previous post. this is not a way to config your OpenVPN server. Again as you don’t provide any VPN services you don’t need an OpenVPN server. you just need an OpenVPN client.
Hello,
I disabled L2TP Server in PPP as per your advice. The blocked sites, however, continued to be inaccessible! (Just for the record.)
Next, I did a hard reset of the router (keeping default config).
Before resetting, I removed the MT from my network and connected my PC to the DSL modem directly. I could connect to the internet with no problem. (BTW, I don’t have a static IP on my DSL modem. It is dynamic).
This is the course of action for setting up the router:
I opened Quick Set → Home AP → Internet → Automatic → IP Address (192.168.1.110), Netmask (255.255.255.0 (/24)) and Gateway (192.168.1.1) were already populated automatically.
Under Local Network → I manually set IP Address to (172.16.1.1) and DHCP Server Range to (172.16.1.21-172.16.0.254), Netmask was already populated as: 255.255.255.0 (/24)
Question: Why does ‘Address Acquisition’ under Internet in Home AP changes from Automatic to Static as soon as I click Apply and OK to save the above changes? Is this normal?
I then applied your Rule 1 in a new terminal; all okay.
[admin@MikroTik] /ip firewall mangle> add action=mark-routing chain=prerouting new-routing-mark=VPN passthrough=no src-address=172.16.1.21-172.16.1.254
Then applied Rule 2: (gave error)
[admin@MikroTik] /ip firewall nat> add action=masquerade chain=srcnat out-interface=VPN-L2TP
input does not match any value of interface
And Rule 3: (also gave error)
[admin@MikroTik] /ip firewall nat> add action=masquerade chain=srcnat out-interface=VPN-L2TP
input does not match any value of interface
So, I couldn’t proceed beyond Rule 1. Have I missed something so far?
@zippedmails
The idea behind the reset config was for you to have a default IP Range and settings and you did replace it with your old config again.
Anyway
There are a few things.
No, you did not change your L2TP Client interface name. Therefore you got an error in 2-3 rule 3 is depends on the gateway name. so it did not register too. even if you did rename your interface then there is another variable in the picture for the routing rule.
You did not enable your firewall again.
I think it’s time to try remote config.
Question: Why does ‘Address Acquisition’ under Internet in Home AP changes from Automatic to Static as soon as I click Apply and OK to save the above changes? Is this normal?
I think this is a quick set problem.
The gateway in your static IP is wrong too it should be 192.168.1.1 not 110
I appreciate your detailed comments.
However, as stated in my previous post, I did a physical reset of the router (just keeping the default configuration) BEFORE applying rules 1, 2 and 3. So, there was no settings for L2TP Client on the router at this stage to cause a conflict with rules 2 and 3.
Notwithstanding the background, perhaps I should better leave it to you now to do a remote config at your convenience. Kindly PM me as to what you would need to be in place at my end in advance in this connection.
I look forward to your reply and am truly grateful for your assistance.
Kind regards.
I am also comfortable with WhatsApp and have it already installed. Thanks for the link anyways.
Pass me your WhatsApp number in PM please so that I can contact you..
