Killing my head with L2TP server configuration !

RouterOS General
1

Hi

I’m quite a noob on RouterOS for now (training planned soon) and I’m trying to setup an L1TP server on a RB4011iGS+RM device.
I have resetted the device and updated it at latest firmware avalaible from the device.
Configuration of it is as follow:
port 1: WAN port with a public routed IPV4 (setup by the quick setup menu of device).
rest of ethernet ports configured as a LAN with NAT (192.168.88.x)

The goal is to be able from Internet to access the LAN and devices in it

I have followed the Mikrotik Wiki and done the following commands:

/interface l2tp-server server
set enabled=yes use-ipsec=required ipsec-secret=mySecret-ipsec-key default-profile=default

/ip pool add name=vpn-pool range=192.168.99.2-192.168.99.100

/ppp profile
set default local-address=192.168.99.1 remote-address=vpn-pool

/ppp secret add name=user1 password=123

mySecret-ipsec-key, user1 and 123 masked

I have also done the commands to open port in fw

/ip firewall filter
add chain=input protocol=udp port=1701,500,4500
add chain=input protocol=ipsec-esp

I have also done that for the 9 LAN ethernet ports:

set ether2 arp=proxy-arp

but no way to access the local LAN. I get well an IP in the range setup but can’t ping anything from LAN ! I have tried also using 192.168.88.X so same class as LAN ports but not better.
I’m quite lost what to try else ? as I have tried quite few things but nothing worked and I don’t see anything else needed from the Wiki or is it too obvious ?

Thanks for help,

Vincèn

2

A full export of the current configuration, please (with the public address obfuscated if it is present in the export, and any passwords/secrets/private keys/usernames removed). Too many things may be involved. The order of firewall rules matters, that’s the first thing I would look at.

3

Use the correct terms in the title & description - there is no such thing as L1TP.

As you are using a different IP range for VPN clients vs. LAN devices proxy ARP is not required.

It is best practice to create a new PPP profile as any changes to the default ones may have unintended side-effects if they are used elsewhere.

Likely you are missing firewall rules to permit forwarding between VPN and LAN.