Hi sindy!
First of all thank you for babysitting with me! I can not imagine how much time it would take to setup all this without your help.
So after 2 evenings trying here are my results:
First configure only the peers, and after a short while, /ip ipsec remote peer print should show you the peer in state established - one at each client, three at the server if you do all clients at the same time. As no policy will be active yet, the L2TP connection will still run without encryption.
Succeeded with peers.
I'm able to see remote peers: 2 on the server and 1 for each client. they have status "established"
Then, add the policy at the client, with dst-port=33333 instead of 1701, to see whether it becomes active, a mirror policy with a D (dynamic) sign will appear at the server, and at both, you'll see a pair of /ip ipsec installed-sa.
On one client (6.41.3 Router OS) all happens like you say. Policy becomes active and mirror policy appears on the server. SAs installed.
On other one (6.34.1 Router OS) i can not see whether it's active or not. And no mirror policy generated on server. No installed SAs. So here is the end of story for this client.
ip ipsec policy print
Flags: T - template, X - disabled, D - dynamic, I - inactive, * - default
0 T * group=default src-address=::/0 dst-address=::/0 protocol=all proposal=default template=yes
1 src-address=192.168.128.254/32 src-port=any dst-address=SERVER_PUBLIC_IPaddr/32 dst-port=33333 protocol=udp
action=encrypt level=require ipsec-protocols=esp tunnel=no sa-src-address=192.168.128.254
sa-dst-address=SERVER_PUBLIC_IPaddr proposal=default priority=0
a lot of messages like this in logs of client's server
22:30:25 ipsec,error phase1 negotiation failed due to time up 192.168.128.254[500]
<=>SERVER_PUBLIC_IPaddr[500] 868bacdc9dab1caa:0000000000000000
Remote peer - server still present.
If all of the above happens, you may disable the policy, modify its dst-port value to 1701, and re-enable it. Your management connection should survive, but now it should now run encrypted. I cannot exclude that it may fail or start behaving weird due to change of MTU on the path, but don't panic and just open a new one if that happens.
if you cannot connect to the client for more than a minute, simply disable the peer at the server. The IPsec connections will go down and so will the policy (after 30 minutes at worst) and you'll be able to connect to the client again via the unencrypted tunnel.
After I change dst-port in policy connection gets lost. I'm unable to reconnect and just peer disabling on server helps. After 30min I'm able to connect again to client via winbox.
Even after reenabling peer policy at this client does not become active
Flags: T - template, X - disabled, D - dynamic, I - invalid, A - active,
* - default
0 T * group=default src-address=::/0 dst-address=::/0 protocol=all
proposal=default template=yes
1 src-address=192.168.5.254/32 src-port=any dst-address=SERVER_PUBLIC_IPaddr/32
dst-port=1701 protocol=udp action=encrypt level=require
ipsec-protocols=esp tunnel=no proposal=default ph2-count=0
Of course this relates to that client which was able to connect at previous step using 33333 dst port.
Here are my ipsec exports:
Server
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=aes-256-cbc pfs-group=modp3072
/ip ipsec peer
add address=0.0.0.0/0 auth-method=pre-shared-key-xauth dh-group=modp3072 enc-algorithm=aes-256 generate-policy=\
port-strict hash-algorithm=sha256 passive=yes send-initial-contact=no
/ip ipsec user
add name=User1
add name=User2
----
ip ipsec policy print
Flags: T - template, X - disabled, D - dynamic, I - inactive, * - default
0 T * group=default src-address=::/0 dst-address=::/0 protocol=all proposal=default template=yes
1 D src-address=SERVER_PUBLIC_IPaddr/32 src-port=33333 dst-address=Client1_detected_IPaddr/32 dst-port=any protocol=udp
action=encrypt level=require ipsec-protocols=esp tunnel=no sa-src-address=SERVER_PUBLIC_IPaddr
sa-dst-address=Client1_detected_IPaddr priority=2
2 D src-address=SERVER_PUBLIC_IPaddr/32 src-port=1701 dst-address=Client1_detected_IPaddr/32 dst-port=any protocol=udp
action=encrypt level=require ipsec-protocols=esp tunnel=no sa-src-address=SERVER_PUBLIC_IPaddr
sa-dst-address=Client1_detected_IPaddr priority=2
Client1 (the one which passing step with dst-port 33333) -6.41.3
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=aes-256-cbc \
pfs-group=modp3072
/ip ipsec peer
add address=SERVER_PUBLIC_IPaddr/32 auth-method=pre-shared-key-xauth dh-group=modp3072 \
enc-algorithm=aes-256 hash-algorithm=sha256 local-address=192.168.5.254 \
send-initial-contact=no xauth-login=User1
/ip ipsec policy
add dst-address=SERVER_PUBLIC_IPaddr/32 dst-port=1701 protocol=udp src-address=\
192.168.5.254/32
Client 2 ( the one on which just peer stage finishes successfully) -6.34.1
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=aes-256-cbc pfs-group=modp3072
/ip ipsec peer
add address=SERVER_PUBLIC_IPaddr/32 auth-method=pre-shared-key-xauth dh-group=modp3072 enc-algorithm=aes-256 \
hash-algorithm=sha256 local-address=192.168.128.254 send-initial-contact=no
/ip ipsec policy
add dst-address=SERVER_PUBLIC_IPaddr/32 dst-port=33333 protocol=udp sa-dst-address=SERVER_PUBLIC_IPaddr sa-src-address=\
192.168.128.254 src-address=192.168.128.254/32
Not "like that" - this one has to be disabled, but the usual masquerade rule
action=masquerade chain=srcnat out-interface=WAN
must stay.
Disabled all-ppp rules.
The one you've mentioned is present
Also one detail to mention ( I don't know is this necessary information in this case or not)
Server connects to Internet as PPPoE client so I have NAT rule on it:
add action=masquerade chain=srcnat out-interface=ISP
where ISP is
/interface pppoe-client> print
Flags: X - disabled, R - running
0 R name="ISP" max-mtu=1480 max-mru=1480 mrru=1600 interface=WAN user="user" password="passwd"
profile=default keepalive-timeout=60 service-name="" ac-name="" add-default-route=yes
default-route-distance=0 dial-on-demand=no use-peer-dns=yes allow=pap,chap,mschap1,mschap2
