Hi, guys
I have setup L2TP/IPSec tunnel between two subnets with MikroTik on gateway according to Mikrotik Manual.
Office Mikrotik:
WAN IP:212.1.1.1
LAN 192.168.1.254/24
Remote Mikrotik:
WAN IP: 87.1.1.1
LAN 192.168.2.254/24
Tunnel and encryption are working.
Pinging from Office to ANY connected device in Remote LAN is OK, but pinging from remote to Office is some complicated:
Pinging to Office Mikrotik LAN IP (192.168.1.254) - is OK, but pinging to any connected device in Office - TIMEOUT
I has investigate all day 
, but cannot found what is missing in Office router config…
Can help somebody?
How is your routing set up?
Routes on Remote and Offce are very similar:
On Office:
dst-address=0.0.0.0/0 gateway=212.1.1.254 distance=1
dst-address=192.168.1.0/24 gateway=lan distance=0
dst-address=212.1.1.0/24 gateway=wan distance=0
dst-address=10.10.10.2/32 gateway=l2tp-remote distance=0
dst-address=192.168.2.0/24 gateway=10.10.10.2 distance=1
On REMOTE:
dst-address=0.0.0.0/0 gateway=87.1.1.254 distance=1
dst-address=192.168.2.0/24 gateway=lan distance=0
dst-address=87.1.1.0/24 gateway=wan distance=0
dst-address=10.10.10.1/32 gateway=l2tp-office distance=0
dst-address=192.168.1.0/24 gateway=10.10.10.1 distance=1
Routes seem fine, how is your firewall/NAT?
NAT is very simple
chain=srcnat action=masquerade to-addresses=0.0.0.0/0 out-interface=wan
Firewall is more complex…
Port_scanner, Syn_Flooder are blocking - all from Mikrotik example:
http://wiki.mikrotik.com/wiki/Basic_universal_firewall_script
But I have investigate this long time by adding LOG to all chains before DROP, None interesting is dropped 
None firewall entry has only 192.168.1.254/32 address in src-, or dst-address - I always use 192.168.1.0/24…
Therefore - I can reach 192.168.1.254 (routers LAN Address) from Remote LAN - I think this is not firewall problem…
NAT will not be a problem then. Do you have any mangle set up?
To me, it sounds most likely to be a firewall problem.
Place these rules on top of all firewall on both sides just to be sure: (change the proper lines)
add chain=input in-interface="L2TP Interface name"
add chain=forward in-interface="L2TP Interface name"
add chain=forward out-interface="L2TP Interface name"
add chain=output out-interface="L2TP Interface name"
If that still doesnt help, we need to take a look at L2TP server and client configs (PPP profiles, secrets, etc)
Then possibly take a look at the IPSec config but that shouldnt drop anything since the L2TP session establishes properly.
No mangle setup…
adding these firewall rules to top on both sides - not helped
On /ip ipsec installed-sa
on both sides I see two entries state=mature (sometimes - four entries - two entries are state=dying… )
Does it means that IPSec is working properly?
/interface l2tp-server shows uptime above 6 hours…( I have been disable/enable l2tp-client on remote side in that time…)
Does it means L2TP is working properly?
Please post:
“/interface export compact”
“/ppp export compact”
“/ip ipsec export compact”
Feel free to leave out sensitive information.
Interface, PPP and IPSec coinfiguration on both sides:
OFFICE
/interface bridge
add l2mtu=1598 name=lan
/interface ethernet
set 0 disabled=yes
set 1 name=wan
set 2 name=eth2
set 3 disabled=yes
set 4 disabled=yes
set 5 disabled=yes
set 6 disabled=yes
set 7 disabled=yes
set 8 disabled=yes
set 9 disabled=yes
set 10 disabled=yes
/interface l2tp-server
add name=l2tp-remote user=usr
/interface bridge port
add bridge=lan interface=eth2
add bridge=lan interface=eth3
/interface l2tp-server server
set authentication=mschap2 enabled=yes
/ppp profile
add name=remote only-one=yes use-compression=yes use-encryption=yes use-vj-compression=yes
/ppp secret
add comment="Some description" local-address=10.10.10.1 name=remote password=pwd remote-address=10.10.10.2 service=l2tp
/ip ipsec peer
add address=10.10.10.2/32 dpd-interval=disable-dpd dpd-maximum-failures=1 hash-algorithm=sha1 secret="secret"
/ip ipsec policy
add dst-address=192.168.2.0/24 sa-dst-address=10.10.10.2 sa-src-address=10.10.10.1 src-address=192.168.1.0/24 tunnel=yes
\
REMOTE
/interface bridge
add l2mtu=1598 name=lan
/interface ethernet
set 0 disabled=yes
set 1 name=wan
set 2 name=eth2
set 3 name=eth3
set 4 name=eth4
set 5 name=eth5
set 6 name=eth6
set 7 name=eth7
set 8 name=eth8
set 9 name=eth9
set 10 name=eth10
/interface l2tp-client
add allow=mschap2 connect-to=212.1.1.1 disabled=no name=l2tp-office password=psw user=usr
/interface bridge port
add bridge=lan interface=eth2
add bridge=lan interface=eth3
add bridge=lan interface=eth4
add bridge=lan interface=eth5
add bridge=lan interface=eth6
add bridge=lan interface=eth7
add bridge=lan interface=eth8
add bridge=lan interface=eth9
add bridge=lan interface=eth10
/ppp aaa
set accounting=no
/ip ipsec peer
add address=10.10.10.1/32 dpd-interval=disable-dpd dpd-maximum-failures=1 hash-algorithm=sha1 secret="secret"
/ip ipsec policy
add dst-address=192.168.1.0/24 sa-dst-address=10.10.10.1 sa-src-address=10.10.10.2 src-address=192.168.2.0/24 tunnel=yes
And there is the problem. Your IPSec config is completly wrong. I was assuming you had L2TP/IPSec configured and working properly.
You are using tunnel mode, and your peer and policy settings are completly wrong.
Please watch the presentation in my sig, a proper L2TP/IPSec setup is explained there, as well as how IPSec works, so you know what you are doing.
In your case use static routes, in the presentation its deployed with OSPF.
Usefull theory information, but… commands on screen are hard to “decode” from video (also in HD format on 22" monitor)
Can I get slideshow from your presentation somewhere?
Sure, all the presentations are posted on the wiki.
http://wiki.mikrotik.com/wiki/MUM_2013_CR
I has played another day with presentation examples… but nothing news
Results:
FROM OFFICE:
Ping from MKT_Office to Remote_Network_Printer - OK
Ping from MKT_Office to MKT_Remote_LAN_IP - OK
Ping from OFFICE_PC to Remote_Network_Printer - OK
Trace Result from Office_PC to Remote_Network_Printer:
- Office_MKT_LAN_interface_IP - Ok
- L2TP_Remote_IP - Ok
- Remote_Network_Printer - OK
In this direction -from OFFICE to REMOTE - everything is OK
FROM REMOTE:
Ping from MKT_Remote to MKT_Office_LAN_IP is OK
Ping from MKT_Remote to Office_PC - TIMEOUT…
TRACE from MKT_Remote to Office_PC:
- L2TP_Office_IP - OK
2 timeout …
3 timeout…
In this direction some is wrong:
I can reach MKT_Office_LAN, but cannot reach Office_PC…
But Office_PC can reach Remote_Network_Printer
What is wrong - I cannot undestand…
Can anybody help?
Have you fixed the IPSec / L2TP to a proper config? Are you now using IPSec in transport mode or tunnel mode?
IPSec in Transport mode.
L2TP server local address is 10.10.10.1 - Remote address = 10.10.10.2
Office MTK:
/ip ipsec peer
add address=Remote_WAN_IP port=500 auth-method=pre-shared-key secret=“Secret” generate-policy=no
exchange-mode=main-l2tp send-initial-contact=no
nat-traversal=yes hash-algorithm=sha1 enc-algorithm=3des dh-group=modp1024 lifetime=30m
dpd-interval=5s dpd-maximum-failures=3
/ip ipsec policy
add action=encrypt disabled=no dst-address=Remote_WAN_IP dst-port=any ipsec-protocols=esp level=require
priority=0 proposal=default protocol=all sa-dst-address=Remote_WAN_IP
sa-src-address=OFFICE_WAN_IP src-address=OFFICE_WAN_IP src-port=any tunnel=no
Remote MTK:
/ip ipsec peer
add address=OFFICE_WAN_IP auth-method=pre-shared-key comment=L2TP/IPSEC dh-group=modp1024
disabled=no dpd-interval=5s dpd-maximum-failures=3 enc-algorithm=3des
exchange-mode=main-l2tp generate-policy=no hash-algorithm=sha1 lifetime=30m my-id-user-fqdn=“”
nat-traversal=yes port=500 secret=“Secret”
send-initial-contact=yes
/ip ipsec policy
add action=encrypt disabled=no dst-address=OFFICE_WAN_IP dst-port=any ipsec-protocols=esp level=require
\ priority=0 proposal=default protocol=all sa-dst-address=
OFFICE_WAN_IP sa-src-address=REMOTE_WAN_IP src-address=REMOTE_WAN_IP src-port=any tunnel=no
Only ONE Office LAN IP (MTK LAN IP) is reachable from Remote
and ALL Remote LAN IP are reachable from Office…
Because I can reach Office_MTK_LAN_IP from remote MTK - I think this is routing or forward problem, but not transport or tunnel…
IPSec is correct now, but at this point, please just post the whole “/export compact” from both routers.
Attached both MikroTik’s whole export compact files…
remote.rsc (9.31 KB)
office.rsc (9.62 KB)
Holy… that firewall is overkill. What I am noticing however:
office.rsc doesnt have a drop all rule at the end (you should probably fix that). But it has proper forward chain rules to allow the communication to work anyway.
remote.rsc has a drop all rule at the end. It doesnt however have the proper rules to allow forwarding to/from the L2TP tunnel.
Rest of the config looks good.
normal firewall - allow only that want to allow… disable all other…
I’ve fixed rules by your suggestion…
but… nothing…
Made some more investigation with firewall on BOTH routers
I’ve disabled drop rule
added log rule to end of all chains
When pinging, I found that UDP ports 500,1701, and protocol=ipsec-esp are dropped on remote - Fixed…
After fix - no more interesting entries in log, but result is the same…
Only one more idea I have - clearing firewall and starting add rules step by step…
Another ideas?
Have restored clean configuration on Office router…
Built L2TP/IPSec, more simple firewall… result = the same
L2TP, IPSec (transport mode) seems to be working good…
From Offce all are reachable:
Office MKT => Remote MKT L2TP IP 10.10.10.2
Office MKT => Remote MKT LAN IP
Office MKT => Remote PC
Office PC => Remote MKT LAN IP
Office PC => Remote PC
From Remote:
Remote MKT => Office MKT L2TP IP 10.10.10.1
Remote MKT => Office MKT LAN IP - OK
Remote MKT => Office PC - NOT REACHABLE
Firewall on both routers has rule in all chains to LOG everything before DROP
Nothing is logged …
CAN HELP ANYBODY???