L2TP/IPSEC tunnel - almost done.

RouterOS Beginner Basics
1

Hi guys,

I’m going to connect 1 HQ and 3 remote small offices (with three RB951G-2HnD and one RB751G-2HnD). I’ve studied several manuals on web and made l2tp/ipsec tunnel between 2 offices for now.

From MT1 (RB951G-2HnD) I can ping 192.168.5.2 and 192.168.1.1, but can’t ping 192.168.1.9.
From MT2 (RB751G-2HnD) I can ping 192.168.5.1 and 192.168.0.1, but can’t ping 192.168.0.4.

What am I missing to get access to that addresses? Or what can you advise? I will appreciate any help.

Tomas Kirnak has the great presentation of L2TP/IPSEC and he uses OSPF for routing. But I can’t find some manual like “OSPF for dummies”. But I believe that it requires only a few lines in the terminal to implement it.

Configuration:

MT1:

/ip firewall address-list                     
MY_NETS                                      192.168.0.0/16

/ip firewall nat
chain=srcnat action=accept src-address-list=MY_NETS dst-address-list=MY_NETS 
chain=srcnat action=masquerade src-address=192.168.0.0/24

/ip route print
#      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE 
0 ADS  0.0.0.0/0                          81.xxx.xxx.xxx            0
1 ADC  81.xxx.xxx.xxx/26  81.xxx.xxx.xxx  ether1                    0
2 ADC  192.168.0.0/24     192.168.0.1     bridge1                   0
3 A S  192.168.1.0/24                     192.168.5.2               1
4 ADC  192.168.5.2/32     192.168.5.1     l2tp-tun                  0

MT2:

/ip firewall address-list                     
MY_NETS                                      192.168.0.0/16

/ip firewall nat
chain=srcnat action=accept src-address-list=MY_NETS dst-address-list=MY_NETS 
chain=srcnat action=masquerade src-address=192.168.1.0/24

/ip route print
#      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE
0 ADS  0.0.0.0/0                          82.xxx.xxx.xxx            0
1 ADC  82.xxx.xxx.xxx/26  82.xxx.xxx.xxx  ether1                    0
2 A S  192.168.0.0/24                     192.168.5.1               1
3 ADC  192.168.1.0/24     192.168.1.1     bridge1                   0
4 ADC  192.168.5.1/32     192.168.5.2     l2tp-tun-to-m1            0

For now firewall is not enabled.

Thanks in advance.
Sorry for my English.

2

The first arc-nat rule is not really needed. Filter will be better. And for the second Nat rule the out-interface should be configured to be your normal gateway.
If you so it that way the von traffic should get through.

3

Hi, Rudios. Thanks for your reply. My problem has been solved. Kaspersky was blocking ICMP4. Now it’s ok.