Hi all, let`s try to explain my problem.
Task:
There is 2 computers, one runs program as a server, other connects to the program as a client to show some data. Client computer sometimes is away but still wants to see data, but also we want to stay safe. For communication between client and server program use ports 1433 and 9933. In LAN everything forks perfect.
What is done:
We are using wAP R-nD LTE router. Made LAN network 192.168.1.0/24 and VPN L2TP over IPsec with network 192.168.5.0/24. Also attaching my config.
Problem:
Client and server computers cant communicate properly by the program. I can ping the server computer, I can access the network printers, can even print, but the program refuses to work properly. I have made some rules in firewall, and see the traffic going. I think that it`s the problem with my NAT setting, but never understood the NAT thing properly, so maybe you guys can help me to solve this thing.
The kind of NAT most used is to Access Internet from internal computer (For example), I Will try to explain you why is it:
Supose the following:
-A machine in your network is trying to access to www.facebook.com
-The machine got the IP address of www.facebook.com from its DNS servers or cache, supouse it is 100.100.100.100
-The machine has 192.168.0.100 as IP
-The machine send an IP packet which has 192.168.0.100 as source address and 100.100.100.100 as destination address
-Because 100.100.100.100 is not in the same network, the machine will send the packet to its default Gateway (I supouse it is the mikrotik router)
-The packet reach Facebook.com
-When Facebook try to reply, it will send a packet using as destination address, what was source address in the previous packet, in this case 192.168.0.100
The reply will never get your machine because Facebook does not know how to reach any internal IP
So, you need to NAT, you need to the router to change source address for all outgoing connection to use the public IP
As I can see, you have just 1 nat rule enabled, which is for local devices can acccess to Internet (I think)
If the connections using those ports you said, are generated from outside using the public IP, you will need to create another nat rule (dst-nat in this case) to send all package received on those ports to the server
So, the problem is when the clients connects from outside with L2TP?
The clients are using private or public IP to access the server?
In “/ip firewall connection” add the “reply src address” and “reply dst address” columns and filter to only see when “Dst. Address/Port” is 1433 or 9933
Copy here the result, changing IP addresses with generic ones
The kind of NAT most used is to Access Internet from internal computer (For example), I Will try to explain you why is it:
Supose the following:
-A machine in your network is trying to access to > www.facebook.com
-The machine got the IP address of > www.facebook.com > from its DNS servers or cache, supouse it is 100.100.100.100
-The machine has 192.168.0.100 as IP
-The machine send an IP packet which has 192.168.0.100 as source address and 100.100.100.100 as destination address
-Because 100.100.100.100 is not in the same network, the machine will send the packet to its default Gateway (I supouse it is the mikrotik router)
-The packet reach Facebook.com
-When Facebook try to reply, it will send a packet using as destination address, what was source address in the previous packet, in this case 192.168.0.100
The reply will never get your machine because Facebook does not know how to reach any internal IP
So, you need to NAT, you need to the router to change source address for all outgoing connection to use the public IP
That`s very nice explanation! Thank you!
As I can see, you have just 1 nat rule enabled, which is for local devices can acccess to Internet (I think)
If the connections using those ports you said, are generated from outside using the public IP, you will need to create another nat rule (dst-nat in this case) to send all package received on those ports to the server
So, the problem is when the clients connects from outside with L2TP?
The clients are using private or public IP to access the server?
Yes, the problem is when the clients connects from outside with L2TP.
Clients uses private IP to access the server. 192.168.5.0/24 connects to 192.168.1.145.
In “/ip firewall connection” add the “reply src address” and “reply dst address” columns and filter to only see when “Dst. Address/Port” is 1433 or 9933
Copy here the result, changing IP addresses with generic ones
Attaching the foto.
If I try to switch “reply src address” with “reply dst address” otherwise than in photo, no data appears.
You are wellcome!
I wanted to see if “Reply src. Address” is the same than “Destination address” and “Reply dst. Address” is the same than “Source Address”
You can add these columns, with a right click on any ítem on the list → Show columns → Reply dst. Address
As I think, the router should not nat these connections, so I think the issue is other.
These connections appear like established, dont seems to has any problem.
Hmmmmm, not sure
Is it possible that the server try to open a new connection with the client and this new connection are not accepted on filter rules?
Is it possible to acept temporarily all connection to those ports for test purpose?
Maybe someone with more knowledge than me is required here
I just see the filter rules.
It seems you have allowed for “192.168.1.145 → 192.168.5.0/24” ports 1433 and 993
But for “192.168.5.0/24 → 192.168.1.145” you dont have allowed the port 993
As I can see in the photo, there are connections on with the port 993, with 192.168.1.145 as dst-address
Did you try to add the following?
I think maybe you speak in spanish, because the word “foto” is in spanish, I do
I have not so much knowledge about l2tp, but this does not seems to me an issue related to l2tp, because ping and other staff worked as you said.
When the client are in the same network, the connection with the server should not through the router, so I still want to check if it is related to filter rules:
You have 1 interface for l2tp, right?
Could you temporarily accept all traffic on l2tp interface for test purpose? (both ways, in and out)
Just créate the rule, test and delete the rule
Just contacted the software support, and they said that program wont support such thing like client and server communication in different subnets. So thank you very much!
Ok, just another question, is it possible somehow set up VPN, that its network would be in same subnet? Or maybe, I could trick the system communication with NAT? When I set up the VPN, I have to write remote and local addresses, so maybe its possible to make the system to think that I`m in same LAN?
Anyone? If I make the VPN client computer appear in the same network 192.168.1.0/24 it wont let me ping the 192.168.1.0/24 devices
EDIT: Ok, I have made it work in internal ip with NAT rule to masquarade,
Chain: srcnat
Src. Address: 192.168.1.0/24
Dst. Address: !192.168.1.254
Action: masquerade
But program still not working properly, I can ping now lan devices, access cameras NVR web GUI, etc, but program is not working… Any ideas?
The VPN connection is still not really on the same network even though it is part of the same subnet, you might have to use L2 VPN such as OpenVPN TAP or EoIP.
