L2TP VPN doesn't work over WAN

RouterOS General
1

Hi guys,

I created a L2TP connection in Winbox, my LAN clients can connect to it just fine, however, I cannot connect to VPN over Wan

I guess it will be the firewall rules, I thought additional rules will be created automatically if it’s done via Winbox ?

These are my current rules:

/ip firewall filter
add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=drop chain=input comment=“defconf: drop all not coming from LAN” in-interface-list=!LAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

Can somebody please advise

Thanks a lot

2

Nope.

/ip firewall filter
add place-before=[find chain=input protocol=icmp] chain=input protocol=udp dst-port=500,4500 in-interface-list=WAN action=accept
add place-before=[find chain=input protocol=icmp] chain=input protocol=udp dst-port=1701 in-interface-list=WAN ipsec-policy=in,ipsec action=accept

3

Thank you, I have added those 2 lines, however, it didn’t do any difference, in the firewall window (Winbox), I don’t see any additional rules, then what I had before


[admin@MikroTik_RB4011] /ip firewall filter> add place-before=[find chain=input protocol=icmp] chain=input protocol=udp dst-port=
500,4500 in-interface-list=WAN action=accept
no such item
[admin@MikroTik_RB4011] /ip firewall filter> add place-before=[find chain=input protocol=icmp] chain=input protocol=udp dst-port=1701 in-interface-list
=WAN ipsec-policy=in,ipsec action=accept
no such item
[admin@MikroTik_RB4011] /ip firewall filter>

4

Sorry, the match protocol=icmp doesn’t work this way. You have to do it the following way:

/ip firewall filter
add place-before=[find chain=input protocol~“icmp”] chain=input protocol=udp dst-port=500,4500 in-interface-list=WAN action=accept
add place-before=[find chain=input protocol~“icmp”] chain=input protocol=udp dst-port=1701 in-interface-list=WAN ipsec-policy=in,ipsec action=accept

5

Thank you very much Sindy, It now works!