Mikrotik (behind NAT) to Mikrotik IPSEC/IKE2 (with certs) tunnel + EoIP

  1. on both Router A and Router B, you have a NAT rule, like below, why we need this rule:
    /ip firewall nat add action=src-nat chain=srcnat dst-address=10.22.22.2 to-addresses=10.22.22.1 place-before=0

Ping to internal IP (10.22.22.2) from Router A did not work without this rule, so I added it.


  1. If, let’s say , one subnet of Router A ( 192.168.1.0/24) has to route all its traffic through router B to access internet. how to do it ?

I believe there are multiple ways to do it. I am really not sure what would be the right way, but maybe you can use a separate routing table for such subnet? Or maybe you can use steps as per this tutorial in order to route all traffic originating from your specified subnet through VPN server?

I am not a networking professional and all the steps I’ve given are practically tested by me. If something is not right or can be improved - feedback is always welcome. :slight_smile: