Mikrotik to Mikrotik ovet L2TP can not ping

RouterOS General
1

I have 2 mikrotik routers connected over L2TP Vpn connection, after connecting Router1 can not ping Router2 and Router2 can not ping Router1, i dont have access too from pc to Mikrotik server after my local Mikrotik is connected to first Mikrtoik Server.
I have setted all 4 networks in Route but nothing.
Shemme.jpg

2

Anyone can help me what i need to do ?

3

Most likely you need to add routes or configure an automatic routing protocol.
But it is hard to say for sure because there is no information what you already configured.

4

Mikrotik Server:


/ip address
add address=192.168.1.2/24 interface=WAN network=192.168.1.0
add address=10.1.10.1/24 interface=Bridge1 network=10.1.10.0
=========================
/ip route
add disabled=no distance=1 dst-address=10.1.100.0/24 gateway="L2TP-Xelmep Server" \
    routing-mark=VPNfromDE-10.100
add disabled=no distance=1 dst-address=10.1.10.0/24 gateway="L2TP-Xelmep Server" \
    routing-mark=VPNfromDE-10.10
add disabled=no distance=1 dst-address=192.168.1.0/24 gateway="L2TP-Xelmep Server" \
    routing-mark=VPNfromDE-192.168
add disabled=no distance=1 dst-address=192.168.178.0/24 gateway="L2TP-Xelmep Server" \
    routing-mark=VPNfromDE-192.178
add distance=1 gateway=192.168.1.1
=========================
/interface l2tp-server
add name="L2TP-Xelmep Server" user=""
/interface l2tp-server server
set allow-fast-path=yes default-profile=L2TP/IPSec enabled=yes use-ipsec=yes
======================
/ppp profile
add local-address=10.1.10.1 name=VPN-Profil remote-address=dhcp_pool1 use-encryption=\
    no use-mpls=yes
add bridge=Bridge1 dns-server=8.8.8.8 local-address=10.1.10.1 name=L2TP/IPSec \
    remote-address=dhcp_pool1 use-encryption=yes use-mpls=yes
======================

/ip firewall filter
add action=accept chain=forward src-address-list=A-InLan
add action=accept chain=forward dst-address-list=A-InLan
add action=accept chain=input comment="Accept related" connection-state=related
add action=accept chain=forward comment="Accept gre" connection-limit=100,32 \
    in-interface=WAN protocol=gre
add action=accept chain=forward comment="WANtoLAN L2TP" out-interface=WAN src-address=\
    192.168.178.2
add action=accept chain=forward comment="Open L2TP ports 500,1701,4500" dst-port=\
    500,1701,4500 in-interface=WAN protocol=udp
add action=accept chain=input comment="Allow-LAN and VPN" src-address-list=A-InLan
add action=log chain=input comment="Drop BlackList Brute Force" dst-port=\
    21,22,23,80,85,500,1701,1723,4500,8291 log-prefix=BlackList_DropLog protocol=tcp \
    src-address-list=BlackList_log
add action=drop chain=input comment="Drop BlackList Brute Force" src-address-list=\
    BlackList
add action=drop chain=input comment="Drop Ping" disabled=yes in-interface=WAN \
    protocol=icmp
add action=drop chain=forward connection-limit=15,32 disabled=yes dst-address-list=\
    BlackList protocol=tcp
add action=accept chain=forward comment="VPN Gra" in-interface=WAN protocol=gre
add action=accept chain=forward comment="Allow Main Router - FritzBox" src-address=\
    192.168.1.1
add action=drop chain=input comment="Drop ssh brute forcers" dst-port=22 protocol=tcp \
    src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=\
    none-static chain=input connection-state=new dst-port=22 protocol=tcp \
    src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=5m \
    chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=\
    ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=5m \
    chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=\
    ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=5m \
    chain=input connection-state=new dst-port=22 protocol=tcp
add action=drop chain=input comment="Drop telnet brute forcers" dst-port=23 protocol=\
    tcp src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=\
    none-static chain=input connection-state=new dst-port=23 protocol=tcp \
    src-address-list=telnet_stage3
add action=add-src-to-address-list address-list=telnet_stage3 address-list-timeout=5m \
    chain=input connection-state=new dst-port=23 protocol=tcp src-address-list=\
    telnet_stage2
add action=add-src-to-address-list address-list=telnet_stage2 address-list-timeout=5m \
    chain=input connection-state=new dst-port=23 protocol=tcp src-address-list=\
    telnet_stage1
add action=add-src-to-address-list address-list=telnet_stage1 address-list-timeout=5m \
    chain=input connection-state=new dst-port=23 protocol=tcp
add action=drop chain=input comment="Drop Web80 brute forcers" dst-port=80 protocol=\
    tcp src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=\
    none-static chain=input connection-state=new dst-port=80 protocol=tcp \
    src-address-list=Web80_stage3
add action=add-src-to-address-list address-list=Web80_stage3 address-list-timeout=\
    none-dynamic chain=input connection-state=new dst-port=80 protocol=tcp \
    src-address-list=Web80_stage2
add action=add-src-to-address-list address-list=Web80_stage2 address-list-timeout=5m \
    chain=input connection-state=new dst-port=80 protocol=tcp src-address-list=\
    Web80_stage1
add action=add-src-to-address-list address-list=Web80_stage1 address-list-timeout=5m \
    chain=input connection-state=new dst-port=80 protocol=tcp
add action=drop chain=input comment="Drop vpn1701 brute forcers" dst-port=1701 \
    protocol=tcp src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=\
    none-static chain=input connection-state=new dst-port=1701 protocol=tcp \
    src-address-list=vpn1701_stage3
add action=add-src-to-address-list address-list=vpn1701_stage3 address-list-timeout=\
    none-dynamic chain=input connection-state=new dst-port=1701 protocol=tcp \
    src-address-list=vpn1701_stage2
add action=add-src-to-address-list address-list=vpn1701_stage2 address-list-timeout=5m \
    chain=input connection-state=new dst-port=1701 protocol=tcp src-address-list=\
    vpn1701_stage1
add action=add-src-to-address-list address-list=vpn1701_stage1 address-list-timeout=5m \
    chain=input connection-state=new dst-port=1701 protocol=tcp
add action=drop chain=input comment="Drop vpn4500 brute forcers" dst-port=4500 \
    protocol=tcp src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=\
    none-static chain=input connection-state=new dst-port=4500 protocol=tcp \
    src-address-list=vpn4500_stage3
add action=add-src-to-address-list address-list=vpn4500_stage3 address-list-timeout=5m \
    chain=input connection-state=new dst-port=4500 protocol=tcp src-address-list=\
    vpn4500_stage2
add action=add-src-to-address-list address-list=vpn4500_stage2 address-list-timeout=5m \
    chain=input connection-state=new dst-port=4500 protocol=tcp src-address-list=\
    vpn4500_stage1
add action=add-src-to-address-list address-list=vpn4500_stage1 address-list-timeout=5m \
    chain=input connection-state=new dst-port=4500 protocol=tcp
add action=drop chain=input comment="Drop Web85 brute forcers" dst-port=85 protocol=\
    tcp src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=\
    none-dynamic chain=input connection-state=new dst-port=85 protocol=tcp \
    src-address-list=Web85_stage3
add action=add-src-to-address-list address-list=Web85_stage3 address-list-timeout=5m \
    chain=input connection-state=new dst-port=85 protocol=tcp src-address-list=\
    Web85_stage2
add action=add-src-to-address-list address-list=Web85_stage2 address-list-timeout=5m \
    chain=input connection-state=new dst-port=85 protocol=tcp src-address-list=\
    Web85_stage1
add action=add-src-to-address-list address-list=Web85_stage1 address-list-timeout=5m \
    chain=input connection-state=new dst-port=85 protocol=tcp
add action=accept chain=output comment=\
    "Drop FTP Brute Force - Allow 'Incorrect Login' reply" content=\
    "530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
    
add action=accept chain=forward in-interface=WAN protocol=gre
add action=accept chain=forward out-interface=WAN src-address=192.168.1.2
add action=accept chain=forward dst-port=500,1701,4500 in-interface=WAN protocol=udp
add action=accept chain=input connection-state=related
=======================================

Mikrotik Client:

/interface l2tp-client
add allow-fast-path=yes connect-to=xxxxxxxxxx.ddns.net name=L2TPtoMK profile=L2TP-Profile \
    use-ipsec=yes user=MikrotikHB
 ===========================
 /ip route
add distance=1 gateway=192.168.178.1
add distance=1 dst-address=10.1.10.0/24 gateway=L2TPtoMK
add distance=1 dst-address=10.1.100.0/24 gateway=L2TPtoMK
add distance=1 dst-address=192.168.1.0/24 gateway=L2TPtoMK
add distance=1 dst-address=192.168.178.0/24 gateway=L2TPtoMK
============================

/ip firewall filter
add action=accept chain=forward comment="Accept gre" connection-limit=100,32 in-interface=WAN \
    protocol=gre
add action=accept chain=forward comment="WANtoLAN" out-interface=WAN src-address=\
    192.168.178.2
add action=accept chain=forward comment="Open L2TP ports 500,1701,4500" dst-port=500,1701,4500 \
    in-interface=WAN protocol=udp
add action=accept chain=input comment="Accept related" connection-state=related
add action=accept chain=input comment="Allow-LAN and VPN" src-address-list=A-InLan
add action=log chain=input comment="Drop BlackList Brute Force" dst-port=\
    21,22,23,80,85,500,1701,1723,4500,8291 log-prefix=BlackList_DropLog protocol=tcp \
    src-address-list=BlackList_log
add action=drop chain=input comment="Drop BlackList Brute Force" src-address-list=BlackList
add action=drop chain=input comment="Drop Ping" disabled=yes in-interface=WAN protocol=icmp

add action=drop chain=forward connection-limit=15,32 disabled=yes dst-address-list=BlackList \
    protocol=tcp
add action=accept chain=forward comment="VPN Gra" disabled=yes in-interface=WAN protocol=gre
add action=accept chain=forward comment="Allow Main Router - FritzBox" disabled=yes \
    dst-address-list=A-InLan in-interface=bridge1 out-interface=bridge1 src-address-list=\
    A-InLan
add action=drop chain=input comment="Drop ssh brute forcers" dst-port=22 protocol=tcp \
    src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=none-static \
    chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=5m chain=input \
    connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=5m chain=input \
    connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=5m chain=input \
    connection-state=new dst-port=22 protocol=tcp
add action=drop chain=input comment="Drop telnet brute forcers" dst-port=23 protocol=tcp \
    src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=none-static \
    chain=input connection-state=new dst-port=23 protocol=tcp src-address-list=telnet_stage3
add action=add-src-to-address-list address-list=telnet_stage3 address-list-timeout=5m chain=\
    input connection-state=new dst-port=23 protocol=tcp src-address-list=telnet_stage2
add action=add-src-to-address-list address-list=telnet_stage2 address-list-timeout=5m chain=\
    input connection-state=new dst-port=23 protocol=tcp src-address-list=telnet_stage1
add action=add-src-to-address-list address-list=telnet_stage1 address-list-timeout=5m chain=\
    input connection-state=new dst-port=23 protocol=tcp
add action=drop chain=input comment="Drop Web80 brute forcers" dst-port=80 protocol=tcp \
    src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=none-static \
    chain=input connection-state=new dst-port=80 protocol=tcp src-address-list=Web80_stage3
add action=add-src-to-address-list address-list=Web80_stage3 address-list-timeout=none-dynamic \
    chain=input connection-state=new dst-port=80 protocol=tcp src-address-list=Web80_stage2
add action=add-src-to-address-list address-list=Web80_stage2 address-list-timeout=5m chain=\
    input connection-state=new dst-port=80 protocol=tcp src-address-list=Web80_stage1
add action=add-src-to-address-list address-list=Web80_stage1 address-list-timeout=5m chain=\
    input connection-state=new dst-port=80 protocol=tcp
add action=drop chain=input comment="Drop vpn1701 brute forcers" dst-port=1701 protocol=tcp \
    src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=none-static \
    chain=input connection-state=new dst-port=1701 protocol=tcp src-address-list=vpn1701_stage3
add action=add-src-to-address-list address-list=vpn1701_stage3 address-list-timeout=\
    none-dynamic chain=input connection-state=new dst-port=1701 protocol=tcp src-address-list=\
    vpn1701_stage2
add action=add-src-to-address-list address-list=vpn1701_stage2 address-list-timeout=5m chain=\
    input connection-state=new dst-port=1701 protocol=tcp src-address-list=vpn1701_stage1
add action=add-src-to-address-list address-list=vpn1701_stage1 address-list-timeout=5m chain=\
    input connection-state=new dst-port=1701 protocol=tcp
add action=drop chain=input comment="Drop vpn4500 brute forcers" dst-port=4500 protocol=tcp \
    src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=none-static \
    chain=input connection-state=new dst-port=4500 protocol=tcp src-address-list=vpn4500_stage3
add action=add-src-to-address-list address-list=vpn4500_stage3 address-list-timeout=5m chain=\
    input connection-state=new dst-port=4500 protocol=tcp src-address-list=vpn4500_stage2
add action=add-src-to-address-list address-list=vpn4500_stage2 address-list-timeout=5m chain=\
    input connection-state=new dst-port=4500 protocol=tcp src-address-list=vpn4500_stage1
add action=add-src-to-address-list address-list=vpn4500_stage1 address-list-timeout=5m chain=\
    input connection-state=new dst-port=4500 protocol=tcp
add action=drop chain=input comment="Drop Web85 brute forcers" dst-port=85 protocol=tcp \
    src-address-list=BlackList
add action=add-src-to-address-list address-list=BlackList address-list-timeout=none-dynamic \
    chain=input connection-state=new dst-port=85 protocol=tcp src-address-list=Web85_stage3
add action=add-src-to-address-list address-list=Web85_stage3 address-list-timeout=5m chain=\
    input connection-state=new dst-port=85 protocol=tcp src-address-list=Web85_stage2
add action=add-src-to-address-list address-list=Web85_stage2 address-list-timeout=5m chain=\
    input connection-state=new dst-port=85 protocol=tcp src-address-list=Web85_stage1
add action=add-src-to-address-list address-list=Web85_stage1 address-list-timeout=5m chain=\
    input connection-state=new dst-port=85 protocol=tcp