Mikrotik to Mikrotik VPN accross the Internet

RouterOS General
1

HI all,
I am trying to setup a Mikrotik to Mikrotik VPN across the internet but I cannot seem to get it working.
Basically I have
Site1 - Internet – SMC ADSL – Microtik RB750- Lan 192.168.20.0/24
Site2 – Internet – SMC ADSL – Microtik RB750 – Lan 192.168.91.0/24
Both of the SMC ADSL Routers have the DMZ setup to pass all traffic to the Microtik Routers.

I have followed various guides to setup an IPSEC VPN Tunnel between both sites.
What happens is that they never seem to connect. I don’t see any connection attempts in the logs even though I have set the logging to include IPSec VPN traffic.

I have put in the static nat rule so that the traffic from one Lan is allowed to the 2nd Lan without Masquerading but still I see no connection attempts come up in the log when I try to ping the opposite site.

I feel I must be missing something here but I am not sure what.
I understand that in the current config, all traffic is basically being Natted twice but I see no way around that.

Any help would be appreciated.

2

Bump; no idea’s anyone ?

3

If possible set your SMC ADSL routers to bridge mode and let Mikrotik act as a router.
Then follow these Wiki guidelines:
http://wiki.mikrotik.com/wiki/Manual:IP/IPsec

HTH,

4

thanks for your reply,
the guideline you sent me is the one I have been working from.
So the 2 Mikrotiks are setup according to that document.
I can’t set the ADSL Modems to bridge mode as they don’t support it.
I understand that the VPN would be better without a Nat router but it will work through a Nat router won’t it ?

5

Hi all,
I have a feeling that the firewall is dropping the ipsec traffic as it hits the mikrotik.
Ok so I have setup the mikrotik according to the various guides but shouldn’t there be a firewall rule that says to let the port 500 etc in.

Any help would be appreciated.

6 
/ip firewall filter
add action=accept chain=input comment=IPSec disabled=no dst-port=500 protocol=udp
add action=accept chain=output comment=IPSec disabled=no dst-port=500 protocol=udp
add action=accept chain=input comment=IPSec-ESP disabled=no protocol=ipsec-esp
add action=accept chain=output comment=IPSec-ESP disabled=no protocol=ipsec-esp
add action=accept chain=input comment=IPSec-AH disabled=no protocol=ipsec-ah
add action=accept chain=output comment=IPSec-AH disabled=no protocol=ipsec-ah

HTH,

7

Also allow udp/4500 for NAT-T.