Hello,
I have a NAT problem with my subnets and my IPSEC VPN.
I don’t see how to route traffic through the established VPN.
You don’t route traffic with IPSec, at least not in RouterOS. What goes in tunnel is controlled by policies. In your case it’s when source is 10.52.52.80 (single address on this router) and destination 192.168.102.0/24 or 192.168.104.0/24. If you want to route more, you have to either change policies on both sides, or use srcnat to change address to 10.52.52.80.
Ok,
Like this :
add action=src-nat chain=srcnat dst-address=192.168.102.0/24 src-address=192.168.0.0/24 to-addresses=10.52.52.80 ?
Yes, that will allow access from 192.168.0.0/24 to 192.168.102.0/24.
OK, thanks
I had already tried this rule.
When I set it up I do not receive any traffic entering the ipsec tunnel.
As I am not controlling the other side of the VPN, I do not know if it is from the mikrotik.
Is there a rule to put in place for the incoming traffic from Ipsec?
It’s hard to say what exactly happens. It can be the other side not sending anything. Or maybe you block it. Normally it wouldn’t happen, but people sometimes invent crazy things. For start, check that you accept all required ipsec traffic from peer (udp 500 and 4500, esp protocol). If you don’t find anything, you can export config and post it it, and if the problem is in there, maybe someone will see it.
Hi,
many thanks for informations.
I have check Filter rules Udp part a ipsec protocol is allow.
Here is the conf.
Regards
export.zip (5.09 KB)
It’s rather long to try to understand it all, and nothing clearly stands out. But I guess it could be related to your dual-WAN config. Check what exactly happens with those packets, if they get any routing marks, if encrypted traffic uses right WAN, etc.