makes no sense …
… I assume it was network=10.10.N.0 broadcast=10.10.N.255
anyway:
for problem 1
if you mean that the client has to see the right networks, use pptp profiles to add dial-in users to specific address list for the network / neworks they should use, then mark their traffic accordingly to have the right routing
if you mean that the response for the client creating the tunnel goes the wrong way, in mangle table you should mark connections incoming on an interface and use that mark to mark routing in output chain
/ ip firewall service-port
set gre disabled=no
i think it should raise an error, but maybe is only unuseful .. anyway I don’t understand what it should obtain
for problem 2
for firewall should be sufficient one or two forward rule with action “accept” based on two address-lists of on the interfaces they come in and out
for routing add some rules to evaluate your internal and vpn traffic only on main table.
I normally have somethinglike this:
Problem 1. Trivially gre service port is on.
User connect successfully and get correct ip. Tunnel is established.
User ping every firewall interface (10.10.n.254 and 192.168.n.254) but no clients in LANn (clients are pinged from mikrotik firewall terminal).
Note that arp is enabled in LANn interfaces.
I suppose that’s a mangle (my) error. If I disable mangle marking routes all go right.
But. How to mark correctly without loose n-WAN balancing?
Problem 2 resolution: I think your position is correct but may you be more verbose? May you use my notation? For example if x and y are two LANs what are you route rules? I think masquerade flow have precedence and packet from x to y go throw WANx and not throw LANy.
So my question will be explicited as “How to setup correct rules if I want LANx and LANy comunicate and LANx go in internet by WANx and LANx go in internet by WANy?”
problem 1 and 2
for both of them, you need to force your firewall to resolve addresses in the main table, because VPN links are addedd only in main routing table.
so I would add:
# for pptp clients: I used the best match of a network address for the pool you used... in rules you will use networks, not ranges
/ip route rule add action=lookup-only-in-table dst-address=172.16.0.192/26 table=main
# for local subnets:
/ip route rule add action=lookup-only-in-table dst-address=192.168.N.0/24 table=main
as long as you don’t have the same addresses in more than one local network, this will work.
honestly, I think that in ppp profile local address should better be in the same network as the pool you give to clients, but maybe if you are using only pptp it can work, for the assumptions that the protocol has (I think your clients will have “use default route”, right?).
copy&paste error. Correct address are: