need help in vpn

RouterOS General
1

Dear all i need help i had configure vpn on mikrotik and have 2 isp

from isp A vpn work perfectly but when i try to connect vpn from isp B i got following error

proto tcp (syn) my remote ip-mirotik ip



please help

2

Can you please share your configuration (/export hide-sensitive)?

3

thanks for reply sir following ismy firewall configuration


1 chain=input action=accept connection-state=established

2 chain=input action=accept protocol=udp port=1701,500,4500 log=yes

3 chain=input action=accept protocol=ipsec-esp log=yes

4 chain=input action=accept protocol=udp port=1701,500,4500

5 ;;; BSNL VPN
chain=input action=accept tcp-flags=“” protocol=tcp in-interface=bsnl
dst-port=1723 log=yes log-prefix=“”

6 ;;; BSNL VPN
chain=input action=accept protocol=tcp in-interface=bsnl dst-port=8291
log=yes log-prefix=“”

7 ;;; vpn
chain=input action=accept protocol=tcp dst-port=1723 log=yes log-prefix=“”

4

i can connect on ISP A perfectly but unable to get connect on ISP B


Getting error
Firewall info input in:ispB out :(nine),proto tcp (syn) My ip->ISP B IP

5

sir please help me in this

6

i had diagnose when i shut ISP A ISB B is getting successfully connected .

can someone guide what changes i have to made to get it connected from both isp A & B

Please if anyone can help

7

The answer is in this post. Start reading it from the last paragraph, as it explains its relationship to your need.

8

Thank you very much sir for your reply

after adding below rule
/ip firewall mangle
add chain=prerouting connection-state=established,related connection-mark=no-mark action=accept # if a mid-connection packet has no connection mark, it needs the default handling
add chain=prerouting connection-state=established,related in-interface=your-wan # download packets MUST NOT be routing-marked


getting error as follows
prerouting :in:ispb:(unknown0),src mac : mac address proto udp ip->ISB b ip Nat ip>isb B ip >lan ip len 56
prerouting :in:lan out:(unknown0),src mac : mac address proto udp ip->ISB b ip Nat ip>isb B ip >lan ip len 56

Please help what could i do next to resolve the same

thanks in advance

9

I don’t understand why you call a log message an “error”, that’s first; second, I don’t know which log rules are logging these packets because none of the above ones have log=yes; third, I cannot see the rest of your firewall, and fourth, you didn’t write whether it works as desired an only the log messages bother you or whether it still doesn’t work as expected.

So please follow the instruction in my automatic signature just below.

10
11

The firewall rules work depending on their mutual order in each chain and together with the routing setup. So I need your complete configuration export, anonymized the way suggested in the automatic signature, to tell you exactly what to add/remove/change.

12

problem seems to be that if ISP A is the primary default gateway, traffic incoming from ISP B will get forwarded to ISP A unless being marked in mangle, to go out through ISP B’s gateway. thats why it works when you unplug ISP A.

please follow the answer here. As this is for vpn traffic, you can omit the rules in forward chain.

13

thanks..it works .now i am able to login through ISP A and ISB B also
But now 1 issue if i connect it With ISP B also i am getting ISP A ip address only(WAN ip.. my WAN ip shows ISP A only )

so how could i resolve the same