I have a MikroTik router at my office in Office A with two internet connections, WAN1 and WAN2, configured for load balancing and failover. The local network at this office uses the subnet 192.168.10.0/24.
In another office B, there is a MikroTik router on the subnet 10.10.0.0/16, which hosts an L2TP VPN server. The VPN connection between the two offices is established successfully, and devices in the office B can access resources in the office A without any issues.
However, the Islamabad office is unable to access the 10.10.0.0/16 network. The MikroTik router in Office A can successfully ping devices on the 10.10.0.0/16 subnet, but the LAN devices cannot.
Interestingly, if I disable the WAN2 internet connection in the Office A, the 10.10.0.0/16 network becomes accessible from the Office A LAN.
Can anyone help me resolve this issue?
# model = RB750Gr3
# serial number = HGE09Q8B6SD
/interface bridge
add admin-mac=******* arp=proxy-arp auto-mac=no comment=defconf \
name="Local Network"
/interface ethernet
set [ find default-name=ether1 ] name=WAN1
set [ find default-name=ether2 ] name=WAN2
set [ find default-name=ether3 ] arp=proxy-arp
/interface l2tp-client
add connect-to=****** disabled=no ipsec-secret=****** name=\
L2tp-Ahmedpur password=***** use-ipsec=yes user=HO
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.10.20-192.168.10.254
add name=VPNpool ranges=192.168.5.2-192.168.5.50
/ip dhcp-server
add address-pool=dhcp disabled=no interface="Local Network" lease-time=\
2d7h10m name=dhcp1
/ppp profile
add dns-server=192.168.10.3,8.8.8.8 local-address=192.168.10.1 name=L2TP \
remote-address=dhcp
add dns-server=192.168.10.1,8.8.8.8 local-address=192.168.5.1 name=PPTP \
remote-address=VPNpool
set *FFFFFFFE only-one=no
/interface bridge port
add bridge="Local Network" comment=defconf disabled=yes interface=WAN1
add bridge="Local Network" comment=defconf interface=ether3
add bridge="Local Network" comment=defconf interface=ether4
add bridge="Local Network" comment=defconf interface=ether5
/interface l2tp-server server
set allow-fast-path=yes ipsec-secret=******* use-ipsec=yes
/interface list member
add interface=WAN1 list=WAN
add interface="Local Network" list=LAN
/interface pptp-server server
set enabled=yes
/ip address
add address=192.168.10.1/24 interface="Local Network" network=192.168.10.0
add address=192.168.5.1/24 disabled=yes interface=ether4 network=192.168.5.0
/ip dhcp-client
add add-default-route=no comment=defconf disabled=no interface=WAN1
add add-default-route=no comment=defconf disabled=no interface=WAN2
/ip dhcp-server network
add address=192.168.5.0/24 dns-server=192.168.10.3,192.168.10.1,4.4.4.4 \
gateway=192.168.5.1
add address=192.168.10.0/24 dns-server=192.168.10.3,192.168.10.1,4.4.4.4 \
gateway=192.168.10.1
/ip dns
set allow-remote-requests=yes servers=192.168.10.3,192.168.1.254,4.4.4.4
/ip firewall filter
add action=accept chain=forward disabled=yes dst-address=192.168.10.0/24 \
src-address=10.10.0.0/16
add action=accept chain=forward disabled=yes dst-address=10.10.0.0/16 \
src-address=192.168.10.0/24
add action=accept chain=input dst-port=1723 protocol=tcp
add action=accept chain=input dst-port=1701 protocol=udp
add action=accept chain=input dst-port=500 protocol=udp
add action=accept chain=input dst-port=4500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=forward protocol=gre
add action=accept chain=forward protocol=icmp
add action=accept chain=forward dst-address=10.10.0.0/16 src-address=\
192.168.10.0/24
add action=accept chain=forward connection-state=established,related
add action=accept chain=forward dst-address=10.10.0.0/16 src-address=\
192.168.10.0/24
add action=accept chain=forward dst-address=192.168.10.0/24 src-address=\
10.10.0.0/16
/ip firewall mangle
add action=accept chain=prerouting dst-address=192.168.1.0/24 in-interface=\
"Local Network"
add action=accept chain=prerouting dst-address=192.168.2.0/24 in-interface=\
"Local Network"
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=WAN1 new-connection-mark="WAN1 Connection" passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
in-interface=WAN2 new-connection-mark="WAN2 Connection" passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
connection-state=new dst-address-type=!local in-interface="Local Network" \
new-connection-mark="WAN1 Connection" passthrough=yes \
per-connection-classifier=src-address-and-port:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
dst-address-type=!local in-interface="Local Network" new-connection-mark=\
"WAN2 Connection" passthrough=yes per-connection-classifier=\
src-address-and-port:2/1
add action=mark-routing chain=prerouting connection-mark="WAN1 Connection" \
in-interface="Local Network" new-routing-mark=To_WAN1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark="WAN2 Connection" \
in-interface="Local Network" new-routing-mark=To_WAN2 passthrough=yes
add action=mark-routing chain=output connection-mark="WAN1 Connection" \
new-routing-mark=To_WAN1 passthrough=yes
add action=mark-routing chain=output connection-mark="WAN2 Connection" \
new-routing-mark=To_WAN2 passthrough=yes
add action=accept chain=prerouting dst-address=10.10.0.0/16
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.10.0/24 src-address=\
10.10.0.0/16
add action=masquerade chain=srcnat disabled=yes dst-address=10.10.0.0/16 \
src-address=192.168.10.0/24
add action=masquerade chain=srcnat out-interface=WAN1
add action=masquerade chain=srcnat out-interface=WAN2
add action=dst-nat chain=dstnat dst-port=3389 protocol=tcp to-addresses=\
192.168.10.3 to-ports=3389
add action=accept chain=dstnat dst-port=1701 protocol=udp
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.10.0/24 \
src-address=192.168.5.0/24
add action=masquerade chain=srcnat src-address=192.168.5.0/24
add action=masquerade chain=srcnat disabled=yes src-address=192.168.10.0/24
add action=accept chain=srcnat protocol=gre
add action=masquerade chain=srcnat out-interface=L2tp-Ahmedpur
add action=masquerade chain=srcnat out-interface=L2tp-Ahmedpur
/ip route
add check-gateway=ping disabled=yes distance=1 gateway=192.168.1.254 \
routing-mark=To_WAN1
add check-gateway=ping distance=1 gateway=192.168.2.1 routing-mark=To_WAN2
add check-gateway=ping distance=1 gateway=192.168.1.254
add check-gateway=ping distance=1 gateway=192.168.1.254
add check-gateway=ping distance=1 gateway=192.168.2.1
add distance=1 dst-address=10.10.0.0/16 gateway=L2tp-Ahmedpur
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.10.0/24,192.168.5.0/24
set api-ssl disabled=yes
/ip traffic-flow
set enabled=yes
/system clock
set time-zone-name=Asia/Karachi