Greetings! (cross posting.. I had posted in ‘beginners’, but perhaps this is not exactly a beginners subject??)
I’ve been attempting to create a single node “road warrior” L2TP/IPSec config for my home. All I want is ONE LAPTOP to be able to VPN into my home network.
Tonight, I managed to get my OS X 10.11.6 El Capitan laptop to successfully establish a L2TP/IPSec VNP link to a 751G-2HnD running RouterOS 6.37.1.. I’m super proud.. BUT, while I can ping the local gateway interface, I cannot ping or use any other protocols to access devices located on my LAN, which is the main goal.. I’m PRETTY sure this is either a NAT traversal or IP FILTER rule issue, but I just don’t seem to be able to figure out what I’m doing wrong.
I should mention this same router already is a VPN client to a 750GL also running RouterOS 6.37.1 located in a vacation home. This site to site VPN link was relatively easy to setup and has been working flawlessly for some time now..
I’ve searched around the forums, and this seems like a fairly common issue, but so far the obvious solutions are not working to solve my issue..
I set up proxy arp:
[etimberl@routerA] /interface ethernet> export
# sep/17/2017 21:26:30 by RouterOS 6.37.1
# software id = XX4C-3VWZ
#
/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway
set [ find default-name=ether2 ] arp=proxy-arp name=ether2-master-local
set [ find default-name=ether3 ] master-port=ether2-master-local name=ether3-slave-local
set [ find default-name=ether4 ] master-port=ether2-master-local name=ether4-slave-local
set [ find default-name=ether5 ] master-port=ether2-master-local name=ether5-slave-local
[etimberl@routerA] /interface ethernet>
…to no avail..
I’ve LOOKED at my IP FILTER and NAT rules, and while I SUSPECT the problem lies therein, I just can’t see the problem..
Here are what i believe are the relevant /export hide-sensitive sections that I think covers my config.. Could I impose on someone a little more experienced than myself to perhaps point me in the direction I need to go to solve this dilemma??
[etimberl@routerA] > ip ipsec export hide-sensitive
# sep/18/2017 10:36:10 by RouterOS 6.37.1
# software id = XX4C-3VWZ
#
/ip ipsec mode-config
add address-pool=ericsdhcppool name=LAPTOP split-include=192.68.100.0/24
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
add name=incoming_vpn_proposal pfs-group=none
add auth-algorithms=sha512,sha256 name=LAPTOP
/ip ipsec peer
add address=0.0.0.0/0 enc-algorithm=aes-256,aes-192,aes-128 exchange-mode=main-l2tp \
generate-policy=port-strict local-address=192.168.100.35 passive=yes
[etimberl@routerA] > interface l2tp-server server export hide-sensitive
# sep/18/2017 10:36:36 by RouterOS 6.37.1
# software id = XX4C-3VWZ
#
/interface l2tp-server server
set authentication=mschap2 default-profile=Laptop enabled=yes max-mru=1460 max-mtu=1460 \
use-ipsec=yes
[etimberl@routerA] > ip firewall filter export
# sep/18/2017 10:36:47 by RouterOS 6.37.1
# software id = XX4C-3VWZ
#
/ip firewall filter
add chain=input port=1701,500,4500 protocol=udp
add chain=input port=1701 protocol=tcp
add chain=input protocol=ipsec-esp
add chain=input protocol=ipsec-ah
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established,related
add action=accept chain=input in-interface=!ether1-gateway src-address=192.168.100.0/24
add action=accept chain=forward connection-state=""
add action=drop chain=input in-interface=ether1-gateway
[etimberl@routerA] > ip firewall nat export
# sep/18/2017 10:36:58 by RouterOS 6.37.1
# software id = XX4C-3VWZ
#
/ip firewall nat
add action=accept chain=srcnat src-address=172.22.22.0/24
add action=accept chain=srcnat dst-address=192.168.88.0/24 src-address=192.168.100.0/24
add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway \
to-addresses=0.0.0.0
add action=dst-nat chain=dstnat dst-address-list=host_mtrcycllvr dst-port=8081 in-interface=\
ether1-gateway protocol=tcp to-addresses=192.168.100.27 to-ports=8081
add action=dst-nat chain=dstnat dst-address-list=host_mtrcycllvr dst-port=8082 in-interface=\
ether1-gateway protocol=tcp to-addresses=192.168.100.27 to-ports=8082
add action=dst-nat chain=dstnat dst-port=3457 in-interface=ether1-gateway protocol=tcp \
to-addresses=192.168.100.27 to-ports=22
[etimberl@routerA] >
How I got here - TOTAL Mikrotik newby some years ago, clicked “quick set”, then “Home AP”, adjusted some network numbers and called it done. Over the years have been slowly adding to and learning more about router OS. Adding scripts to handle backups, port forwarding, Dynamic DNS resolution, and the Site2Site VPN link.. I’ll freely admit I’m somewhat naive about NAT and IP FILTER rules, though I’ve recently made some effort to clean them up and truly understand them..
Thanks so very much for any kind assistance!
Sincerely,
Eric