I’m trying to use an RB2011, running RouterOS 6.18, as the firewall/router for a new remote office. The company has an existing Linux OpenVPN server in the main office, and the RB2011 is intended to be an OpenVPN client, routing private traffic back to the office while allowing all other traffic to leave through the on-site network.
The server has a “ccd” file for the client, containing this line:
ifconfig-push 172.31.103.7 255.255.252.0
With every other client type (Windows, OS X, iOS, Android, and Linux openvpn) this line results in the client assigning that IP address, with that subnet mask, to the VPN interface (so in this example, the VPN interface would be 172.31.103.7/22, and the routing table would contain an entry for 172.31.100.0/22 pointing to the VPN interface.)
On the MikroTik, I’m seeing this:
[admin@MikroTik] /interface ovpn-client> /ip address print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 172.17.0.1/21 172.17.0.0 bridge-int
1 172.17.255.1/24 172.17.255.0 ether2-dmz
2 D 192.168.169.199/24 192.168.169.0 ether1-ext
3 D 172.31.103.7/32 255.255.252.0 Company VPN
As you can see, it’s using the subnet mask as the “network” for the VPN interface, and giving the network a /32 subnet mask instead.
Unless I’ve missed something, this appears to be a bug in how the MikroTik parses the IP assignment it receives from the OpenVPN server.
The router’s configuration…
[admin@MikroTik] /interface ovpn-client> export
# aug/06/2014 00:35:57 by RouterOS 6.18
# software id = ITJG-VRGN
#
/interface ovpn-client
add add-default-route=no auth=sha1 certificate=vlabs cipher=blowfish128 connect-to=108.33.151.189 \
disabled=no mac-address=FE:4B:8A:2F:3B:C1 max-mtu=1500 mode=ip name="Company VPN" password="" \
port=443 profile=default user=vlabs-router
Any ideas?