I have a problem that I can’t solve on my own and I hope you can help me.
I have two mikrotik connected by ipsec between them. They’re both connected and you can see each other. What’s the problem? I have a computer on a subnet of one of the mikrotiks that I can’t access from the other mikrotik.
The configuration of both mikrotik is as follows:
Mikrotik1
LAN: 192.168.0.28/30
Mikrotik2
LAN: 172.16.0.0/16
On the Mikrotik 1 LAN I have a computer with IP 192.168.0.30 without a gateway. This computer cannot have a gateway.
From the Mikrotik2 I can ping the IP 192.168.0.29 (IP of Mikrotik 1) but I cannot reach the computer with IP 192.168.0.30.
Could someone tell me how to get from the Mikrotik2 LAN to the computer with IP 192.168.0.30 without gateway, in the Mikrotik1?
“They see each other” is not enough. If you can reach one Mikrotik by its private IP from another one’s private IP, it means that the tunnel itself works, but firewall rules may prevent devices connected to the Mikrotiks from seeing each other although the Mikrotiks themselves do. So the first step should be to temporarily connect something else instead of that problematic computer, with same IP settings (192.168.0.30/30 and default gateway 192.168.0.29) and make sure it is remotely accessible via the VPN; only after this step you may proceed with dealing with the routing limitations.
Next, there may be many reasons why the “gateway cannot be set” on the problematic computer. Either it is really a limitation of its network stack, or it may be an issue that the interface you use is not the primary one an it is either not possible to set up a (non-default) route through it or you don’t know how to do it. Depending on that, the solution may vary from setting up a DHCP server which provides a routing table without a default route, through setting a proxy-arp mode on the LAN port (where nothing but the problematic device is connected anyway), down to setting a src-nat on that LAN port as the last resort (which means that the problematic device will see all traffic to come from 192.168.0.29 but this may not be an issue for you).
The tunnel is currently running. You can ping from one Mikrotik to the other, to the IP of each Mikrotik in the LAN. For example: Mikrotik1 can ping to IP 172.16.0.1 and Mikrotik2 can ping to IP 192.168.0.29.
From Mikrotik1 I can ping IP 192.168.0.30, but from Mikrotik2 (remote) I cannot ping that IP.
The device with IP 192.168.0.30 cannot have a gateway for certain reasons. The solution would be to put a gateway in the configuration of the equipment, but it is not what I want.
The proxy-arp is enabled on the Mikrotik1’s LAN.
What I need is to be able to ping from the Mikrotik2 to the IP 192.168.0.30 which is in the Mikrotik1.
Is there any possibility to establish a gateway on the mikrotik1 for the device with IP 192.168.0.30 or any route that will get me from the Mikrotik2 to that device?
“can ping the own LAN address of the remote Mikrotik” and “can ping an address of a device in the LAN subnet of the remote Mikrotik” are two different things from the point of view of the firewall on the remote Mikrotik, because the former case is handled by filter chain input whilst the latter is handled by filter chain forward.
In that case, one way which doesn’t need anything to change on the device itself is to let the device see all requests from Mikrotik2’s LAN as if coming from the address of Mikrotik1 which is within the same subnet as its own IP on that interface, so packets towards that address do not need any gateway and can be sent directly. To achieve this, set up a src-nat rule on Mikrotik1: /ip firewall nat add chain=srcnat dst-address=192.168.0.30 action=src-nat to-addresses=192.168.0.29
This could also be a way, but it would require that the mask on that device was shorter (possibly down to 0 if it doesn’t interfere with anything else, you don’t share the details of that device’s configuration) - at least as wide so that it would cover both 192.168.0.30 and 172.16.0.0/16 simultaneously, which would mean /1 (and it already covers half of the whole IP address range so it is probably not a good idea). This would be necessary so that the device would assume that the 172.16.x.x is on its LAN subnet and send an ARP request for it, which the Mikrotik1 would respond under certain circumstances.
I still can’t access the computer with IP 192.168.0.30 This IP is set on a subnetwork card, so no gateway can be set.
The tunnel still works, I can ping to IP 192.168.0.29, I can ping from Mikrotik1 to IP 192.168.0.30 but not from the remote Mikrotik… I don’t know how to continue.
Show me the whole output of /ip firewall nat print on Mikrotik1. As you say you can ping the 192.168.0.30 from Mikrotik1, the rule you’ve added must be shadowed by some other one, or you must have mistakenly added it to Mikrotik2 instead of Mikrotik1.
Either you have manually set somewhere in /ip firewall raw a rule with an action=notrack for the traffic from 172.16.0.0/24 to 192.168.0.28/30 (or more), or you have set notrack-chain=forward in /ip ipsec identity. Due to that, connection tracking is disabled for the tunneled traffic, and therefore NAT cannot work.