@Larsa
I did try this, yesterday, I think it was even your recommendation. I tried to turn off both Windows FW and also MK and the combination.
For the 651 I also bumped into the articles you mention and reinstalled the network driver as well as the L2TP minidriver updated to latest windows KBs and the drivers for the adapters and restarted the computer. Still was getting same issue.
Since I am getting the same error code also on 3 other windows machines, I believe it might not be really a windows issue.To be sure, I setup a new laptop with a fresh W10 installation and got 651 error the moment I hit the connect button.
When I looked to MK logs it went OK through Phase 1 (Identity protection) than it dropped.
MK LOG
@CZFan
I completely scrapped the PTPT setup, I left the GRE there for WOL, but since you mention it. I the GRE was behind DROP Invalid rule not drop everything - i thought this rule should be rather at the
beginning, as it drops just invalid packets not tp process them through other rules, no? For further tests i rather moved it down to make sure it was not an issue.
I added the rules like suggested, but it still issues the same message.
This is how the FW looks now - is that what you had in mind?
MK FW
# nov/27/2020 14:50:47 by RouterOS 6.47.7
# software id = B8RB-MITG
#
# model = RBD53iG-5HacD2HnD
# serial number = D96C0C4CC55D
/ip firewall layer7-protocol
add comment="Steam L7" name=Steam regexp="^..+\\.(steam|valvesteampowered|stea\
mcommunicty|steamgames|steamusercontent|steamcontentsteamstatic).*\$"
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=accept chain=input comment="allow L2TP" dst-port=500,1701,4500 \
protocol=udp
add action=accept chain=input comment="allow ipsec" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="Remote admin" dst-port=8291 protocol=\
tcp
add action=accept chain=input comment="GRE for WOL" protocol=gre
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=fasttrack-connection chain=forward comment="Fastrack Steam" \
connection-mark=steam-connection
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-connection chain=forward comment="Steam UDP Ports" \
new-connection-mark=steam-connection passthrough=no port=\
2700-28999,3478,4379,4380 protocol=udp
add action=mark-connection chain=forward comment="Steam TCP Ports" dst-port=\
27015,27036,27037 new-connection-mark=steam-connection passthrough=no \
protocol=tcp
add action=mark-connection chain=forward comment="Steam HTTPS" dst-port=443 \
new-connection-mark=steam-connection passthrough=yes protocol=tcp
add action=mark-connection chain=forward comment="Steam L7" layer7-protocol=\
Steam new-connection-mark=steam-connection passthrough=no protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
add action=accept chain=dstnat dst-port=5001 protocol=tcp src-address=\
192.168.2.20
Basically, I am even willing to create a test user for you to test remotely with your client whether you get the same or not.
Let me know if you would do so I would send you a PM
