Hello Mikrotik team,
i was tring to use a client VPN as my gateway but it seems that it fail. that what i want and that what i did:
What i want is
Users -----} VPN -----} Internet
i want to hide my users behinde VPN
what i did for that is
Make a PPTP connection and select add default route check box every thing is ok for this connection it connect well no problems.asi see a new route and a new address when it is connected.
But when checked my web behinde mikrotik i see that still my real ip is available to others not my VPN one. what i miss also do i need to reconnfigure anything else?
I see no default route for the VPN tunnel is the first thing that pops out to me. The router needs to know the route and it needs to have a smaller weight so it will use that by default for all traffic. However I am guessing you don’t want the router itself to use the VPN tunnel as it’s default route, so your setup is going to be a bit more complicated because of this and because you are using the proxy. I also see a hotspot rule in there, so I’m not sure if you are using the hotspot or not.
First of all, when using the proxy, all HTTP requests will be handled by the router, this means that all HTTP traffic leaving the router will be on the output chain. Also the Transparent Proxy only works on HTTP traffic, not HTTPS just to make you aware. Keeping that in mind, here are a couple of steps that should get you started in the right direction.
In the mangle rules in the prerouting chain, set up a rule that will mark connections coming from the LAN subnet that are not destined to a local address, add in it being authorized on the hotspot if you are using that. You will also need another rule in the output chain that will mark connections with a dst-port of 80 with a similar connection mark. Set up one more rule that will mark for routing based off of those connection marks.
Chances are in NAT you are going to have to set up a rule that will NAT the correct IP address on traffic heading out of the router for dst-port 80.
Set up a route that will send traffic out of the VPN when it has the correct routing mark.
I think this here should get you started down the right path at least. This is all of the top of my head and I haven’t ever done a setup quite like this so you will probably have to adjust these a bit more to fit your need and situation.
Yes these rules should work even with the Hotspot and Proxy, like I said however, you will probably need to make some adjustments on your part to get it going like you want.
That was just an IP I used as an example, most of the time when you see 1.1.1.1 or 2.2.2.2 it’s just an example and needs to be replaced with whatever IP you need it to be. It needs to be the IP address of the VPN interface on the MikroTik, this is so the traffic leaving that interface will be NATed to the correct IP address and can be routed and handled by the other end of the tunnel correctly.
That’s what the first mangle that I posted covers. Any new connections coming from 10.10.10.0/24 that are not destined for a local address to the MikroTik and are authorized on the hotspot get marked to be sent out of the VPN tunnel. The second rule covers the Proxy HTTP requests getting sent out of the VPN tunnel.
First thing to answer is, are you able to ping outside addresses from VPN tunnel using that routing table? With the ping utility either in WinBox or by the CLI you can specify a routing table to be used, this will tell you if you are able to pass traffic over the tunnel and that the route is working right.
Second thing, order of firewall rules is very important. The rules are processed in the order that they appear within the same chain. So if a packet hits a rule that is higher up in the chain, it will not be processed by rules further down in that chain.
Your masquerade rule is a little weird in that you are specifying the out interface as the LAN. Is there any reason for that? If not, then I would modify the rule to remove the out interface and specify the src-address as the LAN subnet you want to go out of the tunnel. This should take care of NATing normal client connections out of the tunnel. By making those changes, it should make it so this rule is no longer needed.
This rule is probably too far down on the list to be hit by anything. I would move it further up the list, probably higher than or just bellow the masquerade rule.
Remember that Torch is your friend. Set it up to watch a specific WAN interface and see if traffic is leaving those interfaces, and if so, what IP address they are being NATed to. Also watch your firewall rules to see if they are incrementing properly when you try and pass traffic, this will tell you if the rules are being hit at all. Connection tracking is a good place to look to see if your connections are being marked properly.