Hello
I have little problem to see other subnets after connect by VPN.
I have 3 subnets:
192.168.2.1
10.9.8.1
10.9.6.1
If i give vpn address from 192.168 2.1 pool i can connect to all hosts in this pool.
10.9.8.1 give me access to 8.1 devices and 6.1 to 6.1. etc.
But i want to see from 10.9.6.1 to 192.168.2.1 subnet hosts.
And a wird thing for example:
I can see in 10.9.6.1 all host in 10.9.8.1subnet but I can't see 192.168.2.1 subnet.
This problem not occour wthout VPN connection inside company.
Tried all kind of VPN's
My config in short:
model = RB1100Dx4
serial number = 9BD80BAE53CD
/interface bridge add arp=proxy-arp name=bridge protocol-mode=none
/interface ethernet set [ find default-name=ether1 ] arp=proxy-arp
/interface list add name=WAN
/interface list add name=LAN
/interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec profile set [ find default=yes ] dpd-interval=3m20s
/ip ipsec proposal set [ find default=yes ] auth-algorithms=sha256,sha1 enc-algorithms=aes-256-cbc,3des pfs-group=none
/ip pool add name=vpn-pool-main ranges=192.168.2.36-192.168.2.57
/ip pool add name=vpn-l2tp ranges=10.9.6.100-10.9.6.200
/ip dhcp-server add address-pool=dhcp-pool authoritative=after-2sec-delay disabled=no interface=bridge name=dhcp
/ppp profile add bridge=bridge change-tcp-mss=yes dns-server=192.168.2.1 local-address=192.168.2.1 name=LT2TP-IPSEC remote-address=vpn-pool-main use-encryption=yes
/ppp profile add bridge=bridge change-tcp-mss=yes dns-server=192.168.2.1 interface-list=LAN local-address=192.168.2.1 name=ipsec remote-address=vpn-l2tp use-encryption=yes
/ppp profile add bridge=bridge dns-server=192.168.2.1 local-address=192.168.2.1 name="OVPN MAIN" queue-type=ovpn-default remote-address=vpn-pool-main use-compression=no use-encryption=required
/interface l2tp-server server set authentication=mschap2 default-profile=LT2TP-IPSEC enabled=yes ipsec-secret=xxxxxxxxxxxxxxxxxxx keepalive-timeout=3600 use-ipsec=yes
/interface list member add interface=ether1 list=WAN
/interface list member add interface=bridge list=LAN
/interface ovpn-server server set certificate=cert_serwer cipher=aes128,aes256 enabled=yes keepalive-timeout=3600 max-mtu=1460 require-client-certificate=yes
/interface pptp-server server set max-mru=1460 max-mtu=1460
/ip address add address=xxx.xxx.xxx.xxx/26 comment="WAN master static" interface=ether1 network=xxx.xxx.xxx.xxx
/ip address add address=192.168.2.1/24 comment="LAN MAIN" interface=bridge network=192.168.2.0
/ip address add address=10.9.8.1/24 comment="LAN master Kamery" interface=bridge network=10.9.8.0
/ip address add address=10.9.6.1/24 comment="ipsec vpn" interface=bridge network=10.9.6.0
/ip dhcp-server network add address=192.168.2.0/24 comment="LAN NET" dns-server=192.168.2.1 gateway=192.168.2.1 netmask=24
/ip dns set allow-remote-requests=yes servers=194.204.152.34,8.8.8.8
/ip dns static add address=192.168.2.1 name=router type=A
/ip firewall filter add action=accept chain=input comment="Accept ICMP" protocol=icmp
/ip firewall filter add action=accept chain=input comment=l2tp dst-port=500,1701,4500 in-interface-list=WAN protocol=udp
/ip firewall filter add action=accept chain=input in-interface-list=WAN protocol=ipsec-esp
/ip firewall filter add action=accept chain=input in-interface-list=WAN protocol=ipsec-ah
/ip firewall filter add action=accept chain=forward disabled=yes dst-address=10.9.6.0/24 src-address=192.168.2.0/24
/ip firewall filter add action=accept chain=forward disabled=yes dst-address=192.168.2.0/24 src-address=10.9.6.0/24
/ip firewall filter add action=accept chain=forward comment="VPN drop outside bridge" in-interface=all-ppp out-interface=!bridge
/ip firewall filter add action=accept chain=input comment=OVPN dst-port=1194 protocol=tcp
/ip firewall filter add action=accept chain=input comment="Accept established" connection-state=established
/ip firewall filter add action=accept chain=input comment="Accept related" connection-state=related
/ip firewall filter add action=drop chain=input comment="Drop not accepted from wan" in-interface=ether1
/ip firewall filter add action=drop chain=input comment="Drop not accepted from wan" disabled=yes in-interface=ether2
/ip firewall filter add action=accept chain=forward comment="Accept established" connection-state=established
/ip firewall filter add action=accept chain=forward comment="Accept related" connection-state=related
/ip firewall filter add action=drop chain=forward comment="Drop invalid" connection-state=invalid
/ip firewall filter add action=drop chain=input comment="Drop from Play" in-interface=ether10
/ip firewall nat add action=masquerade chain=srcnat comment=NAT out-interface=ether1
/ip firewall nat add action=masquerade chain=srcnat disabled=yes ipsec-policy=out,none out-interface-list=WAN