I tried several MTU-s so far, but the problem is the same. If i want to ping a host that is working fine, there is not packet loss. On the speedtest.net i get 100/100 Mbit/sec.
So the web browsing is very slow.
If you search my old posts you’ll find some in-depth ones on MTU with screenshot examples of packet captures.
TLDR; if your PPPoE connection is 1480 then you’ll want your tunnel MTU to be 1480 - the tunnels overhead. Depending on the protocol (IPIP, GRE, IPSec transport vs tunnel) will determine exactly how much smaller. It’s a safe bet to set it to 1280 the minimum MTU of IPv6 and test. Their are calculators to help with calculating the ideal MTU bit you’ll find when crypto is added it becomes more difficult to determine a specific MTU because of the additional variables you need to account for.
Also, TCP MSS clamping is and should be unnecessary if MTU is set correctly and the necessary ICMP v4 and v6 messages are allowed. If you rely on it know it’s only doctoring TCP packets and no other protocol.
I tried lot of MTU, but i could not find the proper value. I tried L2TP/IPSec solution and that is working fine and assign public IP.
Hi Guys,
Just wanted to chime in here, this works abosulty awesome and thank you so much @Sob for taking the time to share your solution.
I am using a Hetzner Cloud VPS and ive found using a single vCPU, you can get around 400MBits, which ant bad at all. Adding an additional CPU produces around 800Mits. It seems to be CPU limited due to encryption so im looking at tweaking it a bit and see if can get a bit more out of it. All in all tho, really amazing thank you.
Here’s my config for Hetzner if anyones intrested, its slightly different (very very slight) due to hetzners routing/dhcp stuff.
KEY
94.xxx.xxx.150 - Local IP address of Hetzner Cloud VPS (local being what they provide you)
46.xxx.xxx.162 - IP address of endpoint (where you want the IP’s to work on)
172.30.4.1/32 - My local/LAN IP of my gateway on the network you want to use this on.
.. rest can be changed to what you like, I just used what he suggested to keep it simple for testing.
CHR Gateway (The side you buy/have the IP’s you want to use, Hetzner Cloud VPS in my case)
/interface ipip
add allow-fast-path=no ipsec-secret=*********** local-address=94.xxx.xxx.150 name=ipip-tunnel remote-address=46.xxx.xxx.162
/ip address
add address=172.16.1.2/30 interface=ipip-tunnel
/ip arp
add address=195.xxx.xxx.6 interface=ether1-gateway published=yes
/ip route
add dst-address=195.xxx.xxx.6/32 gateway=172.16.1.1
Destination Side (The side you want to use the IP’s)
/interface ipip
add allow-fast-path=no ipsec-secret=************ local-address=46.xxx.xxx.162 name=ipip-tunnel remote-address=94.xxx.xxx.150
/ip address
add address=172.16.1.1/30 interface=ipip-tunnel
add address=172.30.4.1/32 interface=ether2-master network=195.xxx.xxx.6
/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address=195.xxx.xxx.6 in-interface=ipip-tunnel new-connection-mark=server-public passthrough=no
add action=mark-connection chain=prerouting connection-mark=no-mark new-connection-mark=server-public passthrough=yes src-address=195.xxx.xxx.6
add action=mark-routing chain=prerouting connection-mark=server-public in-interface=ether2-master new-routing-mark=to-chr passthrough=no
/ip route
add dst-address=0.0.0.0/0 gateway=172.16.1.2 routing-mark=to-chr
On the server that I wanted the IP on which is on the destination network, I just used the following: (Assumes debian here):
# /etc/network/interces
interface eth0 inet static
address 195.xxx.xxx.6
netmask 255.255.255.255
gateway 172.30.4.1
Hope this can help anyone trying to achieve the same result using Hetzner.
Regards,
Majestic
Hi @Sob,
On an additional note, you don’t by any chance have a working IPv6 version of this?
This would need to be IPv6 over IPv4 i.e. for sites which don’t have native IPv6 yet.
If you have anything which you wouldn’t mind sharing I would really be apresahted.
Thank you.
Kind Regards,
Majestic
Hi Sob,
One thing I have noticed is, the outgoing packets seems to have the wrong source address. If you say do a curl ifconfig.io you will see the public IP of the end point which you used the IP’s from. Iv’e tried to add an SNAT rule but didn’t help, I expect its because of the interface/way I tried so if you can offer any suggesions would love to hear, thanks.
Update
Found the solution, adding the following code on the CHR (Router you get the IP’s from) fixes this.
/ip firewall nat
add action=src-nat chain=srcnat comment="Hetzner SNAT -- 195.xxx.xxx.6 via ether1-gateway (used with ipip tunnel)" out-interface=ether1-gateway src-address=195.xxx.xxx.6 to-addresses=195.xxx.xxx.6
Kind Regards,
Majestic
Wrong source address, if I understand correctly that it’s 94.xxx.xxx.150, it must be caused by another srcnat/masquerade rule. Instead of adding another srcnat, it’s better to use accept rule, to exclude 195.xxx.xxx.6 from srcnat completely. It doesn’t need any, it already has correct address.
IPv6 depends on how you get it. If a subnet would be routed to CHR, then you can just route part of it further over appropriate tunnel type, nice and clean. If not and it would be a subnet on WAN side of CHR, where you can only connect other hosts, then currently the only way would be to bridge everything all the way from CHR WAN to server. It should also be possible using some ND proxy, but RouterOS doesn’t have that.
Does Hetzner give public (IPv4) subnets on VPS? (Dedicated, yes)
Which VPS series are you running? CX series surely didn’t use to have even additional IPs and now there are only “floating ips”.
https://wiki.hetzner.de/index.php/IP-Adressen/en
https://wiki.hetzner.de/index.php/Cloud_floating_IP_persistent/en
Thanks, spot on, I had a srcnat rule on the 150 address, now all sorted, thank you.
With regards to IPv6 will have a play around now that I have an idea from what you have said, thank you.
Regards,
Majestic
Hi @Joni,
Hetzner has a failry recent new addition, not just their dedciated servers but also VPS’s (https://www.hetzner.com/cloud) and my CHR is on here currently. Using their “failover/extra IP” is working by routing it though to other network fine and yes these are the CX series. Whether the IPv6 will work, needs more investigations and will grab a range soon to test.
Hello Guys,
I have a similar scenario where I am trying to address my server with public ip addresses remotely via vpn tunnel. I have try the method Sob showed with the ipip tunnel and it works well for one server. I have a /28 I want to use to address multiple servers Can you assist with a sample config. CHR end 52.x.x.0/28. Need to address 12 servers so it doesn’t matter to me if I have to bridge it. I tried bridging it but I cannot seem to ping the isp gateway 52.x.x.1 but I can ping the CHR interface.
One address or twelve, there’s not much difference, you can use the same method, it will work.
Aye, confirmed myself with multiple addresses, works like a dream, thank you.
Thanks Guys.
Hello everyone. please, I have a preocupation, the same problem. i’m a beginner with Mikrotik.
I have set a pptp vpn between two sites A (192.168.2.0) and B (192.168.1.0) which works very well,
but I want to go through the internet to reach a machine from my local site, ie network B, as ip public: port → pptp vpn → local network machine.
for example 156.202.X.X:8963 → pptp vpn → 192.168.1.32:80
I tried many indications without success. thanks for the help.
My routers are RB2011UiAS-2HnD
RouterOS 7.7 tested:
extending majestic’s http://forum.mikrotik.com/t/public-ip-over-a-tunnel-solved/119294/1 post
CHR Gateway
/interface ipip
add allow-fast-path=no ipsec-secret=*********** local-address=94.xxx.xxx.150 name=ipip-tunnel remote-address=46.xxx.xxx.162
/ip address
add address=172.16.1.2/30 interface=ipip-tunnel
/ip arp
add address=195.xxx.xxx.6 interface=ether1-gateway published=yes
/ip route
add dst-address=195.xxx.xxx.6/32 gateway=172.16.1.1
Destination Side
/interface ipip
add allow-fast-path=no ipsec-secret=************ local-address=46.xxx.xxx.162 name=ipip-tunnel remote-address=94.xxx.xxx.150
/ip address
add address=172.16.1.1/30 interface=ipip-tunnel
add address=172.30.4.1/32 interface=ether2-master network=195.xxx.xxx.6
+++ /routing table
add disabled=no fib name=to-chr
/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark dst-address=195.xxx.xxx.6 in-interface=ipip-tunnel new-connection-mark=server-public passthrough=no
add action=mark-connection chain=prerouting connection-mark=no-mark new-connection-mark=server-public passthrough=yes src-address=195.xxx.xxx.6
add action=mark-routing chain=prerouting connection-mark=server-public in-interface=ether2-master new-routing-mark=to-chr passthrough=no
--- /ip route add dst-address=0.0.0.0/0 gateway=172.16.1.2 routing-mark=to-chr
+++ /ip route add dst-address=0.0.0.0/0 gateway=%ipip-tunnel routing-table=to-chr
— removed lines
+++ added lines