Hello,
i need little help with L2TP/IPSec VNP. ere is what is going…
I got working VPN on ROS, which is on Public IP and two clients on same LAN on remote location.
One client is able to connect and the second isnt, is it possible to resolve this in some way ?
thank you for reply
nobody ? 
somebody must know something about this 
U need to explane a bit more. Maybe with your config.
thank you for reaction. I will try to explain my problem more…
Im trying to use L2TP/IPSec VPN. For now I have router with public IP and working VPN server, configured by several manuals to work with windows… but the problem is this.
When a client try to connect to VPN server, everything work fine, VPN is established and network is reachable. But if there is another client on the same remote network and he try to connect to VPN server, the connection will fail, because there is established connection and remote peer for the first client with same IP. even if first client disconects and second try to connect, he fails (because of remote peer on the router with same IP)
Is it possible to resole this in some way ?
here is config I use:
Firewall rules:
196 ;;; L2TP/IPSec VPN na router
chain=input action=accept protocol=udp in-interface=eth01.WAN
dst-port=500
197 chain=output action=accept protocol=udp out-interface=eth01.WAN
src-port=500
198 chain=input action=accept protocol=udp in-interface=eth01.WAN
dst-port=1701
199 chain=output action=accept protocol=udp out-interface=eth01.WAN
src-port=1701
200 chain=input action=accept protocol=udp in-interface=eth01.WAN
dst-port=4500
201 chain=output action=accept protocol=udp out-interface=eth01.WAN
src-port=4500
IPSec rules:
;;; L2TP VPN
address=0.0.0.0/0 port=500 auth-method=pre-shared-key
secret="supersecretpassword" generate-policy=yes
exchange-mode=main send-initial-contact=no nat-traversal=yes
my-id-user-fqdn="" proposal-check=obey hash-algorithm=sha1
enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0
IPSec proposal:
name="L2TP/IPSec VPN" auth-algorithms=sha1 enc-algorithms=3des
lifetime=1d pfs-group=modp1024
still nobody ?
I think you have one l2tp server (?) and one secret config (?) if you have a lot of user you need separetly secret and l2tp server for each user.
(but this is a idea I haven’t done l2tp only openvpn and ipsec tunnel)
yes, there is posibility to turn on only one server and users are dynamic
no, every user have his own secret
I think there will be some problem with IPSec, not L2TP
nobody ?
Come on guys
Ok, I will try your config, but I have openvpn config too in our routers and it is same.
There are in the secret IPs of user: local and remote.
If you have secrets separately for users then you need to add local and remote IP pair and you have to use /30 (255.255.255.252) mask!! (eg. …0 is net, … 1 is local, …2 is remote, …3 is broadcast)
And you can use …5 …6 but you can not use …11 …12 pair… and more.
(You didn’t copy/paste to here secret config.)
What is your ROS version??
"nat-traversal=yes "
Why?
and where is this?
add action=accept chain=input disabled=no protocol=ipsec-esp in-interface=eth01.WAN;
(ip protocol 50 for ESP)
Thank you.
users have IPs from DHCP server, only local address are manualy entered (on the router side)
this is ppp profile config
0 * name=“default” local-address=192.168.1.1 remote-address=LAN use-mpls=default use-compression=yes use-vj-compression=yes use-encryption=required only-one=no change-tcp-mss=yes rate-limit=10m/10m dns-server=192.168.1.10 wins-server=192.168.1.10
and ppp secrets are on this profile
v5.14 on RB1100AHx2
NAT travelsal
because almost every user conecting from behind some NATed network
ipsec-esp
I had this rule in firewall, but it wasnt used in any way (there were no packet flow) so I deleted it and it works without it
Ok, you are right!
Need NAT-T for NATed user.
But I don’t understand your all config because I tested today with my 1100AH (ROS 5.14) and I needed this:
mod: I tested with: win7, winXP and Android phone are working well.
(you need separate l2tp-server /user with user-name)
/interface l2tp-server
add disabled=no name=l2tp-in1 user=l2tp-test
/interface l2tp-server server
set authentication=mschap2 default-profile=profile1 enabled=yes
max-mru=1460 max-mtu=1460 mrru=disabled
(you need separate secret /user)
/ppp secret
add caller-id=“” disabled=no limit-bytes-in=0 limit-bytes-out=0 name=l2tp-test
password=gizi123 profile=profile1 routes=“” service=l2tp
/ppp profile
add change-tcp-mss=default local-address=l2tp-pool name=profile1 only-one=default
remote-address=l2tp-pool use-compression=yes use-encryption=yes use-ipv6=no
use-mpls=default use-vj-compression=yes
ipsec peer
/ip ipsec peer
add address=0.0.0.0/0 auth-method=pre-shared-key dh-group=modp1024
disabled=no dpd-interval=2m dpd-maximum-failures=5 enc-algorithm=3des
exchange-mode=main-l2tp generate-policy=yes hash-algorithm=sha1 lifetime=
1d my-id-user-fqdn=“” nat-traversal=yes port=500 secret=giziipsec
send-initial-contact=no
(because if you use generated ipsec policy then it will use default proposal)
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha1 disabled=no enc-algorithms=
3des,aes-128,aes-192,aes-256 lifetime=30m name=default pfs-group=modp1024
ip pool for IP assignments (not DHCP-server what you wrote)
/ip pool
add name=l2tp-pool ranges=192.168.99.2-192.168.99.100
firewall rules
/ip firewall filter
add action=accept chain=input disabled=no protocol=ipsec-esp
add action=accept chain=input connection-state=new disabled=no dst-port=500 protocol=udp
add action=accept chain=input connection-state=new disabled=no dst-port=1701 protocol=udp
add action=accept chain=input connection-state=new disabled=no dst-port=4500 protocol=udp
add action=accept chain=forward comment=“l2tp test” connection-state=new disabled=no src-address=192.168.99.0/24
Thank you so very much. This worked perfectly for me!!! Been wanting to get L2TP working instead of PPTP. Now I can disable PPTP connections.
Further question, following your instructions worked well. However…
If I create a new ‘secret’ for a new user and they try to simultaneously connect at the same time they can but one user will lose network access.
I have also created a new l2tp server interface and mapped the new user to it and the same thing still happens.
Specifics:-
User A connects to VPN. User A pings device on remote network. Device ping responds OK.
User B connects to VPN. User A can no longer ping that device but User B can.
User A will no longer have access to any device on remote network until they disconnect and reconnect.
Any advice?
Please check assigned IPs for userA and userB.
Do you use pool for local and remote IP assignements?
Solutions:
and how could you test it? from same public IP? because ipsec can not generate policy rule if you come same public IP.
(I tested it)
eg. if your users behind same firewall and it has a public IP and it is NATing your users then they will be shown with same public IP
Thanks for your reply.
The only difference was under the ipsec peer setup I used exchange-mode=main instead of exchange-mode=main-l2tp as the version on my mikrotik was 5.6 and did not support main-l2tp. I upgraded to 5.14 and changed it to use main-l2tp and it appears to be working ok now.
Thanks for your help.
Hi,
thank you for your exhausive explanation however, I have problem you described above
and how could you test it? from same public IP? because ipsec can not generate policy rule if you come same public IP.
(I tested it)
eg. if your users behind same firewall and it has a public IP and it is NATing your users then they will be shown with same public IP
this is what I need to solve. I got plenty of users on one remote LAN (with 1 public IP) and only the firs one is able to connect, others are screwed
- (you need separate l2tp-server /user with user-name)
/interface l2tp-server
add disabled=no name=l2tp-in1 user=l2tp-test
/interface l2tp-server server
set authentication=mschap2 default-profile=profile1 enabled=yes
max-mru=1460 max-mtu=1460 mrru=disabled
I dont think I need to create interface for every user when they are created dynamicaly by default
- (you need separate secret /user)
/ppp secret
add caller-id=“” disabled=no limit-bytes-in=0 limit-bytes-out=0 name=l2tp-test
password=gizi123 profile=profile1 routes=“” service=l2tp
Yes I have this, every user have its own secret
/ppp profile
add change-tcp-mss=default local-address=l2tp-pool name=profile1 only-one=default
remote-address=l2tp-pool use-compression=yes use-encryption=yes use-ipv6=no
use-mpls=default use-vj-compression=yes
I have configured profile for VPN
/ip ipsec peer
add address=0.0.0.0/0 auth-method=pre-shared-key dh-group=modp1024
disabled=no dpd-interval=2m dpd-maximum-failures=5 enc-algorithm=3des
exchange-mode=main-l2tp generate-policy=yes hash-algorithm=sha1 lifetime=
1d my-id-user-fqdn=“” nat-traversal=yes port=500 secret=giziipsec
send-initial-contact=no
I have hanged from main to main-l2tp and see what will happen
- (because if you use generated ipsec policy then it will use default proposal)
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha1 disabled=no enc-algorithms=
3des,aes-128,aes-192,aes-256 lifetime=30m name=default pfs-group=modp1024
I came to this
- ip pool for IP assignments (not DHCP-server what you wrote)
/ip pool
add name=l2tp-pool ranges=192.168.99.2-192.168.99.100
Why VPN user cannot get IP from same server as locally connected user ? I see no diference
- firewall rules
/ip firewall filter
add action=accept chain=input disabled=no protocol=ipsec-esp
add action=accept chain=input connection-state=new disabled=no dst-port=500 protocol=udp
add action=accept chain=input connection-state=new disabled=no dst-port=1701 protocol=udp
add action=accept chain=input connection-state=new disabled=no dst-port=4500 protocol=udp
add action=accept chain=forward comment=“l2tp test” connection-state=new disabled=no src-address=192.168.99.0/24
[/quote]
As i sad before, I had rule for protocol=ipsec-esp, but there wasnt any packet flow, so I deleted it, I will add it again ans see what will happen
by the way thank you for your time