RB4011iGS+ and Open VPN no routing, no ping etc..

massimo · February 27, 2025, 1:24pm

Hi all,

with the device in the subject, OS version 7.18 i’ve created an OpenVPN VPN service, i’m able to access the VPN from remote PCs,
but DNS do not work, i don’t ping anything except the same device, i don’t access anything.

The remote LAN is 192.168.1.x, while the OpenVPN profile net is on 192.168.90.x
I see that this is a common problem around, but as for everything i didn’t find any real solution searching the web.

I tried to add a route entry in the openvpn file on the Client remote PC, i’ve tried with a masquerade srcnat for the open-vpn net (192.168.90.x),
but nothing work.

Any help?
thanks

massimo

massimo · March 28, 2025, 10:08am

Any help?
Please

massimo

erlinden · March 28, 2025, 10:10am

Can you please share your current config:

/export file=anynameyoulike

Remove serial and ny other private info, post between code tags by using the </> button.

massimo · March 31, 2025, 7:54am

hi all,
i've removed all the "privacy stuff"

thanks
massimo

2025-03-28 15:39:01 by RouterOS 7.18

software id = JM2P-5G5V

model = RB4011iGS+

serial number =

/interface bridge
add admin-mac=XY:XY:XY:XY:XY:XY auto-mac=no comment=defconf name=bridge
port-cost-mode=short
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec profile
set [ find default=yes ] dh-group=modp2048 dpd-interval=2m
dpd-maximum-failures=5 enc-algorithm=aes-256,3des
add dh-group=modp2048 dpd-interval=2m dpd-maximum-failures=5 enc-algorithm=
aes-256 hash-algorithm=sha256 name=myplace
/ip ipsec peer
add address=1.2.3.4/32 name=myplace profile=myplace
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=aes-256-cbc
pfs-group=modp2048
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc name=myplace
pfs-group=modp2048
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=vpn ranges=192.168.89.3-192.168.89.253
add name=o-vpn ranges=192.168.90.3-192.168.90.253
/port
set 0 name=serial0
set 1 name=serial1
/ppp profile
add change-tcp-mss=yes dns-server=192.168.1.x,192.168.1.y local-address=
192.168.90.1 name=ovpn-profile remote-address=o-vpn use-compression=yes
use-encryption=yes use-ipv6=no
set *FFFFFFFE dns-server=192.168.1.x,192.168.1.y local-address=
192.168.89.1 remote-address=vpn use-compression=yes use-ipv6=no
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether6 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether7 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether8 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether9 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether10 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus1 internal-path-cost=
10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set authentication=chap,mschap2 enabled=yes use-ipsec=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
add auth=sha512 certificate=server cipher=aes256-cbc,aes256-gcm
default-profile=ovpn-profile disabled=no mac-address=x:y> > y> > y
name=ovpn-server1 tls-version=only-1.2 user-auth-method=mschap2
/ip address
add address=192.168.1.24/24 comment=defconf interface=bridge network=
192.168.1.0
add address=a.b.c.d/29 interface=ether1 network=a.b.c.e
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server
add address-pool=default-dhcp disabled=yes interface=bridge lease-time=10m
name=defconf
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf dns-server=192.168.1.x gateway=
192.168.1.x netmask=24
/ip dns
set allow-remote-requests=yes servers=1.2.3.4,1.2.3.5
/ip dns static
add address=192.168.1.x comment=defconf name=router.lan type=A

/ip firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=accept chain=input comment="allow IPsec NAT" dst-port=4500
protocol=udp
add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
add action=accept chain=input comment="OpenVPN (temporanea)" dst-port=1194
in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=forward comment="defconf: accept in ipsec policy"
ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop all not coming from LAN"
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept out ipsec policy"
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
"defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.88.0/24 src-address=
192.168.1.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=
192.168.89.0/24
add action=masquerade chain=srcnat src-address=192.168.90.0/24

/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec identity
add peer=myplace
/ip ipsec policy
add dst-address=192.168.88.0/24 peer=myplace proposal=myplace
src-address=192.168.1.0/24 tunnel=yes
/ip smb shares
set [ find default=yes ] directory=pub
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=
33434-33534 protocol=udp
add action=accept chain=input comment=
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=
udp src-address=xyz::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=input comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
add action=accept chain=forward comment=
"defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1"
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=
ipsec-esp
add action=accept chain=forward comment=
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=
"defconf: drop everything else not coming from LAN" in-interface-list=
!LAN
/ppp secret
add name=user1
add name=user2 service=ovpn
/system clock
set time-zone-name=A/B
/system identity
set name=myfw
/system note
set show-at-login=no
/system routerboard settings
set enter-setup-on=delete-key

rplant · April 3, 2025, 3:11am

Hi,

I would initially make the ovpn-profile setting have the following settings.
interface-list=LAN and dns-server=192.168.90.1

You can tie it down more (perhaps with a OVPN interface list) and appropriate firewall rules when all is working.

/ppp profile
add change-tcp-mss=yes dns-server=192.168.90.1 local-address=
192.168.90.1 name=ovpn-profile remote-address=o-vpn use-compression=yes interface-list=LAN
use-encryption=yes use-ipv6=no

That way when you connect, you should be able to get something from the DNS server
and be able to logon to the router.

Then you can work on getting it to connect to other devices on the router network.
(Likely will need routes at the client)

I would also perhaps change the nat rule

/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.90.0/24 out-interface=bridge

massimo · April 28, 2026, 7:15pm

Thanks for the answer, i’ve survived one year with L2TP VPN, since Open VPN is still not working.
But since L2TP don’t work with all users internet connections i need also Open VPN.

I’ve the firewall nat rule like you wrote, but nothing change.

I’ve set 192.168.90.1 as DNS and LAN in the interface-list, this is making me surfing the web, but
it’s unuseful for me (i guess this setup force the use of my PC’s client local DNS, while as DNSs i need the 2 active directory DNSs in the remote office LAN 192.168.1.x.).

Any suggestion?

I can’t understand why L2TP dial-up vpn see correctly the servers, but Open VPN still don’t the see the office’s servers/LAN.

massimo