Hi, im trying to learn about the Mikrotik RB750G after dumping a cisco small business router and am getting a little stuck…
Ive been jumping on youtube etc to figure out setups and managed to get a VPN setup and working (yey!). The trouble is i have now followed another tutorial to setup a dual WAN (https://www.youtube.com/watch?v=BXf9vaevSMI), which works great and even gives me better speeds… But the trouble is now that when i go offsite and connect to the VPN, i cant see anything and I’m at a loss!. I can connect to the router via winbox but anything outside of that just isnt happeneing.
The issues are now, CCTV isn’t forwarding traffic to the DVR so the CCTV app wont work.
With PPP VPN connected when offsite i cannot RDP to the Server, get to the VMWare web UI, connect to the servers files via an explorer window, or connect to the CCTV web UI either?!
port 1 - WAN Static IP
Port 2 - WAN DHCP
Port 3 - LAN to Ubiquiti switch
maybe add to your signature to use the terminal, i was going through menus looking for an export option But eventually found it. i have replace externals as you suggested and changed usernames to user1 etc. I hope this makes sense to someone to see where ive got wrong! Thanks
Its may also worth noting that we have a static WAN and a DHCP WAN (192.168.1.xxx given form the dhcp modem) The static is the one we use for the vpn and for the cameras and the DHCP is just there as load balancing/failover so the site can keep running if one of the lines go down.
So most important, your firewall is nonexistent in the sense of protecting the router itself from unauthorized access at network level. As there is nothing in chain=input of /ip firewall filter, and as you haven’t at least configured allowed ranges for the individual management services (winbox, api, http, telnet, ssh - but this way is not as safe as firewall rules), the only thing that stands between full access to management of your router and the attacker is the username and password. So it is quite likely that by now you are not the only administrator of your router any more.
Regarding your original issue, both the VPN types you use are L3 point-to-point tunnels, and thus assigning IP addresses from the LAN subnet to the clients causes routing issues - the LAN clients assume that the VPN clients are in the same subnet, so they send ARP requests for them and get no response. This can be addressed in two ways, each has its advantages and disadvantages. The cleaner one is to use an address pool outside the LAN subnet for the VPN clients, but then Windows hosts on LAN with default firewall configuration do not respond pings from VPN clients; the other one is to set the arp property of the LAN interface of the router to proxy-arp; with this setting, the router responds to ARP requests coming from LAN if the queried IP address is directly reachable via another interface (in this case, the VPN tunnel) with its own MAC address, so the LAN hosts sends the packet to the router and the router can deliver it to the actual destination.
But this “cannot reach LAN hosts from VPN clients” issue has nothing to do with the dual WAN setup - the part of your configuration which is related to the dual WAN looks fine to me. Regarding “CCTV isn’t forwarding traffic to the DVR”, where are these two devices connected? Both are in LAN or the CCTV is on LAN of this Mikrotik and the DVR is on another site and should be accessible through VPN?
I followed a basic setup i found online and presumed some basic firewall would have been in place, Thanks for pointing it out, i will do some googling to look at firewall setups.
when I setup the VPN there was a ‘local address’ and ‘remote address’ . the local i set as the gateway Ip and the remote i set as the IP i want the connecting VPN to be assigned, are those correct or should i leave the remote one blank (or both) as the masquerade is set to 192.168.89.0 for VPN traffic so will this conflict?
the DVR and IP cameras are on the same plan. The CCTV has an app to connect to the local unit and was just port forwarded (so basically put the static IP in the app with the port number and the router forwards to the CCTV DVR) so no VPN was involved. this worked fine and the cameras could be viewed via the phone app, but since adding the dual wan using instructions from the youtube vid this has now stopped. the app shows the cameras like it knows they are there, but no video is being show. Similarly, with the VPN, when i was offsite and connected to the VPN i could get to the server, local network, etc etc. but since the Dual WAN setup, this has stopped. i can still connect to the VPN, i can access the router via winbox, but accessing the local network just isn’t happening.
haha
But eventually found it. i have replace externals as you suggested and changed usernames to user1 etc. I hope this makes sense to someone to see where ive got wrong! Thanks