Hello everyone.
At work i have a vpn with a costumer via IPSec from our Mikrotik to their site wich is managed by another office. The subnets are 192.1.0.0/22 on their site and 172.16.10.0/24 on our side.
If, on my pc at work, i assign an ip on the /24 subnet i have no problems to reach all of their pc and stuff.
Now cause covid i’m working from home and i would like to not use anydesk or such to reach my pc at work and do stuff.
At home i have a gre tunnel to reach my office. All works well, i have added a 192.168.20.0/24 subnet to the Mikrotik at work so i can use my 192.168.0.0/24 at home (where i have a Mikrotik too).
Since i have total control on both Mikrotiks i tried to set the routes on the Mikrotiks but of course the customer side don’t know about my 192.168.0.0/24 or if they know it’s the subnet of someone else.
I was thinking about masquerading but i have no idea how to do it to reach just one subnet and where to put. Also if i’m right, masquerading needs an interfaces and site-to-site ipsec don’t create any interface i can work with.
What i can do?
I’m open to all suggestions, the only limit is that i can’t access customer vpn configuration.
Thank you all in advance.
Use action=src-nat instead of action=masquerade. action=src-nat doesn’t need to be linked to any interface, so you can set it up on your office Tik and let it match only on src-address=192.168.20.0/24 dst-address=192.1.0.0/22 on their side (I assume 192.1.0.0 is a typo but I follow the suite). It’s up to you whether you use the office Tik’s own address in 172.16.10.0/24 or some unassigned one as to-addresses in the rule.
Thank you a lot for the quick answer and to point me do the right direction. And no, it’s not a typo. My customer has a subnet 192.1.0.0/22 for over 1000 ip. My fingers makes always a lot of mistakes when i work with them cause i think my finger have memorized 192.168.x.x and write on their own.
I’m working with the scr-nat now and trying the easiest step before to work on the routings.
So via anydesk i contacted my pc, assigned it an ip on the usual network we use at work 192.168.1.0/24 and today it’s .113 with gw .1
Under firewall->nat i have added as line zero
chain=srcnat action=src-nat to-addresses=172.16.10.1 src-address=192.168.1.0/24 dst-address=192.1.0.0/22 log=yes
log-prefix=“”
Without seeing the complete export of your configuration, I can only speculate that there is either some action=notrack rule in chain=prerouting of /ip firewall raw which prevents the “un-src-nat” from working, or that you have an unusual setup in chain=forward of /ip firewall filter, which prevents the responses from being delivered to the client.
See my automatic signature on how to post your configuration safely.
Okay, that’s the problem. The NAT operations depend on connection tracking, and an action=notrack rule in /ip firewall raw makes the packets from 192.1.0.0/22 to 172.16.10.0/24 bypass connection tracking.
The manual works with the typical case, which expects that if you connect to some network using an IPsec tunnel, you don’t need advanced firewall functions because that network is considered secure. So they kill several flies by one smash, reduce CPU consumption and exclude connections via the tunnel from the effect of the commonly used “masquerade whatever should leave via WAN” srcnat rule.
My personal opinion is that having no firewall between own network and other company’s one is a Bad Idea.
Plus you have excluded the traffic between 192.1.0.0/22 and 172.16.10.0/24 from connection tracking only in one direction (client to you), which made the NAT rule “half work” - all the packets from you to client get src-nated but the responses don’t get “un-src-nated”.
So disable that action=notrack rule and try again.
Thank you a lot!
It’s working now.
After i have disabled the no-track in the office Mikrotik the ping from the office pc was successfull. Then i applyied again the routes to reach my home but it was KO.
So with the connections tab i tracked the src address and it was the IP of my Gre tunnel. To solve it i have src natted the 10.0.0.1 but was still not working. Then i applied the same rule to my home Mikrotik and src-natted the 192.168.0.0/24 to 10.0.0.1 and voilà! Now i can reach their whole network from home.
Thank you again.
It should not be necessary to use src-nat on the path between your home and the office - a route to 192.1.0.0/22 via the GRE tunnel at your home Tik, and a route to your home subnet via the GRE tunnel at your office Tik, is the right way. And of course the src-nat rule at the office Tik has to refer to your home subnet as src-address.
The route from home to office, 192.1.0.0/22 via 10.0.0.2 (the ip on gre interface at work) was already in place.
Of course from office and home the routes for and to 192.168.0.0/24<>192.168.1.0/24 were alredy set. Ospf made its work
I will investigate why not works without src-nat. I have this working configuration as backupplan so i can both work and test things.
