Roaad Warrior L2TP/IPSEC VPN cannot access LAN

haris013 · August 6, 2021, 5:30pm

Hello, i have a strange problem, with road warrior VPN, I have the exact setup with other mikrotik routers and is working perfectly but the specific mentioned bellow, can’t access other LAN devices.

Clients are connecting without problem with the VPN but somehow cannot “see” the other devices and servers at LAN.

I am using a vpn pool that is the same with the LAN pool. I have my bridge as arp proxy and I have tried many settings like disabling firewall rules, creating another VPN address pool etc

still the same problem, any client connecting at the VPN cannot access devices at LAN.

Please can you help to detect the issue? The same setup is working without problems at another infrastructure.

The setup is dual WAN using direct public IPs given by ISP

# aug/06/2021 20:27:41 by RouterOS 6.48.3
# software id = XXXXXX
#
# model = RB2011UiAS
# serial number = XXXXXXX
/interface bridge
add admin-mac=08:55:31:7D:23:84 arp=proxy-arp auto-mac=no comment=defconf \
    name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf include=dynamic name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec profile
set [ find default=yes ] dh-group=ecp256,modp2048,modp1536,modp1024 \
    enc-algorithm=aes-256,aes-192,aes-128
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256,sha1 enc-algorithms="aes-256-c\
    bc,aes-256-ctr,aes-256-gcm,aes-192-cbc,aes-192-ctr,aes-192-gcm,aes-128-cbc\
    ,aes-128-ctr,aes-128-gcm"
/ip pool
add name=dhcp_pool0 ranges=192.168.2.100-192.168.2.230
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=bridge name=dhcp1
/ppp profile
add bridge=bridge bridge-learning=yes change-tcp-mss=yes dns-server=\
    1.1.1.1,1.0.0.1 local-address=192.168.2.1 name=ipsec_vpn remote-address=\
    dhcp_pool0 use-encryption=yes
add change-tcp-mss=yes dns-server=1.1.1.1,1.0.0.1 local-address=10.10.10.1 \
    name=test remote-address=VPN_pool use-encryption=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set authentication=mschap2 default-profile=ipsec_vpn enabled=yes \
    ipsec-secret=XXXXXX keepalive-timeout=disabled use-ipsec=required
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether2 list=WAN
/ip address
add address=194.30.216.146/30 interface=ether1 network=194.30.216.144
add address=194.30.216.150/30 interface=ether2 network=194.30.216.148
add address=192.168.2.1/24 interface=bridge network=192.168.2.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip dhcp-server lease
add address=192.168.2.199 client-id=1:0:15:99:88:aa:25 mac-address=\
    00:15:99:88:AA:25 server=dhcp1
/ip dhcp-server network
add address=192.168.2.0/24 dns-server=1.1.1.1,1.0.0.1 gateway=192.168.2.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=www.ependyseis.gr list="Ependyseis Site"
/ip firewall filter
add action=accept chain=input dst-port=8291 in-interface-list=WAN protocol=\
    tcp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input dst-port=1701 protocol=udp
add action=accept chain=input dst-port=4500 protocol=udp
add action=accept chain=input dst-port=500 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall mangle
add action=mark-routing chain=prerouting dst-address-list="Ependyseis Site" \
    new-routing-mark=to_ISP1 passthrough=yes
add action=accept chain=prerouting dst-address=192.168.1.0/24 in-interface=\
    bridge
add action=accept chain=prerouting dst-address=192.168.0.0/24 in-interface=\
    bridge
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=ether1 new-connection-mark=ISP1_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
    in-interface=ether2 new-connection-mark=ISP2_conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark \
    dst-address-type=!local in-interface=bridge new-connection-mark=ISP1_conn \
    passthrough=yes per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark \
    dst-address-type=!local in-interface=bridge new-connection-mark=ISP2_conn \
    passthrough=yes per-connection-classifier=both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting connection-mark=ISP1_conn \
    in-interface=bridge new-routing-mark=to_ISP1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=ISP2_conn \
    in-interface=bridge new-routing-mark=to_ISP2 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP1_conn \
    new-routing-mark=to_ISP1 passthrough=yes
add action=mark-routing chain=output connection-mark=ISP2_conn \
    new-routing-mark=to_ISP2 passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=accept chain=srcnat disabled=yes src-address=192.168.2.0/24
add action=dst-nat chain=dstnat disabled=yes dst-port=5051-5053 \
    in-interface-list=WAN protocol=tcp to-addresses=192.168.2.230 to-ports=\
    5051-5053
add action=accept chain=srcnat disabled=yes src-address=10.10.10.0/24
/ip route
add check-gateway=ping distance=1 gateway=8.8.8.8 routing-mark=to_ISP1
add check-gateway=ping distance=2 gateway=8.8.4.4 routing-mark=to_ISP1
add check-gateway=ping distance=1 gateway=8.8.4.4 routing-mark=to_ISP2
add check-gateway=ping distance=2 gateway=8.8.8.8 routing-mark=to_ISP2
add check-gateway=ping distance=1 gateway=8.8.8.8
add check-gateway=ping distance=1 gateway=8.8.4.4
add distance=1 dst-address=8.8.4.4/32 gateway=194.30.216.149 scope=10
add distance=20 dst-address=8.8.4.4/32 type=blackhole
add distance=1 dst-address=8.8.8.8/32 gateway=194.30.216.145 scope=10
add distance=20 dst-address=8.8.8.8/32 type=blackhole
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add name=XXXXX password=XX profile=ipsec_vpn service=l2tp
add name=XXXXX password=XXXXX profile=ipsec_vpn service=l2tp
add name=XXX password=XXXXX profile=ipsec_vpn service=l2tp
/system clock
set time-zone-name=Europe/Athens
/system logging
add topics=l2tp
add topics=ipsec
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Please help me to debug the issue

nagylzs · August 7, 2021, 5:04pm

Hello,

Why do you have two ppp profiles? One of them is not assigned to the bridge. The second one references VPN_pool which is not defined. Didn’t you delete something important from the export?
After L2TP client is connected, can you ping the remote router? 192.168.2.1
Please enable ICMP in forward chain of your firewall and try to ping something else inside your remote LAN.
What kind of L2TP client are you using? After connecting the L2TP, please export your routes on the client and post it.

haris013 · August 8, 2021, 11:21am

the first PPP profile is not in use right now, also i am not using the vpn pool at the moment.

When the client is connected, i can ping the gateway. Also when i run a network scan/ip scan i can only “see” the gateway and my client(self).

I have allowed the ping and still cannot reach the other clients at my network. I have several web services running at LAN and cannot reach them. I cannot see my NAS, internal web server etc.

I am connecting from windows 10 PC and android Tablet, still the same result, cannot see other devices. I have compared the route tables from my windows 10 PC connected at VPN and I don’t see anything weird. Bellow are the routes attached.

Also attached some of my settings, take a look please, trying to figure out the mistake.

nagylzs · August 9, 2021, 5:20pm

Your routes are okay, I think. You did not uncheck the “use default gateway on remote network” checkbox in adapter properties / network / ipv4 / properties / special / ip settings. All of your traffic goes through the L2TP connection.

I think that this will be a firewall problem. Look at these rules in your input and forward chains:

add action=drop chain=input comment="defconf: drop all not coming from LAN" \ in-interface-list=!LAN
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN

You are dropping all input that is not coming from LAN, and you are dropping all forwards that are not DSTnated. You can ping the router because this rule comes first:

add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp

All other packets from your L2TP client are dropped, because they are not coming in on LAN (input chain) and they are not DST nated (forward chain).

You need to do one of these:

Specify fixed interface name under “/interface l2tp-server add name=l2tp_user1_in user=user1” and change your firewall rules to accept packets from/to this interface in input and forward chains. One solution is to add l2tp_user1_in interface to your LAN interface list, another solution is to add new rules with this interface as in-interface and out-interface.
You can also add new rules with src-address=192.168.2.0/24 and dst-address=192.168.2.0/24 . But then you also need to keep in mind that packets with spoofed IP addresses will be able to come in on your WAN interface (unless you set rp-filter=strict under /ip settings maybe not even then)

nagylzs · August 10, 2021, 5:55am

There is an “interface-list” setting under /ppp profile. I suspect that if you specify interface-list=L2TP then it will put the dynamically created L2TP interfaces into that interface list automatically.

But it is not documented. At least not here: https://wiki.mikrotik.com/wiki/Manual:PPP_AAA#Properties

I wrote a message to MT support and asked them to add missing documentation.

haris013 · August 10, 2021, 10:58am

Thanks for the replies, I tried disabling all filter rules, added l2tpuser at lan, tried the ppp profile interface list, still the same result. I cannot reach lan devices. Also the same firewall setup and VPN settings, i use at other installations without problems. Is there any chance that ISP is the problem? Is something blocked from ISP side? or is any NAT related problem?

The only difference from the other installations where VPN is working, is that mine is dual WAN.

I can’t find why i can’t reach LAN.

nagylzs · August 10, 2021, 12:54pm

ICMP ping packets go through your ipsec tunnel. Any other packet goes through the same tunnel. If it was a problem with your ISP then nothing would work. not even ping.

Can you please post the output of these, after L2tp client is connected:

/ip ipsec active-peers print detail
/ip ipsec policy print detail

nagylzs · August 10, 2021, 1:14pm

I’m sorry I’m just trying to find out what the problem is. It may not help, but try this.

On the router, set a fixed address for a user, and allow forward packets:

/ppp secret
set remote-address=192.168.2.185 where name=XXXXX
/ip firewall filter
add chain=forward action=accept src-address=192.168.2.185 dst-address=192.168.2.0/24 place-before=[find where comment="defconf: drop all from WAN not DSTNATed"]

Then connect with your L2TP client, check that your IP address is 192.168.2.185 indeed, and then try to access something on the remote LAN.

haris013 · August 10, 2021, 8:03pm

Hello, still nothing.

take a look at the screenshot

I tried to rdp our servers, ping our devices, still nothing, seems like i am “out”

nagylzs · August 11, 2021, 5:50am

Disclaimer: I’m just guessing now. I don’t know what is wrong. But it seems that your accept rule’s counter is almost zero.

Please try to add a more specific route, as administrator:

route add -p 192.168.2.0 mask 255.255.255.0 192.168.2.185

I doubt that it will help but let’s try.

haris013 · August 11, 2021, 8:19am

Hello, tried adding route manually, still the same. LAN is unreachable.

nagylzs · August 11, 2021, 6:55pm

I’m comparing your config with mine. I don’t have bridge=bridge on /ppp profile in my configs. Also, I don’t have arp=proxy-arp in my bridge. The problem might be that these packets are not routed, because your ppp interface is added to your bridge as a port.

One more thing to try: remove bridge=bridge setting on your ppp profile and try to reconnect.

(Once again: I’m not an expert, and I’m not sure if this will work or not. Just trying to help.)

haris013 · August 12, 2021, 9:40am

Hello, thanks again for the help. I tried removing bridge from PPP profile, also tried with arp-proxy off, still the same result, no LAN. It is very strange this behavior, i have configured many VPNs, it is my first time facing this problem.

Is there any way to trace where the packets go and why the are not routed at LAN?

rajo · August 12, 2021, 4:42pm

To get split-include working with your Windows 10 clients, follow the instructions here: http://forum.mikrotik.com/t/ipsec-ikev2-windows-10-klient-routes-are-not-transmitted-to-the-client/150835/3

haris013 · August 12, 2021, 10:14pm

Hello, i don’t need split tunneling. I need to access my remote LAN via VPN. I don’t care if the whole traffic is transfered inside VPN.

rajo · August 13, 2021, 1:10am

Take a look at the Windows IPv4 route table screenshot you posted. It shows that your VPN connection is the preferred route to the Internet. Thus, once you’ve established a VPN connection, everything fails. You shouldn’t even be able to ping anything on the Internet, once your VPN connection is established. Even if you’re not using split-include, make the changes I recommended and try again. If proper routes don’t get installed and you don’t want to keep it, you can always change it back and try something different.

nagylzs · August 13, 2021, 5:50am

Oh, so his problem was that he could not access the local LAN? I thought he could not access the remote LAN.

The second thing I wrote was this:

You did not uncheck the “use default gateway on remote network” checkbox in adapter properties / network / ipv4 / properties / special / ip settings. All of your traffic goes through the L2TP connection.

Yes, if you want to access your LOCAL LAN then go to that setting and uncheck that box.

haris013 · August 13, 2021, 7:43pm

tried the settings again i cannot access remote LAN. I tried connecting with android, again i cannot see anything from the remote LAN network. It is like i am not connected at the VPN/remote LAN.

haris013 · August 13, 2021, 7:44pm

My problem is the REMOTE LAN not the local LAN. You have understood right

rajo · August 13, 2021, 7:59pm

What does your Windows route table [screenshot] look like after you connect? Also, does the connection show up as established when you execute “ip ipsec active-peers print”?