I am trying to setup a Tik to act as a sort of VPN gateway for local clients. It would be plugged into an existing local network (like at a hotel), any devices that plug into the Tik (or connect via wifi) will be routed through a VPN connection to the remote corporate network (also a Mikrotik, sitting on a public IP), no client configuration needed on the devices.
The VPN server is already setup for l2tp/ipsec however I can also enable any protocol that will work (eoip?) as long as the l2tp connections continue to work.
I am guessing I just need to setup the VPN Client in the Tik and then route all traffic through that VPN interface, I have found guides on how to do that. But as the Tik will sit behind an uncontrolled NAT firewall how do I best set this up to that the tunnel gets through and I don’t cause any issues like routing loops?
You don’t need to care about that uncontrolled router, all you need from it is access to internet and your VPN server. Just add VPN client interface, tell it to add default route and you’re almost done. Use firewall filter (chain=forward) to block access from LAN interface to WAN, to make sure that connected devices won’t go to internet directly. Last needed thing may be srcnat on VPN client interface, it depends on your server, if it knows about LAN subnet behind client or not.
I’m not surprised it disappeared – 0.0.0.0/0 is the default (“everywhere”).
Your rule is in the input chain. That means that traffic to the router itself (not your network, just the router) will be accepted from those addresses. If you’re trying to get your router to serve this traffic to some other network, it’s the wrong rule. Perhaps you meant the forward chain.
Thank you, I am giving this another shot now (past week has been absolute chaos), Ideally I would like to avoid a NAT and just let client devices get addresses off the corporate DHCP, do I just leave off the srcnat in that case?
I am sure to have more questions shortly as I am not so great with RouterOS yet and still learning.
I tried routing the VPN IP to ether1 but did not work. I was unable to ping the address from the tik and the l2tp tunnel would not connect. However if I specified the local LAN’s gateway address then it works. Problem is for this setup I my not know the gateway address (and don’t want to have to manually set it even if I did). Why can’t I just push it out that port and let whatever gateway on the other side handle it?
Also is it possible to grab a DHCP address from the far end (corporate network) so I don’t have to deal with NATs?
Please, since we talk about networking provide more details…
You cant reach the internet from your PC? From the VPN Client itself?
Do you Reach the Lan on the VPN’s server side ?
All you actually need inside your routing Table is this Roule:
1.
add distance=1 dst-address=Remote LAN gateway=Remote VPN Server IP
That rule will let you reach the Remote LAN..
In case you need to route all your traffic to the Remote VPN server, Internet included, then Default Route must be enabled in your VPN…
add distance=1 gateway=l2tp-out1
After that you must masquerade your out Interface, which is the L2TP..
Now, if you dont want to route all traffic through VPN, do not use the default gateway on your VPN client settings, the masquerade rules must have as out interface your WAN interface,no other masquerade rule is needed, a default route for your actual network and only rule (1) for the VPN…
add distance=1 dst-address=Remote LAN gateway=Remote VPN Server IP
this does not work, I try to ping from the router to the vpn server and all I get is “no route to host” and the l2tp client will not connect
If I change it to this:
add distance=1 dst-address=Remote VPN Server IP gateway=Local LAN Gateway
Then the l2tp client connects, I can ping devices on the remote side, everything works, except passing DHCP requests but that’s a separate hurdle. The only problem is that it requires knowledge of the LAN (the Uncontrolled Gateway in my diagram).
The VPN to get established does not need any route rule…
You answered on your own.. Ofcrose, if you want to reach a Public IP you must have a default route, isnt that obvious ?
The fact that it connecs after that route is normal ofcorse since you do not have any other default route apparently!
So if you only add this
add distance=1 dst-address=Remote LAN gateway=Remote VPN Server IP
YES it will never connect… Maybe you should study a lil more about routing, how it works and also about VPN Tunnels…
Also DHCP is a Layer 2 Protocol… you will need either BCP or EoIP as well…
Thank you for the information regarding DHCP, That explains a lot.
However, I thing there is some confusion regarding my question. I am familiar with routing, my issues is getting the Tik to use the interface (or the IP learned via dhcp through that interface) as the gateway. One of the objectives of this project is to have this router form a VPN tunnel WITHOUT any prior knowledge of the local LAN. I know its possible from a networking standpoint as I have seen other devices that do it. The question is how to do this with a mikrotik.
