Hi all, I am new to Mikrotik and am a little stumped… I have an IPsec VPN from a CCR1016 (branch office) to a Juniper SRX (head office), tunnel is up and passing traffic, however I need to send traffic to a few IP’s down the tunnel to head office, this is a list of 6 IP addresses, at the head office the SRX routes all this traffic to various other gateways.
I have an SRX at a branch office and on this I just add a static route to point to the tunnel interface i.e “set routing-options static route 192.168.47.0/24 next-hop st0.1”
I also have 30 Draytek vigor’s, which I just add the IP’s in to the more section in the IPSEC config page.
I have read that pptp gives a routable interface allowing a static route… surely I am missing the obvious…?
My goal is to swap all branch office Drayteks for Mikrotik, but I need to figure this out first.
Hi thanks for the reply, its just IPsec, the head office and branch office LAN communication works fine, passing traffic.
routes as below
/ip route
add distance=1 gateway=ether11-VirginWAN
add distance=2 gateway=192.168.5.1
/ip route rule
add action=unreachable comment=“Block LAN ports talking to each other”
dst-address=192.168.100.0/24 src-address=10.232.211.32/27
add action=unreachable comment=“Block LAN ports talking to each other”
dst-address=10.232.211.32/27 src-address=192.168.100.0/24
add action=unreachable comment=“Block LAN ports talking to each other”
dst-address=10.232.211.32/27 src-address=192.168.200.0/24
add action=unreachable comment=“Block LAN ports talking to each other”
dst-address=192.168.100.0/24 src-address=192.168.200.0/24
add action=unreachable comment=“Block LAN ports talking to each other”
dst-address=192.168.200.0/24 src-address=10.232.211.32/27
add action=unreachable comment=“Block LAN ports talking to each other”
dst-address=192.168.200.0/24 src-address=192.168.100.0/24
[admin@MikroTik] /ip route>
No they don’t, I am struggling to understand how you route traffic down tunnel and not just out to the web, I love mikrotik as they seem so powerful and flexible yet I cant do a simple route through vpn interface…
If you were using ipip or GRE over ipsec you would be able to create routes like you are used to using. When you are using IPSEC in tunnel mode you create an ipsec policy and a nat statement that matches how you would like the traffic to flow. see https://wiki.mikrotik.com/wiki/Routing_through_remote_network_over_IPsec
so on the remote router you would create a policy as you have done for the 2 lans. replacing the remote lan ip with the servers ip. and the opposite on the other side. similar with the nat statements to put in.
Set up ipsec in transport mode (not tunnel mode) between the CCR and the SRX.
Set up a GRE tunnel between the WAN IPs (it will be secured by ipsec).
Put a /30 on each side of the GRE tunnel.
Route IPs to the /30 address on the “other” side.
Exceedingly simple when you get it set up.
And as stated before, it can’t hurt at all to just run a routing protocol and include the /30 network, plus whatever networks you want to route between them.