route traffic from one router to another via l2tp

RouterOS Beginner Basics
1

Hello guys i’m real new to mikrotik, just configured my main router and found out our isp actually blocks certain resource i wanna access, fortunately i have a friend with mikrotik router and this certain resource is accessible on his side.

His router does can access internet with eth0 (ping, tracert to google.com works), connected devices with dhcp to it work aswell
i got his router connected as client and gave it a static ip 172.20.20.241. ( via winbox PPP->secrets->REMOTE ADRESS)

from now on i configured my router. added this to the workin configuration:

#**routing table to Friend**
/routing table set to_Friend disabled=no fib name=to_Friend
#**ip route to the static client ip, routing table to_Friend**
/ip route set *8000000F disabled=no distance=1 dst-address=0.0.0.0/0 gateway=172.20.20.241 routing-table=to_Friend scope=30 suppress-hw-offload=no target-scope=10; /routing route set *8000000F disabled=no
#**certain resource list:**
/ip firewall address-list set *8C address=RESOURCE.COM disabled=no list=through_Friend)
#**the rule:**
/ip firewall mangle set *5B action=mark-routing chain=prerouting disabled=no dst-address-list=through_Friend log=no log-prefix="" new-routing-mark=to_Friend passthrough=yes)

whatever i did it worked. connected to my main router for a few hours this certain resource was accessible (whatever my friend configured on his side somehow worked too)

he did it in safe mode btw. he forgot to disable it and it is goners.
well i did not cry tho, friend tried configuring everything back but was futile and he dropped an entire configuration alltogether and just gave me an access to the winbox via his machine running anydesk.
whatever i do i cant make his router send the traffic back. i clearly see my configuration works, sends him TX , his router receives RX, actually sends it to the resource, but there is ZERO (0) TX data back to me.

#i configured on his side this: (172.20.20.0/24 net for l2tp users, i connect to it from my pc as a client too)
#i dunno why tho, his firewall was empy and i just populated it with something
/ip firewall filter action=accept chain=forward disabled=no log=no log-prefix="" src-address=172.20.20.0/24
/ip firewall filter action=accept chain=input disabled=no log=no log-prefix="" src-address-list=172.20.20.0/24
#route dunno why it is empty, i selected the interface in gateway , tried with 172.20.20.254 too
 /ip route add disabled=no dst-address=172.20.20.0/24 gateway="" routing-table=main suppress-hw-offload=no

if i try to do traceroute(tracert) as a client of my router
i get this:
7 8 ms 7 ms 8 ms 172.20.20.254
8 12 ms 10 ms 54 ms 172.20.20.241
9 * * *
10 14 ms 12 ms 16 ms 172.20.20.254
11 14 ms 15 ms 16 ms 172.20.20.241
12 * * *
13 14 ms 12 ms 13 ms 172.20.20.254
14 18 ms 18 ms 16 ms 172.20.20.241

whatever i wanna do looks like this:

image

12456
124561211×927 120 KB

i have no idea whatever am i missing, NAT? well i dont think so. the issue certainly is my Friend router config but i have no idea whatever it is

2

Those asterisks folllowed by a hex number are usually no good.

See point #21 here:

An /ip firewall filter rule taken by itself means little, the WHOLE firewall configuration is needed to understand if it does any good, nothing or something unwanted.

And - besides firewall - more generally troubleshooting can only be done knowing the whole configuration of both devices involved, sometimes it is a small detail in a completely different part of the configuration that prevents something to work as intended.

3

Despite the problem of *NNN rules’ numbering you just redirect unconditionaly the route 0.0.0.0/0 to the tunnel so all trafic from the router tries to push to the tunnel. Even the initial connection IMHO so I’m supriesd that you could connect to your friend.
Why you do not redirect only the problematic resources to the tunnel?

4

"asterisks folllowed by a hex number " oh i understand, i just took it from the log, this is why you saw this. whatever configuration you want to see i dont know, it is empty lol, litterally nothing exept the route to isp and the lines i added

well the issue was a bugged route, for some unknown reason updated routerOS firmware then i saw this:

add disabled=no dst-address=172.20.20.0/24 gateway=l2tp-to-router1 routing-table=main \
    suppress-hw-offload=no

see, the gateway is populated with l2tp-to-router1

and yes, it started working right away!

love mikrotik with their crazy bugs, just lately had a buggy l2tp server which droped randomly everyone and i lost my mind trying to configure this, days experementing with mtu mru just a waste of time, updated to the latest routerOS and whoala everything is so smooth, just found out this exact mikrotik runs v7.11 , updated to v7.19 and it fixed the issue.

i cant believe mikrotik is such a buggy mess honestly. i first encountered mikrotik 2 month ago and woa i am just fighting weirdness 99% and only 1% actualy configuration.
glad they released 7.19 it saved my sanity, i thought i was just dumb until i just updated the firmware

5

well you seem weird about this:

#**ip route to the static client ip, routing table to_Friend**
/ip route set *8000000F disabled=no distance=1 dst-address=0.0.0.0/0 gateway=172.20.20.241 routing-table=to_Friend scope=30 suppress-hw-offload=no target-scope=10; /routing route set *8000000F disabled=no

here, exact same one:

add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=172.20.20.241 routing-table=to_Friend scope=30 \
    suppress-hw-offload=no target-scope=10

am i pushing everything ? i doubt it, because i have a routing-table=to_Friend that points to the blocked resource, and nothing else

sorry i did not know how to properly export configuration

6

That’s the easy part, instructions here: