Good morning everyone.
I have a little problem that I can’t solve:
I connected the home network, where I have a Mikrotek 5g Ax router, with the office network where I have a Draytek 2860 router, activating an ipsec tunnel between the two routers.
The two networks are seen correctly and everything works.
Now the Draytek router has another ipsec VPN to another private network on the internet where there is a server that I would need to reach from my home network going through the two tunnels.
Draytek routers have the ability to add other subnets reachable through VPNs just by filling in a few fields in the VPN configuration screen and everything works great.
Now the question is how should Mikrotik be configured so that, trying to contact the ip address of the remote server from the home network, the request passes through the home->office tunnel?.
A thousand thanks!!
Ciao!!
i think you must add that new second network to the ipsec policy on mikrotik router
also on the remote endpoint of that second network add the Mikrotik router network to the ipsec policies on that remote end
hi Chechito.
Thank for your reply.
I tried to add second Policy
[admin@MikroTik] > ip/ipsec/policy/ print
Flags: T - TEMPLATE; A - ACTIVE; * - DEFAULT
#COMMENT PEER TUN SRC-ADD DST-ADD PROT ACTION LEVEL PH2-COUNT
;;; to saialassio 0 A from draytek yes 192.168.3.0/24 10.97.4.128/26 all encrypt require 1
;;; to Alga 1 from draytek yes 192.168.3.0/24 10.7.226.181/32 all encrypt require 0
but if i add second policy to the same peer, the tunnel doesn’t go up.
I can’t modify the router where the server is, It’s not mine.
But i can modify the one in the middle (Draytek).
When i had a Draytek at home, it works perfectly only adding the policy you said.
Probably is it the firewall ?
Thank a lot!
in VPN the concept interesting traffic is thought of as traffic that must be protected by the IPsec VPN that is defined in Security Associations, if remote Router Not managed by you does not include 192.168.3.0/24 as “interesting traffic” will not allow that traffic on the VPN
maybe on Draytek managed by you, you can do some of NAT (Network Address Translation) to “mask” connections coming from 192.168.3.0/24 towards remote network on router not managed by you to make that connections appear like originated from internal network on Draytek Site (i asume that network achieves conection ok across VPN towards site not managed by you)
PD
i not sure Draytek can do that in this topology
Hi Chechito
Draytek knows how to handle traffic because before installing Mikrotik in
my house i had a Dratek also and all worked fine!.
The question is: how have i to config Mikrotek to route traffic to 10.7.226.181 via tunnel IPSEC ? Probably with magle in firewall ?
Thank…
Do you know what traffic selectors are allowed by Draytek for the Mikrotik tunnel?
What do you mean by selectors?
If you mean the routes, the draytek has the routes for the two Mikrotik side networks 192.168.3.0/24 and 172.20.14.0/24.
In fact, when I had the other Draytek at home, everything worked fine…
Before IPsec is established both sides need to negotiate acceptable source and destination addresses. Either via traffic selectors (look it up, it’s a term) or the split tunnel extension.
On your draytek you will need to NAT packets coming from mikrotik before they leave for your server.