s2tp vpn not routing to client network

RouterOS General
1

Hello all,

I did setup l2tp vpn from remote site (SXT LTE) to my home (RB4011, config below, public IP is here) . The remote site does not have public IP. From remote site I can ping all devices in my home network. But from home, I cannot ping anything (except when I’m logged in RB4011, from there all pings to remote site works well)

Network Diagram

Remote site
172.16.1.2 (L2TP IP)
192.168.2.0/24 (Local Subnet)

Home
172.16.1.1 (L2TP IP)
192.168.1.0/24 (Local Subnet)

I’m bit desperate as It was working… and now, suddenly it does not.

Here is a config. Ideas? Thank you!

# nov/15/2020 22:13:08 by RouterOS 6.47.7
# software id = MG06-TFK0
#
# model = RB4011iGS+5HacQ2HnD
# serial number = xxxxxxxxxxxxxxxxxxxxx
/interface bridge
add fast-forward=no name=bridge1
add name=bridgeINET
add name=verejna
/interface wireless
set [ find default-name=wlan1 ] antenna-gain=0 band=5ghz-a/n/ac country=\
    no_country_set frequency=auto frequency-mode=manual-txpower mac-address=\
    B8:69:F4:BE:4F:DE mode=ap-bridge radio-name=B869F4BE4FDE ssid=MikroTik \
    station-roaming=enabled
set [ find default-name=wlan2 ] antenna-gain=0 country=no_country_set \
    frequency-mode=manual-txpower mode=ap-bridge ssid=MikroTik station-roaming=\
    enabled
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether5 ] name=ether5_PTMP_xxxxxxxxx
set [ find default-name=ether6 ] name=ether6_xxxxxxxxxxxxxxx
/interface pppoe-client
add add-default-route=yes allow=chap,mschap1,mschap2 disabled=no interface=\
    bridgeINET max-mtu=1480 name=pppoe-out2 use-peer-dns=yes user=\
    4C:5E:0C:41:4D:89
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm \
    name=MK
/caps-man configuration
add channel.skip-dfs-channels=yes channel.tx-power=17 country="czech republic" \
    datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes \
    distance=indoors guard-interval=any installation=indoor multicast-helper=\
    full name=MK rx-chains=0,1,2 security=MK ssid=MK tx-chains=0,1,2
/interface list
add name=discover
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool1 ranges=192.168.1.10-192.168.1.254
/ip dhcp-server
add add-arp=yes address-pool=pool1 always-broadcast=yes disabled=no interface=\
    bridge1 lease-time=1d name=server1
/ppp profile
add local-address=192.168.1.1 name=kaspikVPN remote-address=pool1 \
    use-encryption=required
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,passw\
    ord,web,sniff,sensitive,api,romon,dude,tikapp"
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=MK name-format=identity
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridgeINET interface=ether6_xxxxxxxxxxx
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether10
add bridge=bridgeINET interface=ether5_PTMP_xxxxxxxxx
add bridge=bridgeINET interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=all
/interface detect-internet
set detect-interface-list=all
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add interface=bridge1 list=discover
/interface pptp-server server
set default-profile=default
/interface wireless cap
set bridge=bridge1 discovery-interfaces=bridge1 interfaces=wlan1,wlan2
/ip address
add address=192.168.1.1/24 interface=bridge1 network=192.168.1.0
add address=79.98.74.144 interface=verejna network=79.98.74.144
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8,8.8.4.4,1.1.1.1 gateway=\
    192.168.1.1
/ip dns
set servers=1.1.1.1,8.8.8.8
/ip firewall filter
add action=accept chain=input comment=VPN port=1701,500,4500 protocol=udp
add action=accept chain=input comment=IPSEC protocol=ipsec-esp
add action=drop chain=input comment=\
    "winbox - rogue login attempts from \"jarko\"" dst-port=8291 protocol=tcp \
    src-address=93.99.229.101 src-port=""
add action=accept chain=input comment=winbox dst-port=8291 protocol=tcp \
    src-port=""
add action=accept chain=input comment=http/htttps dst-port=80,443 protocol=tcp \
    src-port=""
add action=accept chain=input comment="Allow Established connections" \
    connection-state=established
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=accept chain=input in-interface=bridgeINET src-address=\
    192.168.1.0/24
add action=accept chain=forward connection-state=established
add action=accept chain=forward comment="allow related connections" \
    connection-state=related
add action=drop chain=input comment="Drop Invalid connections" \
    connection-state=invalid
add action=drop chain=forward comment="drop invalid connections" \
    connection-state=invalid protocol=tcp
add action=drop chain=forward src-address=0.0.0.0/8
add action=drop chain=forward dst-address=0.0.0.0/8
add action=drop chain=forward src-address=127.0.0.0/8
add action=drop chain=forward dst-address=127.0.0.0/8
add action=drop chain=forward src-address=224.0.0.0/3
add action=drop chain=forward dst-address=224.0.0.0/3
add action=drop chain=input comment="Drop everything else"
/ip firewall nat
add action=src-nat chain=srcnat src-address=192.168.1.0/24 to-addresses=\
    79.98.74.144
/ip route
add distance=1 dst-address=192.168.2.0/24 gateway=172.16.1.2
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ipv6 address
add address=2a02:970:1172:1100:4433:9f1d:490f:ec11 interface=bridge1
/ipv6 nd
set [ find default=yes ] advertise-dns=no
/ppp secret
add local-address=172.16.1.1 name=vatetice profile=default-encryption \
    remote-address=172.16.1.2
add name=kaspik profile=kaspikVPN
/radius
add address=79.98.72.7 service=login
/system clock
set time-zone-name=Europe/Prague
/system identity
set name=xxxxxxxxxxxxxxxxx
/system leds
add interface=wlan2 leds="wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-led,\
    wlan2_signal4-led,wlan2_signal5-led" type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive
/system routerboard settings
# Firmware upgraded successfully, please reboot for changes to take effect!
set auto-upgrade=yes
/system scheduler
add interval=1d name=autoupdate on-event="/system package update\r\
    \ncheck-for-updates once\r\
    \n:delay 3s;\r\
    \n:if ( [get status] = \"New version is available\") do={ install }" \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=apr/08/2019 start-time=03:00:00
/tool graphing interface
add
/tool romon
set enabled=yes
/user aaa
set use-radius=yes
2

Use the [code] and [/code] tags around the configuration export (edit the OP), and post also the configuration of the SXT. It may be a firewall issue at either end. And replace “here” by the actual location, as it si not clear where you were when writing the post :slightly_smiling_face:

3

Edited, thanks!

4

You’ve missed the part “post also the configuration of the other RB” (the SXT). The routing and firewall at the 4011 end look fine to me (both could be optimised a bit but it’s not critical).

Off topic, you are so far the champion of the forum in the discipline of revealing your identity unintentionally, with so many hints in the configuration :slightly_smiling_face:

5

Will redact it bit more :D. But I don’t care if you know my SSID or Public IP/MAC Addresses. I don’t have an access. S2TP is established, but I cannot connect there :(.

Super weird is, that it looks like routing is not working. Adding route 192.168.2.0/24 should be working, but it looks like it’s not.

6

I think I can see the issue:

/ip firewall nat
add action=src-nat chain=srcnat src-address=192.168.1.0/24 to-addresses=79.x.y.z

This rule doesn’t care about the out-interface nor about dst-address, so also connections from the 4011’s LAN subnet to the one on the remote site get src-nated to 79.x.y.z. So try to add out-interface=pppoe-out2 or dst-address=!192.168.2.0/24 to that rule and you should be good.

7

AAAAAA, THANK YOU A MILLION TIMES!

You are of course right :).

Kaspik