Hi everyone,
I’m trying to use a hAP AC as a VPN gateway, connecting my AWS VPC to my on-prem infrastructure, but there are a couple of things that are still off and I’m sure they are Mikrotik specific, so I need some help. To better understand what’s going on, let me start with what happened so far.
I have a VPN (172.31.0.0/16) with a public subnet (172.31.16.0/20) that has an EC2 instance (172.31.37.157) in it. The on-premise infrastructure is a hAP AC where all the LAN ports are plugged into devices, WLAN1 is used as wifi client to provide WAN/internet to all LAN devices, and WLAN2 is used as AP so I can access these devices wirelessly. If you wonder why DCHP starts at .20 it’s because some of the devices only operate with static IP addresses, so I’m manually setting them from .01 to .19 and leaving the rest to DHCP. Here’s how I’m setting this up.
/interface bridge
add name=bridge1
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
add authentication-types=wpa-psk,wpa2-psk group-ciphers=tkip,aes-ccm mode=\
dynamic-keys name=client-wifi-password supplicant-identity=MikroTik \
unicast-ciphers=tkip,aes-ccm wpa2-pre-shared-key=<client-wifi-pwd>
add authentication-types=wpa2-psk group-ciphers=tkip,aes-ccm mode=dynamic-keys \
name=ap-wifi-password supplicant-identity=MikroTik unicast-ciphers=\
tkip,aes-ccm wpa2-pre-shared-key=<ap-client-pwd>
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country="united kingdom" \
disabled=no security-profile=client-wifi-password ssid=<client-wifi-ssid>
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-Ceee \
country="united kingdom" disabled=no frequency=auto installation=indoor \
mode=ap-bridge security-profile=ap-wifi-password ssid=<ap-wifi-id> \
wireless-protocol=802.11 wps-mode=disabled
/ip pool
add name=dhcp ranges=192.168.0.20-192.168.0.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge1 name=dhcp1
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=wlan2
/interface list member
add interface=wlan1 list=WAN
add list=LAN
add interface=bridge1 list=LAN
/ip address
add address=192.168.0.1/24 interface=bridge1 network=192.168.0.0
/ip dhcp-client
add disabled=no interface=wlan1
/ip dhcp-server network
add address=0.0.0.0/24 gateway=0.0.0.0 netmask=24
add address=192.168.0.0/24 gateway=192.168.0.1 netmask=24
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip dns static
add address=1.1.1.1 name=default-dns
So far, so good. The AP is a bit slow to connect, but once it connects, it works just fine and I have internet on all my LAN devices. Now the VPN took me a while to make it work, but eventually I managed to get a connection between the hAP and AWS’ VPN. BTW, I’m using certificate based authentication because I don’t have a fixed IP address as this sits in a contraption that will travel the world as a demo. To make the VPN work, here’s how I did it:
/ip ipsec profile
add dh-group=modp2048 dpd-interval=10s dpd-maximum-failures=3 enc-algorithm=aes-256 hash-algorithm=sha256 \
lifetime=8h name=aws-profile nat-traversal=no prf-algorithm=sha256
/ip ipsec peer
add address=<aws-tunnel-ip>/32 exchange-mode=ike2 name=aws-tunnel-1 profile=aws-profile
/ip ipsec proposal
add auth-algorithms=sha512 enc-algorithms=aes-256-cbc lifetime=1h name=aws-proposal pfs-group=modp2048
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=accept chain=srcnat dst-address=172.31.0.0/16 src-address=192.168.0.0/24
add action=accept chain=srcnat dst-address=192.168.0.0/24 src-address=192.168.1.0/24
/ip ipsec identity
add auth-method=digital-signature certificate=certificate peer=aws-tunnel-1 remote-id=ignore
/ip ipsec policy
add dst-address=172.31.0.0/16 peer=aws-tunnel-1 proposal=aws-proposal src-address=192.168.0.0/24 tunnel=yes
/ip route
add distance=1 dst-address=172.31.0.0/16 gateway=<aws-gateway-ip>
This allows me to successfully establish a connection to AWS’ VPN, but it’s also where things start to get tricky. First, I couldn’t ping any EC2 instance on the AWS side nor EC2 instances could ping the on-prem side. Until I saw this post and, by just pinging the EC2 instance with src-address set, everything magically came to life. But then I realised that I couldn’t ping any LAN device at all. So after reading a lot and (unsuccessfully) messing around with ARP setting, I read somewhere “let’s routing do routing” and I realised that there was no reason why I should not separate all the networks and do proper routing.
But here is where my knowledge of networks (and RouterOS by extension) ends. I did change the AWS VPN to use 192.168.1.0/24 and now I’m propagating both 192.168.1.0/24 and 192.168.0.0/24 to the VPC, but I have no idea what should I do on the Router side of things. Does anyone here have an idea of what should I do next? How to separate the 192.168.0.0/24 LAN so devices in it can communicate with each other, whilst using 192.168.1.0/24 for the VPN?
UPDATE: I just realised that the ping problem is not between LAN devices, but between LAN and whoever is connected to WLAN2!
Thanks in advance!